Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

91–100 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#91

Post by jrabone »

crb wrote: post #53
blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)

And that's just as good an idea as executable data segments in a binary format (ie. not a very good idea). It's taken MS literally YEARS to get to half-decent default filesystem permissions in Windows 7 and this kind of thing just undermines it totally.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#92

Post by dragonwriter »

haberman wrote: post #79

You could imagine the Bitcoin community deciding to blacklist any wallets to which funds like this were demanded and disbursed. That seems like a great idea until you then realize that this would be a way of denying anyone access to their own funds, by specifying their wallet as the recipient even though the attacker doesn't control it. There really doesn't seem to be any good countermeasure to this.

> You could imagine the Bitcoin community deciding to blacklist any wallets to which funds like this were demanded and disbursed.

I can imagine lots of things, but I don't see any reason to believe that that's likely.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#93

Post by bri3d »

pavel_lishin wrote: post #52
tempestn wrote: post #25

Earlier quoted context omitted.

Unfortunate for those folks, but if it can prevent many more people from being infected, then still worthwhile.

Would it actually help? Does the ransomware contact the servers prior to encrypting everything?

This variant seems to - it needs the command and control servers to get the public key.

Particularly evil malware could probably encrypt the data irreversibly if the command and control servers were unavailable, since as long as the decryption works some portion of the time lots of people will pay, but thankfully this particular example doesn't seem to be there yet.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#94

Post by tempestn »

pavel_lishin wrote: post #52
tempestn wrote: post #25

Earlier quoted context omitted.

Unfortunate for those folks, but if it can prevent many more people from being infected, then still worthwhile.

Would it actually help? Does the ransomware contact the servers prior to encrypting everything?

Even if it encrypts regardless, preventing the perpetrators from profiting will remove their incentive to keep spreading this stuff. Once antivirus catches up to the copies in the wild, the problem would be solved. Of course, whether it's actually possible to shut down enough servers to prevent them from profiting is another question. But it seems to me anything that makes it more difficult is a good thing, even though it does suck for those who lose data.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#95

Post by jussij »

crb wrote: post #53
blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)

Google Chrome Updater certainly does have a few virus like characteristics.

Every time my interent connection slows (WiFi) I know it's Chrome Updater so I kill it via Task Manager and everthing is good again.

There doesn't apear to be away to turn it off inside Chrome itself and turning off updates via the registry does not seem to stop it.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#96

Post by [deleted] »

mcphilip wrote: post #30
blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

It actually made my skin crawl reading about it. Never had that reaction to such a story before. Interesting... Edit: It's the BTC aspect that's worrisome. Ransomeware is nothing new -- AIDS Information Trojan did it in 1989, but the (potentially) safe method of payments in crypto currency seem to be a new factor that will attract much more innovation in these type of attacks.

[deleted]

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#97

Post by arca_vorago »

smtddr wrote: post #29
gwern wrote: post #13

The only new thing about this ransomware is that the payment method is through Bitcoin, right?

yup. But the fact they're using bitcoin shows a clever way for ransomware to collect payment with virtually zero-risk; since it's not possible(that I know of) to really trace exactly who, in real life, got those bitcoins. Which means, ransomware might make a strong comeback since the risk is now basically zero, this program isn't that difficult to write and there's real money to be made. Even if you only charged 50 U…

Actually bitcoin has many strengths, but anonymity is not one of them. There have been multiple papers that go into how easy it is to trace, and even laundering style services like SRO used aren't very good.

http://fc13.ifca.ai/proc/1-3.pdf http://cseweb.ucsd.edu/~smeiklejohn/files/imc13.pdf

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#98

Post by ggchappell »

I get annoyed when people are warned not to open some attachment. The real problem here is that in 2013 we're still using the flawed language of "opening attachments" -- as if running a native executable with full permissions is an action that belongs in the same category as viewing an image, reading a text file, or listening to music.

Well, it doesn't. This is a problem that should have been solved at the level of OS permissions/UI long ago. Why does a modern OS include UI functionality allowing a standard user to run an uninstalled executable in a non-sandboxed environment? There's no good reason for it.

In some cases the problem been solved (e.g., restrictions that allow only signed apps to be executed). But I guess none of those cases include Windows, its standard UI, and popular e-mail programs. :-(

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#99

Post by rgbrenner »

[deleted] wrote: post #85
rgbrenner wrote: post #73

Earlier quoted context omitted.

Solved this problem at my startup Nuevo Cloud.. the filesystem is copy-on-write, including deletions.. In the settings you can control how long to keep the copy-on-write log, and then you can jump to any second within the log. So even if this virus encrypted your backup on Nuevo Cloud, you can just pull up the snapshot from a second before the infection, and restore your files.

[deleted]

Yes, the service doesn't have a 'space limit' setting.. So it's essentially infinite storage. It is deduplicated, so there is some savings there.. And the log only saves your changes.. So the space used would be 100% + % changed during period - % duplicated

We are working on a 'space limit' setting (should be finished shortly).. But if that were enabled, and you exceeded it, you would just get a write error when new data is written.. It wouldn't delete the log.. So if that setting were finished, an you got this virus, the virus might get a write error halfway through.. But your old versions would still be safe.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#100

Post by waqf »

mistercow wrote: post #68
antihero wrote: post #35

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. One trivial solution would be OS level au…

The only virus I ever got was the SevenDust 666 virus on Mac OS 8. An infected machine would have a "666" extension that couldn't be deleted (it would instantly replace itself) and then start losing files. So losing files as a target has been around for many years. The interesting change to me is that now viruses have been effectively monetized.

Not such a new change, for it's been known since at least 1989: https://en.wikipedia.org/wiki/AIDS_(trojan_horse)
Post reply on HN