101–110 of 111 posts
I'm surprised that no one has fingerprinted the patterns that these apps take to encrypt the files, then created an antivirus definition for them. Surely they can't be that polymorphic that no one can catch them?
Earlier quoted context omitted.
> To be able to encrypt the files, it has to store the private key (and obviously the public key) somewhere on the computer Why do you say that? The very purpose of public-key crypto is so that you can send only the public key, have the other end encrypt with that, while you hold onto the private key which is the only thing that can decrypt it. No guarantee this uses public key for the crypto though. From what I know…
My mistake. I said encrypt when I should have said decrypt. You are correct though, symmetric key encryption would be better for this, and utilizing the answer giving by kolinko below, I wouldn't be surprised if they did use a different key for each file.
The "decrypt one file for free" feature seems to be specific to CryptoWall which, some have reported, do not use symmetric encryption like CryptoLocker. CryptoLocker stores symmetric keys for each file on the infected machine, encrypt those with a public key and when the payment is received, send the private key from the C&C Server. I would say it's very unlikely CryptoWall would store remotely a private key per file. That could mean a lot of information to be transferred over the wire. Probably because of using only asymmetric (slow) encryption, CryptoWall apparently only encrypt small files completely, and only a piece of the larger ones. One way the "decrypt one file for free" feature might work is by actually uploading the file (or the the encrypted piece of file) to the C&C Server, decrypting it remotely and sending it back. But the feature is definitely worth investigating.
https://blog.fortinet.com/post/cryptowall-another-ransomware...
http://stopmalvertising.com/malware-reports/cryptowall-behin...
Earlier quoted context omitted.
CryptoWall apparently delete shadow copies with a simple vssadmin command. http://stopmalvertising.com/malware-reports/cryptowall-behin...
Good to know; I've only dealt with a couple and they were on workstations that encrypted files on mapped network shares - vssadmin wouldn't have any access to remove shadow copies on the file server, and in all but one of those cases we had both shadow copies locally on the file server and offsite file backups in place (backups only for the last).
Earlier quoted context omitted.
I bet you don't know how the power circuit in your fridge works and still you expect it not to burn down your kitchen while you sleep.
Not quite. A better analogy here is this: there is a supplier of fridges that is notorious for unreliable power circuits. People know this, and buy those fridges anyway, hoping that it won't happen to them, because the fridges are popular and have a particular copyrighted layout of the door and shelves so that they don't have to learn anything new when visiting friends or moving to different house. Initially, the fir…
Earlier quoted context omitted.
Here is a good interview question: Design a simple system that uses amazon as backend to store encrypted data and the keys never leave your control. There were 4TB drives at 100-sh bucks for big things. The problem is not Cryptolocker because there will ALWAYS be malware that targets the data itself. And some people will do it just for fun.
I think Duplicity ( http://duplicity.nongnu.org ) is what you're looking for. For Ubuntu I know there's a nice GUI that anyone who can use a computer can set up. For other platforms I think cli is the only way, but someone could just write a QT/Cocoa wrapper around it.
I use Duply to schedule incremental backups of my server logs to S3 (write only) and then have S3 expire them after 60 days. Works great.
Earlier quoted context omitted.
Agreed – I'm not cheerful about the implications of making things less user-serviceable but … it's not like we don't know how well that's worked out. If you haven't already read it, SwiftOnSecurity's “A story about Jessica” is rather good for illustrating how badly we've failed as an industry to produce devices which are safe for non-experts to use: http://swiftonsecurity.tumblr.com/post/98675308034/a-story-a...
Thats a cool article. On the other hand, WTF is up with that blog?!?
Earlier quoted context omitted.
Agreed – I'm not cheerful about the implications of making things less user-serviceable but … it's not like we don't know how well that's worked out. If you haven't already read it, SwiftOnSecurity's “A story about Jessica” is rather good for illustrating how badly we've failed as an industry to produce devices which are safe for non-experts to use: http://swiftonsecurity.tumblr.com/post/98675308034/a-story-a...
Thats a cool article. On the other hand, WTF is up with that blog?!?
Earlier quoted context omitted.
What exactly is a phone room and how will it help stop ransomware?
A phone room or boiler room operation will not stop ransomware - in fact quite often it's another sort of scam in itself. Here's a short article explaining the process and the Verge covered the subject in length: http://ipensatori.com/2014/05/27/tech-support-scams-what-lie... http://www.theverge.com/2012/5/10/2984893/scamworld-get-rich...
Earlier quoted context omitted.
Good to know; I've only dealt with a couple and they were on workstations that encrypted files on mapped network shares - vssadmin wouldn't have any access to remove shadow copies on the file server, and in all but one of those cases we had both shadow copies locally on the file server and offsite file backups in place (backups only for the last).
Yes, I meant try to delete... My first impression about CryptoWall is that it was hacked together quicker than CryptoLocker. It doesn't bother with generating a symmetric key per file but rather seems to use a single asymmetric key. It also apparently make a copy of the file before encrypting and doesn't zero-out after deleting the plain text file (see another of my comment in this thread)
Sorry, but no, fuck off please. US extraditing people from other countries is an abhorrent practice which should not be happening, ever. Imagine if you got an extradition request from Saudi Arabia, because you broke some of their laws on the Internet. Every single country in the world would tell them to sod off. Yet when US does this it's somehow ok? Absolutely not.