You’re infected—if you want to see your data again, pay us $300 in Bitcoins • Hacker News Board

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#11

Post by coryfklein » Thu, Oct 17, 2013, 8:39 PM UTC

Ah, I guess it is time to send the annual email to mom, dad, and the in-laws to be very wary of downloading anything or clicking on links in suspicious emails.

I find this is good insurance against the inevitable phone calls I receive as the only computer-literate member of the family: "Hey Cory, all my documents disappeared and I can't get them back. Do I have a virus?"

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#12

Post by susi22 » Thu, Oct 17, 2013, 8:40 PM UTC

In a corporate environment I'd expect crucial data to be on the network drive and snapshotted every few hours. We run ZFS on our network and all the secretaries have to do their doc/excel work on the drive. Nowadays that everybody has a Gigabit Ethernet connection read/writes are extremely quick.

Use ZFS and make read only snapshots that are only accessible to the sysadmins. You'll solve many problems that way. We do snapshots at 6am,noon and 6pm and then keep the 6pm one for 7, 14 and 30 days.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#13

Post by gwern » Thu, Oct 17, 2013, 8:41 PM UTC

The only new thing about this ransomware is that the payment method is through Bitcoin, right?

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#14

Post by nsxwolf » Thu, Oct 17, 2013, 8:42 PM UTC

Get a Mac.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#15

Post by jerf » Thu, Oct 17, 2013, 8:49 PM UTC

nvk wrote: post #9

daveid wrote: post #5

The article didn't mention, what systems does this ransomware primarily target? Is it cross-platform?

That i know, only MS

But note that's only due to popularity. Socially engineering your way into a user running an executable means that executable will simply run with user privs. No trickery or hacking required, no OS holes. And that will mean that the executable will have full access to do everything a user could do, which will effectively certainly include sending a new encryption key over the network, and encrypting every file that user can get a hold of.

(One of the little problems with the UNIX-style user permissions is that it is designed to defend the OS, not the user. Sure, that little executable may not be able to corrupt "the system", which may amount to 5 or 10 GBs of easily-replaced code, but it will have its way with the 2TB of the single user's media files.)

The only faint defense Linux/UNIX can claim is the slightly higher probability that you'll be on a checkpointing file system and can roll back, and I say only "slightly" because they still aren't very popular yet compared to conventional file systems.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#16

Post by sillysaurus2 » Thu, Oct 17, 2013, 8:49 PM UTC

amalag wrote: post #7

A company I work with was hit when the employee opened a phishing email supposedly from another employee in the same company. It hit about 50 gb of data on the shared drive. We had Crashplan and restored from a few days previous. I then turned on DKIM and enabled quarantining non DKIM emails via DMARC.

I then turned on DKIM and enabled quarantining non DKIM emails via DMARC.

Translation for techies who aren't familiar with email's many acronyms?

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#17

Post by tbarbugli » Thu, Oct 17, 2013, 8:50 PM UTC

And than the police shut down the ransomware servers and dooms data from many infected victims to garbage, brilliant!

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#18

Post by sillysaurus2 » Thu, Oct 17, 2013, 8:51 PM UTC

mariuolo wrote: post #6

I'm sorry, but if a firm doesn't compartimentalise access and a single infected workstation can bring down everything, then they deserve what they get. Hadn't been ransomware it could have very well been a disgruntled employee, to the same effect.

I want to upvote you for truth, but HN currently has a meanness problem of which this comment is a specimen.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#19

Post by swombat » Thu, Oct 17, 2013, 8:52 PM UTC

sillysaurus2 wrote: post #16

amalag wrote: post #7

A company I work with was hit when the employee opened a phishing email supposedly from another employee in the same company. It hit about 50 gb of data on the shared drive. We had Crashplan and restored from a few days previous. I then turned on DKIM and enabled quarantining non DKIM emails via DMARC.

I then turned on DKIM and enabled quarantining non DKIM emails via DMARC. Translation for techies who aren't familiar with email's many acronyms?

All those acronyms are easily googleable. Not being a techie does not mean you get to be lazy about looking things up.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#20

Post by blhack » Thu, Oct 17, 2013, 8:54 PM UTC

You can work to prevent this by creating a group policy that disallows

     %AppData%\*.exe

and

     %AppData%\*\*.exe

A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care...

sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.