Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

171–180 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#171

Post by DanBC »

swombat wrote: post #19
sillysaurus2 wrote: post #16

Earlier quoted context omitted.

I then turned on DKIM and enabled quarantining non DKIM emails via DMARC. Translation for techies who aren't familiar with email's many acronyms?

All those acronyms are easily googleable. Not being a techie does not mean you get to be lazy about looking things up.

The ten thousand readers of HN who don't know these acronyms can use a search engine to look them up, or someone can ask a question and someone else can answer it and save 9,998 other readers the bother.

1 Google search = 1/35 of a boiled kettle.

So asking the question just saved about 285 boiled kettles of carbon footprint.

(http://green.tmcnet.com/topics/green/articles/216400-google-...)

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#172

Post by GhotiFish »

sillysaurus2 wrote: post #18
mariuolo wrote: post #6

I'm sorry, but if a firm doesn't compartimentalise access and a single infected workstation can bring down everything, then they deserve what they get. Hadn't been ransomware it could have very well been a disgruntled employee, to the same effect.

I want to upvote you for truth, but HN currently has a meanness problem of which this comment is a specimen.

It's not truth, it hits residential users all the same. As much as we nerds might wish it, you don't deserve to be extorted because you don't understand computers.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#173

Post by temp1346 »

scott_karana wrote: post #135
renata wrote: post #117

Earlier quoted context omitted.

CrashPlan supports this, although it is not the default.

It's also not auditable: Tarsnap, while not OSS, has easily available source code for perusal and personal use, if I recall.

The crashplan JARs decompile pretty easily - I had a go a few months ago, and they weren't obfuscated.

Highlights:

The crypto is pretty bad - it's using blowfish in CBC mode with a static IV of 0c22384e5a57412b (convert each byte to decimal...).

The client-server protocol use 32 bit nonces and MACs, which is.

License key validation works by decrypting some packed data from the key after converting the alphabet back to hex. The key is blowfish-cbc encrypted data and the only validation done is verifying the padding - about 1 in 256 randomly generated ones will have valid padding, and the length is not checked.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#174

Post by shiftpgdn »

conductor wrote: post #36
blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

This type of viruses are nothing new [0]. The only new thing in this case is that it demands BitCoins instead of an SMS to a premium number or something else. [0] - https://www.securelist.com/en/descriptions/old313444

What makes this special is the fact it uses real encryption instead of just a password protected zip file.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#175

Post by hobs »

marcosdumay wrote: post #141
mcphilip wrote: post #30

Earlier quoted context omitted.

It actually made my skin crawl reading about it. Never had that reaction to such a story before. Interesting... Edit: It's the BTC aspect that's worrisome. Ransomeware is nothing new -- AIDS Information Trojan did it in 1989, but the (potentially) safe method of payments in crypto currency seem to be a new factor that will attract much more innovation in these type of attacks.

I just though the exact opposite. When I read "Ransomware comes of age with ... anonymous payments." I just thought "Somebody is going for a surprise once he finds out how anonymous Bitcoin really is". Anyway, what really makes me nervous is Microsoft's insistence of executing any data that a their programs touch.

I thought there were numerous laundering services?

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#176

Post by dsuth »

kuschku wrote: post #108
ggchappell wrote: post #98

I get annoyed when people are warned not to open some attachment. The real problem here is that in 2013 we're still using the flawed language of "opening attachments" -- as if running a native executable with full permissions is an action that belongs in the same category as viewing an image, reading a text file, or listening to music. Well, it doesn't. This is a problem that should have been solved at the level of O…

The best solution would be the one used by Linux: Separate Data and Software. On Linux there is a specific flag that has to be set and is not set per default to make a file executable. So if you run something, you know that you are running it as a program and not opening it as data. Windows on the other hand marks everything as executable which begins with MZ and whichs filename ends in .exe or .com

While that is useful, in Windows-land the result would only be another message box to click-through, asking if you wanted to make the file executable, which no average user would understand, and therefore just click OK. If they even took the time to read it before clicking through.

Better to sandbox any executables received from external sources.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#177

Post by mr_luc »

hobs wrote: post #175
marcosdumay wrote: post #141

Earlier quoted context omitted.

I just though the exact opposite. When I read "Ransomware comes of age with ... anonymous payments." I just thought "Somebody is going for a surprise once he finds out how anonymous Bitcoin really is". Anyway, what really makes me nervous is Microsoft's insistence of executing any data that a their programs touch.

I thought there were numerous laundering services?

Here's one:

https://blockchain.info/wallet/send-shared

(Please note, before downvoting, that I'm not saying that's a bad thing)

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#179

Post by Silhouette »

Pxtl wrote: post #168
Silhouette wrote: post #105

Earlier quoted context omitted.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? Yes, and from a security point of view it should be treated as hostile accordingly. There is no need to actively circumvent Windows security like this. Firefox, among many other examples, is quite capable of automatically updating itself using a proper Windows service mechanism. It's long past time that Google were called out on this one. Not o…

Installing into %AppData% is, iirc, Microsoft's intended approach with ClickOnce installers (which Chrome uses). The difference is that ClickOnce installers have a far more restrictive permissions model than old MSIs. ClickOnce-installed applications are limited to "Internet Zone" permissions. This can make them immensely frustrating to develop with, actually, since many of MS's own development frameworks fail misera…

Fascinating. Thanks for sharing this information. I had no idea this was actually a sanctioned installation option, but clearly it is if you know what to look for[1]. That's actually rather disturbing, from a security point of view...

[1] http://msdn.microsoft.com/en-us/library/142dbbz4%28v=vs.90%2...

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#180

Post by olliesaunders »

kuschku wrote: post #108
ggchappell wrote: post #98

I get annoyed when people are warned not to open some attachment. The real problem here is that in 2013 we're still using the flawed language of "opening attachments" -- as if running a native executable with full permissions is an action that belongs in the same category as viewing an image, reading a text file, or listening to music. Well, it doesn't. This is a problem that should have been solved at the level of O…

The best solution would be the one used by Linux: Separate Data and Software. On Linux there is a specific flag that has to be set and is not set per default to make a file executable. So if you run something, you know that you are running it as a program and not opening it as data. Windows on the other hand marks everything as executable which begins with MZ and whichs filename ends in .exe or .com

The absence of that executable flag does nothing to protect you from using an existing executable and some data such as an interpreter and source code.
Post reply on HN