Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

krebsonsecurity.com

Post reply on HN
Print view View original

91–100 of 229 posts

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#91

Post by cube00 »

Melatonic wrote: post #75
zahlman wrote: post #47

Earlier quoted context omitted.

> If an admin elevation popup happens when you haven't triggered it then you probably know something is wrong. And most malware will not be able to install. Malware can still do a lot without "installation". Running as an unprivileged user, it can still do anything to/with the filesystem that the user would be able to do, and will (on most normal setups) be able to make outbound Internet connections without limitatio…

This is true but defense is a multi layered approach and even the built in Microsoft stuff (like Defender AV) have massively improved. I would argue most malware comes down to uneducated users doing the wrong thing - but that's a whole different can of worms :-)

> I would argue most malware comes down to uneducated users doing the wrong thing

This feels unnecessarily harsh. Those users are the victims of criminal activity. The protective controls could be a lot better.

Windows doesn't offer immutable local file versions to protect against ransomware running as a non-privileged user. It doesn't offer any protection if a single application suddenly starts to overwrite huge amounts of data.

Instead they choose to try and shove OneDrive down our throats as the only answer to ransomware protection.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#92

Post by ofjcihen »

ronsor wrote: post #64
DelaneyM wrote: post #59

Earlier quoted context omitted.

It’s not much harder to just harden your system to not be vulnerable in the first place, and that protects your from a lot more.

Please tell me what tools you use to receive future zero-day vulnerability patches.

To be fair the vast, vast majority of exploitation that we see (especially in the news) comes from sub-par security setups and poor training/architecture. That’s no even going into security monitoring which most companies don’t or barely have.

Zero days account for very small amount of exploitation in comparison and by definition are unpatched so I think the commenter was right to point out the basics.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#93

Post by mlyle »

zahlman wrote: post #47
Melatonic wrote: post #13

The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password. Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is ba…

> If an admin elevation popup happens when you haven't triggered it then you probably know something is wrong. And most malware will not be able to install. Malware can still do a lot without "installation". Running as an unprivileged user, it can still do anything to/with the filesystem that the user would be able to do, and will (on most normal setups) be able to make outbound Internet connections without limitatio…

It's still a big win because it prevents subverting the underlying system. Logs still tell the truth. Security software keeps running. The damage can be inspected with the operating system's tools.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#94

Post by akersten »

thrtythreeforty wrote: post #53
tripplyons wrote: post #18

Earlier quoted context omitted.

Yes, and don't forget to install the VirtualBox guest extensions in your host machine to make it looks even more like a VM!

Is there any downside to unironically doing this? Seems like it'd actually work.

Anticheat might throw a fit

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#95

Post by chisleu »

charcircuit wrote: post #84
chisleu wrote: post #40

Earlier quoted context omitted.

There are lots of malware families. Russian hackers, scammers, and such are basically celebrated in Russia for attacking the west. But they get in big trouble if they screw anything up inside Russia. Hence, the "safety mechanism" here.

Yes, but this is a specific safety mechanism, why this is over others?

It's simple for the malware to check. For instance, you don't want to hit a Russian oligarch's laptop w/ ransomware just because his GPS says he is in another country. You don't want to trust the outbound ip because they might be on a VPN, etc. This is more broad and simple and easy. Can you think of a better way?

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#96

Post by andybak »

danielschreber wrote: post #68
DelaneyM wrote: post #59

Earlier quoted context omitted.

It’s not much harder to just harden your system to not be vulnerable in the first place, and that protects your from a lot more.

Wikipedia's page on "just intonation" is, oddly, about music.

OK. You've lost me.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#97

Post by throwaway48476 »

NoOn3 wrote: post #21
throwaway48476 wrote: post #3

Earlier quoted context omitted.

It has always been this way and will continue to be. Russia along with north korea consider ransomware to be legitimate economic activity. It's part of their hybrid warfare strategy.

I don't think this is done on purpose at the state level in Russia or China, It's just that sometimes government don't pay attention to those who do it if this is done in relation to somehow unfriendly countries. But the US also uses hacking for hostile purposes. For example, Stuxnet and some other cases. Yes, it's not ransomware, but the difference is not that huge. Western-backed countries like Ukraine are also doi…

When Russia arrests a hacker they're turned over to the GRU and told who to target. Western governments use hacking for intelligence gathering not economic warfare. The ochko123 fraudster was very connected with the Russian government, it's state policy.

No, just using Linux doesn't make you safe.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#98

Post by cwmoore »

danielschreber wrote: post #68
DelaneyM wrote: post #59

Earlier quoted context omitted.

It’s not much harder to just harden your system to not be vulnerable in the first place, and that protects your from a lot more.

Wikipedia's page on "just intonation" is, oddly, about music.

And it is so too that “just deserts” are rarely desserts at all.

Re: Many ransomware strains will abort if they detect a Russian keyboard installed (2021)

#100

Post by v5v3 »

e_y_ wrote: post #8
gmargari wrote: post #5

2021

I wonder if Ukraine has been removed from the exclusion list since then. A quick Google search says that the keyboards layouts are different from Russian keyboards.

Syria may get removed soon, seeing as now a USA aligned country.
Post reply on HN