Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

211–220 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#211

Post by jve »

jafaku wrote: post #75
antihero wrote: post #35

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. One trivial solution would be OS level au…

This opened my eyes, thanks. I'll see how to set up backups that I can create but not delete.

BackupPC[1] does this by using pull technique to backup your data.

[1]: http://backuppc.sourceforge.net/

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#212

Post by pjmlp »

venomsnake wrote: post #186
Pxtl wrote: post #169

Earlier quoted context omitted.

Yes, but UAC has the same weakness as Linux permissions - it only protects the OS and programs, not the user-data. Programs can screw with userland data all they like without user permission.

Yeah but ... in Linux at least you have to set +x yourself on the downloads. Which is basic sanity check. In windows there are too many ways to get elevated. And only one level of elevation.

Normal users just set them without thinking twice about it.

Do you know one of the most asked questions in Mac OS X user forums from new users is how to disable root?

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#213

Post by pjmlp »

m_myers wrote: post #132
fekberg wrote: post #106

Earlier quoted context omitted.

Here's a command you can run to find out what executables exist in AppData: dir /S /P "%userprofile%\AppData\*.exe" > %userprofile%\Desktop\FoundFiles.txt

Or for PowerShell: dir -Path "$env:userprofile\AppData" -Filter *.exe -Recurse > "$env:userprofile\Desktop\FoundFiles.txt" Useful if your corporate security policy, like mine, has disabled the command prompt but left PowerShell intact.

It still wonders me the amount of IT folks unaware of Powershell.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#214

Post by teddyh »

pavel_lishin wrote: post #50
smtddr wrote: post #29

Earlier quoted context omitted.

yup. But the fact they're using bitcoin shows a clever way for ransomware to collect payment with virtually zero-risk; since it's not possible(that I know of) to really trace exactly who, in real life, got those bitcoins. Which means, ransomware might make a strong comeback since the risk is now basically zero, this program isn't that difficult to write and there's real money to be made. Even if you only charged 50 U…

> Educating users to stop running random programs in zip files attached to emails, is apparently impossible. Imagine something just like the malware we're discussing, but instead of a 72 hour timer, it's a 4 hour timer - and at the end, it pops up a "gotcha! just kidding. but if this were real malware, you would have either lost hundreds of dollars, or all your documents. Don't open attachments like me."

That wouldn’t work. People subjected to this would:

1. Immediately kill the messenger, and

2. Continue to open executable mail attachments, because nothing bad has ever happened that didn’t work itself out in the end.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#215

Post by pgeorgi »

venomsnake wrote: post #186
Pxtl wrote: post #169

Earlier quoted context omitted.

Yes, but UAC has the same weakness as Linux permissions - it only protects the OS and programs, not the user-data. Programs can screw with userland data all they like without user permission.

Yeah but ... in Linux at least you have to set +x yourself on the downloads. Which is basic sanity check. In windows there are too many ways to get elevated. And only one level of elevation.

not as if users care about watching out before setting +x.

After all, there are tons of popular projects requesting users to run "curl http://... | sudo sh" and consider that a good idea, too.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#216

Post by kbart »

marcosdumay wrote: post #151
haberman wrote: post #79

You could imagine the Bitcoin community deciding to blacklist any wallets to which funds like this were demanded and disbursed. That seems like a great idea until you then realize that this would be a way of denying anyone access to their own funds, by specifying their wallet as the recipient even though the attacker doesn't control it. There really doesn't seem to be any good countermeasure to this.

Or the police could just investigate the wallet, because it there is a feature that Bitcoin does not have, it's anonymity.

Which police? The guys behind this virus may as well be somewhere deep in China or Russia, good luck reaching them. It's not a terrorism or child pornography to get serious international attention.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#217

Post by antihero »

rgbrenner wrote: post #73
masklinn wrote: post #61

Earlier quoted context omitted.

> Backups are, obviously, a much better solution but require extra storage and usually cost money. And the virus will encrypt anything writable, so the backup needs to be "pull", if the infected machine is the one doing backups and has write access to a non-cold-storage backup location it will may encrypt the backup itself.

Solved this problem at my startup Nuevo Cloud.. the filesystem is copy-on-write, including deletions.. In the settings you can control how long to keep the copy-on-write log, and then you can jump to any second within the log. So even if this virus encrypted your backup on Nuevo Cloud, you can just pull up the snapshot from a second before the infection, and restore your files.

Yup, this is basically what I was thinking - the daemon would run as a system user (e.g. root or something that could access user files) would "commit" the changes on write, pulling from the user's files, creating a read-only copy.

Obviously there are of course issues running stuff like this as root - if the daemon was compromised in any way it's game over.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#218

Post by antihero »

marcosdumay wrote: post #146
antihero wrote: post #35

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. One trivial solution would be OS level au…

> the original files would be written to location that is read only to the user and only accessible via the OS A versioning filesystem looks much cleaner than a different location. Maybe we should start using those again. (Is there any candidate for ext5 already?) And yes, partitioning the data permissions for the same user is a much needed change. Nobody got a solution for that yet, and there are lots of people tryi…

Yep, if this could exist at file-system level it would be wonderful. What candidates actually exist for this and are in a usable state? BTRFS? ZFS?

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#219

Post by hnha »

fekberg wrote: post #147

I've been trying to raise awareness in my social medias, since my family, friends and co-workers might not spend time on HackerNews. If you want, copy my message and share with your family, friends and co-workers: "Hi folks, There's a new virus out there that I want to raise awareness of, it's called CryptoLocker. Basically what this virus does is that it tracks all your files - hard drives, flash drives, usb sticks,…

0. Have a working and secure backup strategy.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#220

Post by Volpe »

keeperofdakeys wrote: post #142
Volpe wrote: post #134

Earlier quoted context omitted.

And that good reason is? EDIT: If I want to run/update something (Chrome) in Userland, why should an OS security model stop me? My guess is, Microsoft have successfully confused a common business requirement with a security one.

No, it's a required security feature that goes back decades in some operating systems. You need to be able to trust the code that runs on your system, and to do that you want to ensure only admin can install things. Of course, Windows has now partially solved that with UAC. Unfortunately you can never know if you can trust the software or not though. However this does stop malware from secretly running without your p…

An interactive shell (like bash/python/irb) is untrusted code (i.e the user can type whatever the hell they like). But I don't/shouldn't need root to run it.
Post reply on HN