10 ms·

How My Mom Got Hacked

170 points by panarky 12y ago

gringe 12y ago
> Welcome to the new ransomware economy, where hackers have a reputation to consider. It's not new for organized crime to consider its reputation. In fact you could argue that organized crime exists solely based on its reputation, and I would certainly argue that for CryptoWall. If nobody trusted that paying them would work, they would lose virtually all reason to do what they do. I'm not going to defend digital extortion, but it exists because people pay it, and articles like this are part of the problem by making it known to Googlers that paying works. It's complicated and I think we should think hard about where where we point fingers if we want to fix this.
- joosters 12y ago
  I don't see any complications or deep thinking required before pointing fingers. It's the criminals who are to blame. No amount of educating end users will magically fix these kind of attacks, whether or not people write articles about their ransom payments.
  - gringe 12y ago
    I beg to disagree. If you effectively made everyone realize that not paying utterly destroys the extortionist's business model, that does "magically fix these kinds of attacks" overnight. Not that I'm saying educating people about this is practical or even possible. One thing that I think is destructive though is "blaming the criminals", since a) we don't even know who they are, b) their business model depends entirely on them being promoted as a legitimate threat you can pay to fix, and c) blaming them distracts from finding a real solution.
    - joosters 12y ago
      Since, as you say, educating everyone is not possible, you can't destroy the business model. So let's keep the 'magical fixes' out of the discussion. How does blaming the criminals distract from finding a real solution? (You haven't yet even suggested a viable solution that we could be distracted from)
    - headShrinker 12y ago
      While I agree with the essence of your message, it is flawed only because of free will. When given the opportunity an individual will usually think selfishly even in regard to a larger system. Isn't this the basis for "game theory"? Everyone individually thinks they can squeak by, get a little bit of an advantage, pay off the extortionists, no harm done right? Or in another example, if nobody took a job for a shitty company there would be no shitty companies right? So why are people taking shitty company jobs?
    - phaus 12y ago
      I'll have to find the article later, but I read somewhere that about 1.7% of victims actually ended up paying money to the original cryptolocker guys, yet this seems to be enough to keep them in business. For your plan to work, you would need pretty much 100% compliance, which simply isn't going to happen.
BorisMelnik 12y ago
This may sound cliche, but ransomeware truly is plaguing the nation. 3 "phone room" busts here where I live in the last month or so, all of which were the "tech support" hot lines that you called into after you've paid the ransom to "fix your PC." sure, there are many different levels of extortion. Some outfits are very upfront i.e. "your PC has been locked..." others are much more subtle and appear to come across as a legit operation and it isn't until you speak to your techie son-in-law that you find out you've been hit. IMHO the best way to nab these guys is the phone rooms. More and more cities / states are requiring these rooms to have licenses and in my city the FBI has set up a temporary shop to go after these guys.
- dtech 12y ago
  What exactly is a phone room and how will it help stop ransomware?
  - gergo_v 12y ago
    A phone room or boiler room operation will not stop ransomware - in fact quite often it's another sort of scam in itself. Here's a short article explaining the process and the Verge covered the subject in length: http://ipensatori.com/2014/05/27/tech-support-scams-what-lies-beneath/ http://ipensatori.com/2014/05/27/tech-support-scams-what-lie... http://www.theverge.com/2012/5/10/2984893/scamworld-get-rich-quick-schemes-mutate-into-an-online-monster http://www.theverge.com/2012/5/10/2984893/scamworld-get-rich...
    - BorisMelnik 12y ago
      thank you, exactly. lots of that going on here. 3 years ago it was timeshare sales then timeshare recovery i.e. "helping victims get their money back from the scam, which in and of itself was a scam."
- sp4ke 12y ago
  The problem is not the ransomware neither the criminals ... it's the way internet/computer users became completely unaware of what they are using and blindly trusting everything. Think of this as a natural balance to the ridiculously insecure internet and people's tech culture. If we are all going to live in a world where we use internet and technologies everyday, we should have a minimum of knowledge on how it works and not blindly trust everything. One other point, it's useless to try stopping these guys, they are selling the software on the blackmarket with source code, the more you catch the more room you give to new criminals and the better breed the virus becomes ...
0x0 12y ago
Could the "one file free decrypt preview" feature be used to sniff out the crypto key required to decrypt all the other files? Or does the virus need to check in with the backend for every single file for unique keys?
- logn 12y ago
  > does the virus need to check in with the backend for every single file for unique keys? As it's based on CryptoLocker, all the files would be encrypted with the same key. After CryptoLocker was busted by law enforcement, "Fox-IT and fellow firm FireEye introduced an online service which allows infected users to retrieve their private key by uploading a sample file, and then receive a decryption tool" (https://en.wikipedia.org/wiki/Cryptolocker#Takedown_and_recovery_of_files https://en.wikipedia.org/wiki/Cryptolocker#Takedown_and_reco...) edit: technically the files are encrypted with different keys but those keys are stored on the victim's machine and encrypted with a single key -- http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-new-version-or-copycat/ http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-ne...
  - HackinOut 12y ago
    I wouldn't be so sure this would help: CryptoLocker was using symmetric encryption (AES) for the files while CryptoWall apparently solely use RSA (which creates problems for the pirate, like slow encryption, thus encrypting only small files (.jpeg, .doc...)?). Only the public key seems to be downloaded when the malware installs. (http://stopmalvertising.com/malware-reports/cryptowall-behind-the-scenes.html http://stopmalvertising.com/malware-reports/cryptowall-behin...) If this is the case, I would surprised if they would download the private key for the one free decrypt feature. If they encrypt only small files they might do the decryption on the remote C&C Server? It's worth investigating anyway.
Kiro 12y ago
Great article but I'm sad that it didn't cover what I thought the headline was referring to; how she was hacked to begin with.
venomsnake 12y ago
And that is why I have the "if you don't have backup, I won't bother to help you with your lost files" policy when friend or family come crying. I make only one exception from this rule. Cryptolocker is not the problem. The lack of reliable backup is. 15 years into the internet age, and 5 into the cloud you have no excuse.
- Sir_Substance 12y ago
  I would genuinely rather lose all my critical data to cryptolocker than put it in the cloud. Given a choice between my data being accessible by no-one or everyone, I will pick no-one every time. Data in the cloud /is/ available to everyone that matters. I'd also like to remind you that it can be impractical to back up some forms of data, especially in the cloud. High definition video (weddings, funerals, holidays) is impractically large. The problem /is/ Cryptolocker. Anyone with an ounce of practicality will take mitigating steps against it, I have no sympathy for anyone who ignores the risk, but the solution is not massive scale global data duplication, that is treating the symptoms. The solution is to dissuade criminals from this path. Widescale international cooperation in finding these people would be a start.
  - JCole 12y ago
    You don't need to backup to the cloud, have people forgotten about physical hard drives?
    - r0m4n0 12y ago
      Yep, a good mitigation plan is a 2tb time capsule. All my precious cat photos are backed up on the regular, encrypted and within reach.
      - TeMPOraL 12y ago
        As long as you remember to keep that drive unplugged - otherwise it'll get cryptolocked with everything else.
    - 12y ago
mrmondo 12y ago
I'm surprised that no one has fingerprinted the patterns that these apps take to encrypt the files, then created an antivirus definition for them. Surely they can't be that polymorphic that no one can catch them?
- mdisraeli 12y ago
  Polymorphism typically referred to worms and viruses that changed their own code base as they spread. Most infections, however, happen from phishing emails either with attachments or linking to the payload. Changing the files produced so as to no longer be caught by antivirus signatures is trivial, and you can even create a unique variant for each phish. Many legitimate programs will seem to act similarly - opening files and overwriting contents with something else. ID3 tag writers for MP3s, file type converters, batch image processing, etc. This means you can't match easily against the types of actions being taken. Let's imagine, however, that the antivirus was still able to detect that something odd was happening. If it prompts the user, they will inevitably click 'yes run this file', because that's what they have always done. If it quarantines the file... well, you just add another few lines to the phishing email saying that the attachment is perfectly safe ("scanned by symantec" apparently...) and to go ahead and bring it back out from quarantine
- fencepost 12y ago
  HitmanPro.Alert (http://www.surfright.nl/en/alert http://www.surfright.nl/en/alert) includes a variation of this - it's not looking for fingerprints, it's monitoring for process behavior characteristic of individually encrypting bunches of files.
- acdha 12y ago
  The problem is that the signature-based antivirus model assumes 1980s-speed networking where an attacker releases a single program which has months or years to spread around the world. In the Internet era, the attacker receives the same AV updates when you do and can tweak an executable until it's no longer detected locally before immediately deploying it. This approach can even be automated both to permute the executable until it passes and to stop spreading it after it starts being flagged.
arethuza 12y ago
My wife's father died about a month ago - two days after he died his widow got a call from some bunch of scoundrels saying "we need to fix your late husband's PC so you can get at his tax records".... Fortunately, he never had a PC (he was in his mid 80s) so it was obviously a scam but we were all appalled at the cheek of such an approach and the for the fact that a lot of people, particularly the elderly in a moment of stress, would fall for such as scam.
- mjklin 12y ago
  This is an update of another scam, wherein scam artists prowl the obituaries and send "brown package material" with embarrassing contents to the surviving family member, claiming the deceased had ordered it. Their hope is that the surviving member will pay up to avoid embarrassment. Yeah, you have to be a sicko to think this stuff up.
- cafard 12y ago
  And this is why they tell you to have somebody stay to mind the home during a funeral.
ColinWright 12y ago
So the title is "How My Mom Got Hacked" and the only thing it actually says about that actual title is: The virus is thought to infiltrate your computer when you click on a legitimate-looking attachment or through existing malware lurking on your hard drive, ... So, there's really nothing about how his mom got hacked. Don't get me wrong, it's an interesting article, interesting to read about the process that ensues once you've been hacked, and I've up-voted it, but I'm disappointed not to see anything about how it happened.
- coda 12y ago
  How her mom. Well read.
  - ColinWright 12y ago
    Thank you. I read the article in some detail, I didn't read the author's name. The author's gender is not evident from the text of the item. For what it's worth, I found your comment somewhat snarky.
    - Kiro 12y ago
      "... and about dispatching her daughter to the Coin Cafe A.T.M. at the 11th hour." I agree about the snarkiness though.
      - ColinWright 12y ago
        True enough - by that stage I'd given up reading word by word and was skimming, so I missed it - well spotted.
- binaryanomaly 12y ago
  How my mom caught a virus that encrypted her personal files - would be a more appropriate title imho. But anyway after reading the article it's clear what happened. Evil mail attachement --> infection.
ExpiredLink 12y ago
> “Whoever these yahoos are, they have some little shred of humanity.” Not really. Their "business model" is extremely restricted. 99.99 of their victims cannot handle the Bitcoin thingy.
- davidgerard 12y ago
  How Ordinary Everyday Moms and Dads Are Being Introduced To The Exciting World Of Bitcoin! (though today they can certainly get ... cheap coins)
- phaus 12y ago
  >Their "business model" is extremely restricted. 99.99 of their victims cannot handle the Bitcoin thingy. Its actually pretty interesting how this developed. Some of guys running variants of cryptolocker realized how much money they were missing out on and established customer support channels to help their victims figure out how to pay.
HackinOut 12y ago
Apparently CryptoWall does a dumb copy of the files before encrypting them and do not zero-out after deleting. If it still proceeds this way, that makes it fairly easy to do some recovery. Source: http://www.wyattroersma.com/?p=108 http://www.wyattroersma.com/?p=108
- wyldfire 12y ago
  Hey, that's really useful/helpful info! I'll endorse TestDisk/PhotoRec as a mechanism for recovering deleted files, should be appropriate for most (though you might want a trusted tech savvy person to execute this recovery). The System Rescue CD includes these packages. http://www.cgsecurity.org/wiki/PhotoRec http://www.cgsecurity.org/wiki/PhotoRec http://www.sysresccd.org/SystemRescueCd_Homepage http://www.sysresccd.org/SystemRescueCd_Homepage
tim333 12y ago
You'd think Putin might be persuaded to take action against some of the guilty parties. I know that has not been the Russian tradition but things could change.
- genwin 12y ago
  The guilty parties (where known) are local heroes. The US has a bad reputation in much of the world.
alexggordon 12y ago
Has anyone ever done a serious technological evaluation of one of these programs? I'd be very interesting in learning more specifically about its encryption mechanism. For example, To be able to decrypt (edit: used to say encrypt) the files, it has to store the private key (and obviously the public key) somewhere on the computer, whether in memory or elsewhere to decrypt the files. In addition to this, if this is a variant like mentioned in the article, where you can "decrypt one file for free", then the software obviously has to access both keys to decrypt that, meaning with the right tools you should be able to capture those keys if you can capture the program in the action of decrypting a file. While an obviously viable solution to this is good backups and educating people about computer security, that won't put these people out of business, which is what would really stop this. Either way though, if anyone here knows of any material delving into hacking ransomware like this let me know, I'd love to read about it.
- kolinko 12y ago
  It doesn't have to know the private key, just the public one, woth the private being on the virus-owner's side. Furthermore, it's possible to encrypt each file with a different key so one public key would only deceypt one file. Oh, and a fun fact - with the newest cryptography algorithms it's even possible to modify the files without knowing what they contain. If I'm not mistaken it would even be possoble to create a software that can conpute checksums of files without knowing the file contents.
  - Osmium 12y ago
    > Oh, and a fun fact - with the newest cryptography algorithms it's even possible to modify the files without knowing what they contain. If I'm not mistaken it would even be possoble to create a software that can conpute checksums of files without knowing the file contents. To my knowledge, this is only true in a purely academic (not practical) sense at present. There do exist homomorphic encryption schemes but current implementations are ridiculously slow.
- peeters 12y ago
  > To be able to encrypt the files, it has to store the private key (and obviously the public key) somewhere on the computer Why do you say that? The very purpose of public-key crypto is so that you can send only the public key, have the other end encrypt with that, while you hold onto the private key which is the only thing that can decrypt it. No guarantee this uses public key for the crypto though. From what I know, a symmetric key is more suitable to encrypting huge amounts of data. Could be wrong about that though.
dghughes 12y ago
It would be fun if one of these extortionists was a victim and had his files locked by a rival.
doah78 12y ago
I work for a school district in the US and we see this occasionally. We just wipe the computer and restore files to the Users network drive from backup. I personally think getting into a good backup regimen is a better use for the money than paying some scumbags.
johansch 12y ago
Isn't this a pretty strong argument against Bitcoin and other cryptocurrencies? (I am being serious.)
- mseebach 12y ago
  Not really. Most useful technologies can be used in crime and we'd get nowhere if we allowed that fact to be used as an argument against the technology. Pre-Bitcoin, the scammer would have her call an expensive foreign premium-rate phone number or mail cash to a foreign address.
  - johansch 12y ago
    How about when in a few years time there's a scalable, functioning market for hits/murders with bitcoin as payment? I love the elegance of the bitcoin protocol, but I am worred that the civilized world will have to clamp down on it. You just can't have a place where anyone with enough money (a few k EUR/USD) can perform murders without any reasonable risk of being exposed. This will effectively turn us into a bandit country like Russia. I also think it will become harder to effecticely clamp down on cryptocurrencies as time passes, so time is of an essence.
    - mseebach 12y ago
      > You just can't have a place where anyone with enough money (a few k EUR/USD) can perform murders without any reasonable risk of being exposed. Your 'reasonable risk of being exposed' is when you plan and execute the hit. It's pretty difficult to do. Also, when your target winds up dead, the first investigation is into whether anyone might want that person dead (motive), not the money trail. Any hitman worth his salt will already today know to get paid in cash or similar liquid assets. As opposed to the ransom situation, the payment of a hit can be arranged long before investigators start looking, so you can easily ship a boxful of cash to a dead drop and avoid ever meeting the hitman in person. And even if there was a money trail, you couldn't hope to get to a hitman by following it unless you have the other end to start down - ie. you know the "customer", who's the bigger criminal anyway. > This will effectively turn us into a bandit country like Russia. No, the availability of anonymous payments is not the defining difference between Russia and 'us'. The rule of law is.
kazinator 12y ago
The article doesn't seem answer the question raised in the title. How did Mom get hacked? Actually it's buried in there: > "So what can we all do to protect ourselves? Keep our computers backed up [...] and most of all, Beware the Attachment." Ah, so the Attachment is what got Mom! You know, the above should really be "Beware the Attachment processed on a Microsoft Windows box using the default and/or most popular handlers for its file type." Also: "beware of letting naive users use the same Windows PC's for Internet-based consumption activities net surfing and e-mail, and for production/retention of important content."
- acdha 12y ago
  That's effectively saying that non-experts should only use something like iOS or maybe ChromeOS. The same class of attacks works against any user using any operating system which allows them to install arbitrary code - Mac, Android, Linux, etc. all have past examples of successful attacks which started with an email attachment, browser drive-by, etc.
  - lotu 12y ago
    That actually may be a very good idea. It's not that non-experts should be forbidden from using these thing it is that we should stop handing people guns that they end up using to shoot themselves in the foot with.
    - acdha 12y ago
      Agreed – I'm not cheerful about the implications of making things less user-serviceable but … it's not like we don't know how well that's worked out. If you haven't already read it, SwiftOnSecurity's “A story about Jessica” is rather good for illustrating how badly we've failed as an industry to produce devices which are safe for non-experts to use: http://swiftonsecurity.tumblr.com/post/98675308034/a-story-about-jessica http://swiftonsecurity.tumblr.com/post/98675308034/a-story-a...
      - kazagistar 12y ago
jokoon 12y ago
my neighbor also had this. was not really able to fix it. felt pretty bad.
known 12y ago
Install/configure http://wiki.debian.org/iptables http://wiki.debian.org/iptables
fencepost 12y ago
I don't see any mention here, but as someone who deals with front-line response to users regularly, take a look at CryptoPrevent from FoolishIT (yes, really, https://www.foolishit.com/vb6-projects/cryptoprevent/ https://www.foolishit.com/vb6-projects/cryptoprevent/) and HitmanPro.Alert (http://www.surfright.nl/en/alert http://www.surfright.nl/en/alert) with CryptoGuard. The first does a bunch of local policy setup to restrict where executables can run along with some optional subscription signature watching;the second does more watching for encrypting behavior including on a host sharing files via SMB. I also recommend making sure that shadow copies are turned on and allocated plenty of space - including on a separate partition or drive if the user in question regularly comes close to filling the drive. It's not a backup, but it is much faster to restore from a shadow copy than from an offsite backup. edit: added links
- HackinOut 12y ago
  CryptoWall apparently delete shadow copies with a simple vssadmin command. http://stopmalvertising.com/malware-reports/cryptowall-behind-the-scenes.html http://stopmalvertising.com/malware-reports/cryptowall-behin...
  - fencepost 12y ago
    Good to know; I've only dealt with a couple and they were on workstations that encrypted files on mapped network shares - vssadmin wouldn't have any access to remove shadow copies on the file server, and in all but one of those cases we had both shadow copies locally on the file server and offsite file backups in place (backups only for the last).
    - HackinOut 12y ago
      Yes, I meant try to delete... My first impression about CryptoWall is that it was hacked together quicker than CryptoLocker. It doesn't bother with generating a symmetric key per file but rather seems to use a single asymmetric key. It also apparently make a copy of the file before encrypting and doesn't zero-out after deleting the plain text file (see another of my comment in this thread)
gambiting 12y ago
" The main difficulty in stopping cybercriminals isn’t finding them, but getting foreign governments to cooperate and extradite them." Sorry, but no, fuck off please. US extraditing people from other countries is an abhorrent practice which should not be happening, ever. Imagine if you got an extradition request from Saudi Arabia, because you broke some of their laws on the Internet. Every single country in the world would tell them to sod off. Yet when US does this it's somehow ok? Absolutely not.

170 points by panarky 12y ago

> Welcome to the new ransomware economy, where hackers have a reputation to consider. It's not new for organized crime to consider its reputation. In fact you could argue that organized crime exists solely based on its reputation, and I would certainly argue that for CryptoWall. If nobody trusted that paying them would work, they would lose virtually all reason to do what they do. I'm not going to defend digital extortion, but it exists because people pay it, and articles like this are part of the problem by making it known to Googlers that paying works. It's complicated and I think we should think hard about where where we point fingers if we want to fix this.

joosters 12y ago
I don't see any complications or deep thinking required before pointing fingers. It's the criminals who are to blame. No amount of educating end users will magically fix these kind of attacks, whether or not people write articles about their ransom payments.
- gringe 12y ago
  I beg to disagree. If you effectively made everyone realize that not paying utterly destroys the extortionist's business model, that does "magically fix these kinds of attacks" overnight. Not that I'm saying educating people about this is practical or even possible. One thing that I think is destructive though is "blaming the criminals", since a) we don't even know who they are, b) their business model depends entirely on them being promoted as a legitimate threat you can pay to fix, and c) blaming them distracts from finding a real solution.
  - joosters 12y ago
    Since, as you say, educating everyone is not possible, you can't destroy the business model. So let's keep the 'magical fixes' out of the discussion. How does blaming the criminals distract from finding a real solution? (You haven't yet even suggested a viable solution that we could be distracted from)
  - headShrinker 12y ago
    While I agree with the essence of your message, it is flawed only because of free will. When given the opportunity an individual will usually think selfishly even in regard to a larger system. Isn't this the basis for "game theory"? Everyone individually thinks they can squeak by, get a little bit of an advantage, pay off the extortionists, no harm done right? Or in another example, if nobody took a job for a shitty company there would be no shitty companies right? So why are people taking shitty company jobs?
  - phaus 12y ago
    I'll have to find the article later, but I read somewhere that about 1.7% of victims actually ended up paying money to the original cryptolocker guys, yet this seems to be enough to keep them in business. For your plan to work, you would need pretty much 100% compliance, which simply isn't going to happen.

BorisMelnik 12y ago

This may sound cliche, but ransomeware truly is plaguing the nation. 3 "phone room" busts here where I live in the last month or so, all of which were the "tech support" hot lines that you called into after you've paid the ransom to "fix your PC." sure, there are many different levels of extortion. Some outfits are very upfront i.e. "your PC has been locked..." others are much more subtle and appear to come across as a legit operation and it isn't until you speak to your techie son-in-law that you find out you've been hit. IMHO the best way to nab these guys is the phone rooms. More and more cities / states are requiring these rooms to have licenses and in my city the FBI has set up a temporary shop to go after these guys.

dtech 12y ago
What exactly is a phone room and how will it help stop ransomware?
- gergo_v 12y ago
  A phone room or boiler room operation will not stop ransomware - in fact quite often it's another sort of scam in itself. Here's a short article explaining the process and the Verge covered the subject in length: http://ipensatori.com/2014/05/27/tech-support-scams-what-lies-beneath/ http://ipensatori.com/2014/05/27/tech-support-scams-what-lie... http://www.theverge.com/2012/5/10/2984893/scamworld-get-rich-quick-schemes-mutate-into-an-online-monster http://www.theverge.com/2012/5/10/2984893/scamworld-get-rich...
  - BorisMelnik 12y ago
    thank you, exactly. lots of that going on here. 3 years ago it was timeshare sales then timeshare recovery i.e. "helping victims get their money back from the scam, which in and of itself was a scam."
sp4ke 12y ago
The problem is not the ransomware neither the criminals ... it's the way internet/computer users became completely unaware of what they are using and blindly trusting everything. Think of this as a natural balance to the ridiculously insecure internet and people's tech culture. If we are all going to live in a world where we use internet and technologies everyday, we should have a minimum of knowledge on how it works and not blindly trust everything. One other point, it's useless to try stopping these guys, they are selling the software on the blackmarket with source code, the more you catch the more room you give to new criminals and the better breed the virus becomes ...

0x0 12y ago

Could the "one file free decrypt preview" feature be used to sniff out the crypto key required to decrypt all the other files? Or does the virus need to check in with the backend for every single file for unique keys?

logn 12y ago
> does the virus need to check in with the backend for every single file for unique keys? As it's based on CryptoLocker, all the files would be encrypted with the same key. After CryptoLocker was busted by law enforcement, "Fox-IT and fellow firm FireEye introduced an online service which allows infected users to retrieve their private key by uploading a sample file, and then receive a decryption tool" (https://en.wikipedia.org/wiki/Cryptolocker#Takedown_and_recovery_of_files https://en.wikipedia.org/wiki/Cryptolocker#Takedown_and_reco...) edit: technically the files are encrypted with different keys but those keys are stored on the victim's machine and encrypted with a single key -- http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-new-version-or-copycat/ http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-ne...
- HackinOut 12y ago
  I wouldn't be so sure this would help: CryptoLocker was using symmetric encryption (AES) for the files while CryptoWall apparently solely use RSA (which creates problems for the pirate, like slow encryption, thus encrypting only small files (.jpeg, .doc...)?). Only the public key seems to be downloaded when the malware installs. (http://stopmalvertising.com/malware-reports/cryptowall-behind-the-scenes.html http://stopmalvertising.com/malware-reports/cryptowall-behin...) If this is the case, I would surprised if they would download the private key for the one free decrypt feature. If they encrypt only small files they might do the decryption on the remote C&C Server? It's worth investigating anyway.

Kiro 12y ago

Great article but I'm sad that it didn't cover what I thought the headline was referring to; how she was hacked to begin with.

venomsnake 12y ago

And that is why I have the "if you don't have backup, I won't bother to help you with your lost files" policy when friend or family come crying. I make only one exception from this rule. Cryptolocker is not the problem. The lack of reliable backup is. 15 years into the internet age, and 5 into the cloud you have no excuse.

Sir_Substance 12y ago
I would genuinely rather lose all my critical data to cryptolocker than put it in the cloud. Given a choice between my data being accessible by no-one or everyone, I will pick no-one every time. Data in the cloud /is/ available to everyone that matters. I'd also like to remind you that it can be impractical to back up some forms of data, especially in the cloud. High definition video (weddings, funerals, holidays) is impractically large. The problem /is/ Cryptolocker. Anyone with an ounce of practicality will take mitigating steps against it, I have no sympathy for anyone who ignores the risk, but the solution is not massive scale global data duplication, that is treating the symptoms. The solution is to dissuade criminals from this path. Widescale international cooperation in finding these people would be a start.
- JCole 12y ago
  You don't need to backup to the cloud, have people forgotten about physical hard drives?
  - r0m4n0 12y ago
    Yep, a good mitigation plan is a 2tb time capsule. All my precious cat photos are backed up on the regular, encrypted and within reach.
    - TeMPOraL 12y ago
      As long as you remember to keep that drive unplugged - otherwise it'll get cryptolocked with everything else.
  - 12y ago

mrmondo 12y ago

I'm surprised that no one has fingerprinted the patterns that these apps take to encrypt the files, then created an antivirus definition for them. Surely they can't be that polymorphic that no one can catch them?

mdisraeli 12y ago
Polymorphism typically referred to worms and viruses that changed their own code base as they spread. Most infections, however, happen from phishing emails either with attachments or linking to the payload. Changing the files produced so as to no longer be caught by antivirus signatures is trivial, and you can even create a unique variant for each phish. Many legitimate programs will seem to act similarly - opening files and overwriting contents with something else. ID3 tag writers for MP3s, file type converters, batch image processing, etc. This means you can't match easily against the types of actions being taken. Let's imagine, however, that the antivirus was still able to detect that something odd was happening. If it prompts the user, they will inevitably click 'yes run this file', because that's what they have always done. If it quarantines the file... well, you just add another few lines to the phishing email saying that the attachment is perfectly safe ("scanned by symantec" apparently...) and to go ahead and bring it back out from quarantine
fencepost 12y ago
HitmanPro.Alert (http://www.surfright.nl/en/alert http://www.surfright.nl/en/alert) includes a variation of this - it's not looking for fingerprints, it's monitoring for process behavior characteristic of individually encrypting bunches of files.
acdha 12y ago
The problem is that the signature-based antivirus model assumes 1980s-speed networking where an attacker releases a single program which has months or years to spread around the world. In the Internet era, the attacker receives the same AV updates when you do and can tweak an executable until it's no longer detected locally before immediately deploying it. This approach can even be automated both to permute the executable until it passes and to stop spreading it after it starts being flagged.

arethuza 12y ago

My wife's father died about a month ago - two days after he died his widow got a call from some bunch of scoundrels saying "we need to fix your late husband's PC so you can get at his tax records".... Fortunately, he never had a PC (he was in his mid 80s) so it was obviously a scam but we were all appalled at the cheek of such an approach and the for the fact that a lot of people, particularly the elderly in a moment of stress, would fall for such as scam.

mjklin 12y ago
This is an update of another scam, wherein scam artists prowl the obituaries and send "brown package material" with embarrassing contents to the surviving family member, claiming the deceased had ordered it. Their hope is that the surviving member will pay up to avoid embarrassment. Yeah, you have to be a sicko to think this stuff up.
cafard 12y ago
And this is why they tell you to have somebody stay to mind the home during a funeral.

ColinWright 12y ago

So the title is "How My Mom Got Hacked" and the only thing it actually says about that actual title is: The virus is thought to infiltrate your computer when you click on a legitimate-looking attachment or through existing malware lurking on your hard drive, ... So, there's really nothing about how his mom got hacked. Don't get me wrong, it's an interesting article, interesting to read about the process that ensues once you've been hacked, and I've up-voted it, but I'm disappointed not to see anything about how it happened.

coda 12y ago
How her mom. Well read.
- ColinWright 12y ago
  Thank you. I read the article in some detail, I didn't read the author's name. The author's gender is not evident from the text of the item. For what it's worth, I found your comment somewhat snarky.
  - Kiro 12y ago
    "... and about dispatching her daughter to the Coin Cafe A.T.M. at the 11th hour." I agree about the snarkiness though.
    - ColinWright 12y ago
      True enough - by that stage I'd given up reading word by word and was skimming, so I missed it - well spotted.
binaryanomaly 12y ago
How my mom caught a virus that encrypted her personal files - would be a more appropriate title imho. But anyway after reading the article it's clear what happened. Evil mail attachement --> infection.

ExpiredLink 12y ago

> “Whoever these yahoos are, they have some little shred of humanity.” Not really. Their "business model" is extremely restricted. 99.99 of their victims cannot handle the Bitcoin thingy.

davidgerard 12y ago
How Ordinary Everyday Moms and Dads Are Being Introduced To The Exciting World Of Bitcoin! (though today they can certainly get ... cheap coins)
phaus 12y ago
>Their "business model" is extremely restricted. 99.99 of their victims cannot handle the Bitcoin thingy. Its actually pretty interesting how this developed. Some of guys running variants of cryptolocker realized how much money they were missing out on and established customer support channels to help their victims figure out how to pay.

HackinOut 12y ago

Apparently CryptoWall does a dumb copy of the files before encrypting them and do not zero-out after deleting. If it still proceeds this way, that makes it fairly easy to do some recovery. Source: http://www.wyattroersma.com/?p=108 http://www.wyattroersma.com/?p=108

wyldfire 12y ago
Hey, that's really useful/helpful info! I'll endorse TestDisk/PhotoRec as a mechanism for recovering deleted files, should be appropriate for most (though you might want a trusted tech savvy person to execute this recovery). The System Rescue CD includes these packages. http://www.cgsecurity.org/wiki/PhotoRec http://www.cgsecurity.org/wiki/PhotoRec http://www.sysresccd.org/SystemRescueCd_Homepage http://www.sysresccd.org/SystemRescueCd_Homepage

tim333 12y ago

You'd think Putin might be persuaded to take action against some of the guilty parties. I know that has not been the Russian tradition but things could change.

genwin 12y ago
The guilty parties (where known) are local heroes. The US has a bad reputation in much of the world.

alexggordon 12y ago

Has anyone ever done a serious technological evaluation of one of these programs? I'd be very interesting in learning more specifically about its encryption mechanism. For example, To be able to decrypt (edit: used to say encrypt) the files, it has to store the private key (and obviously the public key) somewhere on the computer, whether in memory or elsewhere to decrypt the files. In addition to this, if this is a variant like mentioned in the article, where you can "decrypt one file for free", then the software obviously has to access both keys to decrypt that, meaning with the right tools you should be able to capture those keys if you can capture the program in the action of decrypting a file. While an obviously viable solution to this is good backups and educating people about computer security, that won't put these people out of business, which is what would really stop this. Either way though, if anyone here knows of any material delving into hacking ransomware like this let me know, I'd love to read about it.

kolinko 12y ago
It doesn't have to know the private key, just the public one, woth the private being on the virus-owner's side. Furthermore, it's possible to encrypt each file with a different key so one public key would only deceypt one file. Oh, and a fun fact - with the newest cryptography algorithms it's even possible to modify the files without knowing what they contain. If I'm not mistaken it would even be possoble to create a software that can conpute checksums of files without knowing the file contents.
- Osmium 12y ago
  > Oh, and a fun fact - with the newest cryptography algorithms it's even possible to modify the files without knowing what they contain. If I'm not mistaken it would even be possoble to create a software that can conpute checksums of files without knowing the file contents. To my knowledge, this is only true in a purely academic (not practical) sense at present. There do exist homomorphic encryption schemes but current implementations are ridiculously slow.
peeters 12y ago
> To be able to encrypt the files, it has to store the private key (and obviously the public key) somewhere on the computer Why do you say that? The very purpose of public-key crypto is so that you can send only the public key, have the other end encrypt with that, while you hold onto the private key which is the only thing that can decrypt it. No guarantee this uses public key for the crypto though. From what I know, a symmetric key is more suitable to encrypting huge amounts of data. Could be wrong about that though.

dghughes 12y ago

It would be fun if one of these extortionists was a victim and had his files locked by a rival.

doah78 12y ago

I work for a school district in the US and we see this occasionally. We just wipe the computer and restore files to the Users network drive from backup. I personally think getting into a good backup regimen is a better use for the money than paying some scumbags.

johansch 12y ago

Isn't this a pretty strong argument against Bitcoin and other cryptocurrencies? (I am being serious.)

mseebach 12y ago
Not really. Most useful technologies can be used in crime and we'd get nowhere if we allowed that fact to be used as an argument against the technology. Pre-Bitcoin, the scammer would have her call an expensive foreign premium-rate phone number or mail cash to a foreign address.
- johansch 12y ago
  How about when in a few years time there's a scalable, functioning market for hits/murders with bitcoin as payment? I love the elegance of the bitcoin protocol, but I am worred that the civilized world will have to clamp down on it. You just can't have a place where anyone with enough money (a few k EUR/USD) can perform murders without any reasonable risk of being exposed. This will effectively turn us into a bandit country like Russia. I also think it will become harder to effecticely clamp down on cryptocurrencies as time passes, so time is of an essence.
  - mseebach 12y ago
    > You just can't have a place where anyone with enough money (a few k EUR/USD) can perform murders without any reasonable risk of being exposed. Your 'reasonable risk of being exposed' is when you plan and execute the hit. It's pretty difficult to do. Also, when your target winds up dead, the first investigation is into whether anyone might want that person dead (motive), not the money trail. Any hitman worth his salt will already today know to get paid in cash or similar liquid assets. As opposed to the ransom situation, the payment of a hit can be arranged long before investigators start looking, so you can easily ship a boxful of cash to a dead drop and avoid ever meeting the hitman in person. And even if there was a money trail, you couldn't hope to get to a hitman by following it unless you have the other end to start down - ie. you know the "customer", who's the bigger criminal anyway. > This will effectively turn us into a bandit country like Russia. No, the availability of anonymous payments is not the defining difference between Russia and 'us'. The rule of law is.

kazinator 12y ago

The article doesn't seem answer the question raised in the title. How did Mom get hacked? Actually it's buried in there: > "So what can we all do to protect ourselves? Keep our computers backed up [...] and most of all, Beware the Attachment." Ah, so the Attachment is what got Mom! You know, the above should really be "Beware the Attachment processed on a Microsoft Windows box using the default and/or most popular handlers for its file type." Also: "beware of letting naive users use the same Windows PC's for Internet-based consumption activities net surfing and e-mail, and for production/retention of important content."

acdha 12y ago
That's effectively saying that non-experts should only use something like iOS or maybe ChromeOS. The same class of attacks works against any user using any operating system which allows them to install arbitrary code - Mac, Android, Linux, etc. all have past examples of successful attacks which started with an email attachment, browser drive-by, etc.
- lotu 12y ago
  That actually may be a very good idea. It's not that non-experts should be forbidden from using these thing it is that we should stop handing people guns that they end up using to shoot themselves in the foot with.
  - acdha 12y ago
    Agreed – I'm not cheerful about the implications of making things less user-serviceable but … it's not like we don't know how well that's worked out. If you haven't already read it, SwiftOnSecurity's “A story about Jessica” is rather good for illustrating how badly we've failed as an industry to produce devices which are safe for non-experts to use: http://swiftonsecurity.tumblr.com/post/98675308034/a-story-about-jessica http://swiftonsecurity.tumblr.com/post/98675308034/a-story-a...
    - kazagistar 12y ago

jokoon 12y ago

my neighbor also had this. was not really able to fix it. felt pretty bad.

known 12y ago

Install/configure http://wiki.debian.org/iptables http://wiki.debian.org/iptables

fencepost 12y ago

I don't see any mention here, but as someone who deals with front-line response to users regularly, take a look at CryptoPrevent from FoolishIT (yes, really, https://www.foolishit.com/vb6-projects/cryptoprevent/ https://www.foolishit.com/vb6-projects/cryptoprevent/) and HitmanPro.Alert (http://www.surfright.nl/en/alert http://www.surfright.nl/en/alert) with CryptoGuard. The first does a bunch of local policy setup to restrict where executables can run along with some optional subscription signature watching;the second does more watching for encrypting behavior including on a host sharing files via SMB. I also recommend making sure that shadow copies are turned on and allocated plenty of space - including on a separate partition or drive if the user in question regularly comes close to filling the drive. It's not a backup, but it is much faster to restore from a shadow copy than from an offsite backup. edit: added links

HackinOut 12y ago
CryptoWall apparently delete shadow copies with a simple vssadmin command. http://stopmalvertising.com/malware-reports/cryptowall-behind-the-scenes.html http://stopmalvertising.com/malware-reports/cryptowall-behin...
- fencepost 12y ago
  Good to know; I've only dealt with a couple and they were on workstations that encrypted files on mapped network shares - vssadmin wouldn't have any access to remove shadow copies on the file server, and in all but one of those cases we had both shadow copies locally on the file server and offsite file backups in place (backups only for the last).
  - HackinOut 12y ago
    Yes, I meant try to delete... My first impression about CryptoWall is that it was hacked together quicker than CryptoLocker. It doesn't bother with generating a symmetric key per file but rather seems to use a single asymmetric key. It also apparently make a copy of the file before encrypting and doesn't zero-out after deleting the plain text file (see another of my comment in this thread)

gambiting 12y ago

" The main difficulty in stopping cybercriminals isn’t finding them, but getting foreign governments to cooperate and extradite them." Sorry, but no, fuck off please. US extraditing people from other countries is an abhorrent practice which should not be happening, ever. Imagine if you got an extradition request from Saudi Arabia, because you broke some of their laws on the Internet. Every single country in the world would tell them to sod off. Yet when US does this it's somehow ok? Absolutely not.