Another Ransomware Outbreak Is Going Global • Hacker News Board

Re: Another Ransomware Outbreak Is Going Global

#431

Post by rkuykendall-com » Thu, Jun 29, 2017, 10:17 PM UTC

Animats wrote: post #381

Scoundreller wrote: post #376

Earlier quoted context omitted.

And the next relevant update: 6/27/2017 7:11:15 PM As of 6:30 Tues. 6/27, APM Terminals employees are still without email or office telephone services. No emails or voicemails can be accessed or answered. Please standby for PA Alerts or for critical matters please contact Giovanni Antonuccio (908) 966 - 2779.

That's bad. Maersk hasn't been communicating with the shipping industry. Journal of Commerce says nobody is getting useful info about Maersk's status.[1] Now we have a hint as to why - they can't even communicate internally. The Maersk site still has nothing but a statement that they are down. Maersk's Twitter feed has nothing useful. No press releases. The only useful comments are coming from non-Maersk port employe…

> Maersk's Twitter feed has nothing useful

I wouldn't be surprised if nobody had access to the password.

Re: Another Ransomware Outbreak Is Going Global

#432

Post by ryanlol » Fri, Jun 30, 2017, 12:35 AM UTC

notgood wrote: post #430

ryanlol wrote: post #425

Earlier quoted context omitted.

>I got bored to keep answering, in general your points seem week which make you sound a bit too much like a ransomware creator. Probably not because you have 3 years here but otherwise you do. Not a ransomware creator but I understand the economics at play. Ransomware is more profitable than sending spam, unless you're spamming to spread malware. The value of individual installs has historically averaged at signifi…

Not really, ransomware is way more dangerous than selling viagra; I may want to kill you if you encrypt my data, not so much if you sell me a couple of viagra pills that don't work. When you scam someone (e.g nigerian scam) you take money from one (or a few) person only, here you are taking data from a lot of people and hoping some very few will pay; making a lot more enemies in the process, likely including state ac…

Diminishing returns, running spam botnets is already so risky that making more enemies by graduating to ransomware probably doesn't make a perceptible difference. Do you go to prison for 25 years or 30?

Sure, you could probably deter ransomware by sending DEVGRU to murder the authors, but I doubt it's worth the political shitstorm that'd follow.

Re: Another Ransomware Outbreak Is Going Global

#433

Post by comboy » Fri, Jun 30, 2017, 8:35 AM UTC

notgood wrote: post #429

comboy wrote: post #428

Earlier quoted context omitted.

The ransomware can present the key fingerprint for example. But even without it, there are so many options, e.g. timestamp signed message on the blockchain before the release. After just one confirmed message you don't care about pretenders because people can check if the signature matches with the previous message.

I think you are overestimating the technical capacities of the average randomware victim.

It's enough that some technical people verify it. The average random victim gets his info from news sites and more technical friends.

Re: Another Ransomware Outbreak Is Going Global

#434

Post by spacemanmatt » Sun, Jul 02, 2017, 4:55 PM UTC

jbergstroem wrote: post #162

samstave wrote: post #114

Earlier quoted context omitted.

1997 here :-) hat was that XP xploit app from back then... I cant recall what it was called...

teardrop?

landattack

Re: Another Ransomware Outbreak Is Going Global

#435

Post by hypervis0r » Sun, Jul 09, 2017, 7:58 PM UTC

fosco wrote: post #418

hypervis0r wrote: post #220

Earlier quoted context omitted.

Not OP, but he is right. I just walked out of work, where I had to reverse the sample. It indeed uses EternalBlue (attacks by enumerating local network IPs with Windows APIs and randomly scanning the internet). Apart from that, it overwrites the MBR with a custom bootloader and schedules a restart ("shutdown /t /r") as SYSTEM in a random amount of time. After rebooting, it fakes a chkdsk and meanwhile, encrypts your…

can you share literature on what tools you used to reverse engineer and maybe other items worth reading if I am interested in this type of research?

Literature: sorry no, I didn't read anything; everything I know is from practice.

As for the tools: just IDA Pro, really, if you don't count the standard stuff: a VM to avoid getting the host infected (VirtualBox), Burp (to analyze malware HTTP traffic), etc. Nothing too fancy.