Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The No More Ransom Project

nomoreransom.org

Post reply on HN
Print view View original

161–170 of 241 posts

Re: The No More Ransom Project

#161

Post by Houshalter »

mikemoka wrote: post #137

About prevention there is something more that I am not sure has been mentioned, some tools are taking a new, broader approach to the problem, which is to constantly monitor for encrypted files and stop the associated processes, this way often limiting the loss to a few files, these are the links: Criptostalker https://github.com/unixist/cryptostalker Ransomwhere (macOS) https://objective-see.com/products/ransomwhere.…

In principle it's super easy to detect, encrypted files look like random data and it's unlikely users would be replacing every file with random data on purpose. Its a never ending war though. If you got enough users to do this, the hackers would then switch to encryption that mimics what normal files look like to fool the detector.

Re: The No More Ransom Project

#162

Post by Houshalter »

metafunctor wrote: post #121

Is there any case where versioned backups wouldn't completely solve a ransomware situation? Assuming, of course, that the ransomware doesn't somehow spider out and compromise all your past backups as well. Let's assume your past backup versions are safe.

Are the versioned backups physically separated from the infected machine? Otherwise what stops it from just encrypting your backups hard drives as well, everytime you connect them?

Re: The No More Ransom Project

#163

Post by IgorPartola »

dsacco wrote: post #62
CalChris wrote: post #31

So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/... Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them. I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. Th…

Good comment. I've interacted with ransomware scammers on several occasions. Each time I couldn't help but be impressed by their operations. In one case, the scammers provided an email address for customer support once the victim paid the ransom. They were courteous, helpful and professional - more so than many customer response teams I've had to interact with in legitimate companies. To be clear, I also don't recomm…

Y'all make this all sound so appealing.

Re: The No More Ransom Project

#164

Post by Houshalter »

Paul_S wrote: post #147

If you are willing to pay the ransomware demands who are you going to pay when your HDD fails? I'm not saying ransomware isn't a problem in itself but from a user's perspective it's indistinguishable from HDD failure and should be dealt with by using backups.

Ransomware can infect your backups to though. HDD failures aren't contagious.

Re: The No More Ransom Project

#165

Post by monochromatic »

Taek wrote: post #15
toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

It's been pointed out in the past that most ransomware services have better customer support than paid services. That's because they stand to gain $XXX from each successful interaction and they stand to lose substantially more if they have a reputation of not returning the data.

The market works!

Re: The No More Ransom Project

#166

Post by rwallace »

Remember if your backup solution is a USB drive, you actually need at least two USB drives, with at least one of them disconnected from your computer at all times. If you only have one, the virus will encrypt that one along with your computer. That needs to be spelled out, because people intuitively think backing up to a single USB drive is sufficient.

Re: The No More Ransom Project

#167

Post by bubo_bubo »

logicallee wrote: post #152
21 wrote: post #145

Earlier quoted context omitted.

Yet the modern world decided to go back on that. The principle being that you are not (as) responsible for what you do under duress.

This is a good and important point. However is data ransom this kind of duress? In a sense, paying a ransom is taking the law into your own hands -- rather than say to the FBI, "criminals have asked me for ransom" you are interacting with the criminals directly. On a literal level you are literally transferring cold hard cash to them. You make a good argument for why the policy suggestion I made is not a good idea, b…

Yes, it's duress. I'm sure you having 10 years of your life locked up in an encrypted vault would put a cramp in your style.

>transferring cold hard cash to them

So? If I go to the 7-11 and buy a soda, and the cashier has been skimming the till, I am transferring cold hard cash to a thief.

The difference you keep skipping over is mens rea and I suggest you read up on it before you sound more foolish than you already are.

Re: The No More Ransom Project

#169

Post by ThrustVectoring »

TeMPOraL wrote: post #87
toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

It doesn't ignore any of the things you said. Yes, it's most likely better for you to pay. This kind of selfish thinking is, like many other kind of selfish thinking, what enables this type of crime in the first place . Sure the criminals will release your files. Just like with regular, "meatspace" ransom, only a stupid criminal would not release hostages after having their demands met. It's in their best interest to…

It's better for you not to pay, because it means that you're the sort of person who isn't worth trying to extort.

Re: The No More Ransom Project

#170

Post by derefr »

wlesieutre wrote: post #144
ocdtrekkie wrote: post #129

Earlier quoted context omitted.

I'm kind amazed at the tone deafness of several comments in this thread. I get that as a larger effect, reducing the success rate of scammers hurts their business, but if I'm dealing with someone who's been hit because they weren't adequately prepared, I'm gonna recommend they pay the ransom if they want their stuff back. Because I'm trying to recommend what's best for them. People could be losing their entire family…

When Transmission had an infected release a couple of months ago, I remember reading that the malware had in-progress features to encrypt Time Machine drives. It gets installed, waits a couple of days, locks up your hard drive and any backup drives that you connect, and there's nothing to do about it. That's enough to hose 99% of users, even the ones following traditionally sufficient practices. You're only safe if y…

> You're only safe if you have offsite backups with drives that didn't mount to your computer recently.

Or if your backup solution is—from the perspective of the computer being backed up—an append-only store. Like a box of tapes, or Tarsnap using restricted keys, or Arq pointed at a versioned S3 bucket, or a NAS exposing an iSCSI target backed by an LVM thin pool LV with automatic daily snapshots.

Sadly, as far as I know, no turn-key hardware "home backup" or "home NAS" product is in that category, though.

Post reply on HN