Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

krebsonsecurity.com

Post reply on HN
Print view View original

131–140 of 229 posts

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#131

Post by zarzavat »

charcircuit wrote: post #111
chisleu wrote: post #95

Earlier quoted context omitted.

It's simple for the malware to check. For instance, you don't want to hit a Russian oligarch's laptop w/ ransomware just because his GPS says he is in another country. You don't want to trust the outbound ip because they might be on a VPN, etc. This is more broad and simple and easy. Can you think of a better way?

You could check what language the operating is set to, or the browser bookmarks /history to name a couple. Checking installed keyboards is somewhat obscure and sounds like something someone cleverly came up with and I'm interested in how is sprea

Language wouldn't work, many bilingual people prefer to have their UI language set to English even if it's not their native language.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#132

Post by 8note »

johanneskanybal wrote: post #118
ekianjo wrote: post #57

Earlier quoted context omitted.

You can game on Linux for many years now. Windows is mostly mandatory if you play multiplayer games with anticheat

yea pong working on linux doesen’t equal to gaming working on linux. Most games won’t start or play worse.

ive been playing elden ring fantastically on the steam deck. its the game of the year from a couple years back

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#133

Post by EvanAnderson »

v5v3 wrote: post #103
EvanAnderson wrote: post #88

Earlier quoted context omitted.

> It will help stop the spread quite a bit however (even if it can access user local data). User's should be running limited user accounts for daily-driver Windows machines. Having said that, today's attacks are all about the data. It's all about exfil/ransomware/blackmail because there's money to be had there. On an individual home user PC there's no lateral movement or bigger targets to attack. I hate to invoke xkc…

> Also instead of separate physical boxes why not just use a VM ? >Pragmatism. I have a bunch of extra low-spec laptops laying around. My machines are, for the most part, cast-off Customer garbage. I haven't actually spent money on reasonable machine since about 2015. >smile But you either need to setup a secure tunnel on each one, or lose access anytime you are away from home.

> But you either need to setup a secure tunnel on each one, or lose access anytime you are away from home.

Mostly isn't a problem for me. On the off chance I'd need the banking remotely I'd just take it with me. Mostly I don't do the sensitive stuff remotely and I rarely travel anymore.

Like I said in the parent post, I should be using Qubes. I'm just lazy.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#135

Post by cookiengineer »

Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

This is good advice, but it will not protect you against any malware that has been written in the last 10 years.

Stealer frameworks and dropper frameworks have implemented a lot of bypasses. From using other installed programs (lolbins / gtfobins etc) to using embedded scripting engines to do their bidding up until just reusing signed and installed default drivers to execute their payloads. A lot of drivers have sideloading and execution capabilities due to how the $igning process in Microsoft is constructed.

Additionally, nobody needs "root" access to do anything these days, this is just plain wrong assumption. Most malware will go for your browser profiles which are readable by your user (duh), so a separate privilege escalation exploit avoiding user account won't help you there either.

It's much better to sandbox your applications as good as possible. Even just using firejail profiles will go a long way, especially in regards to electron apps or apps that have remote update and plugin installation capabilities (e.g. discord, slack and the like).

Please, drop some malware binaries through ghidra or other tools before you give advice like this. You might be part of survivor's bias without realizing it.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#136

Post by azov »

petersellers wrote: post #116
anonymars wrote: post #107

Earlier quoted context omitted.

How does that protect against ransomware?

Limits the blast radius to only the files that the more limited user has write access to.

The files I normally have write access to are my important files though.

Immutable snapshots/offline backups help with those.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#137

Post by BlaDeKke »

KronisLV wrote: post #87
cortesoft wrote: post #43

Earlier quoted context omitted.

There are many reasons someone might have to use Windows. I have a Windows box because a number of games I play don’t support Linux, even with WINE and Proton.

I found that ProtonDB is quite helpful in figuring out how many games will or won’t run well: https://www.protondb.com/ You can even log in with Steam and get the summary for your exact library, for anyone curious.

It’s fine for a casual single player game. I’ve played rimworld on Linux mint. But league? Fortnite? Cod? Battlefield?

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#139

Post by udev4096 »

Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

LPEs exist. In linux world, you get tons of new LPEs every week. On windows, significantly harder

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#140

Post by udev4096 »

eestrada wrote: post #65
Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

The best anti malware on any version of windows has always been to not run windows.

I wouldn't be surprised if attackers started leveraging Wine for not going through the hassle of cross-compiling for different operating systems
Post reply on HN