An old friend recently pinged me through Facebook asking for my contacts. She had lost everything on her hard disk, she explained. But this was no run-of-the-mill hard disk failure. Her computer had been infected with a strain of malware that had encrypted her hard drive. In exchange for unlocking her data, a small sum of money was demanded, to be paid through PayPal.

This is a particularly nasty or clever extortion scheme, depending on your perspective. Encryption can be extremely hard to break, especially if a long key is used. Keeping the “ransom” small makes it cheaper & more convenient to pay up rather than get help from an anti-malware vendor. And unless infections reach epidemic levels, police are unlikely to be motivated to investigate – careers are not made on solving petty theft cases, electronic or otherwise.

Fortunately for my friend, she had no valuable data on her hard disk, so all she lost was an afternoon reformatting and reinstalling her software. I doubt most other victims fared as well.

Low risk, high return attacks tend to grow in popularity. It is troubling that as of this time, it's unclear if any of the major anti-malware vendors have a countermeasure.