241–250 of 295 posts
Victims don't even get the enjoyment of having to make their payments in some far flung corner of an MMO, like the plot of Reamde. https://www.goodreads.com/book/show/10552338-reamde
That's the first thing I thought of, too. This is just about exactly the model of the Reamde crew.
Earlier quoted context omitted.
An interactive shell (like bash/python/irb) is untrusted code (i.e the user can type whatever the hell they like). But I don't/shouldn't need root to run it.
His point was that you need root "to install it", not "to run it".
I fail to see the difference. Sorry.
Wouldn't it be possible to attach a debugger to a running instance of the virus and extract the key while encryption is taking place?
So the encryption process does not know how to decrypt it.
Imagine a combustion engine, you know how to burn gas to extract energy and CO2. But this engine does not know how to make gas from CO2 and energy.
"This infection is typically spread through emails sent to company email addresses that pretend to be customer support related issues from Fedex, UPS, DHS, etc. These emails would contain a zip attachment that when opened would infect the computer. These zip files contain executables that are disguised as PDF files as they have a PDF icon and are typically named something like FORM_101513.exe or FORM_101513.pdf.exe. Since Microsoft does not show extensions by default, they look like normal PDF files and people open them."
I haven't got a Windows box handy to try this on but I assume there is at the very least an extra warning dialog when opening an exe - even a zipped exe?
Not that that mitigates this at all. The inability to distinguish executables from data files - and although that doesn't apply in this case - the ability of data files to hide executable payloads either via design or error - is a major and currently uncorrected flaw in the system.
Evidence that paying the ransom actually results in the files coming back is the most troubling aspect here - these people are looking to establish a longer term criminal enterprise.
I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes. Pull-only backups were the savior here, although because we didn't notice until the next day, the…
"JPEGs were altered but still viewable". Could be a problem with their encryption. Care to share a before and after JPEG of something? For science?
Everyone is talking about post-infection. However - this passage from http://www.bleepingcomputer.com/virus-removal/cryptolocker-r... seems fairly key also: "This infection is typically spread through emails sent to company email addresses that pretend to be customer support related issues from Fedex, UPS, DHS, etc. These emails would contain a zip attachment that when opened would infect the computer. These zip file…
Earlier quoted context omitted.
Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)
Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? Yes, and from a security point of view it should be treated as hostile accordingly. There is no need to actively circumvent Windows security like this. Firefox, among many other examples, is quite capable of automatically updating itself using a proper Windows service mechanism. It's long past time that Google were called out on this one. Not o…
When I first saw the title, I thought it went like this: 1. Your machine is infected, and it encrypts everything it can. 2. The 72 hour countdown begins, and during that time your machine has been re-purposed to crunch BitCoins. 3. All you have to do is wait 72 hours, and everything will un-encrypt and uninstall, leaving you perfectly fine. Creators profit by having millions of machines crunching BitCoins in their na…