The only new thing about this ransomware is that the payment method is through Bitcoin, right?
Yes, but that alone is important. A lot more difficult to shut down.
You’re infected—if you want to see your data again, pay us $300 in Bitcoins
31–40 of 295 posts
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#32I've gotten a few copies of this, all to an email address that was only ever given out to AT&T, and is not guessable.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#33While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers. Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?
I think that you could use Box for this pretty effectively. With their $15/month business plan, you get 1TB of storage and can apparently set any directory as a "workspace", which presumably includes the home directory. For most users, that would be more sufficient to keep everything backed up and the syncing process is supposed to be the same kind of transparent deal as Dropbox (which would also be a good solution, except that you can't set an arbitrary directory as your Dropbox folder).
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#34While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers. Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?
Not technically a true backup system, I think, but Dropbox is pretty easy to use and is a lot better than nothing.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#35I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account.
One trivial solution would be OS level automatic versioning of files (ala Dropbox or Sparkleshare) - the original files would be written to location that is read only to the user and only accessible via the OS, hence, backups could always be restored from it, but never destroyed without admin rights.
Of course, with people having great internet and whatnot, an automatic cloud based solution would be much more likely and useful.
I think with Windows 8.1 and onwards, Microsoft are automatically doing this by setting up the "Documents" type folders in SkyDrive - a great think moving forward.
Backups are, obviously, a much better solution but require extra storage and usually cost money.
So there might be a niche for a freeware product that runs as an admin that automatically versions files - perhaps even as simple as having an admin-owned .git repo for the Documents folder.
The worrying thing about this attack is that targeting user data is trivial on all OSs, because of the way we think about privileges - it could be done to us Linux users through something nasty in our shell rc using GPG or whatever. There is no need to compromise anything.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#36You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.
This type of viruses are nothing new [0]. The only new thing in this case is that it demands BitCoins instead of an SMS to a premium number or something else.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#37While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers. Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?
Look into one of the many cloud based backup providers. I don't have any specific recommendations but here's a list off the top of my head:
1. http://www.carbonite.com/ 2. http://www.crashplan.com/ 3. http://www.backblaze.com/
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#38The only new thing about this ransomware is that the payment method is through Bitcoin, right?
yup. But the fact they're using bitcoin shows a clever way for ransomware to collect payment with virtually zero-risk; since it's not possible(that I know of) to really trace exactly who, in real life, got those bitcoins. Which means, ransomware might make a strong comeback since the risk is now basically zero, this program isn't that difficult to write and there's real money to be made. Even if you only charged 50 U…
the bitcoin pseudo-anonymity is a plus, but i feel the real value in this new round of ransomware is that the unlocking actually works. Its possible for the ransomware app to verify payment and unlock itself, with no contact or control from the ransomware author, greatly reducing the author's risk. Actually, its easier for the victim too - rather than wiring funds to some bank account in far off lands, a quick anonymous digital payment instead. Im speculating but its possible for the app to query blockchain.info for a deposit for a given address, or (less likely) for the app to download the blockchain itself, and then unlock after a certain balance. If there is high confidence that the data will actually get unlocked, that swings the balance of fight the app or pay the app towards the pay the app side. The author sits back and waits for those wallets to fill up.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#39Victims don't even get the enjoyment of having to make their payments in some far flung corner of an MMO, like the plot of Reamde. https://www.goodreads.com/book/show/10552338-reamde
The story was no doubt based on earlier real-life examples of "Ransomware" like this one: http://www.infoworld.com/t/malware/ransomware-returns-if-you...
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#40While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers. Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?
Look into one of the many cloud based backup providers. I don't have any specific recommendations but here's a list off the top of my head: 1. http://www.carbonite.com/ 2. http://www.crashplan.com/ 3. http://www.backblaze.com/
From the Reddit article linked above [1]:
"Backup solutions like Carbonite are no good against this as they will commit the encrypted files to the cloud."
You need "cold" backups to get around this without paying.
[1] http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care...