Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Another Ransomware Outbreak Is Going Global

forbes.com

Post reply on HN
Print view View original

91–100 of 435 posts

Re: Another Ransomware Outbreak Is Going Global

#91

Post by fpgaminer »

hackrack wrote: post #74

Idea: What if the purpose of these WannaCry style ransomware attacks isn't to get people to pay in Bitcoin, but to drive up the price of Bitcoin?

WannaCry caused the price to drop, rather sharply. If anything, the purpose would be to buy cheap Bitcoins and hope the price later corrects back upwards after the news has blown over.

I suspect the price drop is due to some trading algorithms using sentiment analysis. They see all the negative press around these ransomware, see the included word Bitcoin, assume the negative article is about Bitcoin, and automatically sell.

But that's just my theory, since I have a hard time imagining human traders seeing news like this and selling because of it.

Re: Another Ransomware Outbreak Is Going Global

#93

Post by HalfwayToDice »

spiderfarmer wrote: post #64
jannes wrote: post #50

This is even more proof how powerful a 0-day in the wrong hands can be. All of the affected companies' should be considered compromised by the NSA. Actually, every single Windows PC with an internet connection that has been used before March 14 should be considered irrevocably compromised. Ransomware is much more visible than spyware. Think about all the spyware-infected PCs/networks that nobody knows about.

Call me paranoid but I consider even a clean, freshly installed and fully updated Windows PC already compromised by the NSA.

This is absurd nonsense, but my viewpoint is a lonely one on HackerNews.

Re: Another Ransomware Outbreak Is Going Global

#94

Post by SCHiM »

110011 wrote: post #75

Can someone provide a simple (but not overly so) explanation of how the current generation of ransomware operate i.e., A) spread and B) lock up the computer? Does it always require human intervention for A. ? Thank you.

There are indications that this new version uses a number of ways to spread.

Where attacker == the ransomware executable:

First is the EternalBlue exploit developed by and leaked from the NSA. EternalBlue exploits a flaw in Windows systems on port 445 TCP that can be used to take complete control of an unpatched system. So if an attacker can connect to a vulnerable Windows machine on port 445 tcp they can take control of that machine.

There are also indications that this ransomware sample spreads using legitimate administrative tools in Windows systems such as WMI (execute commands on a remote system if you an administrator account on that PC), and PSEXEC (mount shares on the remote system if you have an administrator account, execute command if ''). These are legitimate (but legacy) Windows components that normally facilitate the management of client PC's when they're connected to a domain at a company or school. So if an attacker can connect to a Windows machine on port 445 tcp (PSEXEC) or 135 (WMI) AND have administrative credentials for that PC they can take complete control of that machine.

These two are probably part of how the ransomware spreads once it gets inside your network. The wcry outbreak a few weeks ago gained access to networks by infecting one or several people via a phishing e-mail with malicious files/links-to-files inside. AFAIK it's currently still unknown/unconfirmed how this outbreak spreads precisely but I'd guess it's either actively being spread by phishing OR it's been present but dormant in these networks for a while after having been installed by phishing over a longer period of time.

If an attacker possesses a 0-day then all bets are probably off, and even step A would not necessarily require any human interaction.

This outbreak is particularly nasty because after it's done encrypting files it supposedly triggers a crash that forces the system to restart. (handy for servers where a user is not normally able to restart the system). Because the system restarts any, artefacts from the encryption process that might be used to decrypt files without paying or restoring backups are gone.

Re: Another Ransomware Outbreak Is Going Global

#95

Post by willstrafach »

zippoxer wrote: post #80
spiderfarmer wrote: post #64

Earlier quoted context omitted.

Call me paranoid but I consider even a clean, freshly installed and fully updated Windows PC already compromised by the NSA.

Distrusting Windows was the wisest thing you did since you climbed off your horse. [1] No, seriously. How is it paranoia to think the NSA was/is surveilling your Windows installation if we already have proof that they have the means [2] and motivation [3] to do it at scale? [1] http://www.quotes.net/show-quote/34121 [2] https://en.wikipedia.org/wiki/EternalBlue [3] https://en.wikipedia.org/wiki/PRISM_(surveillance_pr…

There is no proof of means or motivation to use 0-days at scale. In fact, using EternalBlue "at-scale" would have caused it to not stay a 0-day for very long.

Re: Another Ransomware Outbreak Is Going Global

#96

Post by willstrafach »

jannes wrote: post #50

This is even more proof how powerful a 0-day in the wrong hands can be. All of the affected companies' should be considered compromised by the NSA. Actually, every single Windows PC with an internet connection that has been used before March 14 should be considered irrevocably compromised. Ransomware is much more visible than spyware. Think about all the spyware-infected PCs/networks that nobody knows about.

It looks like this was not caused by a 0-day, it is apparently using EternalBlue as execution vector plus another (already fixed) vulnerability for lateral movement.

More of a "100-day" at this point.

Re: Another Ransomware Outbreak Is Going Global

#97

Post by devopsproject »

110011 wrote: post #75

Can someone provide a simple (but not overly so) explanation of how the current generation of ransomware operate i.e., A) spread and B) lock up the computer? Does it always require human intervention for A. ? Thank you.

a) No intervention required although many start that way because people click on everything. The general idea is: get into a computer using any means possible and then spread using any means possible

b) They encrypt your files and make you pay usually with a time limit before they just delete the files

Re: Another Ransomware Outbreak Is Going Global

#98

Post by khedoros1 »

110011 wrote: post #75

Can someone provide a simple (but not overly so) explanation of how the current generation of ransomware operate i.e., A) spread and B) lock up the computer? Does it always require human intervention for A. ? Thank you.

A) It's got to find a victim (IP range scans or whatever), then try to infect it. WannaCry used a vulnerability in SMB (CIFS/Windows file sharing) to get the virus payload onto a new machine and get it to run.

B) Once a piece of ransomware is running on your computer, it can generate an encryption key and send that back to its controller machine, then start encrypting files on the computer.

"A" shouldn't be able to happen on its own on a properly firewalled network, I think. So the start of the spread might be someone clicking an e-mail link that they shouldn't, and the infection works to spread on its own once inside a network.

Re: Another Ransomware Outbreak Is Going Global

#99

Post by jonknee »

dijit wrote: post #79
110011 wrote: post #75

Can someone provide a simple (but not overly so) explanation of how the current generation of ransomware operate i.e., A) spread and B) lock up the computer? Does it always require human intervention for A. ? Thank you.

Depends on The ransomware. Usually if it says "0-Day" assume that it can be exploited without human intervention a-la stuxnet

> Usually if it says "0-Day" assume that it can be exploited without human intervention a-la stuxnet

That's not at all what a 0-day means, it just means a previously unknown vulnerability. We've never seen a ransomware attack anywhere close to as sophisticated at Stuxnet. This latest attack is nothing new and is only affecting people who haven't kept their systems up to date.

Post reply on HN