10 ms·

FYI to Sysadmins: Paying the ransom at this point will be a waste of money, as the contact e-mail address has been blocked. https://posteo.de/blog/info-zur-ran

• sillysaurus3 9y ago
  It's always seemed like the best way to end ransomware is to launch hundreds of variants that demand money but don't actually decrypt anything. Unethical, to be sure, but eventually people would learn not to give them money. All the competent ransomware authors are probably quite unhappy whenever a defective ransomware strain pops up.
  • comboy 9y ago
    If it gets big enough then people just hear from each other if paying unlocks the data or not. The best way to end ransomware is to get serious about security. In many cases, being attacked by a ransomware, is paying a low price compared to if it was a targeted attack. edit: Also, I imagine it gets easier after you wrote one i.e. many ransomewares come from the same author. So he could gain a reputation by signing messages saying that yes, this is our ransomware, we always unlock after receiving the payment.
    • notgood 9y ago
      >If it gets big enough then people just hear from each other if paying unlocks the data or not. The idea would be to create "fake" ransomware that looks exactly like the real one >The best way to end ransomware is to get serious about security No matter how serious you get there always gonna be bugs, there isn't a single piece of mass distributed software in human history without bugs. That said, we should try to improve security of software but expecting it to be THE solution is wrong. >Also, I imagine it gets easier after you wrote one i.e. many ransomewares come from the same author. So he could gain a reputation by signing messages saying that yes, this is our ransomware, we always unlock after receiving the payment. Forging a signature is not that hard.
      • comboy 9y ago
        If forging digital signature is not that hard, then you can release some great scientific paper moving crypto decades ahead, or alternatively you can make billions.
        • notgood 9y ago
          I was talking about pixel-made signatures; you know, the one the user actually sees when the computer its already infected; not cryptography between public/private keys; otherwise its a chicken and egg problem; how do you know what signature its the "real"; you google it and hope nobody added its own search results? Go to the official website of the ransomware developer?
          • comboy 9y ago
            The ransomware can present the key fingerprint for example. But even without it, there are so many options, e.g. timestamp signed message on the blockchain before the release. After just one confirmed message you don't care about pretenders because people can check if the signature matches with the previous message.
            • notgood 9y ago
              I think you are overestimating the technical capacities of the average randomware victim.
              • comboy 9y ago
                It's enough that some technical people verify it. The average random victim gets his info from news sites and more technical friends.
  • bcjordan 9y ago
    Is it not cryptographically possible to create a transparent provably-operational decryptor on top of something like ethereum?
    • MichaelGG 9y ago
      It's a marketing issue. People likely to get hit with ransomware are incredibly unlikely to understand what that means. Hell, even main devs have trouble writing contracts, so even if a user knew there was a smart contract, verifying it would be another thing. So it'd get reduced to "guys on Twitter said this one works". I like the idea though.
    • rodarmor 9y ago
      Since you can't store the private key needed to decrypt the files in ethereum, I can't think of how to do this. All blockchain state is public, since it needs to be calculated by and verified by all nodes, so there's nowhere to stash a private key without revealing it.
  • dzhiurgis 9y ago
    It's like saying best way to fight heroin addicts is to supply market with poisoned heroin. No heroin users - no problems!
    • drhodes 9y ago
      The US government did this with alcohol during prohibition, > by the time Prohibition ended in 1933, the federal poisoning program, by some estimates, had killed at least 10,000 people. http://www.slate.com/articles/health_and_science/medical_examiner/2010/02/the_chemists_war.html http://www.slate.com/articles/health_and_science/medical_exa...
    • rickycook 9y ago
      except that getting malware isn't addictive...
      • dzhiurgis 9y ago
        Your information is tho
    • notgood 9y ago
      A non-strawman analogy would be to sell fake heroin that looks exactly like heroin but does nothing at all. This analogy is more exact because the resource you are wasting its the same: money (not lives as in yours)
  • mwilcox 9y ago
    It's a lot more likely that the attackers make money via the markets than via a direct ransom.
  • deleted 9y ago
    [deleted]
• compuguy 9y ago
  English version: https://posteo.de/en/blog/info-on-the-petrwrappetya-ransomware-email-account-in-question-already-blocked-since-midday https://posteo.de/en/blog/info-on-the-petrwrappetya-ransomwa...
• Miner49er 9y ago
  Interesting. If I was Posteo I don't think I would've been so quick to ban the email, this will potentially cause a lot of harm. What about all the people that need their data back? They have no way to get it now. Plus many people are still going to post the money only to get no response from the email.
  • sillysaurus3 9y ago
    It's also a good way to catch the authors. They might accidentally log in without using tor. (It's happened surprisingly often.)
  • willstrafach 9y ago
    This is indeed a heavily debated topic. It will cause a major headache for those who pay and will hopefully make people learn to distrust ransomware, in turn making it less lucrative. On the other hand, that requires a fair number of "acceptable casualties" so to speak. I personally think both sides of this are valid and don't know what the best option really is. It will be interesting to watch how things evolve at least.
    • ryanlol 9y ago
      >will hopefully make people learn to distrust ransomware, in turn making it less lucrative. Ransomware will never ever not be lucrative. Preventing people from getting their data back doesn't discourage future campaigns and primarily hurts the victims of the ransomware.
      • notgood 9y ago
        [citation needed]
        • ryanlol 9y ago
          Seriously? The whole idea is so fundamentally stupid. 1) Ransomware authors have obvious economic incentive to decrypt, and no reason not to. This makes it a herculean task to convince the general public that they wouldn't do so. 2) By the time your data is encrypted, you'll be researching your specific ransomware strain and will find out if it's legit or not. Googling the onion address is an obvious choice and something the ransomware author can just tell you to do. 3) Most people will need someone more technical to arrange the bitcoin payment anyway, these people will verify if the ransomware seems to be legit or not. 4) People don't magically get smarter, phishing still works if you pass the spam filters. 5) Winlockers were immensely lucrative even before they started using crypto. 6) Unless you're going to run your fake-ransomware campaign at an immense scale you'll never drown out the real, working ransomware. And then in the end, what the was your goal anyway? Good job, now you've deleted millions of peoples data on a retarded mission to "stop ransomware". But hey, at least you stopped those evil russians!!! There are precisely zero good arguments for preventing people from decrypting their data.
• hathawsh 9y ago
  It's surprising that the attackers ask victims to send an email. Why not ask victims to publicly post a picture of their screen to social networks with a certain hash tag (and a new account)? That would be less traceable and harder to shut down, I think. Not that I want to give attackers any ideas... :-)
  • blojayble 9y ago
    Thanks, we'll give it a go next time.
  • dokument 9y ago
    I've seen variants that use Bitmessage and other anonymous messengers before.
  • lordnacho 9y ago
    There's so many creative things you can do when you imagine yourself as one of these attackers. - Make a big target amount of money that any large company can pay, eg $10M, and tell people you'll release everyone's key if the amount is raised. - Use an online board like this one to control the state of your network. - Embarrass individual firms by posting pics of their offices from their own webcams. Etc, etc. I reckon talking about these sorts of things will help find solutions rather than just inspire the bad guys.
    • dflock 9y ago
      > Make a big target amount of money that any large company can pay, eg $10M That sounds like a good way to get state level actors on your case.
      • kbenson 9y ago
        Yes, as long as the payments are individually relatively small and anonymous, it's easy for people to misunderstand the amount they may actually be getting. Once you paint a target in the millions, people will notice more, it will become a bigger news story, some congressman or another will make it a pet cause, and then you've got a lot or attention on you. Like any criminal enterprise, the less attention from authorities the better.
• comboy 9y ago
  It's not easy (I presume) to create such software. So why do they rely on some random e-mail provider? They could have done it so that computers unlock automatically after the address receives the payment. It's not that hard, the software could use multiple ways to get the private key (DNS, IRC, twitter, DHT) and it would be really hard to shut down.
  • r1ch 9y ago
    Petya is ransomware-as-a-service, the author gives you the binary payload and unlocking service and it's up to the buyer to distribute / infect people. It often leads to poorly setup things like this where the buyer probably didn't expect their variant to spread so wildly.
• PeterisP 9y ago
  It doesn't seem that getting ransoms was the actual goal of this malware, it seems rather like plausible deniability. This is a good description of some details https://medium.com/@thegrugq/pnyetya-yet-another-ransomware-outbreak-59afd1ee89d4 https://medium.com/@thegrugq/pnyetya-yet-another-ransomware-... - it rather looks like a targeted attack to do chaos+damage to Ukraine.
• memracom 9y ago
  They should sue the pants off whoever shut down that email address. For many companies it would have been cheaper to pay than to suffer the damage that has already been done. And it would be easier to catch the culprits if people give them lots of cash because in spending the loot, they will make mistakes and make themselves visible to the police. Now there is nothing to track until they rewrite their code and try the attack again with randomized email addrs