10 ms·
US police force pay Bitcoin ransom in Cryptolocker malware scam
- danielharan 13y ago"[Police] insisted that the Massachusetts police systems were now clear of infection, and that essential operational computers were not affected, nor was there any data stolen." How the hell would they even know?
- jrockway 13y agoAccording to every article I've read on the Internet, you can't steal data, only copy it. It's not stealing if the owner is not deprived of the original copy. Therefore, it's correct to say that no data was stolen.
- polymatter 13y agoSure, but are the police using that definition of stealing?
- leeoniya 13y agowhy not? it's the least untruthful answer
- ademarre 13y agoThat's certainly not the MPAA's or RIAA's definition of stealing.
- belorn 13y agoI know i am replying to a troll comment, but here it is. It is very easy to steal data. Copy the data, and then delete the original. However, the goal of this malware is to neither delete nor copy the data. It simply sabotage the data, after which the computer user has to pay in order for getting the data restored.
- abcd_f 13y agoSarcastic. You are replying to an sarcastic comment.
- shitlord 13y agoIt is kind of ridiculous how the police manage to damage their computers. As people in positions of power, they really need better training on security and handling equipment. I've seen Toughbooks with severe physical damage... and those things are REALLY hard to damage. At the very least, they need to be taught not to open email attachments from people they don't know.
- dmix 13y agoI wouldn't be so quick to judge their lack of ability - it seems pretty hard to prevent spearphising among a broad set of non-technical users. Training would ideally involve the organization testing by spearphishing their own employees internally like a lot of security companies often do: http://www.darkreading.com/end-user/how-lockheed-martin-phishes-its-own/240153683 http://www.darkreading.com/end-user/how-lockheed-martin-phis...
- yuhong 13y agoYea, but CryptoLocker generally use a zip attachment with a exe file.
- deleted 13y ago[deleted]
- nwh 13y agoCryptolocker spreads with a really stupid email message, and an attachment you have to extract and then execute. You have to be incredibly technically inept to get hit with it.
- mattmanser 13y agoI thought it was spreading with HMRC notices and fake invoice corrections? The ones I've seen are pretty good, all the lingo is correct. They're pushing all the right buttons in the email which would immediately get an accountant or business owner to open it immediately to find out what was wrong. The only obvious warning sign is the zip attachment.
- vincie 13y agoThis is actually the first report of Cryptolocker where "Windows" was mentioned. I find it strange that most reports of malware I ever read never mention Windows.
- teddyh 13y agoFish do not know what water is.
- amalag 13y agoI worked with a company which was affected. They opened a phishing email which claimed to be within the company. We didn't pay any ransom because we recovered from Crashplan backups.
- alexeisadeski3 13y agoSpeechless...
- officialjunk 13y agoanyone find it funny that the article warns about opening email attachments and at the bottom of the page is a signup form for a "zip file email." poor wording choice.
- bmslieght 13y agoI had though the Police is aiding and abetting a crime by paying ? In the (UK) not USA - paying a ransom is technically illegal.
- vincie 13y agoIsn't opening an email attachment a standard, right thing to do? Aren't email attachments supposed to be the main ways to send someone a non-text file, by design? If so, blaming people for doing it is wrong. It is Windows that is wrong. It is the way that Windows lets these executables run and do these things that is wrong.
- akx 13y agoConsidering the Cryptolocker executable does absolutely nothing to elevate itself to admin or exploit the system in any other way, it sounds you're arguing in favor of a walled garden system where only preapproved binaries may run.
- Luc 13y agoNot even preapproved binaries. No binaries at all should run by opening them from an email. It's simply a usability design decision by the developers of the email reader.
- heartbreak 13y agoIf I download a binary from the GMail web interface, the enterprise Outlook web interface, etc., how does Windows know the difference between that binary and a legitimate download received from my web browser? Sure, you get the "This program was downloaded from the Internet" popup (just like OSX), and group policy could dictate that no binaries from the Internet may run, but how is Windows supposed to tell the difference between an email web client and any other file downloaded from the web?
- Mister_Snuggles 13y agoI just saved an attachment from GMail. When I go into the Get Info box (OSX), I can see what URL it came from. I'm sure that Windows attaches similar metadata when it saves attachments. Maybe something like this could serve as a basis for what you propose. The attachment I saved came from https:///mail-attachment.googleusercontent.com https:///mail-attachment.googleusercontent.com. Maybe the solution is as simple as webmail providers putting some standard hostname in their attachment URL that identifies it as an email attachment. Unfortunately though, there are legitimate reasons to circumvent this (have you ever emailed yourself something so you could run it on another computer?), so it would only be a matter of time for attackers to figure out the social engineering required to convince people to jump through those hoops.
- losethos 13y agospreading fear is a business practice employed by Microsoft and other 1st tear companies to bully unknown companies. Don't worry. God is perfectly just. Bad karma. God says... joking okay joke couldn't_be_better look_out test_pilot chaos tree_hugger everythings_a_okay vengeful I_pitty_the_fool awesome I_give_up climate You_get_what_you_pray_for Shalom as_a_matter_of_fact figuratively this_might_end_badly programming HolySpirit super_computer umm_what_now do_over later It's_nice_being_God the chill_out