8 ms·
> Lessons learnt by ransomware developers - rather than using a single pretty arbitrary test, always rely on a more robust statistical model to detect whether y
by jahabrewer 9y ago
> Lessons learnt by ransomware developers - rather than using a single pretty arbitrary test, always rely on a more robust statistical model to detect whether your code is running inside a sandbox.
I like to imagine that one of the developers on that team filed a tech debt item to do exactly this, was never able to get their manager to prioritize it, and is now pulling out their hair saying, "I told you so!"
- haburka 9y agoI'm that developer but instead of working on malware, I just want to make sure that iPhones can actually use the website.
- lithos 9y agoMalware is more interesting. The site itself doesn't seem to have enough ads or well placed enough ads to be "income as a goal". So I'm guessing it's a " proof I can do stuff " or "trophy room" blog, which doesn't care (HR and recruiting will happily use worse websites to judge canidate value, or trophy rooms will be put in a room no one else wants/cabin so far from everyone it doesn't have electricity)
- dis-sys 9y agowill he/she be called into a HR meeting to make a Performance Improvement Plan? ;)
- walshemj 9y agoProbaly get a pair of concrete over shoes
- jessaustin 9y agoPotato, potahto.
- 13of40 9y agoI like to think that they know anything they implement will eventually get blocked, so they have a big collection of unexploited evasion tricks and just introduce them one by one.
- nray 9y agoI like to think wankers who stop hospitals go to jail and never work with a PC again. It would be nice if those BTC were hard to cash out too.
- 13of40 9y agoI've seen ransomware that explicitly tried to avoid hospitals, schools, government, etc., so there's that. I always assumed it was out of self interest though.
- walshemj 9y agoYes screwing some Radom punter over is quite different that triggering an attack that meets the crtiteria for a CNI attack. All this means instead of pc plod being unable extradite the perps from eastern Europe to you get the serious players involved.
- meowface 9y agoNot that it exonerates them whatsoever, but these kinds of attacks (including Wana Cryptor) usually aren't tailored for hospitals or any particular institution. They just harvest as many email addresses as they can (from leaks and purchased lists from spammers, etc.) and try to get as many infections as possible. Hospitals just happened to be disproportionately affected by this attack because a lot of them have ineffective IT departments/mangement and never applied the MS17-010 patch. Of course, these people are still felons and are likely responsible for millions of lost family photos, work and school documents, etc. They just aren't going out of their way to target hospitals.
- toyg 9y ago
- Dolores12 9y agoThere is nothing that stops them to relaunch attack with modified version. Initial wave will use spam, then worm-like part of the ransomware will penetrate internal networks.
- wand3r 9y agoSure but this generated a lot of press so it made the vuln more known; Microsoft released a patch and systems are likely less vulnerable to the same attack. Similar attacks using other vulns or tooling are inevitable but this is prob much less impactful and the registration probably mitigated a lot of damage
- EGreg 9y agohttps://motherboard.vice.com/en_us/article/round-two-wannacry-ransomware-that-struck-the-globe-is-back https://motherboard.vice.com/en_us/article/round-two-wannacr...
- Buge 9y agoWhy wouldn't they do it initially? It would take like 5 minutes to make it use a random string instead of a hardcoded one.
- libeclipse 9y agoYou make it sound like some professional outfit. Is it really like that? I would've thought that it's a bunch of teens.
- bcruddy 9y agoYou think a bunch of teens orchestrated a global attack on this scale? Surely this is satire and you dropped the /s right?
- edmccard 9y ago>...orchestrated a global attack on this scale? Was it "orchestrated", or did the worm just spread randomly and opportunistically?
- napsterbr 9y agoMy bet is a bunch of teens. Not really orchestrated as much as exploited a vulnerability amplified by p2p connection, which led to worldwide scale. By the look and UX of the virus (yes there's a UX there too), they do seem to have a better grasp than most script kiddies, who usually can barely extend whatever script they've got.
- burntrelish1273 9y agoHard to say. It could be an organized crime gang, terrorists, state actor, someone not making enough money legitimately in a 3rd-world country, bored middle-aged techie or teenager wanting to "get away" with something. There may or may not be levels of management, contractor(s) or multiple participants. (Shady "businesses" most definitely have subcontractors. Heck, I know of someone whom got their degrees paid for by a shady illegal gambling outfit.)
- lmm 9y agoI doubt it. This is organised crime motivated by money (which is usually something adults do); the very fact that the program tries to detect whether it's being sandboxed indicates a certain level of professionalism.
- urbanxs 9y agoAwww the know it all reddit style mansplaining. Criminals dont use statisticals models. Traitors cant be stopped by software security. China is in the same boat as the UK and other nations. Windows is crap.
- BrainInAJar 9y ago> I like to imagine that one of the developers on that team filed a tech debt item to do exactly this, was never able to get their manager to prioritize it, and is now pulling out their hair saying, "I told you so!" Malware authors have budgets and schedules too. It's a business, probably more profitable than 90% of the startups in SV
- deleted 9y ago[deleted]
- 794CD01 9y agoThat's not exactly high praise. A tuft of grass is more profitable than 90% of the startups in SV.
- secondhandvape 9y agoEspecially if that tuft of grass is on piece of real estate in the bay area.
- EGreg 9y agoI wonder if Levi's jeans were more profitable than the average goldbug
- blablabla123 9y agoHaha... That's a quite negative point of view. I mean even though most startups don't survive and won't make the involved parties more wealthy, there are people who actually use that stuff. From a user perspective it's profitable ;)
- duncan_bayne 9y ago> It's a business No, it's not, and it's pretty damn rude to make that claim in the presence of legitimate businesspeople.
- klez 9y ago