phobos is not a moon !!! phobos is the god and personification of fear and panic in Greek mythology. this is crucial in understanding ransomware ;)
I imagine it's the root of the term "phobia" in this way.
It is, yeah.
A tale of Phobos – How we almost cracked a ransomware using CUDA
41–50 of 65 posts
Re: A tale of Phobos – How we almost cracked a ransomware using CUDA
#42Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…
Don't do simple rolling backups, use something with deduplication like borg backup or ZFS/btrfs if you want to do it at the FS level. The backup size should not increase by much more than the actual size of any new files, so if suddenly, you need twice as much backup space because all your files seem to have changed, you should get suspicious.
Agreed. I'll shill rsync.net (no affiliation, just a happy customer) and their ZFS VM backup service. It's basically just a lightweight freebsd VM with a big ZFS volume attached, so you can `zfs send` incremental backups to it, and they support meta-snapshotting of your backup machine on their end. I wrote https://github.com/wyager/zfs-backup to manage my automatic incremental backups, and there are a number of other tools like this.
Re: A tale of Phobos – How we almost cracked a ransomware using CUDA
#43Earlier quoted context omitted.
Don't do simple rolling backups, use something with deduplication like borg backup or ZFS/btrfs if you want to do it at the FS level. The backup size should not increase by much more than the actual size of any new files, so if suddenly, you need twice as much backup space because all your files seem to have changed, you should get suspicious.
Seconded, I have an external 2tb HDD that stores 1 years worth of daily backups from my 256gb (~180gb used at any time) laptop hard drive. My backup script ( https://gist.github.com/Jeffrey-P-McAteer/7d4b9052825914b5e0... ) takes maybe 30 minutes for a full backup, 5 minutes for most deltas. Files which are the same get hard-linked to the previous days backups, new files are copied over and content-de-duped by btrfs.
If nothing else, external hard drives are cheap and robust enough that I think more people should invest in having an offsite backup. Annually make a full backup, write the date on the outside, and leave it at the parents house. Make that your family holiday ritual.
Re: A tale of Phobos – How we almost cracked a ransomware using CUDA
#44I know I'm in minority and that this view is not empathetic one, but I really like that ransomware is around. More secure data storage at companies where otherwise it would be just silently stolen and sold. More backups. Even some incentive to research security of encryption methods. We won't get more secure systems without some proper incentives.
This is like saying it’s a good thing that burglars exist so it forces us to invest in stronger locks/doors
An unhardened system allows the first attacker the maximum benefit. A hardened system reduces incentive for the first and every follow on attacker.
Good things can come from bad things. That doesn't make the bad things not bad.
Re: A tale of Phobos – How we almost cracked a ransomware using CUDA
#45I think this would be a stupid idea but you can buy an Antminer for $2458 and it does 104 TH/S for SHA256. I think doing a bit of hacking to make it crack the ransomware might be feasible?
Re: A tale of Phobos – How we almost cracked a ransomware using CUDA
#46Earlier quoted context omitted.
Seconded, I have an external 2tb HDD that stores 1 years worth of daily backups from my 256gb (~180gb used at any time) laptop hard drive. My backup script ( https://gist.github.com/Jeffrey-P-McAteer/7d4b9052825914b5e0... ) takes maybe 30 minutes for a full backup, 5 minutes for most deltas. Files which are the same get hard-linked to the previous days backups, new files are copied over and content-de-duped by btrfs.
If nothing else, external hard drives are cheap and robust enough that I think more people should invest in having an offsite backup. Annually make a full backup, write the date on the outside, and leave it at the parents house. Make that your family holiday ritual.
As of recently, my setup for backups consists of 2x4 TB HDDs (from different manufacturers) with BTRFS in RAID 1, plugged into a small 2-drive USB3 docking station. With both checksumming and mirroring, feels pretty safe from HW-failure/bit rot standpoint (if one disk fails, you can still mount the other in "degraded" mode).
Re: A tale of Phobos – How we almost cracked a ransomware using CUDA
#47Earlier quoted context omitted.
One technique would be to place unchanging bait files that you pre-check before allowing the backup to proceed.
That’s a nifty and cheap idea. Now I am wondering if I should make the standard juicy targets (eg ~/Documents, .config, .ssh) complete decoys and put all of my real data just off to the side. Could still be hit by a generic attack, but targeted data extraction attempts would initially fail.
Hmmm, settings things like `~/.ssh` to non standard locations too would probably block a lot of the standard dependency-chain-malware coming around as well.
Re: A tale of Phobos – How we almost cracked a ransomware using CUDA
#48I know I'm in minority and that this view is not empathetic one, but I really like that ransomware is around. More secure data storage at companies where otherwise it would be just silently stolen and sold. More backups. Even some incentive to research security of encryption methods. We won't get more secure systems without some proper incentives.
This is like saying it’s a good thing that burglars exist so it forces us to invest in stronger locks/doors
If you really want burglars and locks analogy it would be invisible burglars, that steal secrets and things you don't notice from your home. Then some not invisible burglars appear and you realize you need better locks. Invisible burglars are more dangerous.
You may prefer world without burglars at all, but that is not an option. It's just wishful thinking.
Re: A tale of Phobos – How we almost cracked a ransomware using CUDA
#49Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…
I worked in backup software for 22 years until a few years ago. My suggestion is to make a backup and store it for long term on an external drive. The to the cloud full followed incremental backup daily so you can go back to any point along the way at any time. Currently I use Acronis and it works well. I backup to their cloud to avoid having my local backups also encrypted preventing restoring in the event of failure or malware. Good backup strategy would not overwrite old backups until you must and backup regularly, so you don't lose any more data than you can afford to lose. Remember recovery time as well.
Re: A tale of Phobos – How we almost cracked a ransomware using CUDA
#50Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…
Don't do simple rolling backups, use something with deduplication like borg backup or ZFS/btrfs if you want to do it at the FS level. The backup size should not increase by much more than the actual size of any new files, so if suddenly, you need twice as much backup space because all your files seem to have changed, you should get suspicious.
Also ensure your client does not have access to the backup server share so that ransomware can't encrypt backups on a network drive etc.
My backup solution (backuppc/other syncs + zfs + sanoid/syncoid plus offsite server with zfs) means the backup server pulls files from the clients using backuppc/rsync. The backup server volume is zfs snapshoted regularly using sanoid. The offsite server pulls these from the backup server via syncoid/zfs send.
I'm not using rsync.net since I have my own infrastructure, but would definitely choose it as the offsite server if needed.