11 ms·
Ransomware gives free decryption keys to victims who infect their friends
- meowface 10y agoClever idea, but I doubt this would work in 99% of cases. It's basically a link to an EXE. You could probably only convince someone to run it if you have some acquaintance with them, so obviously they'd hate you afterwards. And you only get the key if they not only get infected, but pay up. And you have to do it twice. A better method might be "get 5 people infected", regardless of payment.
- Buge 10y agoThen you could just infect 5 virtual machines.
- curiousgal 10y agoThey have to pay.
- Buge 10y agomeowface said "A better method might be 'get 5 people infected', _regardless of payment_."
- kmm 10y agoThey're probably counting on the average person infected with ransomware not being able to do this
- Buge 10y agoBut someone could set up a service where they charge $50 and someone gives them their referral link and they install 5 times from that link.
- x1798DE 10y ago> A better method might be "get 5 people infected", regardless of payment. If you don't require payment, anyone could just spin up five VMs and infect them, then request a decryption key. Not saying these guys are clever or anything and the scheme seems likely to fail for the reasons you mention, but I think something like a "get two other people infected and they pay up" scheme is the most workable version.
- meowface 10y agoYeah, on second thought you're right.
- pmontra 10y agoHate them? Somebody could send them to jail as accomplices of the ramsomware guys and that's what those people deserve.
- xg15 10y agoSomeone has been watching too much "the ring"...
- mkagenius 10y agoIf it forms a binary tree, the leaves itself will be 50% of the population. (much worse in case of 3-nary tree?)
- Cyph0n 10y agoWhat I don't understand about ransomware in general is how the AES key is stored on the machine. I'm assuming that it's grabbed from the server, used only during encryption, and then scrubbed from RAM/filesystem. Otherwise, it would be possible to recover the key post-encryption. Or am I missing something?
- tokenizerrr 10y agoGenerally they generate a private / public keypair, transmit them to a server, store both somewhere while the encryption process is in progress, then they scrub the local private key.
- RKearney 10y agoThe encryption uses a public/private keys to encrypt the files using the public key, while keeping the private key stored on the remote servers. The clients PC never has access to the decryption key. https://en.wikipedia.org/wiki/Public-key_cryptography https://en.wikipedia.org/wiki/Public-key_cryptography
- Cyph0n 10y agoUsing PK crypto would be horrendously slow, especially if there are a large number of files. Besides, the article notes that this ransomware uses AES-256. Perhaps the AES key is encrypted with RSA after encryption is complete and kept on the infected machine.
- user5994461 10y agoWho cares about the key? It's not like the victim is gonna find it and reverse the cryptography himself. Hiding the key is unnecessary over engineering.
- dmoy 10y agoIf the key is accessible, someone could write software to automate breaking your ransomware.
- jlgaddis 10y agoNovel and innovative. This guy is disrupting the ransomware industry. ;)
- MichaelBurge 10y agoThat's interesting how they use the sob story. Anyone wanting to pay is going to feel conflicted, so they give the user an out by letting them feel like they're helping poor people in Syria. They've chosen Syria because it's well-known and in the news. I wonder if their English is poor, or if they're trying to be endearing to help their conversion rates. You could confirm the former by correlating it with what common errors people in different countries make. It doesn't look like they expect people to infect their friends, but offering the false choice is a pretty common way of making people feel slightly more in control. It probably helps their conversion rates, even if nobody picks the blue option.
- Yhippa 10y agoThis sounds like the beginnings of a future Black Mirror episode.
- ant6n 10y agoThere was already a ransomware episode: https://en.wikipedia.org/wiki/Shut_Up_and_Dance_(Black_Mirror) https://en.wikipedia.org/wiki/Shut_Up_and_Dance_(Black_Mirro...
- mercurialshark 10y agoReamde would have unfolded quite differently had this been the case.
- NoExiiT 10y agoAnd how they know if I infected a friend's computer ? It can be mine, right ? I have just have to setup a new computer with a fresh install and repeat it again and again until they give the key.
- ShotgunSnipist 10y ago"Send the link below to other people. If two or more people will install this file and pay, we will decrypt your files for free."
- NoExiiT 10y agoYes, of course! Damn, I read it too fast ... sorry.
- byebyetech 10y agoSounds like a pyramid scheme!
- CodeWriter23 10y ago"Viral Marketing"
- jpalomaki 10y agoNext step (unless it is already there) could be affiliate marketing (pay 25% of the ransom to people who distribute the malware). If people start getting smart with backups, the response could be to switch blackmailing (pay or we'll distribute your files). I find this whole thing quite scary. We all know how difficult it is to protect yourself from a determined and skilled adversary. Now that there is clear business model and opportunity to make hundreds of millions[1] this thing will probably attract more and more people. Building botnets was a mass market operation. Ransomware could become more targeted, since the value of single infected machine can be much higher. [1] http://thehackernews.com/2015/10/cryptowall-ransomware.html http://thehackernews.com/2015/10/cryptowall-ransomware.html
- rahrahrah 10y agoDoesn't work. The moment someone exposes the game the affiliate marketer will have his affiliate account closed by whichever company or network they're trying to work with.
- cryptarch 10y agoIt won't be hard to set up a darknet-based affiliate service, e.g. one that upon retrieval of the Bitcoins sends 25% to the affiliate, 74% to the botnet herder and 1% to the affiliate service. Perhaps an Ethereum program could do it, but then it might be a good idea to set up a second Ethereum network for anonymous use over darknets.
- rahrahrah 10y agoBut at some point an actual company with an actual reputation on the line would have to be involved. Those are the people that would ban you.
- cryptarch 10y agoHow so? The darknet markets (e.g. Silk Road) seem to be doing great without "actual companies", but they do have an actual reputation. You don't need an actual company to accept Bitcoins. You don't even need a PO box or a telephone number. Just a computer connected to the internet.
- faragon 10y agoWhy is not the FBI actively targeting those criminals?
- djedipus 10y agoThey're waiting for their files to be unlocked
- logicallee 10y agoDon't you mean: "why does the FBI, NSA, CIA, or any cyber security agency exist? They should not exist. SECONDLY, why aren't they actively targeting those criminals?" I think it's important to remember that those agencies shouldn't even exist, before asking why they're not doing something. Don't quietly justify them.
- themckman 10y agoWhy shouldn't they exist?
- logicallee 10y agoThe primary point of my comment was to remind people that most HN readers are very against cyber capabilities/surveillance/etc - so when someone calls for those agencies to do something, it is important to remember that people are against those agencies even existing, having any capabilities at all. Now as for providing you the argument for why they should or shouldn't exist, I think it's political and I like HN's move away from political discussion so let's not have it. But I think it's not going too far to ask people to be explicit about some of the contradictions. If you look at the comment phrasing I "suggested", you'll see it's a contradiction. I don't mean to resolve that contradiction but we shouldn't ignore it - my point was to write the contradiction explicitly. One possible way to address your question briefly would be with reference to some films and books. but we don't need to answer your question in order to acknowledge the contradiction and I wouldn't like to answer it (one way or another - why they should, why they shouldn't exist.) it's good for HN to step back from politics a bit so let's leave it at that.
- dkh 10y agoCompletely evil and terrifying, yet also somehow brilliant psychologically. Tricking people to install it thinking it's the Popcorn Time streaming app has a bit of irony involved.
- gpm 10y agoInteresting plan. I think people are underestimating how effective it might be. Suppose a kid gets their parents computer infected. There is a pretty good chance that they will panic and take the non-monetary route. It's not like infecting others is beyond most kids abilities. Just run the exe themselves on school computers, post it in video game chats, send it to friends, etc. Since they aren't sure how many people will pay before their parents notice there is a strong incentive to send it to a lot of people, not just two. The other route I see is that an adult sees this and tries to infect some company computers, on the theory that the won't be caught and there is a good chance the company will pay up. Not many people will go for it of course, but if it manages to spread internally then they will be in a decent position to demand a lot of money.
- logicallee 10y agoCan we put quotation marks around the word "friends" to show what is really going on more clearly? It is, in fact, recruitment into cyber crime. The title should read: > Ransomware gives free decryption keys to victims who infect their "friends"
- blauditore 10y agoI wonder how Bitcoin-based scammers launder their money. Bitcoin addresses are anonymous, but all transactions are public, right? So while it's hard to find out who's behind an address, it's publicly visible if they spend money, and where it goes. Thus, they're only able to spend it on "trusted" peers to not jeopardize their own anonymosity. For example, if they buy something from an online shop, this transaction will be visible for all Bitcoin users. And if that shop publicly shows its Bitcoin address, authorities might track down that shop and force it to give away their shipment address. Or am I missing something?
- chipperyman573 10y agoYou can use Bitcoin mixers to get around this. https://en.bitcoin.it/wiki/Mixing_service https://en.bitcoin.it/wiki/Mixing_service
- cryptarch 10y agoBitcoin tumblers take care of this. Roughly, you set up a service that puts a lot of people's coins in a single wallet, then you route bitcoins from that wallet to a bunch of different wallets operating in similar fashion. Kind of like how TOR works. It's easy to generate many temporary wallets that can not be linked back to your main wallet, shops can do this too and I think it's considered a good practice to use one address per sale. You can also convert the Bitcoins to a more anonymous coin (Monero?) and back.
- bitmapbrother 10y agoYet another reason to avoid Windows. The only new software being released for Windows are viruses, malware and ransomware.
- charonn0 10y agoThe only vulnerability in this case exists between the keyboard and the chair.
- codedokode 10y agoDo you mean one has to be a computer science graduate to use a computer? And I doubt even CS graduates can always distinguish between real software and fake one with malware inside. I think the problem is in PC and OS design.
- charonn0 10y agoWhat I meant is that ransomware predominantly spreads by tricking the user into running malicious code, as opposed to tricking the OS. There's not a whole lot the OS can do if the user is determined to open e.g. "kittenpic.jpg.exe" or "invoice.doc.exe".
- codedokode 10y agoThat is because user has a previous experience of double clicking files to run or view them and nothing bad happened. > There's not a whole lot the OS can do if the user is determined to open e.g. "kittenpic.jpg.exe" or "invoice.doc.exe". I think there are many options: 1) do not download executable files or make them non-executable after download 2) do not run downloaded executable files 3) do not run executable files without valid signature from OS developers 4) run executable files inside a sandbox For example, iOS uses approaches 1, 3 and 4, and Android uses 4. Only desktop operating systems (including some Linux distrbutions) allow to trick user into running a malware with full access to user's files by clicking a link and pressing Ok twice. That is why I consider this is OS fault, not user's. In many environments users are not supposed to download and run executable files. For example, in a workplace an employee is supposed to use only software approved by the company. And still no operating system provides an easy way to enforce it. Imagine if pressing a wrong button on a washing machine would cause installing malware. Would you like to buy such device?
- mSparks 10y agopopcorn time software is something completely different. this sounds more like an attempt to taint the popcorn time name rather than real malware.
- wutbrodo 10y agoIt seems like a far more plausible explanation that this is real malware that picked well-known software that people are likely to be downloading from sources that they're not super sure about.
- throwaway4891a 10y agoThere's a niche field of malware economics, but it makes sense that for-profit malware is ultimately a business, albeit an usually illegal one, which has to optimize just like any other app: https://cyber.harvard.edu/cybersecurity/Economics_of_Malware https://cyber.harvard.edu/cybersecurity/Economics_of_Malware https://www.coursera.org/learn/malsoftware https://www.coursera.org/learn/malsoftware At some point, it would make sense anonymized malware (i2p, tor only) may go open source similar to commercial open source but instead because of scene cred / blackmarket consulting.
- deoxxa 10y agoThis is roughly what happened with several "exploit droppers" a few years ago. It wasn't pretty GitHub sites or open source blogs, but rather "leaked" versions of the software suites, missing nearly all of the actual exploits. Usually there'd be a couple of very old, widely patched exploits in there so you could see how it worked. People would download the stripped out version, play with it, then buy the actual exploit payloads/plugins. Pretty interesting process to watch from the sidelines!
- jwatte 10y agoOSes will have to start detecting processes that do a lot of disk read/write, and perhaps network upload, and quarantine them. Also, checkpoint/log based file systems like nilfs2 can let you roll back to any point before infection.
- charonn0 10y agoI'm not sure that would be effective. A lot of legitimate software would get caught up in the dragnet.
- jwatte 10y agoYes, and the user would have to whitelist them. However, how much software do you really have that rewrites even 1/10th of all your documents?
- mattstreet 10y agoThen the ransomware would just encrypt the files more slowly.
- Pica_soO 10y agoThe problem with ransomware is also, that it can infect a lot of people who dont have that kind of money. If they would do it decently, the would allow for partial recovery of files with rising prices per batch, and measuring how long the user could come up with the coins. Pricebuilding exercise combined with social engineering. God, they could go full ponzi scheming with this and get a billion people to get rich and accomplices..
- codedokode 10y agoI wonder what can be changed to help find and prosecute the distributors of malware? By the way I think that the ones held responsible and paying for the damages should be distributors, not malware developers especially if they did not know exactly how it would be used. Making malware is like making a gun, it is allowed in some countries. Maybe it will be used for good purposes.
- niij 10y agoI think that's bogus. They can and should be held accountable if they're running enterprises like this. How can malware be used for good purposes? (Mal)icious Soft(ware) doesn't sound too "good" to me.
- imchillyb 10y agoWith airplanes, the manufacturer is on the hook until the plane is no longer in the air. We should require OS manufacturers to do the same. They should be on the hook for security until the last device using their technology is no longer in use.
- gpm 10y agoThat doesn't really make sense. 'Security' is not a binary thing, many pieces of malware, quite possibly including this one, don't break the OSes security model. The OS doesn't consider your browser downloading and running executable a problem, if it did we would all be complaining about wall gardens. If that executable wants to read and write files in your home directory it is allowed to (otherwise you couldn't download and run emacs). The fact that it happens to be encrypting them to ransom back to you isn't something the OS is really in a position to know, or do anything about.
- maverick_iceman 10y agoI wonder why no one is looking at the obvious solution - discredit the ransomware folks. I.e. create ransomware that doesn't free your files even after you pay the ransom. As soon as word gets around that there are ransomwares like that their whole business model will collapse. Sure, this will not be nice to the (small number of) people who get screwed over but it definitely solves the larger problem.
- ThrustVectoring 10y agoAn alternative solution is to make it illegal to pay ransomware.
- gipp 10y agoYeah that's all well and good until major corporate/governmental networks are infected, which has already happened on small scales.
- ThrustVectoring 10y agoMajor corporate and government networks are better able to handle it, so long as you have top-down buy-in. Just publish a policy that anyone caught paying a ransom will be fired, and throw a bit of money into PR puff pieces talking about your tough-on-ransomware policies. Ransomware makers won't try to target your network, since they'll won't get money from the CEO and will have a real hard time negotiating with people from other layers. Any incidental damage will get dealt with by various mitigation policies (backups, etc).
- maverick_iceman 10y agoThat'll just make criminals out of ordinary people.
- ThrustVectoring 10y agoAre you saying that it'll convince literally zero people to not pay the ransom? Every ransom that does not get paid is money that doesn't contribute to the "distributing ransomware is a viable way to make money" problem.
- MisterWalter 10y ago1 - Infect a few virtual machines 2 - Collect decryption keys 3 - Laugh at the hackers Of course not many people out of the general population know how to make a (primarily) windows VM, but I'm surprised that others aren't mentioning it in this thread.
- detaro 10y agoThey require that the other people you infect pay the ransom, so you'd still have to pay for the VMs. (Also https://news.ycombinator.com/item?id=13147428 https://news.ycombinator.com/item?id=13147428 and replies)
- MisterWalter 10y agoWhoops, I missed that bit, that would be why. Thanks.
- deleted 10y ago[deleted]