Called it in July. Read more...
http://blog.kinnaird.us/the-coming-age-of-ransomware-cloud-s...
You’re infected—if you want to see your data again, pay us $300 in Bitcoins
121–130 of 295 posts
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#122Earlier quoted context omitted.
Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)
Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? Yes, and from a security point of view it should be treated as hostile accordingly. There is no need to actively circumvent Windows security like this. Firefox, among many other examples, is quite capable of automatically updating itself using a proper Windows service mechanism. It's long past time that Google were called out on this one. Not o…
I thought it was so you didn't need admin to install it?
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#123While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers. Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?
There's list of a some backup solutions relevant to personal backup (as opposed to enterprise level solutions) here, costs for most providers given too and a brief overview of differentiating features - http://alicious.com/cloud-backup-solutions/.
I quite like duplicati. Slightly opaque to set-up but I'm using it with SkyDrive for some files as at the time of set-up SkyDrive gave me the most free storage with the lowest level of pain [for me] setting up.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#124Earlier quoted context omitted.
Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? Yes, and from a security point of view it should be treated as hostile accordingly. There is no need to actively circumvent Windows security like this. Firefox, among many other examples, is quite capable of automatically updating itself using a proper Windows service mechanism. It's long past time that Google were called out on this one. Not o…
I thought it was so you didn't need admin to install it?
It probably is, but that doesn't make it any better as an idea. There is a good reason why every decent operating system's security model in the past few years has segmented this kind of functionality so only people with elevated privileges can do it.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#125You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.
I tried implementing this solution and it has a lot of difficult side effects. Shortcuts on the task bar could not run (with the exception of Chrome oddly enough). If you select run in IE it fails because it saves to temp and some installers failed as well, again because of the use of temp.
Unless the end user is very saavy or has an onsite IT this seems that the better solution is rotating backups.
Alternating days to external hard drives that are then disconnected is the best mitigation.
And having already had one client effected by this is does scare me. Interesting enough he paid and had his files decrypted in about 48 hours.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#126This is why a RAID setup is not a backup.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#127You could imagine the Bitcoin community deciding to blacklist any wallets to which funds like this were demanded and disbursed. That seems like a great idea until you then realize that this would be a way of denying anyone access to their own funds, by specifying their wallet as the recipient even though the attacker doesn't control it. There really doesn't seem to be any good countermeasure to this.
That sentence works until you start thinking about the likelihood of herding those cats into any action as a community.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#128While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers. Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?
Tarsnap is the only sensible backup provider given the recent history of warantless secret searches in America. SpiderOak is also a contender for file sharing. Both use end-to-end encryption knowable only to the end-user.
I like and have used Tarsnap in the past, but it's not like other providers prevent you from uploading encrypted archives, they just don't encrypt them themselves.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#129You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.
Unfortunately lots of stuff runs under there including, but not limited to:
GitHub for Windows and dozens of apps it installs in there F.lux Anything installed with ClickOnce Chrome GMVault Xamarin's Android Support Markdownpad SkyDrive Join.me
Assuming that everything in there is a virus is too much, I think.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#130You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.
I tried implementing this solution and it has a lot of difficult side effects. Shortcuts on the task bar could not run (with the exception of Chrome oddly enough). If you select run in IE it fails because it saves to temp and some installers failed as well, again because of the use of temp.
Unless the end user is very saavy or has an onsite IT this seems that the better solution is rotating backups.
Alternating days to external hard drives that are then disconnected is the best mitigation.