Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

281–290 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#281

Post by FedRegister »

antihero wrote: post #278
FedRegister wrote: post #257

Earlier quoted context omitted.

>Your proposal is OK if accessing sensitive information is something you only do occasionally, but it's not very practical to switch users completely if you deal with sensitive information often, which many people do. $ sudo -u banking gnucash & $ firefox & Done. My banking files and my Firefox session are now separated.

Interestingly, you may have just fucked yourself, because the sudo session is maintained whilst launching Firefox. If we create a script 1: #!/bin/sh echo "I'm doing something secure" And then script 2: #!/bin/sh echo "I'm doing something insecure". sudo echo "I'm doing something malicious". Then run: $ sudo ./script1.sh; ./script2.sh Looks like Firefox has access to your banking user :)

Not if sudo is set to only allow gnucash! :-)

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#282

Post by howlett »

How is this any different from a virus that wipes (not just deletes) your data? It takes the same amount of time (actually wiping data would be faster) and the result is the same: No data.

Maybe the psychological part of "Oh God the file is there but I can't use it" or the fact it's ransomware?

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#283

Post by james3 »

james3 wrote: post #195
mr_luc wrote: post #177

Earlier quoted context omitted.

Here's one: https://blockchain.info/wallet/send-shared (Please note, before downvoting, that I'm not saying that's a bad thing)

there is no downvoting

thanks for the neg reps, really shows your attitude towards newcomers

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#284

Post by gizmo686 »

Wingman4l7 wrote: post #233
MiguelHudnandez wrote: post #196

I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes. Pull-only backups were the savior here, although because we didn't notice until the next day, the…

> opening a document as an e-mail attachment and not being able to find the actual file they edited I'm so sick of this. The "open/save" dialog is in sore need of being revamped. There's really no such thing as "open" anyway -- it's really "save to some obscure profile temp directory and then open". Try explaining "you can't open a file that's not first saved to disk" to a user, though.

But sometimes you want to just "open" a file. The fact that your computer may choose to save it is an implementation detail. In fact, most systems don't actually 'save' it in many senses of the word. Instead they write it to the file system in a way that indicates that it may be removed at any time without notifying the user. In fact, on Linux (I can't speak to any other OS), it is common for these temporary files never to actually be saved to the disk. Instead they are loaded into a RAM based file-system (tmpfs), usually found at "/dev/shm"

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#285

Post by MiguelHudnandez »

MiguelHudnandez wrote: post #274
keyme wrote: post #224

Earlier quoted context omitted.

"JPEGs were altered but still viewable". Could be a problem with their encryption. Care to share a before and after JPEG of something? For science?

For science, I will try to find one that is acceptable to share and post a before/after, or just the results of the comparison. What I recall from my initial investigation was that the binary was completely different, but opening the image did not indicate any changes. Almost like it was converted from RGB to CMYK or something.

I went back and found that I was mistaken. JPG files that were altered were in fact completely unreadable.

In the confusion, I missed that JPGs with certain naming patterns were encrypted and others were left alone. I took two unrelated facts, 1) that plenty of images were readable, and 2) that plenty of images had binary differences, and put them together to arrive at a faulty conclusion. I am not going to be too hard on myself based on how that day was going for me.

IMG_????.jpg and presumably DSC?????.jpg were encrypted and other patterns were left alone. I presume this is to inflict damage as quickly as possible without getting bogged down encrypting stuff from "Temporary Internet Files" for hours.

I wonder if they'd improve their conversion rate by leaving behind a thumbnail to remind people of how much they liked their pictures that now risk being gone forever.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#286

Post by MiguelHudnandez »

tempestn wrote: post #203
MiguelHudnandez wrote: post #196

I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes. Pull-only backups were the savior here, although because we didn't notice until the next day, the…

Something like CrashPlan provides good protection against this sort of thing for home users. It includes versioned, off-site backups -- either on their servers for around $6 a month, or on a "friend's computer" for free. Either way, the backups are saved via crashplan, not with direct drive access, so it should be safe against this kind of thing. No affiliation, just a user.

Thanks! I am looking at BackBlaze, Arq + Glacier, and now CrashPlan as relatively cheap additions for extra peace of mind.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#287

Post by Silhouette »

FedRegister wrote: post #257
Silhouette wrote: post #183

Earlier quoted context omitted.

Your proposal is OK if accessing sensitive information is something you only do occasionally, but it's not very practical to switch users completely if you deal with sensitive information often, which many people do. On the other hand, if only explicitly authorised applications can create outbound Internet connections at all, and if applications like browsers and e-mail clients need explicit permission to read a gene…

>Your proposal is OK if accessing sensitive information is something you only do occasionally, but it's not very practical to switch users completely if you deal with sensitive information often, which many people do. $ sudo -u banking gnucash & $ firefox & Done. My banking files and my Firefox session are now separated.

And for the 99.7% of users in the real world who drive their computers using a GUI and not a command line? Or those who do use a command line but aren't sufficiently competent with system administration to reliably get sudo-based access control right every time?

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#288

Post by mbreese »

WiseWeasel wrote: post #198
mbreese wrote: post #166

Earlier quoted context omitted.

There are both DNA and RNA viruses.

G(uanine), C(ytosine) and U(racil) are RNA nucleotides, so it seemed more appropriate somehow...

I missed the fact that you were referring to "GCU". That was a little too subtle for my simple mind. :)

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#289

Post by keyme »

MiguelHudnandez wrote: post #285
MiguelHudnandez wrote: post #274

Earlier quoted context omitted.

For science, I will try to find one that is acceptable to share and post a before/after, or just the results of the comparison. What I recall from my initial investigation was that the binary was completely different, but opening the image did not indicate any changes. Almost like it was converted from RGB to CMYK or something.

I went back and found that I was mistaken. JPG files that were altered were in fact completely unreadable. In the confusion, I missed that JPGs with certain naming patterns were encrypted and others were left alone. I took two unrelated facts, 1) that plenty of images were readable, and 2) that plenty of images had binary differences, and put them together to arrive at a faulty conclusion. I am not going to be too ha…

Ah, oh well. I hoped that maybe they've messed up the encryption by doing only file headers or random locations. Thanks for checking it out.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#290

Post by Wingman4l7 »

gizmo686 wrote: post #284
Wingman4l7 wrote: post #233

Earlier quoted context omitted.

> opening a document as an e-mail attachment and not being able to find the actual file they edited I'm so sick of this. The "open/save" dialog is in sore need of being revamped. There's really no such thing as "open" anyway -- it's really "save to some obscure profile temp directory and then open". Try explaining "you can't open a file that's not first saved to disk" to a user, though.

But sometimes you want to just "open" a file. The fact that your computer may choose to save it is an implementation detail. In fact, most systems don't actually 'save' it in many senses of the word. Instead they write it to the file system in a way that indicates that it may be removed at any time without notifying the user. In fact, on Linux (I can't speak to any other OS), it is common for these temporary files ne…

In a way, that's worse! You'll have someone "open" a file, maybe make some edits to it, save it -- and it won't indicate a problem with that because it's considered as a file on disk somewhere -- and then when they go to send it, they can't find it and it may have been overwritten / deleted.
Post reply on HN