Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

21–30 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#21

Post by 3pt14159 »

sillysaurus2 wrote: post #16
amalag wrote: post #7

A company I work with was hit when the employee opened a phishing email supposedly from another employee in the same company. It hit about 50 gb of data on the shared drive. We had Crashplan and restored from a few days previous. I then turned on DKIM and enabled quarantining non DKIM emails via DMARC.

I then turned on DKIM and enabled quarantining non DKIM emails via DMARC. Translation for techies who aren't familiar with email's many acronyms?

DomainKeys Identified Mail (DKIM) lets an organization take responsibility for a message that is in transit. Domain-based Message Authentication, Reporting and Conformance (DMARC) is a technical specification created by a group of organizations to help reduce the potential for email-based abuse, such as email spoofing and phishing e-mails, by solving some long-standing operational, deployment, and reporting issues related to email authentication protocols

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#23

Post by blhack »

sillysaurus2 wrote: post #16
amalag wrote: post #7

A company I work with was hit when the employee opened a phishing email supposedly from another employee in the same company. It hit about 50 gb of data on the shared drive. We had Crashplan and restored from a few days previous. I then turned on DKIM and enabled quarantining non DKIM emails via DMARC.

I then turned on DKIM and enabled quarantining non DKIM emails via DMARC. Translation for techies who aren't familiar with email's many acronyms?

DKIM means: http://en.wikipedia.org/wiki/DomainKeys_Identified_Mail

DMARC means: http://en.wikipedia.org/wiki/DMARC

And the person below you doesn't understand how search engines work.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#25

Post by tempestn »

tbarbugli wrote: post #17

And than the police shut down the ransomware servers and dooms data from many infected victims to garbage, brilliant!

Unfortunate for those folks, but if it can prevent many more people from being infected, then still worthwhile.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#26

Post by sillysaurus2 »

swombat wrote: post #19
sillysaurus2 wrote: post #16

Earlier quoted context omitted.

I then turned on DKIM and enabled quarantining non DKIM emails via DMARC. Translation for techies who aren't familiar with email's many acronyms?

All those acronyms are easily googleable. Not being a techie does not mean you get to be lazy about looking things up.

I use HN only via my phone to avoid procrastinating, and only when I'm away from my main computer. It's quite effective, actually.

Also, experts often have insights that introductory articles lack. Better to ask the source if they don't mind composing.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#28

Post by mcphilip »

While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers.

Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#29

Post by smtddr »

gwern wrote: post #13

The only new thing about this ransomware is that the payment method is through Bitcoin, right?

yup. But the fact they're using bitcoin shows a clever way for ransomware to collect payment with virtually zero-risk; since it's not possible(that I know of) to really trace exactly who, in real life, got those bitcoins. Which means, ransomware might make a strong comeback since the risk is now basically zero, this program isn't that difficult to write and there's real money to be made. Even if you only charged 50 USD, this idea would make hundreds, if not thousands, a month. Change the binary every once in awhile so its signature doesn't match popular anti-virus databases and you got free money coming in for... well ...forever[1]

1. Educating users to stop running random programs in zip files attached to emails, is apparently impossible. Maybe email-clients should scan the contents of any zipfile it receives and if it finds any kind of executable, put up all kinds of warning dialogs saying "You really don't want to run this. There's no reason to get a program in zipped email attachment nowadays. Please go consult your IT-admin or somebody who knows about computers for a 2nd-opinion"

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#30

Post by mcphilip »

blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

It actually made my skin crawl reading about it. Never had that reaction to such a story before. Interesting...

Edit: It's the BTC aspect that's worrisome. Ransomeware is nothing new -- AIDS Information Trojan did it in 1989, but the (potentially) safe method of payments in crypto currency seem to be a new factor that will attract much more innovation in these type of attacks.

Post reply on HN