Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

51–60 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#51

Post by slaven »

jerf wrote: post #15
nvk wrote: post #9

Earlier quoted context omitted.

That i know, only MS

But note that's only due to popularity. Socially engineering your way into a user running an executable means that executable will simply run with user privs. No trickery or hacking required, no OS holes. And that will mean that the executable will have full access to do everything a user could do, which will effectively certainly include sending a new encryption key over the network, and encrypting every file that u…

I think it's no longer accurate to think of this as "MS-focused attack but only because OS X is not as popular". Today, iOS is used by many more people than OS X as their primary computing device and I would say it's pretty safe from this type of attack.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#52

Post by pavel_lishin »

tempestn wrote: post #25
tbarbugli wrote: post #17

And than the police shut down the ransomware servers and dooms data from many infected victims to garbage, brilliant!

Unfortunate for those folks, but if it can prevent many more people from being infected, then still worthwhile.

Would it actually help? Does the ransomware contact the servers prior to encrypting everything?

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#53

Post by crb »

blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#54

Post by MartinCron »

crb wrote: post #53
blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)

Yes, I was able to install Google Chrome on a PC which the user didn't have administrative rights just yesterday. It delighted me to no end.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#55

Post by Pxtl »

jerf wrote: post #15
nvk wrote: post #9

Earlier quoted context omitted.

That i know, only MS

But note that's only due to popularity. Socially engineering your way into a user running an executable means that executable will simply run with user privs. No trickery or hacking required, no OS holes. And that will mean that the executable will have full access to do everything a user could do, which will effectively certainly include sending a new encryption key over the network, and encrypting every file that u…

Relevant xkcd:

http://xkcd.com/1200/

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#57

Post by greglindahl »

smtddr wrote: post #29
gwern wrote: post #13

The only new thing about this ransomware is that the payment method is through Bitcoin, right?

yup. But the fact they're using bitcoin shows a clever way for ransomware to collect payment with virtually zero-risk; since it's not possible(that I know of) to really trace exactly who, in real life, got those bitcoins. Which means, ransomware might make a strong comeback since the risk is now basically zero, this program isn't that difficult to write and there's real money to be made. Even if you only charged 50 U…

Lower risk, but it probably reduces income: how many people can figure out how to make a bitcoin payment? How long does it take to make a bitcoin payment? The harder it is, the more likely the target is to give up and do without.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#58

Post by tedunangst »

slaven wrote: post #51
jerf wrote: post #15

Earlier quoted context omitted.

But note that's only due to popularity. Socially engineering your way into a user running an executable means that executable will simply run with user privs. No trickery or hacking required, no OS holes. And that will mean that the executable will have full access to do everything a user could do, which will effectively certainly include sending a new encryption key over the network, and encrypting every file that u…

I think it's no longer accurate to think of this as "MS-focused attack but only because OS X is not as popular". Today, iOS is used by many more people than OS X as their primary computing device and I would say it's pretty safe from this type of attack.

Only because people can't email you apps to run on your phone. Which, last I checked, is why HN thinks iOS is a terrible, freedom restricting walled garden of evil.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#59

Post by ballard »

susi22 wrote: post #12

In a corporate environment I'd expect crucial data to be on the network drive and snapshotted every few hours. We run ZFS on our network and all the secretaries have to do their doc/excel work on the drive. Nowadays that everybody has a Gigabit Ethernet connection read/writes are extremely quick. Use ZFS and make read only snapshots that are only accessible to the sysadmins. You'll solve many problems that way. We do…

Yup. That's been the standard practice for the past 10 years, to avoid having to request media from an offsite vendor. Used to use VSS on SANs.

(Tested backups are the first three rules of IT.)

Post reply on HN