Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The No More Ransom Project

nomoreransom.org

Post reply on HN
Print view View original

131–140 of 241 posts

Re: The No More Ransom Project

#131

Post by ocdtrekkie »

nom wrote: post #81
adzm wrote: post #59

Earlier quoted context omitted.

This happens quite often at medical offices. Five and even six digit ransoms are not unheard of. On the plus side, it helps encourage Windows updates and IT responsibility.

Now i'm really curious if they calculate the prices based on the files they encrypt. Do you know if it was some kind of spear phishing attack or just a regular ransomware variant? Any sources? thx!

My guess is it's pretty easy for them to report back the infected computer is part of a domain, for example, which most businesses using Windows would be on.

Re: The No More Ransom Project

#132

Post by startling »

hhmc wrote: post #104
gregoor wrote: post #67

Earlier quoted context omitted.

The better advice is imo to keep your browser up-to-date. JS exploits have been come increasingly rare these days, mostly due to Chrome's excellent example of patching quickly and paying good money for exploits (e.g. Pwn2Own). JS 0days are imo far too valuable now to waste them on normal users. So no, disabling JS wouldn't make much sense, if your have an evergreen browser. Disable Flash & Java and try to minimize do…

What do the JS 0days get used for nowadays?

Attacking high-value dissidents: https://blog.lookout.com/blog/2016/08/25/trident-pegasus/

Re: The No More Ransom Project

#133

Post by foota »

smsm42 wrote: post #111
xenadu02 wrote: post #14

Earlier quoted context omitted.

It isn't just badly made ransomware; in some cases people have stolen the master key or the responsible party has released it. In other cases C&C servers have been seized and keys recovered that way. Ransomware exists thanks to a fundamental mistake in the Unix (+Windows, +others) model that a process' rights to the filesystem automatically inherit from the user's rights. Imagine if all processes running under the sa…

What you say is true, however I am afraid permissions are not the solution either. Look at android ecosystem - they have tons of permissions, but who actually looks at them? People just click "accept" 99.9% of the time. Same will be on desktop OSes. Granted, more granular permissions make Android somewhat safer - but it also makes many things harder to do. If you did this on desktop, users would scream and demand to…

Seems like there should be a sort of av layer looking for suspicious activity between the software and privileged calls.

Re: The No More Ransom Project

#134

Post by Joky »

Klathmon wrote: post #84
nodesocket wrote: post #68

This is a Windows phenomenon only right? I'd just restore from Time Machine and go along on my way.

I don't know of any Mac specific variants off the top of my head, but there is no reason why Mac would be immune to it. And the "good" versions of these do things like encrypt or outright delete things like time machine before encrypting the rest.

That supposes that the backup is local, I have a time capsule (remote) and I also plug once every other day an external hard-drive for my time machine backups.

Re: The No More Ransom Project

#135

Post by codedokode »

ndesaulniers wrote: post #80
codedokode wrote: post #64

Earlier quoted context omitted.

Something like this is built into Android and iPhone. As all major desktop OSes are only good in protecting one user from another mobile OSes run every application under its own user account. So vulnerability in an image viewer would not give an attacker access to other apps' data. But the system is not perfect, for example the kernel can still be attacked (and as we know a lot of vulnerabilities were found in Linux…

> So vulnerability in an image viewer would not give an attacker access to other apps' data. By having separate user's per app, apps can't read each others' files by default. If one app has a vulnerability that can be used to acquire root, that app can read all files after disabling SELinux.

> If one app has a vulnerability that can be used to acquire root

To get root privileges you need to attack the kernel (or the application that has those privileges). Having a bug in an image viewer is not enough.

You can try to make obtaining root privileges more complicated only by reducing the attack surface with restricting system calls each application is allowed to make or with redesigning the kernel so that less code is executed in ring 0 (microkernel architecture).

But recent vulnerabilities like Dirty COW or rowhammer could work even in this case.

Re: The No More Ransom Project

#136

Post by noonespecial »

I've had plenty of people lose vital files on borked hard disks and pay thousands to get those files back via drive recovery firms. I've only had one person ask me about ransomed files whom I advised to pay the $400-ish demanded.

I told him that most of my clients pay 10x as much to learn how important backups are.

All data storage devices will fail. What will you do when yours does?

Re: The No More Ransom Project

#137

Post by mikemoka »

About prevention there is something more that I am not sure has been mentioned, some tools are taking a new, broader approach to the problem, which is to constantly monitor for encrypted files and stop the associated processes, this way often limiting the loss to a few files, these are the links:

Criptostalker https://github.com/unixist/cryptostalker

Ransomwhere (macOS) https://objective-see.com/products/ransomwhere.html

Some theoretical information on this approach:

http://www.cise.ufl.edu/~traynor/papers/scaife-icdcs16.pdf

Re: The No More Ransom Project

#138

Post by metafunctor »

nothrabannosir wrote: post #125
metafunctor wrote: post #121

Is there any case where versioned backups wouldn't completely solve a ransomware situation? Assuming, of course, that the ransomware doesn't somehow spider out and compromise all your past backups as well. Let's assume your past backup versions are safe.

There's a new type of ransomware which threatens to release your files to the public if you don't pay. No amount of backups will help you there. :/

Ah, of course, obvious now that you said it.

Re: The No More Ransom Project

#139

Post by cookiecaper »

philfrasty wrote: post #126

OT question: is there no way to flag that bitcoin address in any way (so it gets locked / they cannot withdraw anything)?

Correct, there is no coordinated way to do that right now. Because the blockchain is public, we can tell if coins came from a known bad address or not, but there's no central repository that lists bad actors afaik and the reference client at least doesn't support refusing to trade coins that are "tainted" by a certain address.

I imagine the Bitcoin community would be pretty resistant to attempts to establish something like that, since a lot of the bitcoin ethos is based in distrust for centralized authorities.

Re: The No More Ransom Project

#140

Post by jasonm23 »

majewsky wrote: post #119
TeMPOraL wrote: post #97

Earlier quoted context omitted.

They have to weigh in the risk of getting caught, especially if they piss off enough people. So one paying victim may not be enough for a criminal to go this route.

They are probably located in a country where it is easy to bribe the policemen, and factor that into their cashflow calculation.

It really depends on how much noise/attention they attract.

Bribing one policeman or a department, or a national level LE body, and so on?

Due to the nature of the internet and social media there is an ever decreasing chance of flying under the radar.

Even if a country's entire infrastructure is corrupt, you would still have to deal with a never ending list of 'beaks to wet'.

Post reply on HN