Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

201–210 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#201

Post by wbkang »

spajus wrote: post #200

It's a pity to see that Windows haven't died off yet and things like this are still happening. Using Linux / Mac for years, never looked back. And for those who say "my mother can't use Linux", don't be a cheapskate, get your loved ones a Mac - they will definitely know how to use it.

Keep in mind this is not a virus in a traditional sense. The user has to explicitly run the executable to run this malware.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#202

Post by elliottcarlson »

hollerith wrote: post #197
james3 wrote: post #195

Earlier quoted context omitted.

there is no downvoting

On the contrary, after accumulating a certain amount of karma (500 points??) a user gains the ability to downvote comments (but not stories).

Also, downvoting is only available for a certain comment age. Once the comment is X hours old, you lose the ability to downvote, but can still upvote.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#203

Post by tempestn »

MiguelHudnandez wrote: post #196

I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes. Pull-only backups were the savior here, although because we didn't notice until the next day, the…

Something like CrashPlan provides good protection against this sort of thing for home users. It includes versioned, off-site backups -- either on their servers for around $6 a month, or on a "friend's computer" for free. Either way, the backups are saved via crashplan, not with direct drive access, so it should be safe against this kind of thing.

No affiliation, just a user.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#204

Post by tracker1 »

shanselman wrote: post #129
blhack wrote: post #20

You can work to prevent this by creating a group policy that disallows %AppData%\*.exe and %AppData%\*\*.exe A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care... sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

Unfortunately lots of stuff runs under there including, but not limited to: GitHub for Windows and dozens of apps it installs in there F.lux Anything installed with ClickOnce Chrome GMVault Xamarin's Android Support Markdownpad SkyDrive Join.me Assuming that everything in there is a virus is too much, I think.

I would think that .Net portable apps are likely also per user executables.. not to mention that there are usually at least one scripting environment even on windows cscript/jscript/vbscript/powershell for example, not to mention Java, Python, Ruby and/or node may be installed.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#205

Post by joeblau »

Wow what a scheme. I mean it's almost the perfect situation for whoever wrote the system. It creates an extortion mechanism with a sense of urgency. Normally, users just carry malware around on their machine for weeks or months. The most frustrating part of this whole thing is that if you don't get the private key back and you're not backing up; you're toast.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#206

Post by tempestn »

AnIrishDuck wrote: post #170
Silhouette wrote: post #110

Earlier quoted context omitted.

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. You make an excellent point, but there is…

> This requires a very different model of access control and user/application privileges, and unfortunately I don't think any mainstream OS is even close to solving this one yet. I'm not sure it does require a different model of access control. It just requires people to actually use the access control mechanisms that exist already. You should not access banking details or any other sensitive information in the same…

What about photos? I could see ransomware being very successful just demanding payment to avoid making a bunch of your personal photos publicly available on the internet. They may not be sensitive per se, but they're still likely not something you want out there publicly. Ditto for email, chat messages, etc., etc.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#207

Post by ballard »

dasil003 wrote: post #101
ballard wrote: post #62

Earlier quoted context omitted.

Tarsnap is the only sensible backup provider given the recent history of warantless secret searches in America. SpiderOak is also a contender for file sharing. Both use end-to-end encryption knowable only to the end-user.

I can't afford to have my family photos backed up to tarsnap. Let the NSA have 'em.

It's funny you mention that.... I implore 'cperciva to consider a glacier-level service. It is hard to compete with backblaze, but capping network bwdth is proly one way to skin that cat.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#208

Post by tempestn »

elliottcarlson wrote: post #159
tempestn wrote: post #94

Earlier quoted context omitted.

Even if it encrypts regardless, preventing the perpetrators from profiting will remove their incentive to keep spreading this stuff. Once antivirus catches up to the copies in the wild, the problem would be solved. Of course, whether it's actually possible to shut down enough servers to prevent them from profiting is another question. But it seems to me anything that makes it more difficult is a good thing, even thou…

This wouldn't really prevent them from profiting - an unsuspecting user could still pay the ransom, and then never receive a decryption key, so would be both out of the money and lose their data.

Sure, it wouldn't prevent it completely, immediately. But 1) many users will do a search beforehand to see whether paying actually works. The less often it has worked for others, the less likely they will be to pay, and more importantly, 3) it would prevent them distributing new versions of the malware, which would prevent them profiting once antivirus caught up to the existing versions.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#209

Post by ballard »

temp1346 wrote: post #173
scott_karana wrote: post #135

Earlier quoted context omitted.

It's also not auditable: Tarsnap, while not OSS, has easily available source code for perusal and personal use, if I recall.

The crashplan JARs decompile pretty easily - I had a go a few months ago, and they weren't obfuscated. Highlights: The crypto is pretty bad - it's using blowfish in CBC mode with a static IV of 0c22384e5a57412b (convert each byte to decimal...). The client-server protocol use 32 bit nonces and MACs, which is. License key validation works by decrypting some packed data from the key after converting the alphabet back t…

Noice. =) Expounding would kickass, both kinds. ; D
Post reply on HN