Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Worsening State of Ransomware

cacm.acm.org

Post reply on HN
Print view View original

81–90 of 139 posts

Re: The Worsening State of Ransomware

#81

Post by Sebb767 »

Rygian wrote: post #66
bradleyjg wrote: post #42

Earlier quoted context omitted.

Crypto, or at least bitcoin, is not anonymous. On the contrary the payment trail is there for the whole world to see. Governments could blacklist those coins such that no exchange or legitimate vendor would ever take them. They choose not for whatever reason but not because the technology offers anonymity.

For this to work, the blacklist should apply to the receiving wallet AND CASCADE through to wallets to which that wallet issued any subsequent transfers. Coins used to pay ransomware should effectively taint and freeze everything they touch.

So you want to convert them to a free weapon to freeze random wallets? Guess you could use that dor demanding ransoms...

Re: The Worsening State of Ransomware

#83

Post by dgellow »

Thorentis wrote: post #78

My prediction: Ransomware will be the scapegoat that leads the way on making the use of encryption a criminal offence. This is exactly what many governments want. Up till now, the best argument against encryption is "we can't see what criminals are doing", but that isn't very tangible for many people. Just wait until a powergrid or water treatment plant in the US is down for weeks due to being "attacked with encrypti…

Let's say you outlaw encryption, what would be the impact on ransomware criminals? They will continue not following the law and do their criminal things, using "illegal encryption" (aka non-backdoored encryption).

Re: The Worsening State of Ransomware

#84

Post by tw04 »

Thorentis wrote: post #78

My prediction: Ransomware will be the scapegoat that leads the way on making the use of encryption a criminal offence. This is exactly what many governments want. Up till now, the best argument against encryption is "we can't see what criminals are doing", but that isn't very tangible for many people. Just wait until a powergrid or water treatment plant in the US is down for weeks due to being "attacked with encrypti…

I doubt it, my guess is it will (understandably) be used as the scapegoat to kill cryptocurrency and/or put it under a central authority controlled by governments.

Ransomware was basically non-existent before criminals had a way of being paid anonymously.

Re: The Worsening State of Ransomware

#86

Post by wrycoder »

xen2xen1 wrote: post #7

Funny that nightly tape backups, a very old and established technology, would pretty much fix the problem.

Not necessarily. From the article:

The encryption process ensues over days, weeks, or months, normally progressing through hard drives, attached drives, and network devices. The C&C server decrypts files as they are needed. Along the way, crooks place a ransom note in every folder that has encrypted files; they might also plant other types of malware on systems. During the final stage of an attack, the ransomware uninstalls itself, the thieves remove the encryption key from the infected system and the victim sees a ransom note on the computer screen.

If the encryption goes on over a long enough period, recovery would be a nightmare or even impossible, especially if the tape rotation period is exceeded.

Re: The Worsening State of Ransomware

#87

Post by echelon »

Thorentis wrote: post #78

My prediction: Ransomware will be the scapegoat that leads the way on making the use of encryption a criminal offence. This is exactly what many governments want. Up till now, the best argument against encryption is "we can't see what criminals are doing", but that isn't very tangible for many people. Just wait until a powergrid or water treatment plant in the US is down for weeks due to being "attacked with encrypti…

This is one of the reasons crypto sucks. I'm building a list:

- Attacks sovereign currencies and ability of countries to set fiscal and monetary policy. Instead, it rewards "crypto geniuses" that got in early. I'm not sure these are the people that should have power over our elected governments.

- A waste of human and resource capital that could be spent solving more important problems

- Hugely bad for the environment

- Lack of KYC that enables money laundering, terrorism, and other illicit activities. Including randomware attacking hospitals

- Rewards pump and dump and crazy schemes like NFTs that don't contribute to innovation or the economy

- Relies on cryptography to remain post-quantum safe

Re: The Worsening State of Ransomware

#88

Post by Ajedi32 »

chefkoch wrote: post #77
mikewarot wrote: post #56

Earlier quoted context omitted.

If the backups are made by the system, and the user can't access them, and the system protects itself (and the backups, obviously)... ransomware shouldn't be possible. No matter what the application does, it can't access the backups in such a system.

> If the backups are made by the system, and the user can't access them, and the system protects itself (and the backups, obviously)... ransomware shouldn't be possible. And if the gang get's admin rights on the box your backups are gone.

That's a much higher bar to clear, particularly if end-users don't have admin access to their workstations.

Re: The Worsening State of Ransomware

#89

Post by PeterisP »

mikewarot wrote: post #73
PeterisP wrote: post #53

Earlier quoted context omitted.

The OS, files and configuration which can be unchangeable are trivially replaceable and thus does not really need to be protected. The configuration and data which gets changed all the time is valuable (the effort that was made in making those changes) and the prime target of ransomware, and it can't be write-protected because, well, it needs to get changed. I mean, if "reimage all these computers to the default conf…

>The OS, files and configuration which can be unchangeable are trivially replaceable and thus does not really need to be protected. Precisely the wrong way to think about this. If the OS can't protect itself, you've got a system with zero security.

Well, that's true, OS being able to protect itself is useful and necessary, but my point is that it's nowhere near sufficient (as your parent post seems to imply) for preventing consequences of ransomware attacks, because by the time standard OS protections (which are reasonable) are broken because attackers have privileged access, they can also do worse things than just attack the single computers' OS, and if they can't get privileged access, well, then the OS is effectively write-protected anyway unless you're using something totally outdated. IMHO if the OS and its configuration would be securely write-protected (perhaps from media that's physically read-only?) that wouldn't help much if at all.

It won't prevent lateral movement through the network (that's often memory only, no need to write to disk), it won't prevent persistence through theft of credentials or kerberos tickets (and possibly make it harder to rotate credentials), and of course it won't prevent the exfiltration, encryption and/or destruction of the actually valuable data.

If we look at an advanced ransom attack (e.g. as many described in this article - manually operated after initial access like many Emotet attacks, not some purely automated malware) then I struggle to imagine what parts of the attack would be thwarted if the OS and config would be write protected - do you have something specific in mind?

Re: The Worsening State of Ransomware

#90

Post by kemotep »

mikewarot wrote: post #74
kemotep wrote: post #59

Earlier quoted context omitted.

Especially since the user is the one being tricked into executing the ransomware.

Why does the user have access to the backups?

I was speaking in the context of the files, not the backups.

How is this program to know that a file edited by the virus to encrypt is legitimate or not when the edit is being made by a user that created and owns those files? The backups themselves can be contaminated months before the encryption and ransomware attack is sprung. Restoring from last week or last month's backup might still lead to your system being encrypted.

Additionally, as the other user pointed out the goal would be to gain access to the appropriate user with the level of permissions, such as an admin or root account, and use those credentials to carry out the attack.

Post reply on HN