Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

krebsonsecurity.com

Post reply on HN
Print view View original

81–90 of 229 posts

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#81

Post by kevingadd »

Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

Unfortunately a lot of modern software triggers UAC popups now. Games (for anticheat and/or network connectivity), development tools (for network connectivity or debugging), updaters for stuff that live-updates like Electron apps, etc.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#82

Post by Melatonic »

Aachen wrote: post #45
Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

https://xkcd.com/1200/ It feels bad to post a link-only response but I really don't have anything to add to it. On a system used by multiple persons, sure, you help prevent that a compromise on sister's account immediately impacts mom's and dad's accounts, but that qualification isn't in the comment and probably most computers that HN readers use are single user. Or on a server, dropping privileges speaks for itself.…

Most malware I've commonly seen on individuals computers (like the grandma example) comes about when they want to install something and use and installer that has it bundled with legit software. Or they visit a site that's a shady copy of a legit one.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#83

Post by Melatonic »

bozhark wrote: post #20
Melatonic wrote: post #12

Earlier quoted context omitted.

I was thinking the same thing. Seems like the safest would be standard Russian keyboard layout (or maybe just adding the reg keys mentioned) Also makes me wonder if installing a specific Chinese keyboard could have the same effect (for Chinese made ransomware or maybe even North Korean). Or perhaps they do other checks ?

Could check month/date/time formats

Wouldn't that exclude a ton of countries though ? Russia covers a lot of time zones.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#84

Post by charcircuit »

chisleu wrote: post #40
charcircuit wrote: post #22

I would find the why more interesting. Is there a common library virtually all ransomware uses? Are virtually all ransomware copy pastes of each other? Is there a popular forum post detailing the trick?

There are lots of malware families. Russian hackers, scammers, and such are basically celebrated in Russia for attacking the west. But they get in big trouble if they screw anything up inside Russia. Hence, the "safety mechanism" here.

Yes, but this is a specific safety mechanism, why this is over others?

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#85

Post by thaumasiotes »

ttul wrote: post #4

If you make your machine look like a malware execution sandbox, a lot of malware will terminate to avoid being analyzed. This is just part of the cat and mouse game.

> If you make your machine look like a malware execution sandbox, a lot of malware will terminate to avoid being analyzed. This is just part of the cat and mouse game.

What? This is an entirely separate concern. If you have a Russian input method installed, malware will terminate to avoid legal repercussions.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#86

Post by tokai »

floundy wrote: post #39
tokai wrote: post #35

Earlier quoted context omitted.

>There is no Google Drive client for Linux What? Google accounts have been a thing in Gnome for years. You have Google Drive access right in Nautilus.

Not for ARM.

Almost all distros have an ARM version. KDE can also handle online services such as google drive. There are also a couple of other projects to deal with it if you don't like KDE or Gnome. What you claim is trivially untrue.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#87

Post by KronisLV »

cortesoft wrote: post #43
Phurist wrote: post #14

Earlier quoted context omitted.

Or you know... just use Linux

There are many reasons someone might have to use Windows. I have a Windows box because a number of games I play don’t support Linux, even with WINE and Proton.

I found that ProtonDB is quite helpful in figuring out how many games will or won’t run well: https://www.protondb.com/

You can even log in with Steam and get the summary for your exact library, for anyone curious.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#88

Post by EvanAnderson »

Melatonic wrote: post #76
EvanAnderson wrote: post #19

Earlier quoted context omitted.

> The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. In the early 2000s up thru about 2012 I'd agree with you. Post-Vista malware adapted to UAC and now all malware works well as a normal user. Any data your normal user can access (local or on a remote CIFS server) is fair game for ransomware. Limiting administrator rights doesn't do anyt…

It will help stop the spread quite a bit however (even if it can access user local data). There's a reason escalation path attacks are still the gold standard (start small and move up). You can also run something like applocker and whitelist all the apps you use. Also instead of separate physical boxes why not just use a VM ?

> It will help stop the spread quite a bit however (even if it can access user local data).

User's should be running limited user accounts for daily-driver Windows machines.

Having said that, today's attacks are all about the data. It's all about exfil/ransomware/blackmail because there's money to be had there. On an individual home user PC there's no lateral movement or bigger targets to attack.

I hate to invoke xkcd, but it's true: https://xkcd.com/1200/

> You can also run something like applocker and whitelist all the apps you use.

That's a bit overkill for a personal machine and it won't be licensed for AppLocker anyway.

AppLocker is also a gigantic pain-in-the-ass on corporate machines. My experience with configuring AppLocker for anything other than very task-specific computers is that it's a huge and unending ordeal of whitelisting, trying again, whitelisting more, trying again. Wash, rinse, get complaints from end users, repeat.

> Also instead of separate physical boxes why not just use a VM ?

Pragmatism. I have a bunch of extra low-spec laptops laying around. My machines are, for the most part, cast-off Customer garbage. I haven't actually spent money on reasonable machine since about 2015. >smile<

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#89

Post by EvanAnderson »

Melatonic wrote: post #77
pogue wrote: post #66

Earlier quoted context omitted.

What are these "quasi-malicious customized versions of Chrome" you're referring to?

Confused by that as well - what version of chrome can be installed without admin?

It cannot. There are malicious third parties who have made distributions of Chromium that are fully functional browsers, installing in the user's AppData folder w/o Administrator rights, that have additional "functionality" like exfiltrating browsing history or displaying extra t

This is really what any Electron-based app is. It's just Chromium running out of the AppData folder. There's a whole ecosystem of "shadow IT" software that installs out of the AppData folder, meant to end-run IT and central control, that functions great w/o Administrator rights.

Post reply on HN