Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

231–240 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#231

Post by andreyvit »

Silhouette wrote: post #110
antihero wrote: post #35

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. One trivial solution would be OS level au…

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account. You make an excellent point, but there is…

Well actually, looks like we're getting there.

The problem is seemingly solved by OS X app sandbox and Mac App Store review process (the sandbox alone is not enough, because it allows to declare 'exceptions' like full disk access, so human reviewers are needed to watch out for those).

The sandbox may occasionally be causing some pain (in fact, would be very painful if I had to support OS X 10.7), but at the same time my app can no longer access any user data that the user hasn't explicitly whitelisted, which is a good thing.

Windows Metro apps also live in a sandbox, but they are sort of a different platform (no access to the file system at all, as far as I know). Over time, I can see them gaining some access to a subset of the file system, perhaps via SkyDrive.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#232

Post by Wicher »

anonymous wrote: post #223

Wouldn't it be possible to attach a debugger to a running instance of the virus and extract the key while encryption is taking place?

Yes, but if they have their crypto stuff together, it might not gain you much.

Someone here mentioned the encrypted versions of the files are the original size + a little extra. To me that indicates that they use a public key (of which the private component does not reside on your computer, and never has, but which you can buy). The public key is used to encrypt a key for a symmetric algorithm (AES, DES, ...), which encrypts the data, and the RSA-encrypted version of that symmetric key is then prepended as a header of some sorts.

So using a debugger you'd be able to see the public key, which I suppose is infected-useraccount-specific. It's not useful for decryption, you'll need its private counterpart.

You'll also see the symmetric key, of which a new (random) one should be instantiated for each file that is being encrypted. Should, but might not... if they slipped up, the latter might be reused (for your user account). In which case you can win, if you can observe it encrypting a new file — you'd be able to decrypt the other files too.

They'd have to be quite stupid to slip up like this, but it happens.

Update: Reading a reverse engineering report¹ it appears that it indeed works as described above. And yes, they didn't slip up; a new symmetric key is generated for each individual file.

¹ http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2945

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#233

Post by Wingman4l7 »

MiguelHudnandez wrote: post #196

I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes. Pull-only backups were the savior here, although because we didn't notice until the next day, the…

> opening a document as an e-mail attachment and not being able to find the actual file they edited

I'm so sick of this. The "open/save" dialog is in sore need of being revamped. There's really no such thing as "open" anyway -- it's really "save to some obscure profile temp directory and then open". Try explaining "you can't open a file that's not first saved to disk" to a user, though.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#234

Post by riquito »

Volpe wrote: post #220
keeperofdakeys wrote: post #142

Earlier quoted context omitted.

No, it's a required security feature that goes back decades in some operating systems. You need to be able to trust the code that runs on your system, and to do that you want to ensure only admin can install things. Of course, Windows has now partially solved that with UAC. Unfortunately you can never know if you can trust the software or not though. However this does stop malware from secretly running without your p…

An interactive shell (like bash/python/irb) is untrusted code (i.e the user can type whatever the hell they like). But I don't/shouldn't need root to run it.

His point was that you need root "to install it", not "to run it".

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#235

Post by swombat »

anonymous wrote: post #222
DanBC wrote: post #171

Earlier quoted context omitted.

The ten thousand readers of HN who don't know these acronyms can use a search engine to look them up, or someone can ask a question and someone else can answer it and save 9,998 other readers the bother. 1 Google search = 1/35 of a boiled kettle. So asking the question just saved about 285 boiled kettles of carbon footprint. ( http://green.tmcnet.com/topics/green/articles/216400-google-... )

And having a flamewar on how people should google things for themselves wasted how many kettles? Anyway, if you don't want to tell people things, then don't tell people things, but going on and on on how OP should just google things themselves, is reaching 4chan levels of elitism. It's a really shitty kind of elitism.

A single-line comment is not going on and on.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#236

Post by devcpp »

anonymous wrote: post #223

Wouldn't it be possible to attach a debugger to a running instance of the virus and extract the key while encryption is taking place?

Problem is, the prompt doesn't appear until the encryption has ended, the key has been sent to the servers (it's kind of complicated, it apparently tries to find servers on its own, I wonder if it can be fooled) and that key has been locally destroyed.

So, by the time the user is notified that there is malware on their PC, it's too late. People who know to detect viruses while they're running don't run attachments in the first place.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#237

Post by mbesto »

ggchappell wrote: post #98

I get annoyed when people are warned not to open some attachment. The real problem here is that in 2013 we're still using the flawed language of "opening attachments" -- as if running a native executable with full permissions is an action that belongs in the same category as viewing an image, reading a text file, or listening to music. Well, it doesn't. This is a problem that should have been solved at the level of O…

I believe this is what Bromium is doing with their "micro-VMs" - http://www.bromium.com/use-cases/overview.html

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#238

Post by DanBC »

anonymous wrote: post #222
DanBC wrote: post #171

Earlier quoted context omitted.

The ten thousand readers of HN who don't know these acronyms can use a search engine to look them up, or someone can ask a question and someone else can answer it and save 9,998 other readers the bother. 1 Google search = 1/35 of a boiled kettle. So asking the question just saved about 285 boiled kettles of carbon footprint. ( http://green.tmcnet.com/topics/green/articles/216400-google-... )

And having a flamewar on how people should google things for themselves wasted how many kettles? Anyway, if you don't want to tell people things, then don't tell people things, but going on and on on how OP should just google things themselves, is reaching 4chan levels of elitism. It's a really shitty kind of elitism.

Wait, I'm saying that telling people to just search for things is not good.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#239

Post by scott_karana »

temp1346 wrote: post #173
scott_karana wrote: post #135

Earlier quoted context omitted.

It's also not auditable: Tarsnap, while not OSS, has easily available source code for perusal and personal use, if I recall.

The crashplan JARs decompile pretty easily - I had a go a few months ago, and they weren't obfuscated. Highlights: The crypto is pretty bad - it's using blowfish in CBC mode with a static IV of 0c22384e5a57412b (convert each byte to decimal...). The client-server protocol use 32 bit nonces and MACs, which is. License key validation works by decrypting some packed data from the key after converting the alphabet back t…

Thanks! That's really good to know...

I assume you're using a temp because of the DMCA?... :(

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#240

Post by Wicher »

devcpp wrote: post #236
anonymous wrote: post #223

Wouldn't it be possible to attach a debugger to a running instance of the virus and extract the key while encryption is taking place?

Problem is, the prompt doesn't appear until the encryption has ended, the key has been sent to the servers (it's kind of complicated, it apparently tries to find servers on its own, I wonder if it can be fooled) and that key has been locally destroyed. So, by the time the user is notified that there is malware on their PC, it's too late. People who know to detect viruses while they're running don't run attachments in…

According to the KernelMode thread¹ the keypair is generated on the server. The public key is retrieved from it, but its private counterpart will never be on your machine. No key is sent to the server.

¹http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2945

Post reply on HN