Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Site Recovers Files Locked by Cryptolocker Ransomware

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 44 posts

Re: New Site Recovers Files Locked by Cryptolocker Ransomware

#21

Post by runeks »

MasterScrat wrote: post #17
xxxmadraxxx wrote: post #11

Of course, the conspiracy theorist might say that it's a bit too convenient to suppose the hitherto extremely clever criminals helpfully and stupidly copied their private keys across to computers controlled by 'the feds'. A bit like those supposedly 'random' police stopping of vehicles which turn out to be full of drugs or explosives. Maybe public/private key pairs aren't as secure as we've been lead to believe.

Or maybe they got their hands on the keys some other way they're not willing to disclose.

That would be interesting. Especially the discussion of whether this is morally acceptable (ie. doing illegal things to obtain the private keys from the malware designers).

Re: New Site Recovers Files Locked by Cryptolocker Ransomware

#22

Post by obitoo »

enneff wrote: post #19
MasterScrat wrote: post #17

Earlier quoted context omitted.

Or maybe they got their hands on the keys some other way they're not willing to disclose.

It is likely that they were able to compromise the bad guys' systems and steal the private keys, which in itself is against the law.

Technically yes, but in practice only if the bad guys file charges and/or assist the authorities with evidence, ie their machines.

Re: New Site Recovers Files Locked by Cryptolocker Ransomware

#23

Post by TeMPOraL »

> The free decryption service was made possible because Fox-IT was somehow able to recover the private keys...

Part of me is so hoping that they extracted those keys from the crooks using rubber-hose cryptanalysis. There are many types of Internet scams, some more evil than others, but this is one of the nastiest I ever heard of.

Re: New Site Recovers Files Locked by Cryptolocker Ransomware

#24

Post by aptwebapps »

dan1234 wrote: post #18
nospecinterests wrote: post #15

I know they are doing this as a community service... because, I assume they feel it is their honor and duty to do so... but why the hell do these guys NOT have at least a donate link/button on their site!!!!! This is crazy. I know they are going to get awesome press which would have normally cost thousands but it never hurts to throw up a link and see how much your appreciated.

Does anyone have any conversion stats for those donate buttons? I don't think many people actually use them, especially if the traffic is mainly curious readers sent there by mainstream press.

Well, if word gets out they might get a decent amount of traffic from individuals who are considerably more vested than curious readers.

Re: New Site Recovers Files Locked by Cryptolocker Ransomware

#25

Post by kijin »

Kliment wrote: post #20
kijin wrote: post #16

Earlier quoted context omitted.

> if I am the sole legitimate user of the device... On the flip side, if your device resists your attempts to run cat_pictures_infected_with_cryptolocker.jpg.exe, it is clear that somebody else has some degree of control over the behavior of your device, and this somebody does not consider you to be the sole legitimate controller of your device. Who is this somebody, and what right does he/she/they have to retain par…

How about if said somebody is a less tired, more sober, more attentive and less stressed me?

If you wrote a program to restrain your own careless self, or installed someone else's program with the expectation that it will restrain you, then I suppose everything's kosher. We're all consenting adults, right?

Things get more complicated when a stranger decides to tell you what you can or can't do, without your consent, against your expectations, and sometimes even in spite of your loud complaints.

Re: New Site Recovers Files Locked by Cryptolocker Ransomware

#26

Post by [deleted] »

MasterScrat wrote: post #17
xxxmadraxxx wrote: post #11

Of course, the conspiracy theorist might say that it's a bit too convenient to suppose the hitherto extremely clever criminals helpfully and stupidly copied their private keys across to computers controlled by 'the feds'. A bit like those supposedly 'random' police stopping of vehicles which turn out to be full of drugs or explosives. Maybe public/private key pairs aren't as secure as we've been lead to believe.

Or maybe they got their hands on the keys some other way they're not willing to disclose.

[deleted]

Re: New Site Recovers Files Locked by Cryptolocker Ransomware

#27

Post by praseodym »

TeMPOraL wrote: post #23

> The free decryption service was made possible because Fox-IT was somehow able to recover the private keys... Part of me is so hoping that they extracted those keys from the crooks using rubber-hose cryptanalysis. There are many types of Internet scams, some more evil than others, but this is one of the nastiest I ever heard of.

They got a database copy:

BBC article: http://www.bbc.com/news/technology-28661463

Fox-IT CEO: https://twitter.com/cryptoron/status/496945787700805632

Re: New Site Recovers Files Locked by Cryptolocker Ransomware

#28

Post by mhurron »

nospecinterests wrote: post #15

I know they are doing this as a community service... because, I assume they feel it is their honor and duty to do so... but why the hell do these guys NOT have at least a donate link/button on their site!!!!! This is crazy. I know they are going to get awesome press which would have normally cost thousands but it never hurts to throw up a link and see how much your appreciated.

> I assume they feel it is their honor and duty to do so

Free advertising.

Why should a commercial entity have a donate button? Why would I donate to a business?

Re: New Site Recovers Files Locked by Cryptolocker Ransomware

#30

Post by traevesty »

mhurron wrote: post #28
nospecinterests wrote: post #15

I know they are doing this as a community service... because, I assume they feel it is their honor and duty to do so... but why the hell do these guys NOT have at least a donate link/button on their site!!!!! This is crazy. I know they are going to get awesome press which would have normally cost thousands but it never hurts to throw up a link and see how much your appreciated.

> I assume they feel it is their honor and duty to do so Free advertising. Why should a commercial entity have a donate button? Why would I donate to a business?

You'd donate to a business for the same reason you'd donate to an individual: to give resources to a cause that you support and to incentivize a direction of work.

You might be surprised to learn that the business world already has tons of donation buttons and trust networks. For accounting reasons they're often called contracts.

Post reply on HN