Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How My Mom Got Hacked

nytimes.com

Post reply on HN
Print view View original

51–60 of 111 posts

Re: How My Mom Got Hacked

#51

Post by phaus »

gringe wrote: post #28
joosters wrote: post #24

Earlier quoted context omitted.

I don't see any complications or deep thinking required before pointing fingers. It's the criminals who are to blame. No amount of educating end users will magically fix these kind of attacks, whether or not people write articles about their ransom payments.

I beg to disagree. If you effectively made everyone realize that not paying utterly destroys the extortionist's business model, that does "magically fix these kinds of attacks" overnight. Not that I'm saying educating people about this is practical or even possible. One thing that I think is destructive though is "blaming the criminals", since a) we don't even know who they are, b) their business model depends entire…

I'll have to find the article later, but I read somewhere that about 1.7% of victims actually ended up paying money to the original cryptolocker guys, yet this seems to be enough to keep them in business. For your plan to work, you would need pretty much 100% compliance, which simply isn't going to happen.

Re: How My Mom Got Hacked

#52

Post by phaus »

ExpiredLink wrote: post #20

> “Whoever these yahoos are, they have some little shred of humanity.” Not really. Their "business model" is extremely restricted. 99.99 of their victims cannot handle the Bitcoin thingy.

>Their "business model" is extremely restricted. 99.99 of their victims cannot handle the Bitcoin thingy.

Its actually pretty interesting how this developed. Some of guys running variants of cryptolocker realized how much money they were missing out on and established customer support channels to help their victims figure out how to pay.

Re: How My Mom Got Hacked

#53

Post by alexggordon »

Has anyone ever done a serious technological evaluation of one of these programs? I'd be very interesting in learning more specifically about its encryption mechanism. For example, To be able to decrypt (edit: used to say encrypt) the files, it has to store the private key (and obviously the public key) somewhere on the computer, whether in memory or elsewhere to decrypt the files. In addition to this, if this is a variant like mentioned in the article, where you can "decrypt one file for free", then the software obviously has to access both keys to decrypt that, meaning with the right tools you should be able to capture those keys if you can capture the program in the action of decrypting a file.

While an obviously viable solution to this is good backups and educating people about computer security, that won't put these people out of business, which is what would really stop this.

Either way though, if anyone here knows of any material delving into hacking ransomware like this let me know, I'd love to read about it.

Re: How My Mom Got Hacked

#55

Post by pmontra »

JCole wrote: post #12
Sir_Substance wrote: post #11

Earlier quoted context omitted.

I would genuinely rather lose all my critical data to cryptolocker than put it in the cloud. Given a choice between my data being accessible by no-one or everyone, I will pick no-one every time. Data in the cloud /is/ available to everyone that matters. I'd also like to remind you that it can be impractical to back up some forms of data, especially in the cloud. High definition video (weddings, funerals, holidays) is…

You don't need to backup to the cloud, have people forgotten about physical hard drives?

I do have a physical hard disk for my backups but I also backup some critical data "on the cloud" (actually, some servers of mine). There is always a chance that the pc and the disk are stolen by a burglar or my house catches fire. Then there is the matter of making the encryption and access keys survive any of those events.

Re: How My Mom Got Hacked

#56

Post by mjklin »

arethuza wrote: post #10

My wife's father died about a month ago - two days after he died his widow got a call from some bunch of scoundrels saying "we need to fix your late husband's PC so you can get at his tax records".... Fortunately, he never had a PC (he was in his mid 80s) so it was obviously a scam but we were all appalled at the cheek of such an approach and the for the fact that a lot of people, particularly the elderly in a moment…

This is an update of another scam, wherein scam artists prowl the obituaries and send "brown package material" with embarrassing contents to the surviving family member, claiming the deceased had ordered it.

Their hope is that the surviving member will pay up to avoid embarrassment. Yeah, you have to be a sicko to think this stuff up.

Re: How My Mom Got Hacked

#57

Post by kolinko »

alexggordon wrote: post #53

Has anyone ever done a serious technological evaluation of one of these programs? I'd be very interesting in learning more specifically about its encryption mechanism. For example, To be able to decrypt (edit: used to say encrypt) the files, it has to store the private key (and obviously the public key) somewhere on the computer, whether in memory or elsewhere to decrypt the files. In addition to this, if this is a v…

It doesn't have to know the private key, just the public one, woth the private being on the virus-owner's side.

Furthermore, it's possible to encrypt each file with a different key so one public key would only deceypt one file.

Oh, and a fun fact - with the newest cryptography algorithms it's even possible to modify the files without knowing what they contain. If I'm not mistaken it would even be possoble to create a software that can conpute checksums of files without knowing the file contents.

Re: How My Mom Got Hacked

#58

Post by peeters »

alexggordon wrote: post #53

Has anyone ever done a serious technological evaluation of one of these programs? I'd be very interesting in learning more specifically about its encryption mechanism. For example, To be able to decrypt (edit: used to say encrypt) the files, it has to store the private key (and obviously the public key) somewhere on the computer, whether in memory or elsewhere to decrypt the files. In addition to this, if this is a v…

> To be able to encrypt the files, it has to store the private key (and obviously the public key) somewhere on the computer

Why do you say that? The very purpose of public-key crypto is so that you can send only the public key, have the other end encrypt with that, while you hold onto the private key which is the only thing that can decrypt it.

No guarantee this uses public key for the crypto though. From what I know, a symmetric key is more suitable to encrypting huge amounts of data. Could be wrong about that though.

Re: How My Mom Got Hacked

#59

Post by doah78 »

I work for a school district in the US and we see this occasionally. We just wipe the computer and restore files to the Users network drive from backup.

I personally think getting into a good backup regimen is a better use for the money than paying some scumbags.

Re: How My Mom Got Hacked

#60

Post by peeters »

ColinWright wrote: post #13

So the title is "How My Mom Got Hacked" and the only thing it actually says about that actual title is: The virus is thought to infiltrate your computer when you click on a legitimate-looking attachment or through existing malware lurking on your hard drive, ... So, there's really nothing about how his mom got hacked. Don't get me wrong, it's an interesting article, interesting to read about the process that ensues o…

It's a common title structure; I don't see anything clickbaity about it. It should be interpreted as "the story of my mom getting hacked".

Think "How I Met Your Mother", which has little to do with the mechanics of Ted meeting his future wife, but rather the story surrounding it.

Post reply on HN