Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

141–150 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#141

Post by marcosdumay »

mcphilip wrote: post #30
blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

It actually made my skin crawl reading about it. Never had that reaction to such a story before. Interesting... Edit: It's the BTC aspect that's worrisome. Ransomeware is nothing new -- AIDS Information Trojan did it in 1989, but the (potentially) safe method of payments in crypto currency seem to be a new factor that will attract much more innovation in these type of attacks.

I just though the exact opposite. When I read "Ransomware comes of age with ... anonymous payments." I just thought "Somebody is going for a surprise once he finds out how anonymous Bitcoin really is".

Anyway, what really makes me nervous is Microsoft's insistence of executing any data that a their programs touch.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#142

Post by keeperofdakeys »

Volpe wrote: post #134
Silhouette wrote: post #124

Earlier quoted context omitted.

It probably is, but that doesn't make it any better as an idea. There is a good reason why every decent operating system's security model in the past few years has segmented this kind of functionality so only people with elevated privileges can do it.

And that good reason is? EDIT: If I want to run/update something (Chrome) in Userland, why should an OS security model stop me? My guess is, Microsoft have successfully confused a common business requirement with a security one.

No, it's a required security feature that goes back decades in some operating systems. You need to be able to trust the code that runs on your system, and to do that you want to ensure only admin can install things.

Of course, Windows has now partially solved that with UAC. Unfortunately you can never know if you can trust the software or not though. However this does stop malware from secretly running without your permission, since it would require a UAC prompt to run. Then we get into uneducated users.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#143

Post by at-fates-hands »

rgbrenner wrote: post #73
masklinn wrote: post #61

Earlier quoted context omitted.

> Backups are, obviously, a much better solution but require extra storage and usually cost money. And the virus will encrypt anything writable, so the backup needs to be "pull", if the infected machine is the one doing backups and has write access to a non-cold-storage backup location it will may encrypt the backup itself.

Solved this problem at my startup Nuevo Cloud.. the filesystem is copy-on-write, including deletions.. In the settings you can control how long to keep the copy-on-write log, and then you can jump to any second within the log. So even if this virus encrypted your backup on Nuevo Cloud, you can just pull up the snapshot from a second before the infection, and restore your files.

I do something similar. I keep all my files on an external HD drive. Only thing on my pc are the programs I need.

My impending move to Tails OS is also timely considering this new virus. We just spent two days dealing with this after an exec launched one of these and encrypted a bunch of files on one of our servers. This, after two emails warning about it.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#144

Post by wentkenko »

People on here are talking about attachments and being smart enough not to fall for sham downloads, but this isn't how most of ransomeware is spread to its victims. They use exploit packs and 0 days. Visiting a website that's been hijacked with an Iframe or a proxy that embeds an Iframe or any other data to the HTML that is returned could get you infected. There is no full proof way around this unfortunately.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#145

Post by abstractConcept »

smtddr wrote: post #88
greglindahl wrote: post #57

Earlier quoted context omitted.

Lower risk, but it probably reduces income: how many people can figure out how to make a bitcoin payment? How long does it take to make a bitcoin payment? The harder it is, the more likely the target is to give up and do without.

I've never done it before myself, but this looks simple enough; like a paypal donation: http://shop.wikileaks.org/donate Now, how the malware-writer goes about verifying payment is beyond my understanding...

I would think their C&C server sets up a random Bitcoin wallet, and waits for a deposit, then allows the private key to be retrieved the next time CryptoLocker phones home.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#146

Post by marcosdumay »

antihero wrote: post #35

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. One trivial solution would be OS level au…

> the original files would be written to location that is read only to the user and only accessible via the OS

A versioning filesystem looks much cleaner than a different location. Maybe we should start using those again. (Is there any candidate for ext5 already?)

And yes, partitioning the data permissions for the same user is a much needed change. Nobody got a solution for that yet, and there are lots of people trying. Apple, for example, is just giving up on iOS; Google has a subpar solution on Android that does not actually work on practice (the cyanomod people did improved it a bit) but is the closest we have from something viable.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#147

Post by fekberg »

I've been trying to raise awareness in my social medias, since my family, friends and co-workers might not spend time on HackerNews.

If you want, copy my message and share with your family, friends and co-workers:

"Hi folks,

There's a new virus out there that I want to raise awareness of, it's called CryptoLocker. Basically what this virus does is that it tracks all your files - hard drives, flash drives, usb sticks, network drives/shares - then it encrypts the files it finds.

The only way to unlock the files again is to pay $300 to get the key used for the encryption. The encryption used is RSA with a 2048 bit key which makes it extremely hard to crack, I'd say impossible with the time span and todays computers.

You have 72 hours before they trash the key making it impossible for you to get your data back.

This can be extremely devastating if you are running a business and all your files are gone. If you sync your files to the cloud, you're still not safe, it syncs the encrypted files as well. If you are able to restore to previous versions of your files in the cloud - great.

Let your friends, family and co-workers know about this.

Here are some simple ways to avoid getting a virus in general:

1. Don't open e-mails from people you don't know

2. Don't open attachments in e-mails unless you were waiting for the attachment

3. Don't go to websites/click links that you don't fully trust

4. Don't download and execute files that you don't fully trust

It might seem obvious to the most of us to don't do the above, but to a lot of friends, family and co-workers it might not be.

Imagine waking up and having to pay $300 to get your data back. However, the police tracked down one of the servers that serves the keys and shut them down which means the keys were not delivered and the data was lost, this means even if you do pay the $300, there is no guarantee that you will get the data back.

Raise awareness of this and avoid having your files lost."

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#148

Post by Silhouette »

kevindication wrote: post #136
Silhouette wrote: post #124

Earlier quoted context omitted.

It probably is, but that doesn't make it any better as an idea. There is a good reason why every decent operating system's security model in the past few years has segmented this kind of functionality so only people with elevated privileges can do it.

This. I love Chrome, but their target market is using Windows, and asking them to click "Yes" to upgrade Chrome (or leaving this question up to the administrator) is not a barrier worth circumventing.

asking them to click "Yes" to upgrade Chrome

You don't even need to do that. You should need administrator access to install software initially, but that installation process can set up a system service that handles any subsequent updates automatically. This then runs independent of any current user on the system, and therefore does not depend on their personal privileges, nor does it need to prompt anyone for permissions for every update.

Clearly there is a risk involved with any process that can automatically download code you will subsequently execute. However, with proper access control, at least a compromised application running in user space can't do things like modifying its own executable so the malware has a place to live or, more generally, anything else that the user couldn't do without elevating their privilege level.

This certainly doesn't get us to an ideal security model. As I noted elsewhere in this discussion, a user on most systems today can probably still do things like e-mailing all the sensitive work documents they can access to a hostile party with just their normal privileges. However, it does at least prevent one common kind of attack.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#149

Post by jonhohle »

fekberg wrote: post #147

I've been trying to raise awareness in my social medias, since my family, friends and co-workers might not spend time on HackerNews. If you want, copy my message and share with your family, friends and co-workers: "Hi folks, There's a new virus out there that I want to raise awareness of, it's called CryptoLocker. Basically what this virus does is that it tracks all your files - hard drives, flash drives, usb sticks,…

5. Consider alternatives to Windows so you won't have to deal with these silly things that have largely only been affecting Windows users for the last decade+.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#150

Post by marcosdumay »

susi22 wrote: post #12

In a corporate environment I'd expect crucial data to be on the network drive and snapshotted every few hours. We run ZFS on our network and all the secretaries have to do their doc/excel work on the drive. Nowadays that everybody has a Gigabit Ethernet connection read/writes are extremely quick. Use ZFS and make read only snapshots that are only accessible to the sysadmins. You'll solve many problems that way. We do…

In about any corporation you look, crucial data will be in a Windows server (no ZFS available, sorry), and backed up on intervals that are some integer multiple of 24 hours.

Or, better, the above is the best case scenario that IT dreams of achieving some day. In practice, a huge share of the crucial data sits on people's machine, with no backups, and go on vacation every year.

Post reply on HN