July 30, 2014 By Derek Brink 3 min read

Ransom, which refers to some kind of payment that is demanded in exchange for the release of someone or something that has been taken, is a simple yet effective ploy that has been used by criminals for thousands of years.

For example, on his way home from the Third Crusade in 1192, King Richard the Lionheart was captured and held for ransom by Duke Leopold of Austria. The amount demanded was so large that it took over a year for England to raise it, giving root to the now-familiar idiom “a king’s ransom.” In 1932, the 20-month-old son of famous aviator Charles Lindbergh was kidnapped and held for ransom in one of the most high-profile cases in the history of the FBI.

The dynamics of ransom are not difficult to understand: I take something dear to you, and you pay me to give it back.

Ancient Approaches, Modern Applications

Today, criminals are applying these ancient approaches to modern technologies. Ransomware, one of the fastest-growing areas of cyber crime, refers to malicious software that is specifically designed to take control of a computer system or its data and hold it hostage so the attackers can demand payment from their victims. Although ransomware initially targeted PCs, it is now migrating to mobile platforms as well. Some recent public disclosures involving demands for ransom include:

  • The town of Greenland, New Hampshire, which lost eight years’ worth of data when it fell victim to a ransomware known as CryptoLocker.
  • Brokerage and investment advisory firm Benjamin F. Edwards, which exposed data related to some 430 New Hampshire residents from a ransomware called CryptoWall.
  • Domino’s Pizza in France and Belgium, where the personal information (including favorite pizza toppings) of about 650,000 customers was compromised. The hackers responsible demanded a ransom of 30,000 euros in exchange for not disclosing the information publicly.

Cyber Extortion: Related to Ransomware

Note that, technically, this last example is not ransomware (a type of malicious software), but rather a demand for ransom for compromised customer data. It seems that cyber criminals continue to move faster than the tech industry’s ability to create new jargon to describe it. In practical terms, it shows that we should also be aware of another ancient and effective exploit: extortion, which is the crime of taking money (or something else of value) from another party by use of threat or force. The dynamics of extortion are not difficult to understand, either: I cause (or threaten to cause) you harm, and you pay me to stop.

Unfortunately, there are also ample public disclosures related to cyber extortion:

  • News aggregator Feedly was the victim of a distributed denial-of-service (DDoS) attack in which the attackers demanded payment to make it stop.
  • Move Inc., an online real estate services provider, battled DDoS attacks that disrupted its website operations. It refused to respond to a demand for payment.
  • Evernote also battled a DDoS attack that disrupted operations, although it is unclear in this case whether the attackers also demanded payment.

Although these particular examples of cyber extortion are against larger-scale targets, it’s worth noting that the tactic can also be directed at smaller, personal targets — no one is really immune.

What You Need to Do

To protect against ransomware, now is the perfect time for organizations to remind themselves of some basic best practices:

  • Back up your data regularly (from an end user’s perspective, this is the easiest way out).
  • Ensure that your endpoints and servers are patched and up-to-date.
  • Deploy appropriate endpoint protection.
  • Regularly make end users aware of safe email and Web-browsing practices, and periodically test their behavior.

To protect against cyber extortion, it is essential for all organizations to understand the importance of developing a strong incident response capability to complement their traditional prevention-oriented security strategies. Prevention cannot be successful 100 percent of the time, so it makes sense to be capable of detecting and responding to incidents more quickly when they do occur. Note that incident response is not an action that an organization needs at a specific point in time; rather, it is a capability that an organization develops and uses when needed.

More from

CVE-2023-20078 technical analysis: Identifying and triggering a command injection vulnerability in Cisco IP phones

7 min read - CVE-2023-20078 catalogs an unauthenticated command injection vulnerability in the web-based management interface of Cisco 6800, 7800, and 8800 Series IP Phones with Multiplatform Firmware installed; however, limited technical analysis is publicly available. This article presents my findings while researching this vulnerability. In the end, the reader should be equipped with the information necessary to understand and trigger this vulnerability.Vulnerability detailsThe following Cisco Security Advisory (Cisco IP Phone 6800, 7800, and 8800 Series Web UI Vulnerabilities - Cisco) details CVE-2023-20078 and…

X-Force data reveals top spam trends, campaigns and senior superlatives in 2023

10 min read - The 2024 IBM X-Force Threat Intelligence Index revealed attackers continued to pivot to evade detection to deliver their malware in 2023. The good news? Security improvements, such as Microsoft blocking macro execution by default starting in 2022 and OneNote embedded files with potentially dangerous extensions by mid-2023, have changed the threat landscape for the better. Improved endpoint detection also likely forced attackers to shift away from other techniques prominent in 2022, such as using disk image files (e.g. ISO) and…

The compelling need for cloud-native data protection

4 min read - Cloud environments were frequent targets for cyber attackers in 2023. Eighty-two percent of breaches that involved data stored in the cloud were in public, private or multi-cloud environments. Attackers gained the most access to multi-cloud environments, with 39% of breaches spanning multi-cloud environments because of the more complicated security issues. The cost of these cloud breaches totaled $4.75 million, higher than the average cost of $4.45 million for all data breaches.The reason for this high cost is not only the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today