My mini Ask HN: Do you trust makers of security software?
Not the big ones that are well-known names in the PC market. There are quite some shady security software vendors out there, and a handful very competent ones that I trust if I have to.
The No More Ransom Project
61–70 of 241 posts
Re: The No More Ransom Project
#62So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/... Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them. I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. Th…
Good comment.
I've interacted with ransomware scammers on several occasions. Each time I couldn't help but be impressed by their operations. In one case, the scammers provided an email address for customer support once the victim paid the ransom. They were courteous, helpful and professional - more so than many customer response teams I've had to interact with in legitimate companies.
To be clear, I also don't recommend paying the ransom, but the work is often impressive.
Re: The No More Ransom Project
#63My mini Ask HN: Do you trust makers of security software?
No, absolutely not. Even if their intentions are good, they still have shown some questionable competence, for example:
http://www.theregister.co.uk/2016/03/31/trend_micro_patches_...
http://www.pcworld.com/article/3020327/antivirus-software-co...
Re: The No More Ransom Project
#64Is using a VM to surf the web a reasonable answer? Are there any VMs (for my MBP for example) that are reasonably fast, don't take a lot of battery, and not clumsy? Can't this be built into the OS so I don't actually have to do it?
Something like this is built into Android and iPhone. As all major desktop OSes are only good in protecting one user from another mobile OSes run every application under its own user account. So vulnerability in an image viewer would not give an attacker access to other apps' data. But the system is not perfect, for example the kernel can still be attacked (and as we know a lot of vulnerabilities were found in Linux in recent years) and on Android the files on sdcard partition are not protected at all.
But desktop OSes don't do anything at all to protect the user. They allow the user to run a program by just clicking a link in email or web browser and this program has full access to all their data as does the PDF viewer or Java plugin in a browser. The desktop operating systems still use security models from mainframe era.
Re: The No More Ransom Project
#65> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…
> What bothers me about their advice is that it is only correct macroeconomically.
That's because it's the correct advice. Ransom is a very old business, and experience throughout history shows you should never pay the danegeld[1].
> ignores that it is in cybercriminals' best interest to let you decrypt after you paid
That isn't being ignored. Paying the ransom is short-term thinking. Of course they will let you decrypt. By paying them you establish yourself as an easy/reliable mark that will probably pay again in the future. Paying would only make sense if you could somehow guarantee it was an isolated event.
[1] http://www.poetryloverspage.com/poets/kipling/dane_geld.html
Re: The No More Ransom Project
#66Is using a VM to surf the web a reasonable answer? Are there any VMs (for my MBP for example) that are reasonably fast, don't take a lot of battery, and not clumsy? Can't this be built into the OS so I don't actually have to do it?
There are indeed approaches by Microsoft to run some IE edge processes in micro VMs. The hard part is figuring out how much communication to allow with the rest of the OS. Do you want to allow sites to set cookies? For every domain, or just for the target domain? If the latter, what happens with a cookie set after a redirect to a different domain? Do you want to allow downloads to reach the host OS? The more secure y…
I see no problem with downloads. Saving a file can be implemented with a helper that has access to disk but doesn't have other permissions (like accessing the network). The path to save a file is chosen by a user.
The developers either care too much about compatibility with legacy software or just don't want to invest into implementing more secure environment. Patching existing software seems to be much cheaper.
Re: The No More Ransom Project
#67I'm afraid to click the link. Anyone care to provide a tl;dr?
Anytime you're in a similar dilemma just disable JavaScript. There are even plugins that allow you to do that with one click.
The better advice is imo to keep your browser up-to-date. JS exploits have been come increasingly rare these days, mostly due to Chrome's excellent example of patching quickly and paying good money for exploits (e.g. Pwn2Own). JS 0days are imo far too valuable now to waste them on normal users. So no, disabling JS wouldn't make much sense, if your have an evergreen browser.
Disable Flash & Java and try to minimize downloads is the security advice I give nowadays. Also don't install anything unless you absolutely have to (there are plenty of good in-browser options for programs we used to install, e.g. for file conversion).
Re: The No More Ransom Project
#68This is a Windows phenomenon only right? I'd just restore from Time Machine and go along on my way.
Re: The No More Ransom Project
#69So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/... Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them. I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. Th…
Good comment. I've interacted with ransomware scammers on several occasions. Each time I couldn't help but be impressed by their operations. In one case, the scammers provided an email address for customer support once the victim paid the ransom. They were courteous, helpful and professional - more so than many customer response teams I've had to interact with in legitimate companies. To be clear, I also don't recomm…
To be fair, I think legitimate companies' customer support might be a bit more courteous and attentive if they personally stood to gain $500 from each dissatisfied person contacting them...
Re: The No More Ransom Project
#70Earlier quoted context omitted.
Good comment. I've interacted with ransomware scammers on several occasions. Each time I couldn't help but be impressed by their operations. In one case, the scammers provided an email address for customer support once the victim paid the ransom. They were courteous, helpful and professional - more so than many customer response teams I've had to interact with in legitimate companies. To be clear, I also don't recomm…
To be fair, I think legitimate companies' customer support might be a bit more courteous and attentive if they personally stood to gain $500 from each dissatisfied person contacting them...
Oh yes, of course. Without question the superior customer support is a selfish incentive. But I still find it incredibly interesting.