Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The No More Ransom Project

nomoreransom.org

Post reply on HN
Print view View original

211–220 of 241 posts

Re: The No More Ransom Project

#211

Post by Bartweiss »

Houshalter wrote: post #149
CalChris wrote: post #31

So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/... Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them. I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. Th…

That's great until the ransomware gets clever and encrypts your backups too. I'm extremely skeptical of the people that say ransomware is good for the economy or whatever. Broken window fallacy. Sure it creates an incentive to protect against hackers. But isn't that a bit circular? Hackers are good because they create inventive to protect against hackers? Ransomware is by far the most economically damaging kind (and…

Backup encryption is already out there, even. Time Machine is a very popular solution, and implies a lot of desirable demographics (owns a Mac, set up something about as complicated as a BC wallet, probably has no other backup). So there have been some encryption schemes that stick around silently pending a Time Machine backup and then take out the files there too.

It's pretty hard to say that users "should be safe from this" - most of the solid solutions discussed in this thread are probably used by <5% of people, and maybe much less than that.

Re: The No More Ransom Project

#212

Post by Bartweiss »

nom wrote: post #81
adzm wrote: post #59

Earlier quoted context omitted.

This happens quite often at medical offices. Five and even six digit ransoms are not unheard of. On the plus side, it helps encourage Windows updates and IT responsibility.

Now i'm really curious if they calculate the prices based on the files they encrypt. Do you know if it was some kind of spear phishing attack or just a regular ransomware variant? Any sources? thx!

I've heard of some non-scripted ransomware that "phones home". If it points you to an email exchange with the scammer, there's room for a person to sound you out, maybe google you or work off your email address and information reported by the ransomware.

Re: The No More Ransom Project

#213

Post by sliverstorm »

IndianAstronaut wrote: post #180
noonespecial wrote: post #136

I've had plenty of people lose vital files on borked hard disks and pay thousands to get those files back via drive recovery firms. I've only had one person ask me about ransomed files whom I advised to pay the $400-ish demanded. I told him that most of my clients pay 10x as much to learn how important backups are. All data storage devices will fail . What will you do when yours does?

The worst place I have seen this is in scientific labs. Professors and graduate students are terrible about keeping backups, making data easy to understand to others, and maintaining data. My old professor lost more than 2 years of work when one grad student in our had a car crash and his laptop was destroyed in the crash.

I've observed the same. It's baffling, and I don't understand why. Maybe they are in a nasty spot of workers who are non-techie but 100% reliant on tech?

Re: The No More Ransom Project

#214

Post by aweinstock »

shoghicp wrote: post #156
edem wrote: post #141

How can a ransomware infect my computer when I visit a website? This site claims it can happen. I understand how the attachment version works but not this one. I'm a security newb.

Some websites can use security vulnerabilities in different parts of the browser (rendering, image format parsers, Javascript, PDF, fonts, and everything else supported by the browser) to run code on your machine.

For a concrete example of what exploitation of a JS engine bug looks like, PlaidCTF2016 had a challenge that allowed people to run JS in a patched version of V8 that deliberately introduced a bug in array index checking, with the goal being to run x86 machine code.

The patch to v8: http://lpaste.net/317342

An exploit: https://gist.github.com/sroettger/d077d3907999aaa0f89d11d956...

While this bug was artificial, there were (and can still be) bugs with similar consequences in actual engines (see https://www.cvedetails.com/vulnerability-list/vendor_id-1224... or https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=spidermonke... for historical examples).

While a bug in most of the components you mention are bad by themselves, their impact is magnified by the presence of javascript, which allows an attacker to interleave calculations and interactions with the buggy components, bypassing many mitigations.

Re: The No More Ransom Project

#215

Post by sliverstorm »

CalChris wrote: post #31

So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/... Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them. I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. Th…

You should be able to take a sledge hammer to your laptop, buy another and not miss a beat.

For most I think that's the wrong target. Establishing & maintaining totally seamless, push-button rolling restore costs a lot of effort & money.

In the event of failure (which is not guaranteed), you burn a day or three getting things back to normal. So long as failures are rare, this can be cheaper (though availability suffers)

Re: The No More Ransom Project

#216

Post by abecedarius »

trprog wrote: post #184
dwightgunning wrote: post #127

Earlier quoted context omitted.

It's more like a part of a post-sales than customer support (a cost centre).

Although in this case they may be trying to reduce the volume of people who get the police involved. If they are pleasant to deal with throughout that seems likely to diminish people's enthusiasm for demanding legal consequences for the perpetrators.

Reminds me of http://www.tau.ac.il/~algazi/mat/Goffman--Cooling.htm from pre-internet times.

Re: The No More Ransom Project

#217

Post by syrrim »

colejohnson66 wrote: post #178
Houshalter wrote: post #162

Earlier quoted context omitted.

Are the versioned backups physically separated from the infected machine? Otherwise what stops it from just encrypting your backups hard drives as well, everytime you connect them?

What about a versioned filesystem (like ZFS)?

If they had root access they could probably encrypt the whole drive, filesystem and all.

Re: The No More Ransom Project

#218

Post by notgood »

mcintyre1994 wrote: post #189
notgood wrote: post #91

Earlier quoted context omitted.

Another way then: create a script that sends hundreds of emails to the victim from different addresses (wallets) and different amounts; the victim cannot identify which email is from the actual scammer, therefore he will pay none and the scam chances of success would reduce, and with it -eventually- the number of scammers.

Do they really communicate by email after encrypting? Wouldn't it make more sense to communicate via a file on the owned desktop?

Forgot about that, yep, they leave a big message on your screen.

Re: The No More Ransom Project

#219

Post by BJanecke »

johannesg wrote: post #120
haberman wrote: post #43

Do Google Drive / Dropbox cloud backups help in this situation? Or do the encrypted versions propagate into the cloud and irreversibly overwrite the plaintext versions?

Google Drive keeps old versions of every file for 30 days. Enough time to recover the plaintext versions.

I recently had to help someone out, and the randsomware was smart enough to be able to mess wit gDrive revisions :/
Post reply on HN