A new type of ransomware attack could be on the horizon. The attack method, termed ransomcloud, was developed by a white hat hacker to demonstrate just how easy it is to launch an attack that results in cloud-based emails being encrypted.
A successful attack will see the attacker gain full control of a cloud-based email account, allowing them to deploy a ransomware payload that encrypts all emails in the account. This method could also be used to gain full control of the account to use for spamming and other malicious purposes.
The attack works on all cloud-based email accounts that allow third party applications account access via OAuth, which includes Gmail and Office 365 accounts.
The ransomcloud attack starts with a phishing email. In this example, the message appears to have been sent by Microsoft offering the user the opportunity to sign up and use a new email spam filtering service called AntiSpamPro. The email includes the Microsoft logo and appears to be a new Microsoft service that provides the user with better spam protection.
In order to take advantage of this service, the user is required to click a hyperlink in the email to give authorization for the new service to be installed. Clicking the link will result in a popup window appearing that requires the user to authorize the app to access their email account.
Such a request is perfectly reasonable, as an app that offers protection against spam would naturally require access to the email account. Emails would need to be read in order for the app to determine whether the messages are genuine or spam. Clicking on ‘accept’ would give the attacker full control of the email account via an OAuth token. If access is granted, the user loses control of their email account.
In this example, ransomware is installed which encrypts the body text of all emails in the account. An email then appears in the inbox containing the ransom note. The user is required to pay a ransom to regain access to their emails.
Additionally, the attacker could claim the email account as their own and lock the user out, send phishing emails to all the user’s contacts, access sensitive information in emails, use email information to learn about the individual to use in future attacks such as spear phishing campaigns to gain access to their computer.
The ransomcloud attack method is astonishingly simple to pull off and could be adopted by cybercriminals as a new way of extorting money and gaining access to sensitive information.