Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WanaCrypt0r Ransomworm

baesystemsai.blogspot.com

Post reply on HN
Print view View original

41–50 of 71 posts

Re: WanaCrypt0r Ransomworm

#41

Post by SamUK96 »

hvs wrote: post #28
frik wrote: post #23

Earlier quoted context omitted.

1998 was still a great year in Windows world. In 1999 the DotNet vision made lot's of things kind of legacy - kind of, because despite all odds Win32 and shell32/Explorer are still thriving where as DotNet Framework is now officially legacy tech. And UWP hasn't caught on, as mobile is dead end for MS and their Store is incredible bad. True Visual Studio was really great. And like many, one had a VS6 and VB6 install s…

"Back in the 1990s MS was a good company." Umm, isn't that precisely the period when they were charged with antitrust violations? Such a short memory we have.

I think the OPs context for "good company" is "good company _for coders/hackers_". You can have a company behaving in an anti-trustworthy way, but their software still be _good_.

Also, their antitrust violations was due to the Windows OS and anti-competitive behaviours, if i'm not mistaken? If so, then this is not really relevant to their software or OP's post, but more their business approach of locking out competition, which is a question of legality and economics.

Re: WanaCrypt0r Ransomworm

#42

Post by paradite »

RichardHeart wrote: post #30
sp00ls wrote: post #24

Earlier quoted context omitted.

I don't know a single person who would pay upwards of $300 to get their files back if they got hit with ransomware. Hell, I've got something like 10 years of personal files on my machine and I wouldn't pay that much for them. I would bet a lot more people would be willing to pay if the fee was more like $50. That takes it out of the category of 'a lot of money for computer files' for a lot of people and puts it in th…

Sounds like it would be more profitable to just lock out the device than encrypt the files, for its internet browsing value may exceed its file storage value.

It's much easier to recover from lock out (without losing data) than decrypting the file.

Re: WanaCrypt0r Ransomworm

#43

Post by SmellyGeekBoy »

sp00ls wrote: post #24
RichardHeart wrote: post #19

Evil Ransomware improvements we may see: 1. New address per machine (easier to detect payments made, hides profit total.) 2. Deterministic wallet stores all profit in a simple 12 word seed "password." 3. Phone numbers directly to bitcoin vendors. (people running insecure systems love phones.) 4. Phone number to tech support company that bills your credit card to walk you through paying the ransom. 5. Delayed symptoms…

I don't know a single person who would pay upwards of $300 to get their files back if they got hit with ransomware. Hell, I've got something like 10 years of personal files on my machine and I wouldn't pay that much for them. I would bet a lot more people would be willing to pay if the fee was more like $50. That takes it out of the category of 'a lot of money for computer files' for a lot of people and puts it in th…

> Their machines are more like just gateways to the internet than anything.

I've been in the same boat and how absolutely right you are. Generally everything they do online is tied to their webmail-based, ISP-supplied email address too, making for a total nightmare when they want/need to change ISP.

Re: WanaCrypt0r Ransomworm

#44

Post by scott00 »

scraft wrote: post #38
sp00ls wrote: post #24

Earlier quoted context omitted.

I don't know a single person who would pay upwards of $300 to get their files back if they got hit with ransomware. Hell, I've got something like 10 years of personal files on my machine and I wouldn't pay that much for them. I would bet a lot more people would be willing to pay if the fee was more like $50. That takes it out of the category of 'a lot of money for computer files' for a lot of people and puts it in th…

Hmm, I'd certainly consider it, most based on not wanting to deal with the consequences of formatting the machine and starting again (installing programs, set up various setting/configuration options, etc.) I can't 100% say I would, but maybe.

If I got ransomwared I would definitely reformat the drive and reinstall the OS. There's no telling what kind of malware garbage they leave behind. Seems like it would make a lot of sense for the criminal to add you to their botnet, even after decrypting your files.

Re: WanaCrypt0r Ransomworm

#45

Post by ballenf »

paulddraper wrote: post #27
tomlong wrote: post #15

Earlier quoted context omitted.

A fair amount of ransomware is distributed via email, so it's not such a bad idea when this issue is front and centre and all over the news to reinforce good behaviour amongst users. It's not like 'stop clicking random shit in emails' is bad advice.

Why the hell can't I click shit in random emails? It's a friggin email and data transfer for crying out loud. Stop blaming users.

Agreed. We took the name "e-mail" from regular mail. There has only been one case in history of everyone being told to be careful about opening their mail: the anthrax threat. Still remember a bunch of mail arriving with very brittle paper and burnt edges...

So, the big mistake was to use a real world analog in naming e-mail. We should have called it:

"Russian roulette with packages* anonymously tossed by strangers in your direction".

The analogy is broken and creates cognitive dissonance in users.

* Re: data vs. executable: the analogy could be for letter vs. package. A box is big enough to contain a mechanism for action unlike most letters.

(Apologies to the Russians for that idiom.)

Re: WanaCrypt0r Ransomworm

#46

Post by pas »

unklefolk wrote: post #7
raffomania wrote: post #3

according to the article, the balances of the bitcoin addresses collecting the ransoms are 15.13562354 BTC = $26410 13.78022431 BTC = $24045 5.98851225 BTC = $17361 Assuming $300 per ransom, this works out to a total of 226 victims who paid. this seems a little low compared to the huge amount of infected devices.

I think this venn diagram explain part of the problem: https://www.trustar.co/wp-content/uploads/2017/05/WannaCryVe...

How did the 300M USD CryptoWall cashed that much?

Re: WanaCrypt0r Ransomworm

#47

Post by pas »

koolba wrote: post #20
wyldfire wrote: post #6

Earlier quoted context omitted.

Earlier reports I'd heard said that this group was unprepared or poorly prepared to handle the incoming ransom. Many of these ransomware campaigns use a fully automated mechanism to deliver keys upon payment, this group did not.

How does that work in practice? Do the decryption keys get stored in the block chain as well or out of band?

out-of-band, probably sent via email or managed through the "malware app" itself.

Re: WanaCrypt0r Ransomworm

#48

Post by sp332 »

Piskvorrr wrote: post #29
paulddraper wrote: post #27

Earlier quoted context omitted.

Why the hell can't I click shit in random emails? It's a friggin email and data transfer for crying out loud. Stop blaming users.

Oh, you can . Just like you can inject any random substance given to you by a stranger. Being aware that both are high risk activities is the point, methinks.

There's absolutely no reason that sending a link to someone should be able to pwn their box. There's no reason to make such fragile email systems.

Re: WanaCrypt0r Ransomworm

#49

Post by sp332 »

drzaiusapelord wrote: post #35
paulddraper wrote: post #27

Earlier quoted context omitted.

Why the hell can't I click shit in random emails? It's a friggin email and data transfer for crying out loud. Stop blaming users.

Because when your run content in executables, in the case of Ransomware its usually Word macros or js files, those programs run with your user rights, which have read/write permissions for your files. Now you lose your files and you expect the IT department to fix everything for you, instead of doing what the IT department says or using common sense. Funny how that works. You want all the power but none of the respon…

Word disabled macros by default. You can set JS and MHT files to open with something harmless (like notepad) instead of being executed too. We don't have to let "executable" files execute if we don't want them to. There's no reason to take the decision away from the user by default.

Re: WanaCrypt0r Ransomworm

#50

Post by robinwassen »

simias wrote: post #25

I'm surprised by how carefully the worm seems to be coded. They make sure they have an internet connection, they check for disk space in order not to run out while encrypting, they save a backup copy of the "tasksched" executable before replacing it, they shutdown databases (I assume in order to prevent corruption?) etc... I guess they want to make sure the decryption process will work without any issue so that the v…

I would guess the shutdown of apps are not of good intent, rather to release file locks so they can delete the unencrypted database and exchange files.
Post reply on HN