Since the Bitcoin blockchain is public, couldn't you follow the money? Make a list of all wallets that accepted these funds initially, and then do graph analysis, either to see where the money went or provide others with a tool to avoid transactions with those wallets?
You’re infected—if you want to see your data again, pay us $300 in Bitcoins
71–80 of 295 posts
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#72This is what Venti (of the Plan 9 fame) is for!
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#73I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. One trivial solution would be OS level au…
> Backups are, obviously, a much better solution but require extra storage and usually cost money. And the virus will encrypt anything writable, so the backup needs to be "pull", if the infected machine is the one doing backups and has write access to a non-cold-storage backup location it will may encrypt the backup itself.
Solved this problem at my startup Nuevo Cloud.. the filesystem is copy-on-write, including deletions.. In the settings you can control how long to keep the copy-on-write log, and then you can jump to any second within the log.
So even if this virus encrypted your backup on Nuevo Cloud, you can just pull up the snapshot from a second before the infection, and restore your files.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#74I wonder if amount of $300 was determined via A/B testing as optimal for bringing maximum profit.
The article mentions that there is a $100 variant floating around.
Makes me wonder whether they use the $100 variant in markets that $300 would be too much to pay.
If, is as reported, this virus is pulling in around ~$5million / annum, then that is a great basis for setting up a professional organisation to run the virus and extract maximum value from it.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#75I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. One trivial solution would be OS level au…
This opened my eyes, thanks. I'll see how to set up backups that I can create but not delete.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#76This happened to someone I know (really, it wasn't me). Not only did it encrypt the local drives it also hit all of their network drives. As reprehensible as it is to pay the ransom they really had no choice since the encryption happened the prior night before the last backup.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#77In a corporate environment I'd expect crucial data to be on the network drive and snapshotted every few hours. We run ZFS on our network and all the secretaries have to do their doc/excel work on the drive. Nowadays that everybody has a Gigabit Ethernet connection read/writes are extremely quick. Use ZFS and make read only snapshots that are only accessible to the sysadmins. You'll solve many problems that way. We do…
Agreed. At a previous job, I set up a multi-terabyte SMB/NFS file server (Solaris, ZFS) with snapshots taken every 5 minutes. This was incredibly useful. The snapshots (in .zfs directories) were even accessible to end-users so that they could recover from their own mistakes without the help of sysadmins.
With such a setup, the only situation in which sysadmins are required are when end-users accidentally copy sensitive data to the file server, remove it, and need sysadmins to also remove the snapshots to permanently remove the sensitive data.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#78Since the Bitcoin blockchain is public, couldn't you follow the money? Make a list of all wallets that accepted these funds initially, and then do graph analysis, either to see where the money went or provide others with a tool to avoid transactions with those wallets?
Theoretically yes, but in practice mixing services make this much much more complex.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#79You could imagine the Bitcoin community deciding to blacklist any wallets to which funds like this were demanded and disbursed. That seems like a great idea until you then realize that this would be a way of denying anyone access to their own funds, by specifying their wallet as the recipient even though the attacker doesn't control it. There really doesn't seem to be any good countermeasure to this.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#80Disabling or limiting your use of JavaScript and Java in the browser will go a long way towards protecting against delivery of this as it is likely delivered by an exploit kit. If you do hit an exploit kit, Microsoft EMET (free) will probably mitigate the exploit/s.