You’re infected—if you want to see your data again, pay us $300 in Bitcoins • Hacker News Board

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#161

Post by jussij » Fri, Oct 18, 2013, 1:01 AM UTC

socillion wrote: post #152

jussij wrote: post #95

Earlier quoted context omitted.

Google Chrome Updater certainly does have a few virus like characteristics. Every time my interent connection slows (WiFi) I know it's Chrome Updater so I kill it via Task Manager and everthing is good again. There doesn't apear to be away to turn it off inside Chrome itself and turning off updates via the registry does not seem to stop it.

You can try disabling (not deleting) the startup task. Start > Run > msconfig > Startup > Disable GoogleUpdater.exe Or try Firefox!

Thanks. I give that a shot.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#162

Post by code_duck » Fri, Oct 18, 2013, 1:09 AM UTC

fekberg wrote: post #158

jonhohle wrote: post #149

Earlier quoted context omitted.

5. Consider alternatives to Windows so you won't have to deal with these silly things that have largely only been affecting Windows users for the last decade+.

Sure, I'll ask my 70+ year old relatives that have been using PC with Windows since they first got their computer to download an Ubuntu ISO, burn that and re-install their system. Joking aside. I'd love for everyone to just jump on a virus free OS, but as soon as that OS is mainstream there will be viruses. The problem isn't the OS, the problem is that people trust everything that is for instance sent to them via e-m…

You should, actually. Ubuntu has an it efface 90% close enough to windows these days, and back in 2010 I did exactly what you say - got my mother to start using Linux instead. It's filled her needs perfectly and my support calls have dwindled to near-nothing.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#163

Post by victorf » Fri, Oct 18, 2013, 1:15 AM UTC

tedunangst wrote: post #58

slaven wrote: post #51

Earlier quoted context omitted.

I think it's no longer accurate to think of this as "MS-focused attack but only because OS X is not as popular". Today, iOS is used by many more people than OS X as their primary computing device and I would say it's pretty safe from this type of attack.

Only because people can't email you apps to run on your phone. Which, last I checked, is why HN thinks iOS is a terrible, freedom restricting walled garden of evil.

iOS is fantastic if you aren't smart enough to use a computer. Most HN users know better than to run arbitrary apps from email, so for them it is a restriction that only prevents them from using their own device as they wish to use it.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#164

Post by ary » Fri, Oct 18, 2013, 1:31 AM UTC

bcoates wrote: post #140

blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

Don't do that, that's crazy. If you don't want your users running random binaries turn on applocker: http://technet.microsoft.com/en-us/library/dd723683(v=ws.10)... If the "1002.exe" sample on Reddit is accurate the installer is unsigned, so forbidding unsigned binaries should be sufficient. The number of legitimate unsigned Windows binaries is small enough that you should be able to whitelist them by hand.

AppLocker can't be enforced on Windows 7 Professional (or lower). In my case that was a deal breaker.

http://technet.microsoft.com/en-us/library/ee424382.aspx

That being said a very restrictive Software Restriction Policy as linked below would mitigate CryptoLocker as it exists today. It has worked well for me so far.

http://www.mechbgon.com/srp/

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#165

Post by mbreese » Fri, Oct 18, 2013, 1:40 AM UTC

keeperofdakeys wrote: post #142

Volpe wrote: post #134

Earlier quoted context omitted.

And that good reason is? EDIT: If I want to run/update something (Chrome) in Userland, why should an OS security model stop me? My guess is, Microsoft have successfully confused a common business requirement with a security one.

No, it's a required security feature that goes back decades in some operating systems. You need to be able to trust the code that runs on your system, and to do that you want to ensure only admin can install things. Of course, Windows has now partially solved that with UAC. Unfortunately you can never know if you can trust the software or not though. However this does stop malware from secretly running without your p…

Or you could just not trust the code to begin with. The user should be able to run any program they want to. The OS just shouldn't trust the users programs. (And shouldn't autorun programs that the user didn't request).

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#166

Post by mbreese » Fri, Oct 18, 2013, 1:41 AM UTC

WiseWeasel wrote: post #160

samstave wrote: post #112

Earlier quoted context omitted.

> Google Chrome Updater certainly does have a few virus like characteristics. You could say it's in its DNA

Wouldn't it have to be in its RNA? /ducks

There are both DNA and RNA viruses.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#167

Post by Pxtl » Fri, Oct 18, 2013, 1:43 AM UTC

mrtksn wrote: post #70

Pxtl wrote: post #56

Well that's moderately horrifying. I've dealt with ransomware before, but mostly it just used scary messages, not literally encrypting all your data.

but this one seems to do what it claims to do. it's pretty scary for people who don't have decent backup system. but these same people live with the risk of losing their data due to a drive failure, so...

A lot of "decent backup systems" would be vulnerable to this too. Say you back up all your local stuff to a RAID that you've mapped as a drive, as well as a mapped Google Drive?

It's still all toast.

That level of backup would handle any kind of physical failure - a dead drive, the destruction of your house, the failure of Google... but still, this thing would kill it.

There's only so much you can expect from a person when it comes to keeping their personal documents and family photos.

I mean obviously, if you're running a company you need a real backup solution, but for family files or a one-man-show business? There is no reasonable precaution.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#168

Post by Pxtl » Fri, Oct 18, 2013, 1:48 AM UTC

Silhouette wrote: post #105

crb wrote: post #53

Earlier quoted context omitted.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? Yes, and from a security point of view it should be treated as hostile accordingly. There is no need to actively circumvent Windows security like this. Firefox, among many other examples, is quite capable of automatically updating itself using a proper Windows service mechanism. It's long past time that Google were called out on this one. Not o…

Installing into %AppData% is, iirc, Microsoft's intended approach with ClickOnce installers (which Chrome uses). The difference is that ClickOnce installers have a far more restrictive permissions model than old MSIs.

ClickOnce-installed applications are limited to "Internet Zone" permissions. This can make them immensely frustrating to develop with, actually, since many of MS's own development frameworks fail miserably in Internet Zone even when they have no reason to do so (mostly they generate temporary files in places they aren't allowed).

I'm not sure how Google Chrome gets permissions to save files into your documents and whatnot from there - I don't recall Chrome requesting a permissions escalation during install or anything.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#169

Post by Pxtl » Fri, Oct 18, 2013, 1:49 AM UTC

keeperofdakeys wrote: post #142

Volpe wrote: post #134

Earlier quoted context omitted.

And that good reason is? EDIT: If I want to run/update something (Chrome) in Userland, why should an OS security model stop me? My guess is, Microsoft have successfully confused a common business requirement with a security one.

No, it's a required security feature that goes back decades in some operating systems. You need to be able to trust the code that runs on your system, and to do that you want to ensure only admin can install things. Of course, Windows has now partially solved that with UAC. Unfortunately you can never know if you can trust the software or not though. However this does stop malware from secretly running without your p…

Yes, but UAC has the same weakness as Linux permissions - it only protects the OS and programs, not the user-data. Programs can screw with userland data all they like without user permission.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#170

Post by AnIrishDuck » Fri, Oct 18, 2013, 1:51 AM UTC

Silhouette wrote: post #110

antihero wrote: post #35

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. One trivial solution would be OS level au…

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. You make an excellent point, but there is…

> This requires a very different model of access control and user/application privileges, and unfortunately I don't think any mainstream OS is even close to solving this one yet.

I'm not sure it does require a different model of access control. It just requires people to actually use the access control mechanisms that exist already.

You should not access banking details or any other sensitive information in the same user-level context as you use to generally browse the internet. The privileges needed for each task ("browse the internet" vs. "check bank statements") should be different. I personally have a separate user account on my machine set up specifically for "sensitive" tasks.

Separation of data access via privileges is nothing revolutionary, nor is it something that can't be done on any modern OS. Unfortunately, online services are still behind. For example, I would probably switch to an online banking provider that let me create one account for viewing balances and another for transferring cash. But these services will get there in time.

User education is a different story.