18 ms·

The No More Ransom Project

561 points by esalman 10y ago

rhapsodic 10y ago
I'm afraid to click the link. Anyone care to provide a tl;dr?
- philippnagel 10y ago
  It's legit. Informational website about ransomware and what to do in case your device is affected. Apparently sponsored/endorsed/whatever by Europol, the Dutch Police, Kaspersky, Intel, AWS and Barracuda.
  - rhapsodic 10y ago
    > It's legit. Informational website about ransomware and what to do in case your device is affected. That's good to know, but the ransomware criminals probably have the skills, and they definitely have the incentive, to pwn that site.
    - iancarroll 10y ago
      If someone has a vulnerability that will break out of your web browser's sandbox, they're not going to waste it on this site. And the ransomware that can be decrypted with this site is because of the author's incompetence. It's not hard to write secure ransomware, but they somehow failed very badly. Anyone should be able to easily protect this site.
    - catshirt 10y ago
      so like, you just don't go to any websites ever? or what?
- foota 10y ago
  Looks like decryption for badly constructed ransom ware
  - xenadu02 10y ago
    It isn't just badly made ransomware; in some cases people have stolen the master key or the responsible party has released it. In other cases C&C servers have been seized and keys recovered that way. Ransomware exists thanks to a fundamental mistake in the Unix (+Windows, +others) model that a process' rights to the filesystem automatically inherit from the user's rights. Imagine if all processes running under the same user shared the same address space! There is absolutely no reason some random piece of code downloaded from the internet should have access to my home directory, let alone the rest of the filesystem, without my explicit authorization. The future is macOS sandbox / linux cgroup by default for all processes. The macOS solution of presenting the user a system-controlled open dialog that then grants access to the selected path outside the container is elegant and not too intrusive. Taken a step further, it is obvious that CoW filesystems need to be standard and all activity taken by a process should be recorded in snapshots that get coalesced over time. If a rogue process does cause damage it should be possible to roll back just that process' most recent changes to the filesystem.
    - the_duke 10y ago
      I'm really quite surprised that there are no big and used by default user facing sandboxing solutions for the major OSes out there. With dynamic prompts akin to the firewall prompts familiar from Windows/Mac. 'The program "Chrome" wants to create the file "/home/username/.config/chrome/config". Allow "Chrome" to access [just this file / the diretory ~/.config/chrome / the diretory /home/username]' 'WARNING: The program "totally_legit_for_reals" wants to overwrite the file ~/.xinitrc. This is potentially dangerous. Allow access? -> Are you sure?' 'ALERT: the unknown program "xxx" has gained superuser privileges and wants to overwrite a critical system file System32/whatever.dll. This is very dangerous....' Then again, non techie users usually ignore all those prompts and just click accept. Just look at the mess that is Android permissions. Almost no one actually checks them or rejects apps that ask for way too much. I'd still really like a kernel level protection mechanism that requires granting each executable the capabilities it requests, with dynamic pin the Linux world there are SELinux, AppArmor grsecurity, which are often cumbersome to use).
- elorant 10y ago
  Anytime you're in a similar dilemma just disable JavaScript. There are even plugins that allow you to do that with one click.
  - nitrogen 10y ago
    JS is not the only attack surface in a browser. There have been exploitable bugs in image parsers, font renderers, etc. Tracking is possible without JS as well. Maybe try lynx?
    - babuskov 10y ago
      > Maybe try lynx? Or just use VPS when surfing the web.
      - samstave 10y ago
        Or surf from a VM on your machine. I used to do this on linux, as I had copies of my windows VM and I would just browse from the windows box on another screen and then work from the linux one on the main screen
        babuskov 10y ago
        Yes! I meant VM. I was just setting up some VPS and mistyped it.
    - startling 10y ago
      I'd assume Chrome is safer than Lynx these days, to be honest. Not to mention the fact that using Lynx makes you unique enough for it to be a useful tracking indicator.
  - user5994461 10y ago
    And make sure your browser is updated as well ^^
  - XaYdEk 10y ago
    Or better still noScript blocks all js by default and you only whitelist the sites you trust. Throw in a Ghostery for cookies and you are reasonably good to go.
- kintamanimatt 10y ago
  Why are you afraid to click the link?
  - rhapsodic 10y ago
    > Why are you afraid to click the link? Because ransomware criminals would probably love to take over that site and start distributing ransomware or other malware from it. And I have no way to judge how well that site's owners have protected it from that sort of attack. When I'm in doubt, I tend to err on the side of caution.
    - babuskov 10y ago
      > Because ransomware criminals would probably love to take over that site I assume most people reading the website would be those already infected. The criminals are more likely to take over any other high traffic website and infect computers of clueless people who have never heard of ransomware.
toennisforst 10y ago
> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you decrypt after you paid: They need their victims to trust them, and they have nothing to gain from keeping the files encrypted after payment.
- user5994461 10y ago
  I think the fear is that they would ask for more money and/or they'd repeat the ransom again later.
  - GirlsCanCode 10y ago
    For people who are affected by ransom ware it also means something else--they had no off-line backup solution. So they'd be in the same situation if their disk drive were to have failed!
- Taek 10y ago
  It's been pointed out in the past that most ransomware services have better customer support than paid services. That's because they stand to gain $XXX from each successful interaction and they stand to lose substantially more if they have a reputation of not returning the data.
  - the_duke 10y ago
    That's just hilariously twisted.
    - dwaltrip 10y ago
      It's such a perfect example of how human systems are molded by underlying incentives. Of course, the incentives themselves arise within immense cultural and technological contexts. Hopefully one day we see further past the dense fog of complexity. Assuming we aren't adding to it at a faster rate...
CalChris 10y ago
So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/hktxrml0e933lw/iuogsulv5ns4/20161024123233.jpg https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/... Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them. I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. There is no negotiation with a script. What I've also heard is that you can trust the script because these guys want a good reputation. If it gets out that you paid and you didn't get unlocked then no one would pay. If you don't want to pay on the backend then you have to back up on the front end. You should do that already. You should be able to take a sledge hammer to your laptop, buy another and not miss a beat. If you could do that then you could just reformat and reinstall. Prevention is worth it. Protection is worth it. Paying? Well if you did the first two you wouldn't be asking that question. But .65880 Bitcoin equals about 463.97 USD. So you might want to get on the prevention+protection train. Prevention will help you against viruses, keyloggers, etc that can cause a lot more economic harm. Protection, backing up, will also help you in the case of theft or dropping your MPB out of its sleeve when you get out the car. Done both.
- adzm 10y ago
  This happens quite often at medical offices. Five and even six digit ransoms are not unheard of. On the plus side, it helps encourage Windows updates and IT responsibility.
  - nom 10y ago
    Now i'm really curious if they calculate the prices based on the files they encrypt. Do you know if it was some kind of spear phishing attack or just a regular ransomware variant? Any sources? thx!
    - ocdtrekkie 10y ago
      My guess is it's pretty easy for them to report back the infected computer is part of a domain, for example, which most businesses using Windows would be on.
chx 10y ago
Even in an issue about software, americans pull out guns. Have you noticed how noone else does this? It's shocking and abhorrent.
- notmything 10y ago
  Downvoted to the shithouse but I liked this comment.
- samstave 10y ago
  Hmm, well to be honest, I wouldn't use my .45. I would probably use my Mossberg 590A Police edition 12 gauge.
- mibbiting 10y ago
  You do realise guns have other uses other than shooting people don't you. There's nothing remotely shocking or abhorrent about guns.
  - the_duke 10y ago
    Police officers in the UK don't even carry guns! They do just fine without them. Only specially "firearms units" carry them. While that's very unusual even in Europe, it goes to show that as long as not every idiot can buy a gun, things are just fine without such a deadly weapon. That said, shooting at a range is immense fun. ;)
    - mibbiting 10y ago
      Yes I'm aware. I live in the UK. Guns are used for sport, pest control, shooting laptops, etc.
  - jessaustin 10y ago
    Most guns are designed to kill people. Very few guns are designed to disable laptops. GP's point would have been valid if he had said "typical and pathetic" or "cliched and unimaginative" rather than "shocking and abhorrent". b^)
- 10y ago
happy-go-lucky 10y ago
My mini Ask HN: Do you trust makers of security software?
- samstave 10y ago
  I've seen Halt and Catch Fire, so no.
- perlgeek 10y ago
  Not the big ones that are well-known names in the PC market. There are quite some shady security software vendors out there, and a handful very competent ones that I trust if I have to.
  - andrewl 10y ago
    Can you expand on that? Who are the good ones, and the bad ones?
    - perlgeek 10y ago
      The bad ones are typically well-known desktop anti virus scanners that try to score by showing you a high number of threats they allegedly defeated. If you look at those threats in detail, they turn out to be browser cookies, or bookmarks, or something similarly trivial. Identifying good vendors and products is generally harder. I've heard good things about canary.tools and bromium, for example. Both explain what they do in terms that don't make a techie roll their eyes (too much at least): https://canary.tools/#how-it-works https://canary.tools/#how-it-works and https://www.bromium.com/advanced-endpoint-security/our-technology.html https://www.bromium.com/advanced-endpoint-security/our-techn... A good (but not exhaustive) test is to look at what the vendors promise. If they promise you full protection of your machine or network, you know they are full of shit. If they talk only about one aspect (identifying attackers, reducing the attack surface on a browser), things start to look better.
- XparXnoiAx 10y ago
  No, absolutely not. Even if their intentions are good, they still have shown some questionable competence, for example: http://www.theregister.co.uk/2016/03/31/trend_micro_patches_command_execution_flaw/ http://www.theregister.co.uk/2016/03/31/trend_micro_patches_... http://www.pcworld.com/article/3020327/antivirus-software-could-make-your-company-more-vulnerable.html http://www.pcworld.com/article/3020327/antivirus-software-co...
tarr11 10y ago
Is using a VM to surf the web a reasonable answer? Are there any VMs (for my MBP for example) that are reasonably fast, don't take a lot of battery, and not clumsy? Can't this be built into the OS so I don't actually have to do it?
- perlgeek 10y ago
  There are indeed approaches by Microsoft to run some IE edge processes in micro VMs. The hard part is figuring out how much communication to allow with the rest of the OS. Do you want to allow sites to set cookies? For every domain, or just for the target domain? If the latter, what happens with a cookie set after a redirect to a different domain? Do you want to allow downloads to reach the host OS? The more secure you make things, the more usability suffers, so you have to think really hard about all such problems.
  - codedokode 10y ago
    I see no problem with downloads. Saving a file can be implemented with a helper that has access to disk but doesn't have other permissions (like accessing the network). The path to save a file is chosen by a user. The developers either care too much about compatibility with legacy software or just don't want to invest into implementing more secure environment. Patching existing software seems to be much cheaper.
- codedokode 10y ago
  Something like this is built into Android and iPhone. As all major desktop OSes are only good in protecting one user from another mobile OSes run every application under its own user account. So vulnerability in an image viewer would not give an attacker access to other apps' data. But the system is not perfect, for example the kernel can still be attacked (and as we know a lot of vulnerabilities were found in Linux in recent years) and on Android the files on sdcard partition are not protected at all. But desktop OSes don't do anything at all to protect the user. They allow the user to run a program by just clicking a link in email or web browser and this program has full access to all their data as does the PDF viewer or Java plugin in a browser. The desktop operating systems still use security models from mainframe era.
haberman 10y ago
Do Google Drive / Dropbox cloud backups help in this situation? Or do the encrypted versions propagate into the cloud and irreversibly overwrite the plaintext versions?
- tomsmeding 10y ago
  Dropbox seems to store previous versions of files.
- jonathankoren 10y ago
  Not if it's versioned. If you're really afraid of that, just use time machine. If this happened to me, I think I'd just buy a new SSD and restore from backup.
- johannesg 10y ago
  Google Drive keeps old versions of every file for 30 days. Enough time to recover the plaintext versions.
  - BJanecke 10y ago
    I recently had to help someone out, and the randsomware was smart enough to be able to mess wit gDrive revisions :/
tgb 10y ago
For protection, I put all my files I care about on Dropbox. Is that enough? It's enough for backup for most things, but I worry attackers would be smart enough to kill it and also the old revisions that Dropbox stores.
- ktRolster 10y ago
  If enough people do that, then attackers will start attacking dropbox, as well.
  - tgb 10y ago
    Hence my question. They'll ransom my Dropbox but Dropbox keeps deleted files and old versions around, so I'd be safe unless they specifically target Dropbox and Dropbox can't mitigate it.
    - lucb1e 10y ago
      Last time I used Dropbox, you can always get deleted versions back. They might make it difficult though, spamming the log with a gazillion created/deleted files. And maybe there is actually a limitation of, say, 10 deleted versions of the same file path (that might make sense)... but I don't remember seeing any of those limitations last time I looked at it (which was a few years ago). But if you are a concerned customer, why don't you just head over to their help pages and see what the features and limits regarding history and file deletion are?
      - majewsky 10y ago
        If there are certain restrictions to how far you can go back, they will likely find a way around that. If it's 10 versions of the same file path, they'll overwrite each path with a different single-byte file 11 times.
      - colejohnson66 10y ago
        Versions are kept for a month. I once had a few hundred versions of one file a while back.
nodesocket 10y ago
This is a Windows phenomenon only right? I'd just restore from Time Machine and go along on my way.
- rospaya 10y ago
  As if Windows or Linux don't have backup solutions?
- Klathmon 10y ago
  I don't know of any Mac specific variants off the top of my head, but there is no reason why Mac would be immune to it. And the "good" versions of these do things like encrypt or outright delete things like time machine before encrypting the rest.
  - mastax 10y ago
    You may remember an incident with Transmission recently. That was a bundled mac ransomware. https://blog.malwarebytes.com/cybercrime/2016/03/first-mac-ransomware-spotted/ https://blog.malwarebytes.com/cybercrime/2016/03/first-mac-r...
  - Joky 10y ago
    That supposes that the backup is local, I have a time capsule (remote) and I also plug once every other day an external hard-drive for my time machine backups.
- TeMPOraL 10y ago
  It's primarily a Windows thing, but it only happens because Windows is the most popular desktop OS. Mac users sound like a pretty good target though, so I'd expect to see more MacOS-targeted malware in the future.
- valleyer 10y ago
  What an incredibly uninformed comment. I'm a Mac guy through and through, but if you think that most Mac users use Time Machine or that no Windows users use backup software, you need to spend more time in the real world.
michaelbuckbee 10y ago
The guy that made HaveIBeenPwned.com (which I'd urge everybody to use) has a solid free course on Ransomware essentials at: https://www.varonis.com/learn/introduction-to-ransomware/ https://www.varonis.com/learn/introduction-to-ransomware/ It's not the ideal thing for people here on HN, but it's pretty much the ideal thing to send to your non/semi-technical boss or stakeholder at your company who isn't taking ransomware seriously.
debt 10y ago
I had no idear this was such a massive problem. How often are nefarious purps holding people's private data hostage? Seems overblown.
- y80 10y ago
  It's a very big problem, Cryptolocker in 2013 was able to score it's creators around $27 million. That was 3 years ago, it's a pretty dangerous and persistent threat.
bikamonki 10y ago
Anyone else wants to do the static-site server-less dance with me? Or you rather keep playing cat and mouse on a broken Internet?
franciscop 10y ago
I started writing about this but just a personal safeward. Yesterday I dropped my phone by accident, it cracked and doesn't work anymore. But besides the monetary loss, everything was backed-up from the day before so no problem.
metafunctor 10y ago
Is there any case where versioned backups wouldn't completely solve a ransomware situation? Assuming, of course, that the ransomware doesn't somehow spider out and compromise all your past backups as well. Let's assume your past backup versions are safe.
- nothrabannosir 10y ago
  There's a new type of ransomware which threatens to release your files to the public if you don't pay. No amount of backups will help you there. :/
  - metafunctor 10y ago
    Ah, of course, obvious now that you said it.
- Houshalter 10y ago
  Are the versioned backups physically separated from the infected machine? Otherwise what stops it from just encrypting your backups hard drives as well, everytime you connect them?
  - colejohnson66 10y ago
    What about a versioned filesystem (like ZFS)?
    - syrrim 10y ago
      If they had root access they could probably encrypt the whole drive, filesystem and all.
  - metafunctor 10y ago
    Yes – good backups would be somewhat resistant to malicious tampering, so that old versions are not immediately lost no matter what happens on the source computer.
philfrasty 10y ago
OT question: is there no way to flag that bitcoin address in any way (so it gets locked / they cannot withdraw anything)?
- cookiecaper 10y ago
  Correct, there is no coordinated way to do that right now. Because the blockchain is public, we can tell if coins came from a known bad address or not, but there's no central repository that lists bad actors afaik and the reference client at least doesn't support refusing to trade coins that are "tainted" by a certain address. I imagine the Bitcoin community would be pretty resistant to attempts to establish something like that, since a lot of the bitcoin ethos is based in distrust for centralized authorities.
- bendoernberg 10y ago
  The original purpose of Bitcoin was to create digital cash. It is possible to track the transaction history of funds in a bitcoin address, but there is currently no central authority who can blacklist/lock addresses, and most of the major participants in the bitcoin system (users, miners, exchange operators, darknet drug markets) are not interested in changing that.
noonespecial 10y ago
I've had plenty of people lose vital files on borked hard disks and pay thousands to get those files back via drive recovery firms. I've only had one person ask me about ransomed files whom I advised to pay the $400-ish demanded. I told him that most of my clients pay 10x as much to learn how important backups are. All data storage devices will fail. What will you do when yours does?
- IndianAstronaut 10y ago
  The worst place I have seen this is in scientific labs. Professors and graduate students are terrible about keeping backups, making data easy to understand to others, and maintaining data. My old professor lost more than 2 years of work when one grad student in our had a car crash and his laptop was destroyed in the crash.
  - sliverstorm 10y ago
    I've observed the same. It's baffling, and I don't understand why. Maybe they are in a nasty spot of workers who are non-techie but 100% reliant on tech?
mikemoka 10y ago
About prevention there is something more that I am not sure has been mentioned, some tools are taking a new, broader approach to the problem, which is to constantly monitor for encrypted files and stop the associated processes, this way often limiting the loss to a few files, these are the links: Criptostalker https://github.com/unixist/cryptostalker https://github.com/unixist/cryptostalker Ransomwhere (macOS) https://objective-see.com/products/ransomwhere.html https://objective-see.com/products/ransomwhere.html Some theoretical information on this approach: http://www.cise.ufl.edu/~traynor/papers/scaife-icdcs16.pdf http://www.cise.ufl.edu/~traynor/papers/scaife-icdcs16.pdf
- Houshalter 10y ago
  In principle it's super easy to detect, encrypted files look like random data and it's unlikely users would be replacing every file with random data on purpose. Its a never ending war though. If you got enough users to do this, the hackers would then switch to encryption that mimics what normal files look like to fool the detector.
  - noja 10y ago
    Most users never start writing to all the files on their disk, why can't a rate limiter and warning kick in if that happens?
- fastball 10y ago
  Highly recommend Ransomwhere for MacOS users. It has actually stopped a ransomware attack on one of my work machines.
edem 10y ago
How can a ransomware infect my computer when I visit a website? This site claims it can happen. I understand how the attachment version works but not this one. I'm a security newb.
- shoghicp 10y ago
  Some websites can use security vulnerabilities in different parts of the browser (rendering, image format parsers, Javascript, PDF, fonts, and everything else supported by the browser) to run code on your machine.
  - aweinstock 10y ago
    For a concrete example of what exploitation of a JS engine bug looks like, PlaidCTF2016 had a challenge that allowed people to run JS in a patched version of V8 that deliberately introduced a bug in array index checking, with the goal being to run x86 machine code. The patch to v8: http://lpaste.net/317342 http://lpaste.net/317342 An exploit: https://gist.github.com/sroettger/d077d3907999aaa0f89d11d956b438ea https://gist.github.com/sroettger/d077d3907999aaa0f89d11d956... While this bug was artificial, there were (and can still be) bugs with similar consequences in actual engines (see https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-17734/Google-V8.html https://www.cvedetails.com/vulnerability-list/vendor_id-1224... or https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=spidermonkey https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=spidermonke... for historical examples). While a bug in most of the components you mention are bad by themselves, their impact is magnified by the presence of javascript, which allows an attacker to interleave calculations and interactions with the buggy components, bypassing many mitigations.
  - edem 10y ago
    What if my browser does not run as root? Can I protect my files from ransomware by having a copy somewhere else on off-line storage?
- inimino 10y ago
  I didn't see that on the site. Where does it say that? However, vulnerabilities do exist in browsers and that is how that could happen.
BWStearns 10y ago
So a thought on why attackers make "flawed" ransomware. They want to get paid as soon as possible, and a target pays a potentially heavy opportunity cost for noncompliance (waiting for someone to break the rw). The opt-outs are already not going to be "customers", and the "customers" you do get would pay even if they were only going to be locked out for 3 months. You get no extra money for making unbreakable ransomware Edit: this may be similar economically to the Nigerian prices' aversion to English class.
Paul_S 10y ago
If you are willing to pay the ransomware demands who are you going to pay when your HDD fails? I'm not saying ransomware isn't a problem in itself but from a user's perspective it's indistinguishable from HDD failure and should be dealt with by using backups.
- Houshalter 10y ago
  Ransomware can infect your backups to though. HDD failures aren't contagious.
  - rini17 10y ago
    Ever heard about bitrot?
shmerl 10y ago
Hm. I first thought it was an effort to pool resources to repeal patent trolls.
hatsunearu 10y ago
I like the message but it ticked me off that the prevention methods they introduce (backup to cloud and/or use physical media) is coincidentally somewhat related to the sponsors: AWS and Barracuda.
hatsunearu 10y ago
I like the message but it ticked me off that the prevention methods they introduce (backup to cloud and/or use physical media) is coincidentally somewhat related to the sponsors: AWS and Barracuda.
rwallace 10y ago
Remember if your backup solution is a USB drive, you actually need at least two USB drives, with at least one of them disconnected from your computer at all times. If you only have one, the virus will encrypt that one along with your computer. That needs to be spelled out, because people intuitively think backing up to a single USB drive is sufficient.
smaudet 10y ago
The pro-active approach would be, actually ditch your current setup every 3 months. Like others have said, you shouldn't be keeping valuables around on your laptop. Incidentally, this is (or used to be) the trial period for a copy of Windows. Generally I find the data I care about is k in size, the terabytes I seem to accumulate are mostly garbage. Given how large the size of drives of today are, and how small the data that means anything to any of us remains, the size of storage space and the almost effortless ability to replicate are the primary indication of ransomwares general irrelevance.
executesorder66 10y ago
How likely are you to be infected with randsomware if you run a rolling-release Linux distro and update almost daily? I also use uBlock Origin, but I don't disable javascript for any websites.
handonam 10y ago
Would a NAS like QNAP/Synology be sufficient, with proper maintenance (updates, antivirus scanning, credentials)? Trying to think of what I could be mindful of here.
benshu 10y ago
Seems more like a way for the involved parties to collect data on new ransomware popping up on the web than a genuine effort to help victims.

561 points by esalman 10y ago

rhapsodic 10y ago

I'm afraid to click the link. Anyone care to provide a tl;dr?

philippnagel 10y ago
It's legit. Informational website about ransomware and what to do in case your device is affected. Apparently sponsored/endorsed/whatever by Europol, the Dutch Police, Kaspersky, Intel, AWS and Barracuda.
- rhapsodic 10y ago
  > It's legit. Informational website about ransomware and what to do in case your device is affected. That's good to know, but the ransomware criminals probably have the skills, and they definitely have the incentive, to pwn that site.
  - iancarroll 10y ago
    If someone has a vulnerability that will break out of your web browser's sandbox, they're not going to waste it on this site. And the ransomware that can be decrypted with this site is because of the author's incompetence. It's not hard to write secure ransomware, but they somehow failed very badly. Anyone should be able to easily protect this site.
  - catshirt 10y ago
    so like, you just don't go to any websites ever? or what?
foota 10y ago
Looks like decryption for badly constructed ransom ware
- xenadu02 10y ago
  It isn't just badly made ransomware; in some cases people have stolen the master key or the responsible party has released it. In other cases C&C servers have been seized and keys recovered that way. Ransomware exists thanks to a fundamental mistake in the Unix (+Windows, +others) model that a process' rights to the filesystem automatically inherit from the user's rights. Imagine if all processes running under the same user shared the same address space! There is absolutely no reason some random piece of code downloaded from the internet should have access to my home directory, let alone the rest of the filesystem, without my explicit authorization. The future is macOS sandbox / linux cgroup by default for all processes. The macOS solution of presenting the user a system-controlled open dialog that then grants access to the selected path outside the container is elegant and not too intrusive. Taken a step further, it is obvious that CoW filesystems need to be standard and all activity taken by a process should be recorded in snapshots that get coalesced over time. If a rogue process does cause damage it should be possible to roll back just that process' most recent changes to the filesystem.
  - the_duke 10y ago
    I'm really quite surprised that there are no big and used by default user facing sandboxing solutions for the major OSes out there. With dynamic prompts akin to the firewall prompts familiar from Windows/Mac. 'The program "Chrome" wants to create the file "/home/username/.config/chrome/config". Allow "Chrome" to access [just this file / the diretory ~/.config/chrome / the diretory /home/username]' 'WARNING: The program "totally_legit_for_reals" wants to overwrite the file ~/.xinitrc. This is potentially dangerous. Allow access? -> Are you sure?' 'ALERT: the unknown program "xxx" has gained superuser privileges and wants to overwrite a critical system file System32/whatever.dll. This is very dangerous....' Then again, non techie users usually ignore all those prompts and just click accept. Just look at the mess that is Android permissions. Almost no one actually checks them or rejects apps that ask for way too much. I'd still really like a kernel level protection mechanism that requires granting each executable the capabilities it requests, with dynamic pin the Linux world there are SELinux, AppArmor grsecurity, which are often cumbersome to use).
elorant 10y ago
Anytime you're in a similar dilemma just disable JavaScript. There are even plugins that allow you to do that with one click.
- nitrogen 10y ago
  JS is not the only attack surface in a browser. There have been exploitable bugs in image parsers, font renderers, etc. Tracking is possible without JS as well. Maybe try lynx?
  - babuskov 10y ago
    > Maybe try lynx? Or just use VPS when surfing the web.
    - samstave 10y ago
      Or surf from a VM on your machine. I used to do this on linux, as I had copies of my windows VM and I would just browse from the windows box on another screen and then work from the linux one on the main screen
      - babuskov 10y ago
        Yes! I meant VM. I was just setting up some VPS and mistyped it.
  - startling 10y ago
    I'd assume Chrome is safer than Lynx these days, to be honest. Not to mention the fact that using Lynx makes you unique enough for it to be a useful tracking indicator.
- user5994461 10y ago
  And make sure your browser is updated as well ^^
- XaYdEk 10y ago
  Or better still noScript blocks all js by default and you only whitelist the sites you trust. Throw in a Ghostery for cookies and you are reasonably good to go.
kintamanimatt 10y ago
Why are you afraid to click the link?
- rhapsodic 10y ago
  > Why are you afraid to click the link? Because ransomware criminals would probably love to take over that site and start distributing ransomware or other malware from it. And I have no way to judge how well that site's owners have protected it from that sort of attack. When I'm in doubt, I tend to err on the side of caution.
  - babuskov 10y ago
    > Because ransomware criminals would probably love to take over that site I assume most people reading the website would be those already infected. The criminals are more likely to take over any other high traffic website and infect computers of clueless people who have never heard of ransomware.

toennisforst 10y ago

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you decrypt after you paid: They need their victims to trust them, and they have nothing to gain from keeping the files encrypted after payment.

user5994461 10y ago
I think the fear is that they would ask for more money and/or they'd repeat the ransom again later.
- GirlsCanCode 10y ago
  For people who are affected by ransom ware it also means something else--they had no off-line backup solution. So they'd be in the same situation if their disk drive were to have failed!
Taek 10y ago
It's been pointed out in the past that most ransomware services have better customer support than paid services. That's because they stand to gain $XXX from each successful interaction and they stand to lose substantially more if they have a reputation of not returning the data.
- the_duke 10y ago
  That's just hilariously twisted.
  - dwaltrip 10y ago
    It's such a perfect example of how human systems are molded by underlying incentives. Of course, the incentives themselves arise within immense cultural and technological contexts. Hopefully one day we see further past the dense fog of complexity. Assuming we aren't adding to it at a faster rate...

CalChris 10y ago

So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/hktxrml0e933lw/iuogsulv5ns4/20161024123233.jpg https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/... Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them. I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. There is no negotiation with a script. What I've also heard is that you can trust the script because these guys want a good reputation. If it gets out that you paid and you didn't get unlocked then no one would pay. If you don't want to pay on the backend then you have to back up on the front end. You should do that already. You should be able to take a sledge hammer to your laptop, buy another and not miss a beat. If you could do that then you could just reformat and reinstall. Prevention is worth it. Protection is worth it. Paying? Well if you did the first two you wouldn't be asking that question. But .65880 Bitcoin equals about 463.97 USD. So you might want to get on the prevention+protection train. Prevention will help you against viruses, keyloggers, etc that can cause a lot more economic harm. Protection, backing up, will also help you in the case of theft or dropping your MPB out of its sleeve when you get out the car. Done both.

adzm 10y ago
This happens quite often at medical offices. Five and even six digit ransoms are not unheard of. On the plus side, it helps encourage Windows updates and IT responsibility.
- nom 10y ago
  Now i'm really curious if they calculate the prices based on the files they encrypt. Do you know if it was some kind of spear phishing attack or just a regular ransomware variant? Any sources? thx!
  - ocdtrekkie 10y ago
    My guess is it's pretty easy for them to report back the infected computer is part of a domain, for example, which most businesses using Windows would be on.

chx 10y ago

Even in an issue about software, americans pull out guns. Have you noticed how noone else does this? It's shocking and abhorrent.

notmything 10y ago
Downvoted to the shithouse but I liked this comment.
samstave 10y ago
Hmm, well to be honest, I wouldn't use my .45. I would probably use my Mossberg 590A Police edition 12 gauge.
mibbiting 10y ago
You do realise guns have other uses other than shooting people don't you. There's nothing remotely shocking or abhorrent about guns.
- the_duke 10y ago
  Police officers in the UK don't even carry guns! They do just fine without them. Only specially "firearms units" carry them. While that's very unusual even in Europe, it goes to show that as long as not every idiot can buy a gun, things are just fine without such a deadly weapon. That said, shooting at a range is immense fun. ;)
  - mibbiting 10y ago
    Yes I'm aware. I live in the UK. Guns are used for sport, pest control, shooting laptops, etc.
- jessaustin 10y ago
  Most guns are designed to kill people. Very few guns are designed to disable laptops. GP's point would have been valid if he had said "typical and pathetic" or "cliched and unimaginative" rather than "shocking and abhorrent". b^)
10y ago

happy-go-lucky 10y ago

My mini Ask HN: Do you trust makers of security software?

samstave 10y ago
I've seen Halt and Catch Fire, so no.
perlgeek 10y ago
Not the big ones that are well-known names in the PC market. There are quite some shady security software vendors out there, and a handful very competent ones that I trust if I have to.
- andrewl 10y ago
  Can you expand on that? Who are the good ones, and the bad ones?
  - perlgeek 10y ago
    The bad ones are typically well-known desktop anti virus scanners that try to score by showing you a high number of threats they allegedly defeated. If you look at those threats in detail, they turn out to be browser cookies, or bookmarks, or something similarly trivial. Identifying good vendors and products is generally harder. I've heard good things about canary.tools and bromium, for example. Both explain what they do in terms that don't make a techie roll their eyes (too much at least): https://canary.tools/#how-it-works https://canary.tools/#how-it-works and https://www.bromium.com/advanced-endpoint-security/our-technology.html https://www.bromium.com/advanced-endpoint-security/our-techn... A good (but not exhaustive) test is to look at what the vendors promise. If they promise you full protection of your machine or network, you know they are full of shit. If they talk only about one aspect (identifying attackers, reducing the attack surface on a browser), things start to look better.
XparXnoiAx 10y ago
No, absolutely not. Even if their intentions are good, they still have shown some questionable competence, for example: http://www.theregister.co.uk/2016/03/31/trend_micro_patches_command_execution_flaw/ http://www.theregister.co.uk/2016/03/31/trend_micro_patches_... http://www.pcworld.com/article/3020327/antivirus-software-could-make-your-company-more-vulnerable.html http://www.pcworld.com/article/3020327/antivirus-software-co...

tarr11 10y ago

Is using a VM to surf the web a reasonable answer? Are there any VMs (for my MBP for example) that are reasonably fast, don't take a lot of battery, and not clumsy? Can't this be built into the OS so I don't actually have to do it?

perlgeek 10y ago
There are indeed approaches by Microsoft to run some IE edge processes in micro VMs. The hard part is figuring out how much communication to allow with the rest of the OS. Do you want to allow sites to set cookies? For every domain, or just for the target domain? If the latter, what happens with a cookie set after a redirect to a different domain? Do you want to allow downloads to reach the host OS? The more secure you make things, the more usability suffers, so you have to think really hard about all such problems.
- codedokode 10y ago
  I see no problem with downloads. Saving a file can be implemented with a helper that has access to disk but doesn't have other permissions (like accessing the network). The path to save a file is chosen by a user. The developers either care too much about compatibility with legacy software or just don't want to invest into implementing more secure environment. Patching existing software seems to be much cheaper.
codedokode 10y ago
Something like this is built into Android and iPhone. As all major desktop OSes are only good in protecting one user from another mobile OSes run every application under its own user account. So vulnerability in an image viewer would not give an attacker access to other apps' data. But the system is not perfect, for example the kernel can still be attacked (and as we know a lot of vulnerabilities were found in Linux in recent years) and on Android the files on sdcard partition are not protected at all. But desktop OSes don't do anything at all to protect the user. They allow the user to run a program by just clicking a link in email or web browser and this program has full access to all their data as does the PDF viewer or Java plugin in a browser. The desktop operating systems still use security models from mainframe era.

haberman 10y ago

Do Google Drive / Dropbox cloud backups help in this situation? Or do the encrypted versions propagate into the cloud and irreversibly overwrite the plaintext versions?

tomsmeding 10y ago
Dropbox seems to store previous versions of files.
jonathankoren 10y ago
Not if it's versioned. If you're really afraid of that, just use time machine. If this happened to me, I think I'd just buy a new SSD and restore from backup.
johannesg 10y ago
Google Drive keeps old versions of every file for 30 days. Enough time to recover the plaintext versions.
- BJanecke 10y ago
  I recently had to help someone out, and the randsomware was smart enough to be able to mess wit gDrive revisions :/

tgb 10y ago

For protection, I put all my files I care about on Dropbox. Is that enough? It's enough for backup for most things, but I worry attackers would be smart enough to kill it and also the old revisions that Dropbox stores.

ktRolster 10y ago
If enough people do that, then attackers will start attacking dropbox, as well.
- tgb 10y ago
  Hence my question. They'll ransom my Dropbox but Dropbox keeps deleted files and old versions around, so I'd be safe unless they specifically target Dropbox and Dropbox can't mitigate it.
  - lucb1e 10y ago
    Last time I used Dropbox, you can always get deleted versions back. They might make it difficult though, spamming the log with a gazillion created/deleted files. And maybe there is actually a limitation of, say, 10 deleted versions of the same file path (that might make sense)... but I don't remember seeing any of those limitations last time I looked at it (which was a few years ago). But if you are a concerned customer, why don't you just head over to their help pages and see what the features and limits regarding history and file deletion are?
    - majewsky 10y ago
      If there are certain restrictions to how far you can go back, they will likely find a way around that. If it's 10 versions of the same file path, they'll overwrite each path with a different single-byte file 11 times.
    - colejohnson66 10y ago
      Versions are kept for a month. I once had a few hundred versions of one file a while back.

nodesocket 10y ago

This is a Windows phenomenon only right? I'd just restore from Time Machine and go along on my way.

rospaya 10y ago
As if Windows or Linux don't have backup solutions?
Klathmon 10y ago
I don't know of any Mac specific variants off the top of my head, but there is no reason why Mac would be immune to it. And the "good" versions of these do things like encrypt or outright delete things like time machine before encrypting the rest.
- mastax 10y ago
  You may remember an incident with Transmission recently. That was a bundled mac ransomware. https://blog.malwarebytes.com/cybercrime/2016/03/first-mac-ransomware-spotted/ https://blog.malwarebytes.com/cybercrime/2016/03/first-mac-r...
- Joky 10y ago
  That supposes that the backup is local, I have a time capsule (remote) and I also plug once every other day an external hard-drive for my time machine backups.
TeMPOraL 10y ago
It's primarily a Windows thing, but it only happens because Windows is the most popular desktop OS. Mac users sound like a pretty good target though, so I'd expect to see more MacOS-targeted malware in the future.
valleyer 10y ago
What an incredibly uninformed comment. I'm a Mac guy through and through, but if you think that most Mac users use Time Machine or that no Windows users use backup software, you need to spend more time in the real world.

michaelbuckbee 10y ago

The guy that made HaveIBeenPwned.com (which I'd urge everybody to use) has a solid free course on Ransomware essentials at: https://www.varonis.com/learn/introduction-to-ransomware/ https://www.varonis.com/learn/introduction-to-ransomware/ It's not the ideal thing for people here on HN, but it's pretty much the ideal thing to send to your non/semi-technical boss or stakeholder at your company who isn't taking ransomware seriously.

debt 10y ago

I had no idear this was such a massive problem. How often are nefarious purps holding people's private data hostage? Seems overblown.

y80 10y ago
It's a very big problem, Cryptolocker in 2013 was able to score it's creators around $27 million. That was 3 years ago, it's a pretty dangerous and persistent threat.

bikamonki 10y ago

Anyone else wants to do the static-site server-less dance with me? Or you rather keep playing cat and mouse on a broken Internet?

franciscop 10y ago

I started writing about this but just a personal safeward. Yesterday I dropped my phone by accident, it cracked and doesn't work anymore. But besides the monetary loss, everything was backed-up from the day before so no problem.

metafunctor 10y ago

Is there any case where versioned backups wouldn't completely solve a ransomware situation? Assuming, of course, that the ransomware doesn't somehow spider out and compromise all your past backups as well. Let's assume your past backup versions are safe.

nothrabannosir 10y ago
There's a new type of ransomware which threatens to release your files to the public if you don't pay. No amount of backups will help you there. :/
- metafunctor 10y ago
  Ah, of course, obvious now that you said it.
Houshalter 10y ago
Are the versioned backups physically separated from the infected machine? Otherwise what stops it from just encrypting your backups hard drives as well, everytime you connect them?
- colejohnson66 10y ago
  What about a versioned filesystem (like ZFS)?
  - syrrim 10y ago
    If they had root access they could probably encrypt the whole drive, filesystem and all.
- metafunctor 10y ago
  Yes – good backups would be somewhat resistant to malicious tampering, so that old versions are not immediately lost no matter what happens on the source computer.

philfrasty 10y ago

OT question: is there no way to flag that bitcoin address in any way (so it gets locked / they cannot withdraw anything)?

cookiecaper 10y ago
Correct, there is no coordinated way to do that right now. Because the blockchain is public, we can tell if coins came from a known bad address or not, but there's no central repository that lists bad actors afaik and the reference client at least doesn't support refusing to trade coins that are "tainted" by a certain address. I imagine the Bitcoin community would be pretty resistant to attempts to establish something like that, since a lot of the bitcoin ethos is based in distrust for centralized authorities.
bendoernberg 10y ago
The original purpose of Bitcoin was to create digital cash. It is possible to track the transaction history of funds in a bitcoin address, but there is currently no central authority who can blacklist/lock addresses, and most of the major participants in the bitcoin system (users, miners, exchange operators, darknet drug markets) are not interested in changing that.

noonespecial 10y ago

I've had plenty of people lose vital files on borked hard disks and pay thousands to get those files back via drive recovery firms. I've only had one person ask me about ransomed files whom I advised to pay the $400-ish demanded. I told him that most of my clients pay 10x as much to learn how important backups are. All data storage devices will fail. What will you do when yours does?

IndianAstronaut 10y ago
The worst place I have seen this is in scientific labs. Professors and graduate students are terrible about keeping backups, making data easy to understand to others, and maintaining data. My old professor lost more than 2 years of work when one grad student in our had a car crash and his laptop was destroyed in the crash.
- sliverstorm 10y ago
  I've observed the same. It's baffling, and I don't understand why. Maybe they are in a nasty spot of workers who are non-techie but 100% reliant on tech?

mikemoka 10y ago

About prevention there is something more that I am not sure has been mentioned, some tools are taking a new, broader approach to the problem, which is to constantly monitor for encrypted files and stop the associated processes, this way often limiting the loss to a few files, these are the links: Criptostalker https://github.com/unixist/cryptostalker https://github.com/unixist/cryptostalker Ransomwhere (macOS) https://objective-see.com/products/ransomwhere.html https://objective-see.com/products/ransomwhere.html Some theoretical information on this approach: http://www.cise.ufl.edu/~traynor/papers/scaife-icdcs16.pdf http://www.cise.ufl.edu/~traynor/papers/scaife-icdcs16.pdf

Houshalter 10y ago
In principle it's super easy to detect, encrypted files look like random data and it's unlikely users would be replacing every file with random data on purpose. Its a never ending war though. If you got enough users to do this, the hackers would then switch to encryption that mimics what normal files look like to fool the detector.
- noja 10y ago
  Most users never start writing to all the files on their disk, why can't a rate limiter and warning kick in if that happens?
fastball 10y ago
Highly recommend Ransomwhere for MacOS users. It has actually stopped a ransomware attack on one of my work machines.

edem 10y ago

How can a ransomware infect my computer when I visit a website? This site claims it can happen. I understand how the attachment version works but not this one. I'm a security newb.

shoghicp 10y ago
Some websites can use security vulnerabilities in different parts of the browser (rendering, image format parsers, Javascript, PDF, fonts, and everything else supported by the browser) to run code on your machine.
- aweinstock 10y ago
  For a concrete example of what exploitation of a JS engine bug looks like, PlaidCTF2016 had a challenge that allowed people to run JS in a patched version of V8 that deliberately introduced a bug in array index checking, with the goal being to run x86 machine code. The patch to v8: http://lpaste.net/317342 http://lpaste.net/317342 An exploit: https://gist.github.com/sroettger/d077d3907999aaa0f89d11d956b438ea https://gist.github.com/sroettger/d077d3907999aaa0f89d11d956... While this bug was artificial, there were (and can still be) bugs with similar consequences in actual engines (see https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-17734/Google-V8.html https://www.cvedetails.com/vulnerability-list/vendor_id-1224... or https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=spidermonkey https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=spidermonke... for historical examples). While a bug in most of the components you mention are bad by themselves, their impact is magnified by the presence of javascript, which allows an attacker to interleave calculations and interactions with the buggy components, bypassing many mitigations.
- edem 10y ago
  What if my browser does not run as root? Can I protect my files from ransomware by having a copy somewhere else on off-line storage?
inimino 10y ago
I didn't see that on the site. Where does it say that? However, vulnerabilities do exist in browsers and that is how that could happen.

BWStearns 10y ago

So a thought on why attackers make "flawed" ransomware. They want to get paid as soon as possible, and a target pays a potentially heavy opportunity cost for noncompliance (waiting for someone to break the rw). The opt-outs are already not going to be "customers", and the "customers" you do get would pay even if they were only going to be locked out for 3 months. You get no extra money for making unbreakable ransomware Edit: this may be similar economically to the Nigerian prices' aversion to English class.

Paul_S 10y ago

If you are willing to pay the ransomware demands who are you going to pay when your HDD fails? I'm not saying ransomware isn't a problem in itself but from a user's perspective it's indistinguishable from HDD failure and should be dealt with by using backups.

Houshalter 10y ago
Ransomware can infect your backups to though. HDD failures aren't contagious.
- rini17 10y ago
  Ever heard about bitrot?

shmerl 10y ago

Hm. I first thought it was an effort to pool resources to repeal patent trolls.

hatsunearu 10y ago

I like the message but it ticked me off that the prevention methods they introduce (backup to cloud and/or use physical media) is coincidentally somewhat related to the sponsors: AWS and Barracuda.

hatsunearu 10y ago

I like the message but it ticked me off that the prevention methods they introduce (backup to cloud and/or use physical media) is coincidentally somewhat related to the sponsors: AWS and Barracuda.

rwallace 10y ago

Remember if your backup solution is a USB drive, you actually need at least two USB drives, with at least one of them disconnected from your computer at all times. If you only have one, the virus will encrypt that one along with your computer. That needs to be spelled out, because people intuitively think backing up to a single USB drive is sufficient.

smaudet 10y ago

The pro-active approach would be, actually ditch your current setup every 3 months. Like others have said, you shouldn't be keeping valuables around on your laptop. Incidentally, this is (or used to be) the trial period for a copy of Windows. Generally I find the data I care about is k in size, the terabytes I seem to accumulate are mostly garbage. Given how large the size of drives of today are, and how small the data that means anything to any of us remains, the size of storage space and the almost effortless ability to replicate are the primary indication of ransomwares general irrelevance.

executesorder66 10y ago

How likely are you to be infected with randsomware if you run a rolling-release Linux distro and update almost daily? I also use uBlock Origin, but I don't disable javascript for any websites.

handonam 10y ago

Would a NAS like QNAP/Synology be sufficient, with proper maintenance (updates, antivirus scanning, credentials)? Trying to think of what I could be mindful of here.

benshu 10y ago

Seems more like a way for the involved parties to collect data on new ransomware popping up on the web than a genuine effort to help victims.