261–270 of 295 posts
I talked to a small shop owner just the other day that had been hit by this. They said they spent the $300 on a new PC instead - but I'm pretty sure they lost a bunch of irreplaceable data (mailing lists, supplier details etc). Pretty heart breaking.
Everyone is talking about post-infection. However - this passage from http://www.bleepingcomputer.com/virus-removal/cryptolocker-r... seems fairly key also: "This infection is typically spread through emails sent to company email addresses that pretend to be customer support related issues from Fedex, UPS, DHS, etc. These emails would contain a zip attachment that when opened would infect the computer. These zip file…
Why doesn't MS Windows use magic numbers to establish file types, or does it now?
The silly bit is the fact that the file extensions are hidden by default, and users can only use the icon to check the file type.
This is one of the scariest forms of attack on computing since viruses became prevalent in the nineties. The fact they were up until recently relatively undetectable adds another eerie dynamic to the situation. It highlights the aged old problem of people not pro-actively backing up their data offline until it's too late. Go out and buy a couple of cheap 1tb external drives and back your data up now and keep doing it…
Earlier quoted context omitted.
5. Consider alternatives to Windows so you won't have to deal with these silly things that have largely only been affecting Windows users for the last decade+.
Sure, I'll ask my 70+ year old relatives that have been using PC with Windows since they first got their computer to download an Ubuntu ISO, burn that and re-install their system. Joking aside. I'd love for everyone to just jump on a virus free OS, but as soon as that OS is mainstream there will be viruses. The problem isn't the OS, the problem is that people trust everything that is for instance sent to them via e-m…
No more viruses, no more headaches.
Earlier quoted context omitted.
The crashplan JARs decompile pretty easily - I had a go a few months ago, and they weren't obfuscated. Highlights: The crypto is pretty bad - it's using blowfish in CBC mode with a static IV of 0c22384e5a57412b (convert each byte to decimal...). The client-server protocol use 32 bit nonces and MACs, which is. License key validation works by decrypting some packed data from the key after converting the alphabet back t…
Why on earth would anyone use symmetric crypto for license keys?
The test key:
/com/code42/license/LicenseKey.java: private static final byte[] KEY = "Brian in the Conference Room with the Mouse. To be.".getBytes();
I assume this is some inside joke referring to Brian Bispala.
Earlier quoted context omitted.
The crashplan JARs decompile pretty easily - I had a go a few months ago, and they weren't obfuscated. Highlights: The crypto is pretty bad - it's using blowfish in CBC mode with a static IV of 0c22384e5a57412b (convert each byte to decimal...). The client-server protocol use 32 bit nonces and MACs, which is. License key validation works by decrypting some packed data from the key after converting the alphabet back t…
Thanks! That's really good to know... I assume you're using a temp because of the DMCA?... :(
Earlier quoted context omitted.
> the original files would be written to location that is read only to the user and only accessible via the OS A versioning filesystem looks much cleaner than a different location. Maybe we should start using those again. (Is there any candidate for ext5 already?) And yes, partitioning the data permissions for the same user is a much needed change. Nobody got a solution for that yet, and there are lots of people tryi…
Yep, if this could exist at file-system level it would be wonderful. What candidates actually exist for this and are in a usable state? BTRFS? ZFS?
I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes. Pull-only backups were the savior here, although because we didn't notice until the next day, the…
A company I work with was hit when the employee opened a phishing email supposedly from another employee in the same company. It hit about 50 gb of data on the shared drive. We had Crashplan and restored from a few days previous. I then turned on DKIM and enabled quarantining non DKIM emails via DMARC.
Earlier quoted context omitted.
But note that's only due to popularity. Socially engineering your way into a user running an executable means that executable will simply run with user privs. No trickery or hacking required, no OS holes. And that will mean that the executable will have full access to do everything a user could do, which will effectively certainly include sending a new encryption key over the network, and encrypting every file that u…
OS X defaults to only running applications that have been signed with a valid developer ID. It’s not difficult to get such an ID, but Apple can also blacklist them, which would prevent the malware from running once Apple notices it. So I think the Mac has a good defense against this kind of attack.