I have a question regarding this, does anyone know what happens if your data is already encrypted ?
will it encrypt the encrypted files?
You’re infected—if you want to see your data again, pay us $300 in Bitcoins
271–280 of 295 posts
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#272I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes. Pull-only backups were the savior here, although because we didn't notice until the next day, the…
I really don't think we should try to dumb down UX for the benefit of less experienced users. You run the risk of creating a false understanding of how a computer works which can cause harm down the line, as well as frustrating and confusing more advanced users who do know what happens when you save a word document. Besides, as the user population ages it's becoming less of a problem.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#273I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes. Pull-only backups were the savior here, although because we didn't notice until the next day, the…
So you had 2TB of crucial business files and only had a single backup point? No remote / online backup? Scary.
I mentioned cold backups -- those just would've been a little older.
The pull-only archive w/ VSS versions really is massively convenient. It is the first line of defense against the scenario that comes up almost all of the time: "Help, I messed up this important file!"
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#274I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes. Pull-only backups were the savior here, although because we didn't notice until the next day, the…
"JPEGs were altered but still viewable". Could be a problem with their encryption. Care to share a before and after JPEG of something? For science?
For science, I will try to find one that is acceptable to share and post a before/after, or just the results of the comparison.
What I recall from my initial investigation was that the binary was completely different, but opening the image did not indicate any changes. Almost like it was converted from RGB to CMYK or something.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#275I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes. Pull-only backups were the savior here, although because we didn't notice until the next day, the…
I really don't think we should try to dumb down UX for the benefit of less experienced users. You run the risk of creating a false understanding of how a computer works which can cause harm down the line, as well as frustrating and confusing more advanced users who do know what happens when you save a word document. Besides, as the user population ages it's becoming less of a problem.
> Besides, as the user population ages it's becoming less of a problem.
I want to believe. I really do. But I'm not so sure based on personal experience.
This article made the rounds recently, and I think it is apt: http://www.coding2learn.org/blog/2013/07/29/kids-cant-use-co...
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#276For hacker having both an original file and the encrypted version that file should be relatively easy to retrieve the key? Especially if the virus XOR all or a part of the file. Otherwise a hacker may look at the random function that generate the key in the source code of the virus it may be weak and take values from the computer and time of infection.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#277I have a question regarding this, does anyone know what happens if your data is already encrypted ? will it encrypt the encrypted files?
Yes.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#278Earlier quoted context omitted.
Your proposal is OK if accessing sensitive information is something you only do occasionally, but it's not very practical to switch users completely if you deal with sensitive information often, which many people do. On the other hand, if only explicitly authorised applications can create outbound Internet connections at all, and if applications like browsers and e-mail clients need explicit permission to read a gene…
>Your proposal is OK if accessing sensitive information is something you only do occasionally, but it's not very practical to switch users completely if you deal with sensitive information often, which many people do. $ sudo -u banking gnucash & $ firefox & Done. My banking files and my Firefox session are now separated.
Interestingly, you may have just fucked yourself, because the sudo session is maintained whilst launching Firefox.
If we create a script 1:
#!/bin/sh
echo "I'm doing something secure"
#!/bin/sh
echo "I'm doing something insecure".
sudo echo "I'm doing something malicious".
$ sudo ./script1.sh; ./script2.sh
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#279I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes. Pull-only backups were the savior here, although because we didn't notice until the next day, the…
Something like CrashPlan provides good protection against this sort of thing for home users. It includes versioned, off-site backups -- either on their servers for around $6 a month, or on a "friend's computer" for free. Either way, the backups are saved via crashplan, not with direct drive access, so it should be safe against this kind of thing. No affiliation, just a user.
Crashplan restores are also relatively easy, with a few nice options.
Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins
#280When I first saw the title, I thought it went like this: 1. Your machine is infected, and it encrypts everything it can. 2. The 72 hour countdown begins, and during that time your machine has been re-purposed to crunch BitCoins. 3. All you have to do is wait 72 hours, and everything will un-encrypt and uninstall, leaving you perfectly fine. Creators profit by having millions of machines crunching BitCoins in their na…
These machines were probably already crunching BitCoins for years but now that's not profitable ...
Even if you had millions of infected machines crunching on your behalf it wouldn't be profitable?