5 ms·

I'm afraid to click the link. Anyone care to provide a tl;dr?

philippnagel 10y ago
It's legit. Informational website about ransomware and what to do in case your device is affected. Apparently sponsored/endorsed/whatever by Europol, the Dutch Police, Kaspersky, Intel, AWS and Barracuda.
- rhapsodic 10y ago
  > It's legit. Informational website about ransomware and what to do in case your device is affected. That's good to know, but the ransomware criminals probably have the skills, and they definitely have the incentive, to pwn that site.
  - iancarroll 10y ago
    If someone has a vulnerability that will break out of your web browser's sandbox, they're not going to waste it on this site. And the ransomware that can be decrypted with this site is because of the author's incompetence. It's not hard to write secure ransomware, but they somehow failed very badly. Anyone should be able to easily protect this site.
  - catshirt 10y ago
    so like, you just don't go to any websites ever? or what?
foota 10y ago
Looks like decryption for badly constructed ransom ware
- xenadu02 10y ago
  It isn't just badly made ransomware; in some cases people have stolen the master key or the responsible party has released it. In other cases C&C servers have been seized and keys recovered that way. Ransomware exists thanks to a fundamental mistake in the Unix (+Windows, +others) model that a process' rights to the filesystem automatically inherit from the user's rights. Imagine if all processes running under the same user shared the same address space! There is absolutely no reason some random piece of code downloaded from the internet should have access to my home directory, let alone the rest of the filesystem, without my explicit authorization. The future is macOS sandbox / linux cgroup by default for all processes. The macOS solution of presenting the user a system-controlled open dialog that then grants access to the selected path outside the container is elegant and not too intrusive. Taken a step further, it is obvious that CoW filesystems need to be standard and all activity taken by a process should be recorded in snapshots that get coalesced over time. If a rogue process does cause damage it should be possible to roll back just that process' most recent changes to the filesystem.
  - the_duke 10y ago
    I'm really quite surprised that there are no big and used by default user facing sandboxing solutions for the major OSes out there. With dynamic prompts akin to the firewall prompts familiar from Windows/Mac. 'The program "Chrome" wants to create the file "/home/username/.config/chrome/config". Allow "Chrome" to access [just this file / the diretory ~/.config/chrome / the diretory /home/username]' 'WARNING: The program "totally_legit_for_reals" wants to overwrite the file ~/.xinitrc. This is potentially dangerous. Allow access? -> Are you sure?' 'ALERT: the unknown program "xxx" has gained superuser privileges and wants to overwrite a critical system file System32/whatever.dll. This is very dangerous....' Then again, non techie users usually ignore all those prompts and just click accept. Just look at the mess that is Android permissions. Almost no one actually checks them or rejects apps that ask for way too much. I'd still really like a kernel level protection mechanism that requires granting each executable the capabilities it requests, with dynamic pin the Linux world there are SELinux, AppArmor grsecurity, which are often cumbersome to use).
    - progval 10y ago
      That is kind of what Qubes OS does, but for interaction between VMs (eg. copy a file).
    - smsm42 10y ago
      A more robust idea might be a versioned filesystem. Somebody hacks your browser, it overrides your files - no matter, you just rollback to yesterday's version. Of course, that'd require more diskspace, but diskspace is getting cheaper and most of it is used for content that is completely static (like games or photos or videos - not edited much unless you're a professional working with it). Also probably would be a bit slower but I think it can be solved. I think there are a number of implementations of such things, but none mainstream enough.
    - voltagex_ 10y ago
      >"WARNING... ALERT..." Hell, I'm a technical user and after a couple of days running Comodo firewall (which does prompt in a similar way to your examples) I turned it off because I was sick of the prompts and just wanted to use my machine.
elorant 10y ago
Anytime you're in a similar dilemma just disable JavaScript. There are even plugins that allow you to do that with one click.
- nitrogen 10y ago
  JS is not the only attack surface in a browser. There have been exploitable bugs in image parsers, font renderers, etc. Tracking is possible without JS as well. Maybe try lynx?
  - babuskov 10y ago
    > Maybe try lynx? Or just use VPS when surfing the web.
    - samstave 10y ago
      Or surf from a VM on your machine. I used to do this on linux, as I had copies of my windows VM and I would just browse from the windows box on another screen and then work from the linux one on the main screen
      - babuskov 10y ago
        Yes! I meant VM. I was just setting up some VPS and mistyped it.
  - startling 10y ago
    I'd assume Chrome is safer than Lynx these days, to be honest. Not to mention the fact that using Lynx makes you unique enough for it to be a useful tracking indicator.
- user5994461 10y ago
  And make sure your browser is updated as well ^^
- XaYdEk 10y ago
  Or better still noScript blocks all js by default and you only whitelist the sites you trust. Throw in a Ghostery for cookies and you are reasonably good to go.
kintamanimatt 10y ago
Why are you afraid to click the link?
- rhapsodic 10y ago
  > Why are you afraid to click the link? Because ransomware criminals would probably love to take over that site and start distributing ransomware or other malware from it. And I have no way to judge how well that site's owners have protected it from that sort of attack. When I'm in doubt, I tend to err on the side of caution.
  - babuskov 10y ago
    > Because ransomware criminals would probably love to take over that site I assume most people reading the website would be those already infected. The criminals are more likely to take over any other high traffic website and infect computers of clueless people who have never heard of ransomware.

It's legit. Informational website about ransomware and what to do in case your device is affected. Apparently sponsored/endorsed/whatever by Europol, the Dutch Police, Kaspersky, Intel, AWS and Barracuda.

rhapsodic 10y ago
> It's legit. Informational website about ransomware and what to do in case your device is affected. That's good to know, but the ransomware criminals probably have the skills, and they definitely have the incentive, to pwn that site.
- iancarroll 10y ago
  If someone has a vulnerability that will break out of your web browser's sandbox, they're not going to waste it on this site. And the ransomware that can be decrypted with this site is because of the author's incompetence. It's not hard to write secure ransomware, but they somehow failed very badly. Anyone should be able to easily protect this site.
- catshirt 10y ago
  so like, you just don't go to any websites ever? or what?

foota 10y ago

Looks like decryption for badly constructed ransom ware

xenadu02 10y ago
It isn't just badly made ransomware; in some cases people have stolen the master key or the responsible party has released it. In other cases C&C servers have been seized and keys recovered that way. Ransomware exists thanks to a fundamental mistake in the Unix (+Windows, +others) model that a process' rights to the filesystem automatically inherit from the user's rights. Imagine if all processes running under the same user shared the same address space! There is absolutely no reason some random piece of code downloaded from the internet should have access to my home directory, let alone the rest of the filesystem, without my explicit authorization. The future is macOS sandbox / linux cgroup by default for all processes. The macOS solution of presenting the user a system-controlled open dialog that then grants access to the selected path outside the container is elegant and not too intrusive. Taken a step further, it is obvious that CoW filesystems need to be standard and all activity taken by a process should be recorded in snapshots that get coalesced over time. If a rogue process does cause damage it should be possible to roll back just that process' most recent changes to the filesystem.
- the_duke 10y ago
  I'm really quite surprised that there are no big and used by default user facing sandboxing solutions for the major OSes out there. With dynamic prompts akin to the firewall prompts familiar from Windows/Mac. 'The program "Chrome" wants to create the file "/home/username/.config/chrome/config". Allow "Chrome" to access [just this file / the diretory ~/.config/chrome / the diretory /home/username]' 'WARNING: The program "totally_legit_for_reals" wants to overwrite the file ~/.xinitrc. This is potentially dangerous. Allow access? -> Are you sure?' 'ALERT: the unknown program "xxx" has gained superuser privileges and wants to overwrite a critical system file System32/whatever.dll. This is very dangerous....' Then again, non techie users usually ignore all those prompts and just click accept. Just look at the mess that is Android permissions. Almost no one actually checks them or rejects apps that ask for way too much. I'd still really like a kernel level protection mechanism that requires granting each executable the capabilities it requests, with dynamic pin the Linux world there are SELinux, AppArmor grsecurity, which are often cumbersome to use).
  - progval 10y ago
    That is kind of what Qubes OS does, but for interaction between VMs (eg. copy a file).
  - smsm42 10y ago
    A more robust idea might be a versioned filesystem. Somebody hacks your browser, it overrides your files - no matter, you just rollback to yesterday's version. Of course, that'd require more diskspace, but diskspace is getting cheaper and most of it is used for content that is completely static (like games or photos or videos - not edited much unless you're a professional working with it). Also probably would be a bit slower but I think it can be solved. I think there are a number of implementations of such things, but none mainstream enough.
  - voltagex_ 10y ago
    >"WARNING... ALERT..." Hell, I'm a technical user and after a couple of days running Comodo firewall (which does prompt in a similar way to your examples) I turned it off because I was sick of the prompts and just wanted to use my machine.

elorant 10y ago

Anytime you're in a similar dilemma just disable JavaScript. There are even plugins that allow you to do that with one click.

nitrogen 10y ago
JS is not the only attack surface in a browser. There have been exploitable bugs in image parsers, font renderers, etc. Tracking is possible without JS as well. Maybe try lynx?
- babuskov 10y ago
  > Maybe try lynx? Or just use VPS when surfing the web.
  - samstave 10y ago
    Or surf from a VM on your machine. I used to do this on linux, as I had copies of my windows VM and I would just browse from the windows box on another screen and then work from the linux one on the main screen
    - babuskov 10y ago
      Yes! I meant VM. I was just setting up some VPS and mistyped it.
- startling 10y ago
  I'd assume Chrome is safer than Lynx these days, to be honest. Not to mention the fact that using Lynx makes you unique enough for it to be a useful tracking indicator.
user5994461 10y ago
And make sure your browser is updated as well ^^
XaYdEk 10y ago
Or better still noScript blocks all js by default and you only whitelist the sites you trust. Throw in a Ghostery for cookies and you are reasonably good to go.

kintamanimatt 10y ago

Why are you afraid to click the link?

rhapsodic 10y ago
> Why are you afraid to click the link? Because ransomware criminals would probably love to take over that site and start distributing ransomware or other malware from it. And I have no way to judge how well that site's owners have protected it from that sort of attack. When I'm in doubt, I tend to err on the side of caution.
- babuskov 10y ago
  > Because ransomware criminals would probably love to take over that site I assume most people reading the website would be those already infected. The criminals are more likely to take over any other high traffic website and infect computers of clueless people who have never heard of ransomware.