Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

krebsonsecurity.com

Post reply on HN
Print view View original

161–170 of 229 posts

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#161

Post by eviks »

Melatonic wrote: post #75
zahlman wrote: post #47

Earlier quoted context omitted.

> If an admin elevation popup happens when you haven't triggered it then you probably know something is wrong. And most malware will not be able to install. Malware can still do a lot without "installation". Running as an unprivileged user, it can still do anything to/with the filesystem that the user would be able to do, and will (on most normal setups) be able to make outbound Internet connections without limitatio…

This is true but defense is a multi layered approach and even the built in Microsoft stuff (like Defender AV) have massively improved. I would argue most malware comes down to uneducated users doing the wrong thing - but that's a whole different can of worms :-)

So you want to make their lives much harder with two passwords for no good reason? Also, those uneducated users will simply enter the admin password when prompted

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#162

Post by eviks »

cube00 wrote: post #91
Melatonic wrote: post #75

Earlier quoted context omitted.

This is true but defense is a multi layered approach and even the built in Microsoft stuff (like Defender AV) have massively improved. I would argue most malware comes down to uneducated users doing the wrong thing - but that's a whole different can of worms :-)

> I would argue most malware comes down to uneducated users doing the wrong thing This feels unnecessarily harsh. Those users are the victims of criminal activity. The protective controls could be a lot better. Windows doesn't offer immutable local file versions to protect against ransomware running as a non-privileged user. It doesn't offer any protection if a single application suddenly starts to overwrite huge amo…

Isn't "Controlled folder access" part of that protection? Also restore points?

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#163

Post by raverbashing »

ivan_gammel wrote: post #62
userbinator wrote: post #42

Earlier quoted context omitted.

Also, if you identify as Russian or write Russian in the chats or mails to them, they will de-crypt your systems for free. I wonder how that works in this era of AI translation. Not quite the same but I remember there was a Russian shareware author who gave free licenses to Russians.

> I wonder how that works in this era of AI translation Simple translation isn’t enough to show cultural proximity. Patterns of speech are different. You can try to use AI to do the entire conversation, but e.g. Claude will refuse to give you exact phrases, since he is correctly assuming it is a social engineering attack.

Ok just pay a Russian to do the negotiation for you

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#164

Post by red_admiral »

EvanAnderson wrote: post #89
Melatonic wrote: post #77

Earlier quoted context omitted.

Confused by that as well - what version of chrome can be installed without admin?

It cannot. There are malicious third parties who have made distributions of Chromium that are fully functional browsers, installing in the user's AppData folder w/o Administrator rights, that have additional "functionality" like exfiltrating browsing history or displaying extra t This is really what any Electron-based app is. It's just Chromium running out of the AppData folder. There's a whole ecosystem of "shadow I…

This one is usually ok? https://chromium.woolyss.com/ It's sort of like official unofficial download place.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#165

Post by Aachen »

seb1204 wrote: post #61
Aachen wrote: post #45

Earlier quoted context omitted.

https://xkcd.com/1200/ It feels bad to post a link-only response but I really don't have anything to add to it. On a system used by multiple persons, sure, you help prevent that a compromise on sister's account immediately impacts mom's and dad's accounts, but that qualification isn't in the comment and probably most computers that HN readers use are single user. Or on a server, dropping privileges speaks for itself.…

So the mum or grandpa should also use an admin account to execute the file they just downloaded?

They need this access to be able to use their computer, but even if they don't manage their own computer... maybe read the above comment and then let me know what I've overlooked rather than me repeating the whole thing

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#166

Post by orthoxerox »

userbinator wrote: post #42
exiguus wrote: post #37

There is evidence that this will worked for ransomware like Patya and for groups like Fancy Bear or Cozy Bear and Conti. Mostly because the Russia gov. unofficial guaranties immunity if the target is not Russian. Also, if you identify as Russian or write Russian in the chats or mails to them, they will de-crypt your systems for free.

Also, if you identify as Russian or write Russian in the chats or mails to them, they will de-crypt your systems for free. I wonder how that works in this era of AI translation. Not quite the same but I remember there was a Russian shareware author who gave free licenses to Russians.

> I wonder how that works in this era of AI translation.

They will ask you to repeat yourself in Albanian if they have any doubts.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#167

Post by ivan_gammel »

orbital-decay wrote: post #129
ivan_gammel wrote: post #62

Earlier quoted context omitted.

> I wonder how that works in this era of AI translation Simple translation isn’t enough to show cultural proximity. Patterns of speech are different. You can try to use AI to do the entire conversation, but e.g. Claude will refuse to give you exact phrases, since he is correctly assuming it is a social engineering attack.

Prompting a good LLM to convincingly act like a native isn't hard, neither is jailbreaking it if necessary. The hard thing in this case is verifying that it really does that.

Nah, it's not reproducible. It can certainly give you some common phrases, but to create an entire personality with its own set of speech patterns is a different thing. For example, Claude can suggest following friendly conversation starters to sound like a native (a quote below):

   Popular combinations for texts:

   "Прив! Чё как?" - "Hi! How's it going?"
   "Дарова, живой?" - "Hey, you alive?"
   "Салют! Как сам?" - "Hey! How are you?"
    
   Modern slang (especially among younger people):
   
   "Хай" (Khay) - borrowed from English "hi"
   "Йоу" (You) - borrowed from English "yo"
When asked, which one it would pick, it goes with "Дарова, как сам?" (Darova, kak sam?) and that already sounds odd in many contexts.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#168

Post by smallstepforman »

Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

Its easy to reinstall the OS. Its a lot more damaging if you lose your childs birthday photos, tax documents and anything you actually care about. This is where the entire PC security fiasco breaks down, since I want my docs directory protected FROM any system installed app/driver. I want an OS that asks for permission when accessing doc directory.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#170

Post by mrkramer »

rurban wrote: post #169

Just add those two keys into your registry: https://github.com/Unit221B/Russian For persistance install the russian keyboard driver, and switch back to your original.

That's a funny way to combat Russian made malware but I think Russian malware checks which keyboard language you are currently using and not which ones are in total present on your OS.
Post reply on HN