In the past, malicious software typically corrupted or deleted data, but now it can hold your data hostage instead. For example, the Archiveus Trojan copies the contents of the My Documents folder into a password-protected file and then deletes the original files. It leaves a message telling you that you require a 30-character password to access the folder, and that you will be sent the password if you make purchases from an online pharmacy.
In that case, as in most ransomware so far, the password or key is concealed inside the Trojan’s code and can be retrieved by malware analysts. However, in the future, hackers could use asymmetric or public-key encryption (which uses one key to encrypt the data, but another to decrypt it) so that the password would not be stored on your computer.
For example, in February 2012 the UK Metropolitan Police warned Windows users of a malware attack that poses as a message from computer crime-fighting cops. In this attack ransomware attempts to lock the computer, and posing as an official notice from a law enforcement agency, claims that the victim’s PC has visited illegal websites. Only payment of a fine, claims the message, will restore the computer’s functionality. However, the threats are a bluff as ransomware is not capable of doing these things.
Ransomware may become a problem as hackers start to use new means to get ransoms paid. Previously the use of premium rate SMS messages limited the usefulness to specific geographic areas.