Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The No More Ransom Project

nomoreransom.org

Post reply on HN
Print view View original

111–120 of 241 posts

Re: The No More Ransom Project

#111

Post by smsm42 »

xenadu02 wrote: post #14
foota wrote: post #4

Earlier quoted context omitted.

Looks like decryption for badly constructed ransom ware

It isn't just badly made ransomware; in some cases people have stolen the master key or the responsible party has released it. In other cases C&C servers have been seized and keys recovered that way. Ransomware exists thanks to a fundamental mistake in the Unix (+Windows, +others) model that a process' rights to the filesystem automatically inherit from the user's rights. Imagine if all processes running under the sa…

What you say is true, however I am afraid permissions are not the solution either. Look at android ecosystem - they have tons of permissions, but who actually looks at them? People just click "accept" 99.9% of the time. Same will be on desktop OSes. Granted, more granular permissions make Android somewhat safer - but it also makes many things harder to do. If you did this on desktop, users would scream and demand to make it "convenient" - which would lead to them clicking "accept" where they shouldn't.

Re: The No More Ransom Project

#112

Post by valleyer »

nodesocket wrote: post #68

This is a Windows phenomenon only right? I'd just restore from Time Machine and go along on my way.

What an incredibly uninformed comment. I'm a Mac guy through and through, but if you think that most Mac users use Time Machine or that no Windows users use backup software, you need to spend more time in the real world.

Re: The No More Ransom Project

#113

Post by hueving »

stdbrouw wrote: post #37
logicallee wrote: post #26

Earlier quoted context omitted.

This comment contains a policy suggestion. I want it to become law in the United States and elsewhere. I can't quite use the word "literally" but I almost can so I'll do so anyway: if you pay a ransom, you are literally paying for your party to attack someone else. And you are actually literally (not metaphorically) funding their next attack. Paying a ransom should be a criminal act that is twenty times worse than as…

If you drive a car you are literally contributing to global warming. If you pay taxes you are literally funding bombs and missiles. If you download big files you are literally taking bandwidth away from your neighbors. Hyperbole does not a rational argument make.

None of those are hyperbolic, they are just true facts. Understanding the macroeconomic demand you are participating in isn't hyperbolic.

Buying elephant tusks promotes the killing of elephants, regardless of where they came from because the demand you created supports a price in favor of bad actors as well.

Re: The No More Ransom Project

#114

Post by notahacker »

pooper wrote: post #93
notahacker wrote: post #71

Earlier quoted context omitted.

Or we could be slightly less nefarious and create ransomware that decrypts everyone's stuff after the allotted time but leaves a congratulatory "thank you for not cooperating with criminals" message to the people that didn't pay...

> Or we could be slightly less nefarious and create ransomware that decrypts everyone's stuff after the allotted time but leaves a congratulatory "thank you for not cooperating with criminals" message to the people that didn't pay... Please don't do this. People (some would call them victims of cyber crime but not me) are EVIL and if they can trace it back to you, they will sue you. Doing this is not a good idea exce…

I agree, creating malicious software designed to seriously inconvenience people and demand money from them is not a good idea. Never mind being sued, creating and distributing viruses is a felony in most jurisdictions even if it doesn't look like extortion. But on a scale of bad ideas, ransomware that appears to reward you for ignoring it is still a slightly less bad way of encouraging people to ignore ransom demands than ransomware that just punishes everyone

Re: The No More Ransom Project

#115

Post by smsm42 »

the_duke wrote: post #30
xenadu02 wrote: post #14

Earlier quoted context omitted.

It isn't just badly made ransomware; in some cases people have stolen the master key or the responsible party has released it. In other cases C&C servers have been seized and keys recovered that way. Ransomware exists thanks to a fundamental mistake in the Unix (+Windows, +others) model that a process' rights to the filesystem automatically inherit from the user's rights. Imagine if all processes running under the sa…

I'm really quite surprised that there are no big and used by default user facing sandboxing solutions for the major OSes out there. With dynamic prompts akin to the firewall prompts familiar from Windows/Mac. 'The program "Chrome" wants to create the file "/home/username/.config/chrome/config". Allow "Chrome" to access [just this file / the diretory ~/.config/chrome / the diretory /home/username]' 'WARNING: The progr…

A more robust idea might be a versioned filesystem. Somebody hacks your browser, it overrides your files - no matter, you just rollback to yesterday's version. Of course, that'd require more diskspace, but diskspace is getting cheaper and most of it is used for content that is completely static (like games or photos or videos - not edited much unless you're a professional working with it). Also probably would be a bit slower but I think it can be solved.

I think there are a number of implementations of such things, but none mainstream enough.

Re: The No More Ransom Project

#116

Post by david-given »

hrehhf wrote: post #23
toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

In a twisted sort of way, a person could destroy trust that paying the ransom will actually get your data back. Someone could create ransomware that will never decrypt, even after the ransom is paid. Once the victims know the dishonest ransomware is out there, that may ruin the revenue towards the "honest" ransomware.

...it now occurs to me that if, using one of the million or so compromised ad networks, you wrote something would pop up the following message in people's browsers:

"Hi there! Your computer has been infected with a virus which will encrypt one file on your computer at random each day. You can stop this, and decrypt all the files by paying X to bitcoin wallet Y. Don't wait too long, because if you wait too long, we might encrypt some system file and it won't boot any more."

and which did nothing else whatsoever

...then you'd probably actually get some income.

It'd be an interesting (if ethically awful) sociological experiment to find out exactly how much. Returning people's money afterwards, of course.

Re: The No More Ransom Project

#117

Post by voltagex_ »

the_duke wrote: post #30
xenadu02 wrote: post #14

Earlier quoted context omitted.

It isn't just badly made ransomware; in some cases people have stolen the master key or the responsible party has released it. In other cases C&C servers have been seized and keys recovered that way. Ransomware exists thanks to a fundamental mistake in the Unix (+Windows, +others) model that a process' rights to the filesystem automatically inherit from the user's rights. Imagine if all processes running under the sa…

I'm really quite surprised that there are no big and used by default user facing sandboxing solutions for the major OSes out there. With dynamic prompts akin to the firewall prompts familiar from Windows/Mac. 'The program "Chrome" wants to create the file "/home/username/.config/chrome/config". Allow "Chrome" to access [just this file / the diretory ~/.config/chrome / the diretory /home/username]' 'WARNING: The progr…

>"WARNING... ALERT..."

Hell, I'm a technical user and after a couple of days running Comodo firewall (which does prompt in a similar way to your examples) I turned it off because I was sick of the prompts and just wanted to use my machine.

Re: The No More Ransom Project

#118

Post by majewsky »

david-given wrote: post #116
hrehhf wrote: post #23

Earlier quoted context omitted.

In a twisted sort of way, a person could destroy trust that paying the ransom will actually get your data back. Someone could create ransomware that will never decrypt, even after the ransom is paid. Once the victims know the dishonest ransomware is out there, that may ruin the revenue towards the "honest" ransomware.

...it now occurs to me that if, using one of the million or so compromised ad networks, you wrote something would pop up the following message in people's browsers: "Hi there! Your computer has been infected with a virus which will encrypt one file on your computer at random each day. You can stop this, and decrypt all the files by paying X to bitcoin wallet Y. Don't wait too long, because if you wait too long, we mi…

Of course. cough :)

Re: The No More Ransom Project

#119

Post by majewsky »

TeMPOraL wrote: post #97
JoeAltmaier wrote: post #55

Earlier quoted context omitted.

But a virus has zero marginal cost. Even one guy paying and they make money.

They have to weigh in the risk of getting caught, especially if they piss off enough people. So one paying victim may not be enough for a criminal to go this route.

They are probably located in a country where it is easy to bribe the policemen, and factor that into their cashflow calculation.

Re: The No More Ransom Project

#120

Post by johannesg »

haberman wrote: post #43

Do Google Drive / Dropbox cloud backups help in this situation? Or do the encrypted versions propagate into the cloud and irreversibly overwrite the plaintext versions?

Google Drive keeps old versions of every file for 30 days. Enough time to recover the plaintext versions.
Post reply on HN