Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Another Ransomware Outbreak Is Going Global

forbes.com

Post reply on HN
Print view View original

221–230 of 435 posts

Re: Another Ransomware Outbreak Is Going Global

#221

Post by schoen »

Piskvorrr wrote: post #202
80211 wrote: post #149

Earlier quoted context omitted.

People who don't run Windows shouldn't get cocky! There are many, many attacks on Linux: Here's one in the news from just last week. A ransomware where the victim agreed to pay the equivalent of US$1MM in bitcoin. https://arstechnica.com/security/2017/06/web-host-agrees-to-...

That would be akin to running Windows XP. People running Anfient Monftrosities should not get cocky in general, attacks on old systems are only getting worse with time.

Unicode suggestion: "Monſtroſities"

Re: Another Ransomware Outbreak Is Going Global

#222

Post by kbenson »

rhaps0dy wrote: post #133
rsync wrote: post #61

Earlier quoted context omitted.

"Actually, every single Windows PC with an internet connection that has been used before March 14 should be considered irrevocably compromised." March 14 of what year ? I would say 2000 but I am open to discussion ...

You're implying that from March 14, 2000, Windows was very secure. I think you're getting this backwards. If you say 2017, you and your children-comments' dates will be covered, because they are before March 14 2017.

No, the implication is that Windows prior to that was insecure. That does not mean it's secure afterwards, just that we know it was insecure previously. You are extrapolating without evidence.

Re: Another Ransomware Outbreak Is Going Global

#223

Post by napsterbr »

Animats wrote: post #183

Maersk is down. Their main site says: Maersk IT systems are down We can confirm that Maersk IT systems are down across multiple sites and business units due to a cyber attack. We continue to assess the situation. The safety of our employees, our operations and customer's business is our top priority. We will update when we have more information.[1] Maersk is the largest shipping company in the world. 600 ships, with…

By the looks of it, it will be down for several hours, hopefully. And sorry if this sounds wrong, but that's actually a good thing. Only with real damages like this is that security may be taken seriously.

Re: Another Ransomware Outbreak Is Going Global

#224

Post by kakarot »

idealhavoc wrote: post #153
maddyboo wrote: post #127

Does anyone know if any tools exist on Linux which can be used for early detection of ransomeware? Something that monitors file access, disk activity, etc. for suspicious behavior and can trigger some action or alert? I think I remember some discussion about using a 'canary file' - some innocent looking file with known contents which should never be modified. If a modification is detected, you know something fishy is…

To do it properly you would likely be looking at mandatory access control, such as SELinux, so that the ransomware wouldn't be authorized to modify the files and further would make itself obvious in the logs. Not very easy to use (in a way that still provides meaningful security) outside of the server space, though it can be done.

RHEL products, including Fedora, come with a fairly usable SELinux out of the box. By extension, so does Qubes OS.

I currently run a QEMU setup at home with different VMs, all Fedora, for different domains of use (internet, work, development/art, untrusted, a clean environment for installing OS's, etc) in the spirit of Qubes. Regular backups of everything are made frequently.

In the highly unlikely event of a ransomware infection, it would be limited to a single domain.

I believe this is the way forward for personal computing.

Re: Another Ransomware Outbreak Is Going Global

#225

Post by samstave »

KGIII wrote: post #214
samstave wrote: post #188

Earlier quoted context omitted.

Might have been 98/99, can't recall... I started at that company in 97 But it was back orifice I was thinking of.

XP was August of 2001, if you're curious.

Holy crap... then it was win 95 I was using back orifice against...

Re: Another Ransomware Outbreak Is Going Global

#226

Post by tyingq »

agumonkey wrote: post #206
tyingq wrote: post #135

Earlier quoted context omitted.

Aide is a popular utility to monitor for changes to files on Linux systems. http://aide.sourceforge.net You could also use the built in audit subsystem if you wanted to watch a specific canary file, directory, filesysyem, etc. https://www.linux.com/learn/customized-file-monitoring-audit...

I thought tripwire was the standard.. happy to know another name.

Tripwire got very stale after they split off a non open source commercial version.

Aide filled that gap. I believe most people prefer it to the open source tripwire.

Re: Another Ransomware Outbreak Is Going Global

#227

Post by smitherfield »

fpgaminer wrote: post #91
hackrack wrote: post #74

Idea: What if the purpose of these WannaCry style ransomware attacks isn't to get people to pay in Bitcoin, but to drive up the price of Bitcoin?

WannaCry caused the price to drop, rather sharply. If anything, the purpose would be to buy cheap Bitcoins and hope the price later corrects back upwards after the news has blown over. I suspect the price drop is due to some trading algorithms using sentiment analysis. They see all the negative press around these ransomware, see the included word Bitcoin, assume the negative article is about Bitcoin, and automaticall…

>But that's just my theory, since I have a hard time imagining human traders seeing news like this and selling because of it.

Sure they might; the more Bitcoin/cryptocurrency is associated with cybercrime, the more likely it is to be banned (sending the price to ~0 in the affected countries).

Re: Another Ransomware Outbreak Is Going Global

#228

Post by kakarot »

davidsong wrote: post #105
likelynew wrote: post #76

Earlier quoted context omitted.

Why do you think it a mistake?

Because now we can watch those funds and know how much money they made, we can watch them to see if they make a mistake. If every address was different we'd have no idea how much money they're making and only funds paid by people who also reported them would be tainted by the long eyeball of the law.

Probably not viable right now because of the ridiculously high transaction fees.

Re: Another Ransomware Outbreak Is Going Global

#229

Post by hathawsh »

willstrafach wrote: post #131

FYI to Sysadmins: Paying the ransom at this point will be a waste of money, as the contact e-mail address has been blocked. https://posteo.de/blog/info-zur-ransomware-petrwrappetya-bet... (German) https://posteo.de/en/blog/info-on-the-petrwrappetya-ransomwa... (English)

It's surprising that the attackers ask victims to send an email. Why not ask victims to publicly post a picture of their screen to social networks with a certain hash tag (and a new account)? That would be less traceable and harder to shut down, I think.

Not that I want to give attackers any ideas... :-)

Re: Another Ransomware Outbreak Is Going Global

#230

Post by H1Supreme »

astrodust wrote: post #160
eeeeeeeeeeeee wrote: post #155

Earlier quoted context omitted.

Something to keep in mind. They were running: Apache version 1.3.36 and PHP version 5.1.4 It's not like a brand new Ubuntu installation connected to the open Internet will suddenly be pwned. The owners of this company were beyond inept.

Seeing Apache 1 in the wild makes me a bit nostalgic. What kind of utter lunatic would use that for their company today?

Lord have mercy, Apache 1? That's what you get bro.
Post reply on HN