Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The No More Ransom Project

nomoreransom.org

Post reply on HN
Print view View original

31–40 of 241 posts

Re: The No More Ransom Project

#31

Post by CalChris »

So this is what a ransom note looks like:

https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/...

Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them.

I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. There is no negotiation with a script. What I've also heard is that you can trust the script because these guys want a good reputation. If it gets out that you paid and you didn't get unlocked then no one would pay.

If you don't want to pay on the backend then you have to back up on the front end. You should do that already. You should be able to take a sledge hammer to your laptop, buy another and not miss a beat. If you could do that then you could just reformat and reinstall.

Prevention is worth it. Protection is worth it. Paying? Well if you did the first two you wouldn't be asking that question. But .65880 Bitcoin equals about 463.97 USD. So you might want to get on the prevention+protection train.

Prevention will help you against viruses, keyloggers, etc that can cause a lot more economic harm.

Protection, backing up, will also help you in the case of theft or dropping your MPB out of its sleeve when you get out the car. Done both.

Re: The No More Ransom Project

#32

Post by progval »

the_duke wrote: post #30
xenadu02 wrote: post #14

Earlier quoted context omitted.

It isn't just badly made ransomware; in some cases people have stolen the master key or the responsible party has released it. In other cases C&C servers have been seized and keys recovered that way. Ransomware exists thanks to a fundamental mistake in the Unix (+Windows, +others) model that a process' rights to the filesystem automatically inherit from the user's rights. Imagine if all processes running under the sa…

I'm really quite surprised that there are no big and used by default user facing sandboxing solutions for the major OSes out there. With dynamic prompts akin to the firewall prompts familiar from Windows/Mac. 'The program "Chrome" wants to create the file "/home/username/.config/chrome/config". Allow "Chrome" to access [just this file / the diretory ~/.config/chrome / the diretory /home/username]' 'WARNING: The progr…

That is kind of what Qubes OS does, but for interaction between VMs (eg. copy a file).

Re: The No More Ransom Project

#33

Post by user5994461 »

xenadu02 wrote: post #14
foota wrote: post #4

Earlier quoted context omitted.

Looks like decryption for badly constructed ransom ware

It isn't just badly made ransomware; in some cases people have stolen the master key or the responsible party has released it. In other cases C&C servers have been seized and keys recovered that way. Ransomware exists thanks to a fundamental mistake in the Unix (+Windows, +others) model that a process' rights to the filesystem automatically inherit from the user's rights. Imagine if all processes running under the sa…

> Imagine if all processes running under the same user shared the same address space!

I recall that's how it worked under windows 95/98 (and the older OS).

Re: The No More Ransom Project

#35

Post by mschuster91 »

user5994461 wrote: post #33
xenadu02 wrote: post #14

Earlier quoted context omitted.

It isn't just badly made ransomware; in some cases people have stolen the master key or the responsible party has released it. In other cases C&C servers have been seized and keys recovered that way. Ransomware exists thanks to a fundamental mistake in the Unix (+Windows, +others) model that a process' rights to the filesystem automatically inherit from the user's rights. Imagine if all processes running under the sa…

> Imagine if all processes running under the same user shared the same address space! I recall that's how it worked under windows 95/98 (and the older OS).

Nope, 95/98 and IIRC 3.11 are true multi-tasking systems, the processes do not share the RAM address space.

However, everything up to, but not including, Windows 2000 (and its predecessor Windows NT) suffers from ALL local users having effectively admin rights on the machines. Not only that the OS doesn't support user permissions, also the underlying file system FAT32 does not store UID/GID or anything, except the file flags "read only"/"system"/"hidden".

Only Windows NT and above (2000, XP, Vista, 7, 8, 10) are secured in this way. Caveat: NT, 2k and XP allowed installations on FAT32, which nullified many protections.

Re: The No More Ransom Project

#36

Post by djsumdog »

martey wrote: post #28
hrehhf wrote: post #23

Earlier quoted context omitted.

In a twisted sort of way, a person could destroy trust that paying the ransom will actually get your data back. Someone could create ransomware that will never decrypt, even after the ransom is paid. Once the victims know the dishonest ransomware is out there, that may ruin the revenue towards the "honest" ransomware.

> Someone could create ransomware that will never decrypt, even after the ransom is paid. This already exists: http://arstechnica.com/security/2016/07/posing-as-ransomware... > "Once it executes it, it pops up a ransom message looking like any other ransomware," Earl Carter, security research engineer at Cisco Talos, told Ars. "But then what happens is it forces a reboot, and it just deletes all the files. It doesn't…

Makes me wonder if it's just buggy or intentional.

Re: The No More Ransom Project

#37

Post by stdbrouw »

logicallee wrote: post #26
toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

This comment contains a policy suggestion. I want it to become law in the United States and elsewhere. I can't quite use the word "literally" but I almost can so I'll do so anyway: if you pay a ransom, you are literally paying for your party to attack someone else. And you are actually literally (not metaphorically) funding their next attack. Paying a ransom should be a criminal act that is twenty times worse than as…

If you drive a car you are literally contributing to global warming. If you pay taxes you are literally funding bombs and missiles. If you download big files you are literally taking bandwidth away from your neighbors.

Hyperbole does not a rational argument make.

Re: The No More Ransom Project

#38

Post by bubo_bubo »

logicallee wrote: post #26
toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

This comment contains a policy suggestion. I want it to become law in the United States and elsewhere. I can't quite use the word "literally" but I almost can so I'll do so anyway: if you pay a ransom, you are literally paying for your party to attack someone else. And you are actually literally (not metaphorically) funding their next attack. Paying a ransom should be a criminal act that is twenty times worse than as…

Knowingly buying stolen goods is illegal because they are still not yours even if you 'bought' them.

Paying a ransom to get your own property back because it is yours is not even in the same ballpark.

Post reply on HN