Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The No More Ransom Project

nomoreransom.org

Post reply on HN
Print view View original

71–80 of 241 posts

Re: The No More Ransom Project

#71

Post by notahacker »

hrehhf wrote: post #23
toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

In a twisted sort of way, a person could destroy trust that paying the ransom will actually get your data back. Someone could create ransomware that will never decrypt, even after the ransom is paid. Once the victims know the dishonest ransomware is out there, that may ruin the revenue towards the "honest" ransomware.

Or we could be slightly less nefarious and create ransomware that decrypts everyone's stuff after the allotted time but leaves a congratulatory "thank you for not cooperating with criminals" message to the people that didn't pay...

Re: The No More Ransom Project

#72

Post by catshirt »

rhapsodic wrote: post #7
philippnagel wrote: post #3

Earlier quoted context omitted.

It's legit. Informational website about ransomware and what to do in case your device is affected. Apparently sponsored/endorsed/whatever by Europol, the Dutch Police, Kaspersky, Intel, AWS and Barracuda.

> It's legit. Informational website about ransomware and what to do in case your device is affected. That's good to know, but the ransomware criminals probably have the skills, and they definitely have the incentive, to pwn that site.

so like, you just don't go to any websites ever? or what?

Re: The No More Ransom Project

#74

Post by nom »

CalChris wrote: post #31

So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/... Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them. I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. Th…

The ransomware scheme only works because the users actually get their files back and the prices are pretty reasonable for many victims. The perpetrators spend a lot of time on the ransomware and its backend. The better it works works, the more people will pay. They rely on people like us to spread the word that it's not a scam, it's real and it works.

Now that I think about it: It would really damage the whole ransomware scheme if there were fake / rogue versions that won't decrypt, wouldn't it?

Re: The No More Ransom Project

#75

Post by nom »

djsumdog wrote: post #36
martey wrote: post #28

Earlier quoted context omitted.

> Someone could create ransomware that will never decrypt, even after the ransom is paid. This already exists: http://arstechnica.com/security/2016/07/posing-as-ransomware... > "Once it executes it, it pops up a ransom message looking like any other ransomware," Earl Carter, security research engineer at Cisco Talos, told Ars. "But then what happens is it forces a reboot, and it just deletes all the files. It doesn't…

Makes me wonder if it's just buggy or intentional.

Considering that the operators must actively keep the backend alive and support the users, it's more likely they abandoned it for whatever reason.

Re: The No More Ransom Project

#77

Post by TeMPOraL »

nom wrote: post #74
CalChris wrote: post #31

So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/... Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them. I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. Th…

The ransomware scheme only works because the users actually get their files back and the prices are pretty reasonable for many victims. The perpetrators spend a lot of time on the ransomware and its backend. The better it works works, the more people will pay. They rely on people like us to spread the word that it's not a scam, it's real and it works. Now that I think about it: It would really damage the whole ransom…

> It would really damage the whole ransomware scheme if there were fake / rogue versions that won't decrypt, wouldn't it?

Or a single fake story about how ransom doesn't give your data back, published in a high-profile newspaper.

Come to think of it, our news sources write bigger lies every day, here they could actually do some good without any risk to their own reputation.

Re: The No More Ransom Project

#78

Post by awesomepantsm »

nom wrote: post #74
CalChris wrote: post #31

So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/... Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them. I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. Th…

The ransomware scheme only works because the users actually get their files back and the prices are pretty reasonable for many victims. The perpetrators spend a lot of time on the ransomware and its backend. The better it works works, the more people will pay. They rely on people like us to spread the word that it's not a scam, it's real and it works. Now that I think about it: It would really damage the whole ransom…

Exactly, but it will never be zero. There will always be scammers trying to get rich quick on the trust users have placed in the (more) honest scammers. All organized crime has to deal with some amount of posers trying to cash in on their reputation.

Sometimes the way they keep the dishonest guys in line is by attacking others who try to get in on the scheme. Traditionally this would be breaking people's knees, and I imagine well-organized cyber crime boils down to the same thing in the end.

Re: The No More Ransom Project

#79

Post by michaelbuckbee »

The guy that made HaveIBeenPwned.com (which I'd urge everybody to use) has a solid free course on Ransomware essentials at: https://www.varonis.com/learn/introduction-to-ransomware/

It's not the ideal thing for people here on HN, but it's pretty much the ideal thing to send to your non/semi-technical boss or stakeholder at your company who isn't taking ransomware seriously.

Re: The No More Ransom Project

#80

Post by ndesaulniers »

codedokode wrote: post #64
tarr11 wrote: post #41

Is using a VM to surf the web a reasonable answer? Are there any VMs (for my MBP for example) that are reasonably fast, don't take a lot of battery, and not clumsy? Can't this be built into the OS so I don't actually have to do it?

Something like this is built into Android and iPhone. As all major desktop OSes are only good in protecting one user from another mobile OSes run every application under its own user account. So vulnerability in an image viewer would not give an attacker access to other apps' data. But the system is not perfect, for example the kernel can still be attacked (and as we know a lot of vulnerabilities were found in Linux…

> So vulnerability in an image viewer would not give an attacker access to other apps' data.

By having separate user's per app, apps can't read each others' files by default. If one app has a vulnerability that can be used to acquire root, that app can read all files after disabling SELinux.

Post reply on HN