Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

191–200 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#191

Post by krenoten »

Silhouette wrote: post #183
AnIrishDuck wrote: post #170

Earlier quoted context omitted.

> This requires a very different model of access control and user/application privileges, and unfortunately I don't think any mainstream OS is even close to solving this one yet. I'm not sure it does require a different model of access control. It just requires people to actually use the access control mechanisms that exist already. You should not access banking details or any other sensitive information in the same…

Your proposal is OK if accessing sensitive information is something you only do occasionally, but it's not very practical to switch users completely if you deal with sensitive information often, which many people do. On the other hand, if only explicitly authorised applications can create outbound Internet connections at all, and if applications like browsers and e-mail clients need explicit permission to read a gene…

Check out qubes os if you don't want to trust your kernel to enforce your mandatory access controls (you DO only allow certain applications/users/groups/roles/OS's/Hypervisors/etc... to do certain things, DON'T YOU??). Xen is a smaller attack surface, and depending on how much of a pain in the ass you consider having all of your files stolen and deleted being, there are many options for locking it down quite a lot. XSM-Flask if you are too paranoid, Hypersafe for control flow attacks + invariant violation detection tools for non-control data attacks over nested hypervisors if you are resolute.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#192

Post by teraflop »

temp1346 wrote: post #173
scott_karana wrote: post #135

Earlier quoted context omitted.

It's also not auditable: Tarsnap, while not OSS, has easily available source code for perusal and personal use, if I recall.

The crashplan JARs decompile pretty easily - I had a go a few months ago, and they weren't obfuscated. Highlights: The crypto is pretty bad - it's using blowfish in CBC mode with a static IV of 0c22384e5a57412b (convert each byte to decimal...). The client-server protocol use 32 bit nonces and MACs, which is. License key validation works by decrypting some packed data from the key after converting the alphabet back t…

Why on earth would anyone use symmetric crypto for license keys?

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#193

Post by DigitalSea »

This is one of the scariest forms of attack on computing since viruses became prevalent in the nineties. The fact they were up until recently relatively undetectable adds another eerie dynamic to the situation. It highlights the aged old problem of people not pro-actively backing up their data offline until it's too late. Go out and buy a couple of cheap 1tb external drives and back your data up now and keep doing it, there are even tools and drives that handle this automatically for you.

While ransomware isn't anything new, the fact that the authors of such software are using currencies like Bitcoin make it that extra bit harder to track and stop these people from extorting data. I sense a new wave of ransomware is about to hit the scene now that Ars have revealed specifics about potentially making millions a year from such a racket. It's hard informing people about these things without encouraging others to go and try writing their own ransomware and expect Bitcoin as payment.

This really worries me.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#194

Post by grecy »

When I first saw the title, I thought it went like this:

1. Your machine is infected, and it encrypts everything it can.

2. The 72 hour countdown begins, and during that time your machine has been re-purposed to crunch BitCoins.

3. All you have to do is wait 72 hours, and everything will un-encrypt and uninstall, leaving you perfectly fine.

Creators profit by having millions of machines crunching BitCoins in their name.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#195

Post by james3 »

mr_luc wrote: post #177
hobs wrote: post #175

Earlier quoted context omitted.

I thought there were numerous laundering services?

Here's one: https://blockchain.info/wallet/send-shared (Please note, before downvoting, that I'm not saying that's a bad thing)

there is no downvoting

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#196

Post by MiguelHudnandez »

I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes.

Pull-only backups were the savior here, although because we didn't notice until the next day, the pulled backups on that system were also overwritten with encrypted/corrupt files. Luckily we had VSS versioning on the pull-only backup location. There was a close call in that the 2 TB or so of "new" data ended up pushing VSS over quota and we almost lost our good versions of the files that way. If not for the VSS versions, we would've had to resort to cold backups which would've been a bit older. As it stood, no file recovered was more than a few hours old.

Auditing on the file share indicates which workstation was infected. Pertaining to that: it surprises me that in 2013, a default install of Windows will not log any useful information about shared folders by default. You must enable object auditing in Group Policy and specifically declare which users or groups are subject to said auditing on a share-by-share basis. In a world without logrotate, I suppose a sensible default is to just let a bunch of shit happen without recording it.

What gets me wound up most of all is the amount of engineering involved for an average home user to protect themselves. I thought a Mac with Time Machine was enough, but a similar virus would easily corrupt those backups if they were available to it over a mapped drive.

It is the goddamn 21st century, and users are still losing work by overwriting documents by accident, or opening a document as an e-mail attachment and not being able to find the actual file they edited. Should people really need an IT guy with ten years of experience to be protected from simple mistakes? Google has made progress on that front with the Chromebook, I suppose.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#197

Post by hollerith »

james3 wrote: post #195
mr_luc wrote: post #177

Earlier quoted context omitted.

Here's one: https://blockchain.info/wallet/send-shared (Please note, before downvoting, that I'm not saying that's a bad thing)

there is no downvoting

On the contrary, after accumulating a certain amount of karma (500 points??) a user gains the ability to downvote comments (but not stories).

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#198

Post by WiseWeasel »

mbreese wrote: post #166
WiseWeasel wrote: post #160

Earlier quoted context omitted.

Wouldn't it have to be in its RNA? /ducks

There are both DNA and RNA viruses.

G(uanine), C(ytosine) and U(racil) are RNA nucleotides, so it seemed more appropriate somehow...

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#199

Post by fmax30 »

Huh , that is pretty scary add a physical packet snooper on all the traffic sent from my computer , it might be possible to mitm the private key as it is sent to the server. That way i might have a fighting chance against this.(if the traffic was unencrypted that is )

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#200

Post by spajus »

It's a pity to see that Windows haven't died off yet and things like this are still happening. Using Linux / Mac for years, never looked back.

And for those who say "my mother can't use Linux", don't be a cheapskate, get your loved ones a Mac - they will definitely know how to use it.

Post reply on HN