Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

101–110 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#101

Post by dasil003 »

ballard wrote: post #62
mcphilip wrote: post #28

While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers. Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?

Tarsnap is the only sensible backup provider given the recent history of warantless secret searches in America. SpiderOak is also a contender for file sharing. Both use end-to-end encryption knowable only to the end-user.

I can't afford to have my family photos backed up to tarsnap. Let the NSA have 'em.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#102

Post by vertis »

susi22 wrote: post #12

In a corporate environment I'd expect crucial data to be on the network drive and snapshotted every few hours. We run ZFS on our network and all the secretaries have to do their doc/excel work on the drive. Nowadays that everybody has a Gigabit Ethernet connection read/writes are extremely quick. Use ZFS and make read only snapshots that are only accessible to the sysadmins. You'll solve many problems that way. We do…

This is a great solution if you have a good technical staff helping to run a business. The reality is though that this is more likely to affect businesses without technical knowledge, or home users.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#103

Post by derefr »

jrabone wrote: post #91
crb wrote: post #53

Earlier quoted context omitted.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)

And that's just as good an idea as executable data segments in a binary format (ie. not a very good idea). It's taken MS literally YEARS to get to half-decent default filesystem permissions in Windows 7 and this kind of thing just undermines it totally.

What do you suggest instead? People who work at BigCorps and have shitty outdated IE installs are motivated to install alternative web browsers, even when they don't have administrative rights (and they almost never do.) Google is motivated to enable them to do so.

The real problem, I think, is that Microsoft thinks requiring admin rights to write to "Program Files" is the be-all and end-all of solving the "application-environment integrity problem." That works for enterprise-wide deploys of sysadmin-supported software, but falls down for user-specific installations. On OSX, "application-environment integrity" can be enforced easily enough, since the OS delineates applications by a line called "the app bundle." OSX can (though I'm not sure it does) just disallow apps from writing into other apps' bundles without a "do you really mean it" prompt. But in Windows, the The Directory Is The Application Bundle[1], and so Windows doesn't know that this directory is special and should be protected from having other apps in other directories tinkering with it.

[1] http://blogs.msdn.com/b/oldnewthing/archive/2011/06/20/10176...

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#104

Post by kodr »

haberman wrote: post #79

You could imagine the Bitcoin community deciding to blacklist any wallets to which funds like this were demanded and disbursed. That seems like a great idea until you then realize that this would be a way of denying anyone access to their own funds, by specifying their wallet as the recipient even though the attacker doesn't control it. There really doesn't seem to be any good countermeasure to this.

and then the thief stops sending the key to unlock the data.

seriously the only to stop this is to:

- not get infected by opening random exe

- arrest the thief

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#105

Post by Silhouette »

crb wrote: post #53
blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install?

Yes, and from a security point of view it should be treated as hostile accordingly.

There is no need to actively circumvent Windows security like this. Firefox, among many other examples, is quite capable of automatically updating itself using a proper Windows service mechanism.

It's long past time that Google were called out on this one. Not only is it a potential security risk, it also interferes with backups of %AppData%, which is generally an area of Windows PCs that you do want to save regularly in case of disasters.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#106

Post by fekberg »

blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

Here's a command you can run to find out what executables exist in AppData:

    dir /S /P "%userprofile%\AppData\*.exe" > %userprofile%\Desktop\FoundFiles.txt

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#107

Post by FootballMuse »

haberman wrote: post #79

You could imagine the Bitcoin community deciding to blacklist any wallets to which funds like this were demanded and disbursed. That seems like a great idea until you then realize that this would be a way of denying anyone access to their own funds, by specifying their wallet as the recipient even though the attacker doesn't control it. There really doesn't seem to be any good countermeasure to this.

What's to say that the bitcoin address remains the same? It can be randomly generated for each infection and as such a blacklist would be impossible.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#108

Post by kuschku »

ggchappell wrote: post #98

I get annoyed when people are warned not to open some attachment. The real problem here is that in 2013 we're still using the flawed language of "opening attachments" -- as if running a native executable with full permissions is an action that belongs in the same category as viewing an image, reading a text file, or listening to music. Well, it doesn't. This is a problem that should have been solved at the level of O…

The best solution would be the one used by Linux: Separate Data and Software.

On Linux there is a specific flag that has to be set and is not set per default to make a file executable.

So if you run something, you know that you are running it as a program and not opening it as data.

Windows on the other hand marks everything as executable which begins with MZ and whichs filename ends in .exe or .com

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#109

Post by smtddr »

cheesylard wrote: post #87
donpdonp wrote: post #38

Earlier quoted context omitted.

the bitcoin pseudo-anonymity is a plus, but i feel the real value in this new round of ransomware is that the unlocking actually works . Its possible for the ransomware app to verify payment and unlock itself, with no contact or control from the ransomware author, greatly reducing the author's risk. Actually, its easier for the victim too - rather than wiring funds to some bank account in far off lands, a quick anony…

That won't work, it could be prevented by a man-in-the-middle attack on the victim's own computer. Just spoof the blockchain signatures required as if the payment was sent on an ad-hoc network and the program would unlock itself.

If blockchain.info was queried over ssl, the spoofing would be a bit harder to pull off.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#110

Post by Silhouette »

antihero wrote: post #35

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. One trivial solution would be OS level au…

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account.

You make an excellent point, but there is a second and perhaps even more sinister side to it. Encrypting your data and holding it hostage is one thing, but even if you have indestructible backups, there are probably still many sensitive pieces of information that can be acquired by a blackmailer with only user-level privileges: bank details, company trade secrets, personal mail/photos/videos, etc.

Having a back-up of these is important, but probably so is ensuring that they aren't distributed to people they shouldn't be. This requires a very different model of access control and user/application privileges, and unfortunately I don't think any mainstream OS is even close to solving this one yet.

Post reply on HN