Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 229 posts

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#61

Post by seb1204 »

Aachen wrote: post #45
Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

https://xkcd.com/1200/ It feels bad to post a link-only response but I really don't have anything to add to it. On a system used by multiple persons, sure, you help prevent that a compromise on sister's account immediately impacts mom's and dad's accounts, but that qualification isn't in the comment and probably most computers that HN readers use are single user. Or on a server, dropping privileges speaks for itself.…

So the mum or grandpa should also use an admin account to execute the file they just downloaded?

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#62

Post by ivan_gammel »

userbinator wrote: post #42
exiguus wrote: post #37

There is evidence that this will worked for ransomware like Patya and for groups like Fancy Bear or Cozy Bear and Conti. Mostly because the Russia gov. unofficial guaranties immunity if the target is not Russian. Also, if you identify as Russian or write Russian in the chats or mails to them, they will de-crypt your systems for free.

Also, if you identify as Russian or write Russian in the chats or mails to them, they will de-crypt your systems for free. I wonder how that works in this era of AI translation. Not quite the same but I remember there was a Russian shareware author who gave free licenses to Russians.

> I wonder how that works in this era of AI translation

Simple translation isn’t enough to show cultural proximity. Patterns of speech are different. You can try to use AI to do the entire conversation, but e.g. Claude will refuse to give you exact phrases, since he is correctly assuming it is a social engineering attack.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#63

Post by exiguus »

Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

Usually, private individuals are not the target of ransomware attacks by organized criminals. Companies often have to pay a lot more money to get their data back. The Petya ransomware is a good example of this.

Nevertheless, when you are on any machine as an intruder and have normal user rights, you can still actively search the machine and network for admin accounts and steal sessions. The ultimate goal is to gain Domain Admin rights.

Besides that, it is not necessary to have admin rights to delete and encrypt data or to run and hide software.

There are also many ways, besides stealing sessions, to gain admin rights, such as through unpatched software, inappropriate user rights, zero-day exploits, and social engineering.

A common way to get users to install malware or ransomware is to bundle it with useful software that the user wants to install.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#64

Post by ronsor »

DelaneyM wrote: post #59
thrtythreeforty wrote: post #53

Earlier quoted context omitted.

Is there any downside to unironically doing this? Seems like it'd actually work.

It’s not much harder to just harden your system to not be vulnerable in the first place, and that protects your from a lot more.

Please tell me what tools you use to receive future zero-day vulnerability patches.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#65

Post by eestrada »

Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

The best anti malware on any version of windows has always been to not run windows.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#66

Post by pogue »

EvanAnderson wrote: post #19
Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

> The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. In the early 2000s up thru about 2012 I'd agree with you. Post-Vista malware adapted to UAC and now all malware works well as a normal user. Any data your normal user can access (local or on a remote CIFS server) is fair game for ransomware. Limiting administrator rights doesn't do anyt…

What are these "quasi-malicious customized versions of Chrome" you're referring to?

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#67

Post by atemerev »

exiguus wrote: post #37

There is evidence that this will worked for ransomware like Patya and for groups like Fancy Bear or Cozy Bear and Conti. Mostly because the Russia gov. unofficial guaranties immunity if the target is not Russian. Also, if you identify as Russian or write Russian in the chats or mails to them, they will de-crypt your systems for free.

It's not that simple, I think. There are many Russians everywhere, and probably they work at victim companies too, so just being Russian won't be enough, if ransom could be in the millions. You'll have to convince them that the company is Russian-owned, or that your father works in FSB, or whatever.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#68

Post by danielschreber »

DelaneyM wrote: post #59
thrtythreeforty wrote: post #53

Earlier quoted context omitted.

Is there any downside to unironically doing this? Seems like it'd actually work.

It’s not much harder to just harden your system to not be vulnerable in the first place, and that protects your from a lot more.

Wikipedia's page on "just intonation" is, oddly, about music.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#69

Post by dfedbeef »

pogue wrote: post #66
EvanAnderson wrote: post #19

Earlier quoted context omitted.

> The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. In the early 2000s up thru about 2012 I'd agree with you. Post-Vista malware adapted to UAC and now all malware works well as a normal user. Any data your normal user can access (local or on a remote CIFS server) is fair game for ransomware. Limiting administrator rights doesn't do anyt…

What are these "quasi-malicious customized versions of Chrome" you're referring to?

Edge? (joking)

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#70

Post by pogue »

floundy wrote: post #17
Phurist wrote: post #14

Earlier quoted context omitted.

Or you know... just use Linux

Every couple of years I give daily driving Linux a try. I still find that old joke about "Linux is only free if your time is worth nothing" to be quite apt.

I would recommend giving Linux Mint a try. It's very newbie friendly with a desktop like environment of Windows, automatic backup creation, and a store to install pretty much any software you need from. I got my elderly parents to try it & they were both able to figure it out quite quickly!

I also hear good things about ZorinOS as it's built as a full fledged Windows alternative with built-in WINE to run native Windows apps in

You can play with them both at this link without having to install anything:

https://distrosea.com/

Post reply on HN