4 ms·

CryptoLocker is amazing. I find the reactions to it so intriguing. Because before, viruses would just delete your data and let you know you were screwed. Game o

CryptoLocker is amazing. I find the reactions to it so intriguing. Because before, viruses would just delete your data and let you know you were screwed. Game over. Now, they delete your data, but offer a quick time-rewind to undo the damage. $500 seems like a not-so-bad deal, and if the data was deleted instead of encrypted, I would imagine you'd pay more than $500 to send it to a recovery shop. So really, it's just doing a good job of teaching users about data loss, without actually forcing them to lose data, just a bit of money. That seems like an overwhelmingly good bargain, overall. Especially if it gets someone to make backups before they suffer a hardware failure that truly renders the data lost. And terrorists? Wikipedia indicates "Russian hackers". I suppose you can stretch terrorist to cover that but well, that's just being dramatic.

thaumaturgy 12y ago
Malware hasn't gone around deleting data in ... I'm not sure exactly when the last time is I saw anything like that, but it's been a very, very long time. The majority of malware now is a commercial effort, it's just trying to turn you into part of an obnoxious ad network, use your computer to send spam, pick up account information or credit card details that in aggregate are worth a little bit on some particular forums, that sort of thing. Cryptolocker is amazing because the developers didn't screw it up. It runs very quietly in the background. Most people never realize it's there. It comes in multiple pieces, so your AV software might disable the UI portion of Cryptolocker but all your files will still disappear (oldest files first). Each file is encrypted with a different key, and then a master key is used to encrypt all of those keys. It's basically, "the kind of malware tptacek would build if tptacek built malware." It's also been a huge boon for us in convincing people to get backups going finally, because the sort of people that are willing to gamble that their hard drive will never fail aren't also willing to gamble that they'll never click on the wrong thing online. I hate having to scare people into getting backups, but, that's how it is.
deleted 12y ago
[deleted]
- dagw 12y ago
  CryptoLocker isn't amazing. it's petty thuggery. No it really isn't. It's smart software written by smart people. Our continuous underestimation of the 'enemy' is the reason we keep finding ourselves in these situations. The sooner we stop dismissing the blackhats as just 'dumb kids' and start accepting that many of them are probably smarter and better programmers than most of us, the sooner we as a society can start getting a real grip on computer security. Your appeal to is humanity is noble and I certainly agree that it would very nice indeed, but it doesn't help solve the immediate problem in front of us.
  - deleted 12y ago
    [deleted]
    - dagw 12y ago
      The immediate solution to the problem in front of us is to have these talented people stop developing this awful piece of software No that's the long term solution. A solution that is going to require some pretty huge changes in society as a whole. We need a solution in place today that works while try to figure out to get from where we are now to where we want to be. And we don't get to either of these solutions by failing to understand what we are dealing with. At the end of the day I think these people realize the quality of their work and us pretending it is any less than it actually is isn't going to have any effect.
- tempestn 12y ago
  You can certainly argue that Cryptolocker is immoral, but I don't see how you could say it isn't clever. It is entirely possible to do bad things in intelligent ways. Now, your parent is arguing that CL is actually a net good, even if it's doubtful that its author's motivations are altruistic. While I by no means endorse CL, I can certainly understand the argument. Most people will experience a hard drive failure at some point in their lives, surely. Could this malware ultimately save more data loss than it causes? Maybe. Although I doubt it. And even in cases where people have backups it will waste time. Regardless, I absolutely agree with you that it's immoral. But still clever.
notahacker 12y ago
If someone kidnapped your child and asked for a ransom, would you consider it an "overwhelmingly good bargain" because you'd get them back and they wouldn't talk to strangers in future? There is nothing novel about extortion, even on the internet, and it's not defensible as "doing a good job of teaching users about data loss"
- jbob2000 12y ago
  Your metaphor is a little flawed. It's more like allowing a random person off the street to babysit your child then they kidnap them. You could have avoided the whole situation by not allowing some random person into your home.
  - notahacker 12y ago
    If you consider opening email attachments that appear to be pdfs from legitimate sources (and only backing up occasionally) to be a comparable level of negligence to offering your children to anonymous strangers, perhaps. No amount of victim-blaming justifies the original poster's assertion that it's an "overwhelmingly good bargain" though.
pbhjpbhj 12y ago
Attacking rich people with a knife is a net good. It means they'll hire body guards, then if they have a medical emergency there will be someone there to assist or call an ambulance. If you hadn't attacked them then they could have be choking or having a cardiac infarction and not have anyone there to help. /s

thaumaturgy 12y ago

Malware hasn't gone around deleting data in ... I'm not sure exactly when the last time is I saw anything like that, but it's been a very, very long time. The majority of malware now is a commercial effort, it's just trying to turn you into part of an obnoxious ad network, use your computer to send spam, pick up account information or credit card details that in aggregate are worth a little bit on some particular forums, that sort of thing. Cryptolocker is amazing because the developers didn't screw it up. It runs very quietly in the background. Most people never realize it's there. It comes in multiple pieces, so your AV software might disable the UI portion of Cryptolocker but all your files will still disappear (oldest files first). Each file is encrypted with a different key, and then a master key is used to encrypt all of those keys. It's basically, "the kind of malware tptacek would build if tptacek built malware." It's also been a huge boon for us in convincing people to get backups going finally, because the sort of people that are willing to gamble that their hard drive will never fail aren't also willing to gamble that they'll never click on the wrong thing online. I hate having to scare people into getting backups, but, that's how it is.

deleted 12y ago

[deleted]

dagw 12y ago
CryptoLocker isn't amazing. it's petty thuggery. No it really isn't. It's smart software written by smart people. Our continuous underestimation of the 'enemy' is the reason we keep finding ourselves in these situations. The sooner we stop dismissing the blackhats as just 'dumb kids' and start accepting that many of them are probably smarter and better programmers than most of us, the sooner we as a society can start getting a real grip on computer security. Your appeal to is humanity is noble and I certainly agree that it would very nice indeed, but it doesn't help solve the immediate problem in front of us.
- deleted 12y ago
  [deleted]
  - dagw 12y ago
    The immediate solution to the problem in front of us is to have these talented people stop developing this awful piece of software No that's the long term solution. A solution that is going to require some pretty huge changes in society as a whole. We need a solution in place today that works while try to figure out to get from where we are now to where we want to be. And we don't get to either of these solutions by failing to understand what we are dealing with. At the end of the day I think these people realize the quality of their work and us pretending it is any less than it actually is isn't going to have any effect.
tempestn 12y ago
You can certainly argue that Cryptolocker is immoral, but I don't see how you could say it isn't clever. It is entirely possible to do bad things in intelligent ways. Now, your parent is arguing that CL is actually a net good, even if it's doubtful that its author's motivations are altruistic. While I by no means endorse CL, I can certainly understand the argument. Most people will experience a hard drive failure at some point in their lives, surely. Could this malware ultimately save more data loss than it causes? Maybe. Although I doubt it. And even in cases where people have backups it will waste time. Regardless, I absolutely agree with you that it's immoral. But still clever.

notahacker 12y ago

If someone kidnapped your child and asked for a ransom, would you consider it an "overwhelmingly good bargain" because you'd get them back and they wouldn't talk to strangers in future? There is nothing novel about extortion, even on the internet, and it's not defensible as "doing a good job of teaching users about data loss"

jbob2000 12y ago
Your metaphor is a little flawed. It's more like allowing a random person off the street to babysit your child then they kidnap them. You could have avoided the whole situation by not allowing some random person into your home.
- notahacker 12y ago
  If you consider opening email attachments that appear to be pdfs from legitimate sources (and only backing up occasionally) to be a comparable level of negligence to offering your children to anonymous strangers, perhaps. No amount of victim-blaming justifies the original poster's assertion that it's an "overwhelmingly good bargain" though.

pbhjpbhj 12y ago

Attacking rich people with a knife is a net good. It means they'll hire body guards, then if they have a medical emergency there will be someone there to assist or call an ambulance. If you hadn't attacked them then they could have be choking or having a cardiac infarction and not have anyone there to help. /s