Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

111–120 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#111

Post by Karunamon »

alec wrote: post #71

Since the Bitcoin blockchain is public, couldn't you follow the money? Make a list of all wallets that accepted these funds initially, and then do graph analysis, either to see where the money went or provide others with a tool to avoid transactions with those wallets?

Problem is that doesn't really help you identify the perpetrators. Both mixing services, and the fact that a user can generate unlimited wallets (if someone sends money to a wallet, you can't prove they own the second wallet or if they transferred money to someone else) makes this very difficult.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#112

Post by samstave »

jussij wrote: post #95
crb wrote: post #53

Earlier quoted context omitted.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)

Google Chrome Updater certainly does have a few virus like characteristics. Every time my interent connection slows (WiFi) I know it's Chrome Updater so I kill it via Task Manager and everthing is good again. There doesn't apear to be away to turn it off inside Chrome itself and turning off updates via the registry does not seem to stop it.

>Google Chrome Updater certainly does have a few virus like characteristics.

You could say it's in its DNA

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#113

Post by mey »

rosser wrote: post #40
misterbwong wrote: post #37

Earlier quoted context omitted.

Look into one of the many cloud based backup providers. I don't have any specific recommendations but here's a list off the top of my head: 1. http://www.carbonite.com/ 2. http://www.crashplan.com/ 3. http://www.backblaze.com/

From the Reddit article linked above [1]: "Backup solutions like Carbonite are no good against this as they will commit the encrypted files to the cloud." You need "cold" backups to get around this without paying. [1] http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care...

Backblaze maintains previous versions of files on a rolling basis of 4 week window. This includes deleted files.

I do not work for backblaze, but I am a happy user.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#114

Post by sejje »

swombat wrote: post #19
sillysaurus2 wrote: post #16

Earlier quoted context omitted.

I then turned on DKIM and enabled quarantining non DKIM emails via DMARC. Translation for techies who aren't familiar with email's many acronyms?

All those acronyms are easily googleable. Not being a techie does not mean you get to be lazy about looking things up.

FWIW he said he is a techie.

I often prefer a succinct summary from an expert to, say, a wikipedia entry.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#115

Post by secabeen »

pavel_lishin wrote: post #45
rosser wrote: post #40

Earlier quoted context omitted.

From the Reddit article linked above [1]: "Backup solutions like Carbonite are no good against this as they will commit the encrypted files to the cloud." You need "cold" backups to get around this without paying. [1] http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care...

I was under the impression that Crashplan's backups included limited versioning?

They do. I wouldn't even call them limited. They're pretty extensive, up to and including never remove deleted files.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#116

Post by timv »

kuschku wrote: post #108
ggchappell wrote: post #98

I get annoyed when people are warned not to open some attachment. The real problem here is that in 2013 we're still using the flawed language of "opening attachments" -- as if running a native executable with full permissions is an action that belongs in the same category as viewing an image, reading a text file, or listening to music. Well, it doesn't. This is a problem that should have been solved at the level of O…

The best solution would be the one used by Linux: Separate Data and Software. On Linux there is a specific flag that has to be set and is not set per default to make a file executable. So if you run something, you know that you are running it as a program and not opening it as data. Windows on the other hand marks everything as executable which begins with MZ and whichs filename ends in .exe or .com

Except in this case (original article) it was an executable inside a zip file.

In the normal case, unzipping a file on linux will result in the executable bit being restored if it was included on the original file.

This is normally what you want - imagine an app that was distributed (over https) as a zip file where you then had to go and manually add the executable bit to each relevant file.

But a zip file that was opened as an email attachment is largely indistinguishable from one that was opened from an HTTPS download (it need not be that way, but it is), so the OS has no reliable way to allow you to run executables you download in a zip, but not ones you received as an email in a zip file.

There are certainly ways around it, but the executable bit isn't really the solution here.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#117

Post by renata »

ballard wrote: post #62
mcphilip wrote: post #28

While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers. Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?

Tarsnap is the only sensible backup provider given the recent history of warantless secret searches in America. SpiderOak is also a contender for file sharing. Both use end-to-end encryption knowable only to the end-user.

CrashPlan supports this, although it is not the default.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#118

Post by missing_cipher »

crb wrote: post #53
blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)

I'm also seeing Dropbox, uTorrent and PunkbusterB in %appdata% according to fekberg's command.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#120

Post by dmix »

conductor wrote: post #36
blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

This type of viruses are nothing new [0]. The only new thing in this case is that it demands BitCoins instead of an SMS to a premium number or something else. [0] - https://www.securelist.com/en/descriptions/old313444

aka "Ransomware" https://en.wikipedia.org/wiki/Ransomware_(malware)

> The first known ransomware was the 1989 "PC Cyborg" trojan written by Joseph Popp

Post reply on HN