IBM Says TOR Network a Vehicle for Ransomware

Aug 26, 2015

Report from the X-Force group says attackers are using TOR to hide their crimes

According to a report from IBM's X-Force team, the anonymous TOR network is increasingly being used to support ransomware schemes and other Internet attack scenarios. Big Blue warned companies and ISPs to start blocking TOR traffic from their networks.

Ransomware, which encrypts the victim's hard drive and demands payment to release the data, is a growing phenomenon around the world. According to the report, attackers use the TOR network to communicate with the victim and transfer monetary payments.

The reports states that the success of the TOR network as a vehicle for petty end-user ransomware attacks and SQL injection has emboldened the perpetrators, and TOR is now used for botnet control and sophisticated industrial espionage.

Although TOR services are intended to be hidden and anonymous, organizations can still take steps to keep them off the network. The report includes recommendations such as:

  • Prohibiting the use of unapproved encrypted proxy services
  • Prohibiting the use of personally subscribed proxy services
  • Prohibiting the download and installation of unapproved software
  • Prohibiting the use of personally owned removable devices
  • Prohibiting computers from booting to media other than the hard drive
  • Using publicly available lists of proxy nodes to block network traffic to and from listed sites
  • Implementing a comprehensive desk audit program

The TOR network also has legitimate functions, such as supporting the free speech rights of users in totalitarian countries. Many innocent users implement a TOR node for ideological or political reasons without realizing the node could also be used to stage criminal activities.

Related content

  • Linux News

    Updates on technologies, trends, and tools

  • A Peek Inside TeslaCrypt Ransomware

    Criminals offer online help over Tor network

  • Samba Security Hole Patched but Risk is Bigger

    Millions of devices that use Samba Server are vulnerable to attacks.

  • Welcome

    Security is always big news in IT. The talk today is that the Hollywood Presbyterian Medical Center, in Hollywood, California, has just suffered a crippling ransomware attack. Most of the computers at the hospital are compromised with what appears to be a variant of the CryptoWall ransomware tool.

  • NEWS

    This month: Linux Mint 19.2 “Tina” Released; Gnome and KDE Coming Together; Fedora CoreOS Preview Released; SUSE Appoints New CEO; GitHub Blocks Access to Private Repositories in Certain Countries; and A New Ransomware Targeting Linux-Based NAS Devices.

comments powered by Disqus

Issue 247/2021

Buy this issue as a PDF

Digital Issue: Price $12.99
(incl. VAT)