Earlier quoted context omitted.
Wouldn't it have to be in its RNA? /ducks
There are both DNA and RNA viruses.
And retroviruses- an RNA virus that reverse transcribes itself into a DNA provirus: http://en.wikipedia.org/wiki/Reverse_transcribing_virus
You’re infected—if you want to see your data again, pay us $300 in Bitcoins
181–190 of 295 posts
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#182I get annoyed when people are warned not to open some attachment. The real problem here is that in 2013 we're still using the flawed language of "opening attachments" -- as if running a native executable with full permissions is an action that belongs in the same category as viewing an image, reading a text file, or listening to music. Well, it doesn't. This is a problem that should have been solved at the level of O…
We only use that language because it's an order of magnitude easier to explain to novice computer users, and because as you stated, the problem still hasn't been fixed at the OS permissions / UI level.
A modern OS lets us do that because lots of users are the sole user of their PC and do not understand the idea of permissions.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#183Earlier quoted context omitted.
I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. You make an excellent point, but there is…
> This requires a very different model of access control and user/application privileges, and unfortunately I don't think any mainstream OS is even close to solving this one yet. I'm not sure it does require a different model of access control. It just requires people to actually use the access control mechanisms that exist already. You should not access banking details or any other sensitive information in the same…
Your proposal is OK if accessing sensitive information is something you only do occasionally, but it's not very practical to switch users completely if you deal with sensitive information often, which many people do.
On the other hand, if only explicitly authorised applications can create outbound Internet connections at all, and if applications like browsers and e-mail clients need explicit permission to read a general user file (as opposed to, say, accessing their own designated configuration or data files), then you significantly decrease the degree of vulnerability a user has to data leakage attacks (among other types).
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#184Finally viruses are doing what they're supposed to - wreck your computer instead of staying under the radar as long as possible. If people are motivated to protect themselves from this they'll also be preventing botnets and doing good to the rest of the internet.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#185Earlier quoted context omitted.
OS X defaults to only running applications that have been signed with a valid developer ID. It’s not difficult to get such an ID, but Apple can also blacklist them, which would prevent the malware from running once Apple notices it. So I think the Mac has a good defense against this kind of attack.
Malware developer can make 256 valid developer IDs, compute 256 signatures and switch them automatically and randomly during the propagation of malware. Once Apple blacklists one developer ID, another one pops out, and so malware continues to propagate.
That would cost $25,600 and require 256 valid Social Security or DUNS numbers.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#186Earlier quoted context omitted.
No, it's a required security feature that goes back decades in some operating systems. You need to be able to trust the code that runs on your system, and to do that you want to ensure only admin can install things. Of course, Windows has now partially solved that with UAC. Unfortunately you can never know if you can trust the software or not though. However this does stop malware from secretly running without your p…
Yes, but UAC has the same weakness as Linux permissions - it only protects the OS and programs, not the user-data. Programs can screw with userland data all they like without user permission.
Yeah but ... in Linux at least you have to set +x yourself on the downloads. Which is basic sanity check.
In windows there are too many ways to get elevated. And only one level of elevation.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#187I got a similar virus once but it was before bitcoin was popular. It just asked for money via credit card. The virus hid my files, and I needed them for work too.
Fortunately the virus did that by some filesystem driver level hack, because after I booted into Linux I was able to mount the partition and get my files back.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#188We got hit with this last week at work. It was finally picked up by AV about 4 hours after it first got through the mail filter, but by that time we'd already had 5 users open the attachment.
It's not a major problem if you have a good backup policy for both workstations and servers, but if not, it's one of the worst viruses I've ever seen.
I've heard that some people have had luck paying the ransom, recovering the files and then doing a credit card charge-back, but luckily we had everything backed up so didn't need to resort to such measures.
Just as an experiment, I tried decrypting some of the files using the Panda Security decryption tool being linked from various fora, but it seems to do nothing at all, and honestly I don't see how it could do anything without resorting to brute force.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#189or dont use windows...
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#190I know a customer that got hit by this Tuesday morning. Unsurprisingly, Avast did nothing. I just told her the bad news and clean-installed Windows. I have tried to find the private key with sample files, using known file byte headers, the public key and brute force on the private key. Sadly, no luck yet.
That's assuming the private key is even reused. If they're generating a new key for each user (which they very well could be), you're boned.