Ransomware often has a screen or ransom note displaying the required steps the user must undertake to decrypt or access their files, sometimes the ransomware may include a decrypting tool that requires a password or key for the user to decrypt their files.

How did I get Ransomware?

Ransomware is often installed by a user inadvertently or for large organisations can often be published through common software distribution platforms that have been compromised in a supply chain attack.

Ransomware can also be installed through other applications the user may have installed such as an application masquerading as a legitimate program. Sometimes ransomware can be disguised to look like something else or remain dormant in a machine until it is designed to activate to evade detection.

Ransomware is very popular among cyber criminals as its increased usage is generally due to its proven business model. Generally users pay the ransom to restore function to their computer. Ransomware is generally a new technique in computer crime.

How Does Ransomware Spread?

Ransomware spreads on home computers by encrypting data and demands the payment of a ransom in order to gain access again however it often spreads through businesses too. If a PC becomes infected if a hacker presents them with a ransom note.

Ransomware could spread to computers by exploiting security flaws in operating systems or software applications that have been exposed to the internet and picked up during automated scans of the internet looking for vulnerable software, then encrypts important information on those computers and demands payment from their users to decrypt them.

Good security practice at home can prevent ransomware,

• Updating or securing applications that connect to the internet can prevent hackers exploiting security holes and bugs in the software.
• Only run applications that you trust and are from trusted sources, websites or blogs may be designed to look legitimate as part of a baiting technique to get users to run the software. Especially free or hacked software that promise more than they actually deliver. Use common sense.
• Typically ransomware enters your environment by being installed by home users or phishing. So make sure to know what reputable software is and the risks of running non-reputable software.

Does Ransomware Work?

Ransomware is very effective at extorting users according to recent trends in malware distribution. Mostly due to the fact that its effects are irreversible and generally the value trade-off for ransomware is essentially easier than tying to recreate or recover data.

Some ransomware gangs are starting to form branding to encourage businesses for payment and as a small guarantee they will see their data again.

Some companies have silently paid ransomware ransoms simply to avoid exposure.

Should I Pay the Ransomware Ransom?

Absolutely not, paying a ransomware ransom justifies the hackers efforts and proves their business model. There is large scale talks on how best to handle ransomware however the general consensus is not to pay, many organisations have paid to the disappointment of the information security community.

Generally backup and disaster recovery solutions, when implemented correctly such as cold or immutable backups should prevent ransomware attacks from preventing recovery.

Can I Get My Data Back Without Paying the Ransom?

In short, unless you have a backup, it will not be possible to recover your data. It is also extremely important that you do not validate a ransomware business model by paying the ransom.

If you have ever wanted to use WiFi reliably in your own home, most homelabbers and computer enthusiasts will eventually learn that using consumer equipment to achieve fast speeds and low ping can be a route that many take in vain, whilst mesh networking appliances look promising for home applications, the ever vast expanding market of power-line networking adapters and WiFi range extenders have lead consumers astray and often leave them unhappy with their network performance due to patchy and inconsistent behavior caused by devices looking for the ‘strongest’ signal despite it not necessarily being the fastest or most optimal.

Having an ISP issued router has never put me off fiddling before, having being issued a Netgear WNR3500L V2 it wasn’t long before I decided to flash Tomato on it and leave Netgear Genie hopefully forever.

Having moved on with my life I quickly became unhappy with the performance of the WiFi and decided it needed sprucing up a little bit, running two routers on two sides of the house were becoming tiresome due to patchiness and being connected to one side of the house while at the other requiring manual adjustment. It was time to buy something enterprise to set-and-forget. Alas enterprise comes with a hefty price tag.

Rather than going mainstream and buying something like Ubiquiti or MikroTiK, popular routers with the home lab community. I decided to take a different approach to save a buck. Having flashed firmware on many devices in the past, such as Arduino, ESP8266s or even other routers I decided to get my hands on the enterprise CISCO Meraki MR18, a subscription model router with a hefty price tag at the current time of £308.38 for a three-year license. Would I be paying that? Absolutely not.

I picked one up off eBay for a fairly high market price of £17.99 which came with a wall bracket and no plug or license. Why so cheap compared to the £308.38 price tag? Well, it turns out Meraki are giving them away free to anyone who sits through their webinar, and once the license runs out it’s my understanding that they essentially become paperweights. Once it arrived I fired it up just to see what it used to be called and see if I could get a hit on WiGLE’s database to see where this thing came from, unfortunately, 0 hits means my best guess is that it came from somewhere around Aylesbury, UK. The location of the Ebay E-Recycler the SSID was generic “Guest Access” and “Staff Internet”.

Once I cleaned up the router it looked brand new, the power cable I got from my drawer of many cables and began to study the thing, the brushed aluminum backing had the screws hidden behind rubber feet, an easy adversary I had the thing open in no time.

I particularly like the bendy lightpipe for the RGB leds.

The UART pins were neatly placed and populated with pins at the top of the AP and easy to flash with.

I decided to opt for flashing OpenWRT on to it, basically because at the time they were the only ones supporting this particular device and it would only really be acting as an Access Point, with my Tomato router doing all the hard work.

Thanks for reading. Enjoy this picture of my neighbors cat.