I imagine that this combined with virus capabilities (so it can spread itself via network) would be an overkill. Strange that they didn't do it, once you have an access to the local network (as soon as the initial victim runs .exe received by email) it shouldn't be too hard.
You’re infected—if you want to see your data again, pay us $300 in Bitcoins
221–230 of 295 posts
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#222Earlier quoted context omitted.
All those acronyms are easily googleable. Not being a techie does not mean you get to be lazy about looking things up.
The ten thousand readers of HN who don't know these acronyms can use a search engine to look them up, or someone can ask a question and someone else can answer it and save 9,998 other readers the bother. 1 Google search = 1/35 of a boiled kettle. So asking the question just saved about 285 boiled kettles of carbon footprint. ( http://green.tmcnet.com/topics/green/articles/216400-google-... )
And having a flamewar on how people should google things for themselves wasted how many kettles? Anyway, if you don't want to tell people things, then don't tell people things, but going on and on on how OP should just google things themselves, is reaching 4chan levels of elitism. It's a really shitty kind of elitism.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#223Wouldn't it be possible to attach a debugger to a running instance of the virus and extract the key while encryption is taking place?
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#224I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes. Pull-only backups were the savior here, although because we didn't notice until the next day, the…
"JPEGs were altered but still viewable".
Could be a problem with their encryption. Care to share a before and after JPEG of something? For science?
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#225I get annoyed when people are warned not to open some attachment. The real problem here is that in 2013 we're still using the flawed language of "opening attachments" -- as if running a native executable with full permissions is an action that belongs in the same category as viewing an image, reading a text file, or listening to music. Well, it doesn't. This is a problem that should have been solved at the level of O…
The best solution would be the one used by Linux: Separate Data and Software. On Linux there is a specific flag that has to be set and is not set per default to make a file executable. So if you run something, you know that you are running it as a program and not opening it as data. Windows on the other hand marks everything as executable which begins with MZ and whichs filename ends in .exe or .com
> On Linux there is a specific flag that has to be set and is not set per default to make a file executable.
Windows does too. It's called FILE_EXECUTE permission.
It just happens to grant them to everything by default, but the problem isn't the lack of the feature.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#226While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers. Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?
I really like SpiderOak https://spideroak.com
I have mine set to backup every 4 hours. It versions the files as well so you can restore to a previous backup.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#227Earlier quoted context omitted.
Malware developer can make 256 valid developer IDs, compute 256 signatures and switch them automatically and randomly during the propagation of malware. Once Apple blacklists one developer ID, another one pops out, and so malware continues to propagate.
That would cost $25,600 and require 256 valid Social Security or DUNS numbers.
Alternatively, it would require compromising the machines of 256 Apple developers. Guess what kind of person is likely to be capable of doing that.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#228Earlier quoted context omitted.
but this one seems to do what it claims to do. it's pretty scary for people who don't have decent backup system. but these same people live with the risk of losing their data due to a drive failure, so...
A lot of "decent backup systems" would be vulnerable to this too. Say you back up all your local stuff to a RAID that you've mapped as a drive, as well as a mapped Google Drive? It's still all toast. That level of backup would handle any kind of physical failure - a dead drive, the destruction of your house, the failure of Google... but still, this thing would kill it. There's only so much you can expect from a perso…
Firstly RAID is not a backup.
This type of thing only works because the backup user has identical permissions to the backup contents as the user being backed up (because they're the same).
It wouldn't work on any system where the backup user is a separate, privileged process that is the only one with write access to the stores of backed up files.
ZFS with a snapshot script is a good way to implement this for a networked drive on Samba, since it's implicit, automatic, and the point at which it hits would be really really obvious since your snapshot sizes would suddenly explode. The same story is true of volume shadow copy (but MS idiotically limits the user's ability to set a known and trustworthy shadow copy schedule).
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#229Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#230I'm sorry, but if a firm doesn't compartimentalise access and a single infected workstation can bring down everything, then they deserve what they get. Hadn't been ransomware it could have very well been a disgruntled employee, to the same effect.
Have you fully secured your home and office against arson attacks? No? Don't even know how to do so? Didn't think so. Does that mean you deserve what you get if you end up bankrupt in the event of such an attack?