Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

81–90 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#81

Post by mkup »

millstone wrote: post #42
jerf wrote: post #15

Earlier quoted context omitted.

But note that's only due to popularity. Socially engineering your way into a user running an executable means that executable will simply run with user privs. No trickery or hacking required, no OS holes. And that will mean that the executable will have full access to do everything a user could do, which will effectively certainly include sending a new encryption key over the network, and encrypting every file that u…

OS X defaults to only running applications that have been signed with a valid developer ID. It’s not difficult to get such an ID, but Apple can also blacklist them, which would prevent the malware from running once Apple notices it. So I think the Mac has a good defense against this kind of attack.

Malware developer can make 256 valid developer IDs, compute 256 signatures and switch them automatically and randomly during the propagation of malware. Once Apple blacklists one developer ID, another one pops out, and so malware continues to propagate.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#82

Post by AsakiIssa »

I know a customer that got hit by this Tuesday morning. Unsurprisingly, Avast did nothing. I just told her the bad news and clean-installed Windows.

I have tried to find the private key with sample files, using known file byte headers, the public key and brute force on the private key. Sadly, no luck yet.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#83

Post by lstamour »

crb wrote: post #53
blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)

My understanding is they changed that and by default it wants admin rights. Then if that fails, it asks if you want to continue without. (At least, this was my experience the last time I had to install Chrome on a machine without admin rights.)

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#84

Post by bri3d »

donpdonp wrote: post #38
smtddr wrote: post #29

Earlier quoted context omitted.

yup. But the fact they're using bitcoin shows a clever way for ransomware to collect payment with virtually zero-risk; since it's not possible(that I know of) to really trace exactly who, in real life, got those bitcoins. Which means, ransomware might make a strong comeback since the risk is now basically zero, this program isn't that difficult to write and there's real money to be made. Even if you only charged 50 U…

the bitcoin pseudo-anonymity is a plus, but i feel the real value in this new round of ransomware is that the unlocking actually works . Its possible for the ransomware app to verify payment and unlock itself, with no contact or control from the ransomware author, greatly reducing the author's risk. Actually, its easier for the victim too - rather than wiring funds to some bank account in far off lands, a quick anony…

The way this ransomware works still requires a centralized command and control server; without one, it would be possible to trigger the "unlock" codepath in the client without paying the authors.

The authors run a key-storage service which notifies the client (and provides a private key) once payment is received.

In this case the authors are still at a substantial advantage, though - as long as enough unlocks work that "just pay up" is the advice given online, they don't have to care if their C+C server is down half the time or the feds take it down, because the money rolls in even when the decryption isn't working.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#85

Post by [deleted] »

rgbrenner wrote: post #73
masklinn wrote: post #61

Earlier quoted context omitted.

> Backups are, obviously, a much better solution but require extra storage and usually cost money. And the virus will encrypt anything writable, so the backup needs to be "pull", if the infected machine is the one doing backups and has write access to a non-cold-storage backup location it will may encrypt the backup itself.

Solved this problem at my startup Nuevo Cloud.. the filesystem is copy-on-write, including deletions.. In the settings you can control how long to keep the copy-on-write log, and then you can jump to any second within the log. So even if this virus encrypted your backup on Nuevo Cloud, you can just pull up the snapshot from a second before the infection, and restore your files.

[deleted]

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#86

Post by emillerm »

mariuolo wrote: post #6

I'm sorry, but if a firm doesn't compartimentalise access and a single infected workstation can bring down everything, then they deserve what they get. Hadn't been ransomware it could have very well been a disgruntled employee, to the same effect.

I think the article mentions that it's small businesses that are at risk. Most mom and pop shops don't have the greatest IT infrastructure.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#87

Post by cheesylard »

donpdonp wrote: post #38
smtddr wrote: post #29

Earlier quoted context omitted.

yup. But the fact they're using bitcoin shows a clever way for ransomware to collect payment with virtually zero-risk; since it's not possible(that I know of) to really trace exactly who, in real life, got those bitcoins. Which means, ransomware might make a strong comeback since the risk is now basically zero, this program isn't that difficult to write and there's real money to be made. Even if you only charged 50 U…

the bitcoin pseudo-anonymity is a plus, but i feel the real value in this new round of ransomware is that the unlocking actually works . Its possible for the ransomware app to verify payment and unlock itself, with no contact or control from the ransomware author, greatly reducing the author's risk. Actually, its easier for the victim too - rather than wiring funds to some bank account in far off lands, a quick anony…

That won't work, it could be prevented by a man-in-the-middle attack on the victim's own computer. Just spoof the blockchain signatures required as if the payment was sent on an ad-hoc network and the program would unlock itself.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#88

Post by smtddr »

greglindahl wrote: post #57
smtddr wrote: post #29

Earlier quoted context omitted.

yup. But the fact they're using bitcoin shows a clever way for ransomware to collect payment with virtually zero-risk; since it's not possible(that I know of) to really trace exactly who, in real life, got those bitcoins. Which means, ransomware might make a strong comeback since the risk is now basically zero, this program isn't that difficult to write and there's real money to be made. Even if you only charged 50 U…

Lower risk, but it probably reduces income: how many people can figure out how to make a bitcoin payment? How long does it take to make a bitcoin payment? The harder it is, the more likely the target is to give up and do without.

I've never done it before myself, but this looks simple enough; like a paypal donation:

http://shop.wikileaks.org/donate

Now, how the malware-writer goes about verifying payment is beyond my understanding...

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#89

Post by bri3d »

greglindahl wrote: post #57
smtddr wrote: post #29

Earlier quoted context omitted.

yup. But the fact they're using bitcoin shows a clever way for ransomware to collect payment with virtually zero-risk; since it's not possible(that I know of) to really trace exactly who, in real life, got those bitcoins. Which means, ransomware might make a strong comeback since the risk is now basically zero, this program isn't that difficult to write and there's real money to be made. Even if you only charged 50 U…

Lower risk, but it probably reduces income: how many people can figure out how to make a bitcoin payment? How long does it take to make a bitcoin payment? The harder it is, the more likely the target is to give up and do without.

I think their Bitcoin payment method is actually to facilitate international payments (funny in a dark way) - they also take the popular shady prepaid-debit/cash-wire service GreenDot Moneypak and I'd imagine most US victims paid up that way.

There are a couple of anecdotes on Reddit about Canadians and other non-US residents scrambling to find a physical Bitcoin storefront or Craigslist contact to pay the ransom for them since Moneypak wasn't available in their area.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#90

Post by sltkr »

alec wrote: post #71

Since the Bitcoin blockchain is public, couldn't you follow the money? Make a list of all wallets that accepted these funds initially, and then do graph analysis, either to see where the money went or provide others with a tool to avoid transactions with those wallets?

Yes, but this is somewhat like saying you could mark the banknotes used to pay off a person that's blackmailing you. If you catch someone with a marked note that doesn't prove they are the perpetrator; it just means that they received your money somehow.
Post reply on HN