You’re infected—if you want to see your data again, pay us $300 in Bitcoins • Hacker News Board

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#61

Post by masklinn » Thu, Oct 17, 2013, 9:39 PM UTC

antihero wrote: post #35

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. One trivial solution would be OS level au…

> Backups are, obviously, a much better solution but require extra storage and usually cost money.

And the virus will encrypt anything writable, so the backup needs to be "pull", if the infected machine is the one doing backups and has write access to a non-cold-storage backup location it will may encrypt the backup itself.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#62

Post by ballard » Thu, Oct 17, 2013, 9:39 PM UTC

mcphilip wrote: post #28

While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers. Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?

Tarsnap is the only sensible backup provider given the recent history of warantless secret searches in America. SpiderOak is also a contender for file sharing. Both use end-to-end encryption knowable only to the end-user.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#63

Post by mistercow » Thu, Oct 17, 2013, 9:40 PM UTC

synthos wrote: post #41

mistercow wrote: post #33

Earlier quoted context omitted.

I think that you could use Box for this pretty effectively. With their $15/month business plan, you get 1TB of storage and can apparently set any directory as a "workspace", which presumably includes the home directory. For most users, that would be more sufficient to keep everything backed up and the syncing process is supposed to be the same kind of transparent deal as Dropbox (which would also be a good solution,…

until it encrypts the workspace and that gets synced. Although, I suppose you might have a previous revision as I know dropbox supports versioning for some (all?) kinds of files.

Yeah, I'm pretty sure you'd have previous versions to work with. It would be important to check though.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#64

Post by jasonlfunk » Thu, Oct 17, 2013, 9:42 PM UTC

"you need to pay 300 USD / 300 EUR / similar amount in another currency"

How about 300 VND? Seems similar to me. :)

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#65

Post by [deleted] » Thu, Oct 17, 2013, 9:42 PM UTC

susi22 wrote: post #12

In a corporate environment I'd expect crucial data to be on the network drive and snapshotted every few hours. We run ZFS on our network and all the secretaries have to do their doc/excel work on the drive. Nowadays that everybody has a Gigabit Ethernet connection read/writes are extremely quick. Use ZFS and make read only snapshots that are only accessible to the sysadmins. You'll solve many problems that way. We do…

[deleted]

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#66

Post by gknoy » Thu, Oct 17, 2013, 9:42 PM UTC

ryan-c wrote: post #32

I've gotten a few copies of this, all to an email address that was only ever given out to AT&T, and is not guessable.

Would you consider posting a screenshot of what the initial (infection) e-mail looks like?

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#67

Post by masklinn » Thu, Oct 17, 2013, 9:43 PM UTC

susi22 wrote: post #12

In a corporate environment I'd expect crucial data to be on the network drive and snapshotted every few hours. We run ZFS on our network and all the secretaries have to do their doc/excel work on the drive. Nowadays that everybody has a Gigabit Ethernet connection read/writes are extremely quick. Use ZFS and make read only snapshots that are only accessible to the sysadmins. You'll solve many problems that way. We do…

> Use ZFS and make read only snapshots

IIRC ZFS snapshots are read-only by definition. Clones are the writable ones.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#68

Post by mistercow » Thu, Oct 17, 2013, 9:44 PM UTC

antihero wrote: post #35

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. One trivial solution would be OS level au…

The only virus I ever got was the SevenDust 666 virus on Mac OS 8. An infected machine would have a "666" extension that couldn't be deleted (it would instantly replace itself) and then start losing files. So losing files as a target has been around for many years.

The interesting change to me is that now viruses have been effectively monetized.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#69

Post by mariuolo » Thu, Oct 17, 2013, 9:45 PM UTC

pavel_lishin wrote: post #48

mariuolo wrote: post #6

I'm sorry, but if a firm doesn't compartimentalise access and a single infected workstation can bring down everything, then they deserve what they get. Hadn't been ransomware it could have very well been a disgruntled employee, to the same effect.

While you're technically right - we are responsible for our security, and we should lock down our networks just like we lock our front doors - this is basically blaming the victim.

In a nice neighbourhood one could probably leave the door unlocked, but unfortunately internet is more like Gangland than Wonderland.

This said, I'm not blaming home users, but IT folks who failed to secure corporate data and should have known better.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#70

Post by mrtksn » Thu, Oct 17, 2013, 9:46 PM UTC

Pxtl wrote: post #56

Well that's moderately horrifying. I've dealt with ransomware before, but mostly it just used scary messages, not literally encrypting all your data.

but this one seems to do what it claims to do. it's pretty scary for people who don't have decent backup system. but these same people live with the risk of losing their data due to a drive failure, so...