31–40 of 112 posts
http://www.zdnet.com/article/crypto-ransomware-strikes-linux...
https://labs.bitdefender.com/2015/11/linux-ransomware-debut-...
probably "python based" and, as mentioned on the gentoo forums, the ransomware mesage is very similar to the one in: https://github.com/jdsecurity/CryptoTrooper
It doesn't seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to shut it the fuck down . Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable. Take the data you can recover offline and the…
It's worth noting that if you are really serious about doing forensics and investigating the attack, then shutting down can be pretty destructive.
> what data is recoverable.
Another point I'd make is that try to recover as little as possible from the infected system and prefer using clean backups instead.
I agree on the overall sentiment though, attempting to recover a infected system is unnecessarily risky. Nuke it from the orbit, it is the only way to be sure.
Earlier quoted context omitted.
People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!
Try uMatrix. The uMatrix UI makes managing this a lot easier.
I don't understand from this post why run Firefox as root and why have in addition flash enabled on Linux. But it's still interest that they bother with making ransomware the first place for Linux.
Earlier quoted context omitted.
Also, don't run ads (at least not without protection).
I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.
Earlier quoted context omitted.
Even better - make sure that everything is under version control or backed up so that in such a situation you can just reinstall from scratch without introducing the possibility of "recovering" infected files.
There’s still the possibility that the infected files have been already committed to version control or backups, before it activated.
It doesn't seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to shut it the fuck down . Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable. Take the data you can recover offline and the…
Even better - make sure that everything is under version control or backed up so that in such a situation you can just reinstall from scratch without introducing the possibility of "recovering" infected files.
My real concern would be them grabbing secrets, not losing any data.
Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.
Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory. If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.