Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Another Ransomware Outbreak Is Going Global

forbes.com

Post reply on HN
Print view View original

321–330 of 435 posts

Re: Another Ransomware Outbreak Is Going Global

#321

Post by Programmatic »

willstrafach wrote: post #298
Programmatic wrote: post #293

Earlier quoted context omitted.

A signed malicious update would be a Big Deal(tm), but the entity would also be able to survive it by claiming it was negligence. I don't believe negligence has not been significantly penalized in the marketplace, aside from perhaps CAs where damage can be limited (prevent new certs from being seen as valid, plenty of other options for sites). There's no such option available for penalizing Microsoft, and their lock-…

Their update signing is surely performed using an HSM with strict procedures for getting production builds signed, due to the exceptional sensitivity. I think you might underestimate the gravity of such a thing happening, it would not be glossed over.

What are the alternatives once an event occurs and Google/Microsoft/Redhat/?? claim it was an accident outside of their control (possibly due to negligence)? Yes, outside experts will be investigating to the best of their ability and there will be a statement about what measures have been put in place to mitigate the issue in the future. But what else would happen?

Re: Another Ransomware Outbreak Is Going Global

#322

Post by slim »

zmmz wrote: post #33
mihaifm wrote: post #2

> with WannaCry it was alleged a nation state was likely responsible for spreading the malware: North Korea Is there any evidence for this? Looks like another fake rumor.

There's an article on it in NYT which provides a short list of the reaons: https://www.nytimes.com/2017/05/22/technology/north-korea-ra... It basically comes to it looking like Lazarus Group The WannaCry attacks used the same command-and-control server used in the North Korean hack of Sony Pictures Entertainment in 2014, which wiped out nearly half of the company’s personal computers and servers. ... Other digital cr…

Then WikiLeaks published CIA's Marble Framework

https://wikileaks.org/ciav7p1/cms/page_14588467.html

Re: Another Ransomware Outbreak Is Going Global

#323

Post by narrator »

inb4dangshitban wrote: post #305
merrickread wrote: post #216

Earlier quoted context omitted.

I dream of seeing a "security first" development process adopted ..

I predict that this is might be a start of a something akin to few catastrophic bridge collapses that really showed the importance of credentials in engineering. Maybe the era of software "engineers" will come to an end eventually

Do you think the engineers at Microsoft who were responsible for these badly designed and buggy systems wouldn't have been able to get credentials?

Re: Another Ransomware Outbreak Is Going Global

#324

Post by dotancohen »

tyingq wrote: post #135
maddyboo wrote: post #127

Does anyone know if any tools exist on Linux which can be used for early detection of ransomeware? Something that monitors file access, disk activity, etc. for suspicious behavior and can trigger some action or alert? I think I remember some discussion about using a 'canary file' - some innocent looking file with known contents which should never be modified. If a modification is detected, you know something fishy is…

Aide is a popular utility to monitor for changes to files on Linux systems. http://aide.sourceforge.net You could also use the built in audit subsystem if you wanted to watch a specific canary file, directory, filesysyem, etc. https://www.linux.com/learn/customized-file-monitoring-audit...

I'd like to emphasize the canary file. This is a file that you should never access in normal operations. Thus, if the file was in fact accessed, that is a sign that something is scanning your file system.

Depending on the threat, such a scan might be a good reason to pull the cord from the mains socket. You don't want to let a normal shutdown occur, rather pull the cord and mount the disk on another system to recover / analyze.

Re: Another Ransomware Outbreak Is Going Global

#325

Post by hutzlibu »

sillysaurus3 wrote: post #242
devcpp wrote: post #234

Earlier quoted context omitted.

Are you sure about that? You do know most organizations will implement that as a huge amount of bureaucracy for every commit, rather than proper man-hours of security-oriented development.

Only because most organizations don't know how to be effective at security. It's not hard. You don't actually have to change much. You just have to schedule regular pentests, ideally every couple weeks. Pentests protect everyone because it's our job to worry about all of the security flaws that you can't possibly be aware of in your normal day-to-day development cycle. There's just too much for any organization to kn…

"It's not hard."

No, it is not, you just need skilled people working on it. Oh, those people want money for it ...

Re: Another Ransomware Outbreak Is Going Global

#326

Post by zanny »

yodon wrote: post #104
HalfwayToDice wrote: post #93

Earlier quoted context omitted.

This is absurd nonsense, but my viewpoint is a lonely one on HackerNews.

You're not the only one who thinks the idea of wearing a tin foil hat when you use Windows because the NSA only knows how to attack Windows is demeaning to the intelligence of other tin foil hat wearers.

What should I trust more:

A trade secret proprietary and obfuscated operating system from an organization known to collude with the government

Or

Code I have read in part, and know others read, and stand to believe that among all of us using those with the money or time would also audit

Given, we are all on predominantly x86 computers with proprietary obfuscated control processors that can seize control of the system and do whatever they are told by the manufacturer / those the manufacturer gives access to, so the security is in general a whiff.

Or more generally, don't use Linux for a false sense of security, because the security holes go much, much deeper than just the kernel and whats running on top of it, and Linux itself is nothing outstanding from a security architectural standpoint.

Re: Another Ransomware Outbreak Is Going Global

#327

Post by SippinLean »

dx034 wrote: post #249
jpttsn wrote: post #119

Earlier quoted context omitted.

Bitcoin hasn't enabled ransomware. There was ransomware before.

How did that work? Sending money via western union? Wouldn't work in a large scale operation.

Via anonymous prepaid cash service, like what Reveton used. Supposedly the attackers made millions; to your credit some were eventually tracked down by following the payments. Unclear if it's because of the way they laundered the money.

Fusob demanded payment in redemption codes for iTunes gift cards.

Re: Another Ransomware Outbreak Is Going Global

#328

Post by tudorconstantin »

theossuary wrote: post #255
tudorconstantin wrote: post #178

Earlier quoted context omitted.

So far this year, Windows leads the scorecard regarding mass infections and business downtime due to them. So while indeed, open source is not a guarantee for better security, the results are in its favor. It might also be because it's not such an attractive target to hackers due to its low share in the desktop market. But still there millions of linux servers online 24h/24h and I assume they have a bigger potential…

Windows also leads the score card in installation base, which I think is the real causal relationship. If Linux was installed on 90% of desktops you better well believe there'd be a similar number of exploits for it. Something similar happened to Mac OSX not too long ago, as they grew in popularity more and more exploits were found for the operating system.

That's what I tried to express above. I was also wondering what is more profitable in the ransomware economy: infect many, almost worthless machines? Or infect an order or two of magnitude fewer machines, but with a higher chance of paying?

I'd say with a higher chance of paying because people administering them are more likely to know how to buy bitcoins, how to send them and what to do with the decryption key.

Re: Another Ransomware Outbreak Is Going Global

#330

Post by dotancohen »

the_cat_kittles wrote: post #101

i said this before and it was met with mostly hostility, but im still wondering... bitcoin has enabled ransomware, so its a boon to crooks. what has it done for non-crooks? i dont mean conceptually (no fed! decentralized! etc. etc.), i mean since its come into being, what has it done for you personally? for me: i bought a vpn subscription, anonymously. probably not able to do that as easily without btc. but, i would…

> i mean since [bitcoin] [has] come into being, what has it done for you personally?

You mean, besides the roads, and the wine, and the aquaduct?

Post reply on HN