Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The No More Ransom Project

nomoreransom.org

Post reply on HN
Print view View original

11–20 of 241 posts

Re: The No More Ransom Project

#11

Post by iancarroll »

rhapsodic wrote: post #7
philippnagel wrote: post #3

Earlier quoted context omitted.

It's legit. Informational website about ransomware and what to do in case your device is affected. Apparently sponsored/endorsed/whatever by Europol, the Dutch Police, Kaspersky, Intel, AWS and Barracuda.

> It's legit. Informational website about ransomware and what to do in case your device is affected. That's good to know, but the ransomware criminals probably have the skills, and they definitely have the incentive, to pwn that site.

If someone has a vulnerability that will break out of your web browser's sandbox, they're not going to waste it on this site.

And the ransomware that can be decrypted with this site is because of the author's incompetence. It's not hard to write secure ransomware, but they somehow failed very badly. Anyone should be able to easily protect this site.

Re: The No More Ransom Project

#12

Post by user5994461 »

elorant wrote: post #5
rhapsodic wrote: post #2

I'm afraid to click the link. Anyone care to provide a tl;dr?

Anytime you're in a similar dilemma just disable JavaScript. There are even plugins that allow you to do that with one click.

And make sure your browser is updated as well ^^

Re: The No More Ransom Project

#13

Post by user5994461 »

toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

I think the fear is that they would ask for more money and/or they'd repeat the ransom again later.

Re: The No More Ransom Project

#14

Post by xenadu02 »

foota wrote: post #4
rhapsodic wrote: post #2

I'm afraid to click the link. Anyone care to provide a tl;dr?

Looks like decryption for badly constructed ransom ware

It isn't just badly made ransomware; in some cases people have stolen the master key or the responsible party has released it. In other cases C&C servers have been seized and keys recovered that way.

Ransomware exists thanks to a fundamental mistake in the Unix (+Windows, +others) model that a process' rights to the filesystem automatically inherit from the user's rights. Imagine if all processes running under the same user shared the same address space!

There is absolutely no reason some random piece of code downloaded from the internet should have access to my home directory, let alone the rest of the filesystem, without my explicit authorization.

The future is macOS sandbox / linux cgroup by default for all processes.

The macOS solution of presenting the user a system-controlled open dialog that then grants access to the selected path outside the container is elegant and not too intrusive.

Taken a step further, it is obvious that CoW filesystems need to be standard and all activity taken by a process should be recorded in snapshots that get coalesced over time. If a rogue process does cause damage it should be possible to roll back just that process' most recent changes to the filesystem.

Re: The No More Ransom Project

#15

Post by Taek »

toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

It's been pointed out in the past that most ransomware services have better customer support than paid services. That's because they stand to gain $XXX from each successful interaction and they stand to lose substantially more if they have a reputation of not returning the data.

Re: The No More Ransom Project

#16

Post by XaYdEk »

elorant wrote: post #5
rhapsodic wrote: post #2

I'm afraid to click the link. Anyone care to provide a tl;dr?

Anytime you're in a similar dilemma just disable JavaScript. There are even plugins that allow you to do that with one click.

Or better still noScript blocks all js by default and you only whitelist the sites you trust. Throw in a Ghostery for cookies and you are reasonably good to go.

Re: The No More Ransom Project

#17

Post by hannob »

toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

> For your particular case it could be the best solution to just pay - as even police departments have done before.

It could be the best solution for you to pay - if you don't care that you'll finance the attacks on other people and cause more harm overall.

So yes, from a purely egoistic perspective it makes sense.

The question you should ask is not "is it worth paying xxx for my data?", it's "is it worth paying xxx for my data and destroy the data of someone else?".

Re: The No More Ransom Project

#18

Post by GirlsCanCode »

user5994461 wrote: post #13
toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

I think the fear is that they would ask for more money and/or they'd repeat the ransom again later.

For people who are affected by ransom ware it also means something else--they had no off-line backup solution. So they'd be in the same situation if their disk drive were to have failed!

Re: The No More Ransom Project

#20

Post by ewzimm »

hannob wrote: post #17
toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

> For your particular case it could be the best solution to just pay - as even police departments have done before. It could be the best solution for you to pay - if you don't care that you'll finance the attacks on other people and cause more harm overall. So yes, from a purely egoistic perspective it makes sense. The question you should ask is not "is it worth paying xxx for my data?", it's "is it worth paying xxx…

But your individual case isn't going to affect their behavior. If you wanted to change the situation, not paying simply isn't going far enough. You'd need to coordinate with other potential victims or do something like this website and spread defenses. Without putting effort into organization, your thinking that you've helped others is pure egoism because these schemes only require a few people to pay to be profitable.
Post reply on HN