Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 229 posts

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#41

Post by II2II »

floundy wrote: post #17
Phurist wrote: post #14

Earlier quoted context omitted.

Or you know... just use Linux

Every couple of years I give daily driving Linux a try. I still find that old joke about "Linux is only free if your time is worth nothing" to be quite apt.

I don't know what your use case is, so what I'm about to say may not be relevant.

When you're making the transition from one operating system to another, there is going to be an investment of time. It doesn't matter whether you are moving from Windows to Linux or from Linux to Windows. When it comes to getting things done, each operating system is going to have its own strengths and weaknesses. Our attention is going to be drawn towards the weaknesses of what we are trying out because that is what we are going to spend the most time addressing. Our attention is going to drift away from the weaknesses of what we are familiar with since we have long since learned to circumvent or ignore them.

What I am suggesting is that I would spend as much time learning how to daily drive Windows as you would learning how to daily drive Linux. Unfortunately, I cannot draw upon quips like "Windows is only free if your time is worth nothing" since Windows is not free. I have a copy of Windows 11 Professional that cost significantly more than any given component of the computer it runs on.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#42

Post by userbinator »

exiguus wrote: post #37

There is evidence that this will worked for ransomware like Patya and for groups like Fancy Bear or Cozy Bear and Conti. Mostly because the Russia gov. unofficial guaranties immunity if the target is not Russian. Also, if you identify as Russian or write Russian in the chats or mails to them, they will de-crypt your systems for free.

Also, if you identify as Russian or write Russian in the chats or mails to them, they will de-crypt your systems for free.

I wonder how that works in this era of AI translation.

Not quite the same but I remember there was a Russian shareware author who gave free licenses to Russians.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#43

Post by cortesoft »

Phurist wrote: post #14
Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

Or you know... just use Linux

There are many reasons someone might have to use Windows. I have a Windows box because a number of games I play don’t support Linux, even with WINE and Proton.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#44

Post by [deleted] »

Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

[deleted]

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#45

Post by Aachen »

Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

https://xkcd.com/1200/

It feels bad to post a link-only response but I really don't have anything to add to it. On a system used by multiple persons, sure, you help prevent that a compromise on sister's account immediately impacts mom's and dad's accounts, but that qualification isn't in the comment and probably most computers that HN readers use are single user. Or on a server, dropping privileges speaks for itself. But if you're on a desktop and you do online banking in your browser and also open email attachments on that computer... Not being admin would only help clean up the situation without needing to make a live boot (namely, you could theoretically trust the admin user and switch to that) but this isn't recommended practice anyway if you're not a malware specialist and can make sure it is fully gone. I cannot think of any situation where a single user desktop system benefits from admin privilege separation

So basically, what the comic conveys

> The best anti malware

Not being admin doesn't prevent malware from running and gaining persistence within your user account...

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#47

Post by zahlman »

Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

> If an admin elevation popup happens when you haven't triggered it then you probably know something is wrong. And most malware will not be able to install.

Malware can still do a lot without "installation". Running as an unprivileged user, it can still do anything to/with the filesystem that the user would be able to do, and will (on most normal setups) be able to make outbound Internet connections without limitation. In short, these kinds of privileges don't protect against data exfiltration, ransomware operating on the user's important data files, simple vandalism....

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#49

Post by zahlman »

floundy wrote: post #33
pkulak wrote: post #24

Earlier quoted context omitted.

Do you mind elaborating a bit on what went wrong? Like, were you installing on a recent MacBook, or something else not well supported? In my experience, installing and running a popular distro is absolute cake. Easier than Windows, even, since you aren’t forced to create cloud accounts and answer a million privacy questions; you basically install then boot right into your new desktop.

Used it on various devices. A Dell laptop (with power switching between dedicated and iGPU, what a nightmare that was for Linux display drivers), a desktop I built myself, a Raspberry Pi running RPi OS. I find most things fine in Linux and I'm fairly comfortable with the terminal. However it's the 10% or so of things that are very cumbersome in Linux but instant in Windows/Mac that drive me away. Example: There is no…

Have you tried just using it in browser?

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#50

Post by gerdesj »

EvanAnderson wrote: post #25
Phurist wrote: post #14

Earlier quoted context omitted.

Or you know... just use Linux

There's nothing magical about the Linux security architecture, when it comes to malware, aside from abysmal Linux market share. If it were popular it would be targeted. That's not to say there's no value. It's a case of security by obscurity, at best. The Unix security model is much more simplistic than Windows NT. Everybody disables SELinux so there's no meaningful capabilities functionality. Assuming you actually d…

"Everybody disables SELinux"

That implies you are probably using a RH jobbie. With no working whatsover, I assert that many more Linux desktops will be rocking apparmor or no kernel security module.

Oh and no I don't disable SELinux, except as a quick check to see if that is what is causing issues. Obviously I'm not everyone, but I am someone.

Post reply on HN