Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

krebsonsecurity.com

Post reply on HN
Print view View original

191–200 of 229 posts

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#191

Post by IAmBroom »

atemerev wrote: post #67
exiguus wrote: post #37

There is evidence that this will worked for ransomware like Patya and for groups like Fancy Bear or Cozy Bear and Conti. Mostly because the Russia gov. unofficial guaranties immunity if the target is not Russian. Also, if you identify as Russian or write Russian in the chats or mails to them, they will de-crypt your systems for free.

It's not that simple, I think. There are many Russians everywhere, and probably they work at victim companies too, so just being Russian won't be enough, if ransom could be in the millions. You'll have to convince them that the company is Russian-owned, or that your father works in FSB, or whatever.

It is that simple.

How would having one Russian in a company protect them from ransomware? There's no way to make that occurrence detectable to the malware.

Or, for that matter, why would ransomware care about the father of the computer owner?

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#192

Post by ivan_gammel »

hn-shithole wrote: post #187
ivan_gammel wrote: post #167

Earlier quoted context omitted.

Nah, it's not reproducible. It can certainly give you some common phrases, but to create an entire personality with its own set of speech patterns is a different thing. For example, Claude can suggest following friendly conversation starters to sound like a native (a quote below): Popular combinations for texts: "Прив! Чё как?" - "Hi! How's it going?" "Дарова, живой?" - "Hey, you alive?" "Салют! Как сам?" - "Hey! How…

That's not how you'd approach this with an LLM

Obviously not. But this is what LLM may give you, unless you know exactly what to ask for (which you will not know without the proper knowledge of language and cultural context).

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#193

Post by pastage »

floundy wrote: post #33
pkulak wrote: post #24

Earlier quoted context omitted.

Do you mind elaborating a bit on what went wrong? Like, were you installing on a recent MacBook, or something else not well supported? In my experience, installing and running a popular distro is absolute cake. Easier than Windows, even, since you aren’t forced to create cloud accounts and answer a million privacy questions; you basically install then boot right into your new desktop.

Used it on various devices. A Dell laptop (with power switching between dedicated and iGPU, what a nightmare that was for Linux display drivers), a desktop I built myself, a Raspberry Pi running RPi OS. I find most things fine in Linux and I'm fairly comfortable with the terminal. However it's the 10% or so of things that are very cumbersome in Linux but instant in Windows/Mac that drive me away. Example: There is no…

The point is that Linux is not worse it is just different. What you do on Windows or iOS will not be the same as on Linux. How you adapt and if you want to is the point.

I am horribly ineffective on Windows even if I am forced to use it. The only reason for me to use it is to play multiplayer games though, and it is the default install on new laptops before installing Linux. So Windows sucks because it does not have what I need, and I see no reasons to change my ways to Windows.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#194

Post by kgeist »

As someone using a Russian keyboard, I still got my fair share of viruses back in the day, before I knew the basics of cybersecurity. I wonder how prevalent that actually is in the grand scheme of things, or if it's overblown in the article.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#195

Post by mr_mitm »

anonymars wrote: post #185
mr_mitm wrote: post #151

Earlier quoted context omitted.

It's more important in a corporate setting. Lateral movement inside the network is much more likely if the attacker has local admin.

Why would local admin have relevance to network movement?

Because every time an account logs onto a computer, it leaves traces. Some ephemeral in memory, some permanent on disk. It can be Kerberos tickets, process tokens, domain cached credentials, hashes or even clear text passwords in memory. It's common practice in a lot of organizations for administrators to log on to random workstations to perform whatever task they need to do.

Or there is a service running in the context of a service user domain account. Or the password of the local administrator account is identical on all systems, which was very common before LAPS became a thing.

Yes, if you do everything perfectly and always go by best practices, none of this should be relevant, but most people aren't doing everything perfectly all of the time.

To access any of these things, you need local admin permissions. Then you can reuse them to log on to other systems.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#197

Post by supertrope »

fracus wrote: post #126

The title alone is hilarious because it obviously implies, probably correctly so, that most ransomware comes from Russia.

And other CIS countries. It turns out if the authorities don't prosecute computer criminals and wire fraudsters unless there's a domestic victim, they will run amok.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#199

Post by supertrope »

jekwoooooe wrote: post #134

[flagged]

The Internet is by definition universal. Autonomous Systems make their own routing decisions. We cannot cut them off the Internet any more than we can cut off their sea access. If we were to do so (analogous to a naval blockade) you'd have succeeded in only cutting off civilians. Government sponsored or tolerated criminals would still ply their trade like in N Korea.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#200

Post by supertrope »

Phurist wrote: post #14
Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

Or you know... just use Linux

Make sure to never do

  curl example.com/easyscript.sh | sudo bash
Post reply on HN