Slashdot Mirror
Virus Hold Computer Files 'Hostage' for $200
dwayner79 sent in a story about a new virus making the rounds- this one is unique because it locks your files and then demands a $200 ransom to get them back. It seems to me that this might leave some sort of tracable money trail. They don't have much information on any particular transmission mechanism, they just talk about web pages giving it up.
because his "blackmail-letter" is a file called attention!!!.txt, containing this:
Some files are coded.
To buy decoder mail: n781567@yahoo.com
with subject: PGPcoder 000000000032
There's no way for a programmer to collect a ransom for files. How's he going to collect the money, a paypal account? Please! The feds will be all over this guy in a matter of minutes.
Because if the hacker has encrypted the files with a random passphrase and assuming this passphrase isn't the same for all the computers he attacks, it is highly unlikely a security company will be able to easily decrypt the files.
That is what is particularly scary about this. What if the hacker went offline-- even if you are willing to pay the money, you can't get to the files. They are as good as deleted
You are an idiot for dismissing South Africa as third world. We may be in Africa and suffer from some of its problems, but I am sitting here typing my message from a Gentoo box while installing FreeBSD on another machine. Third world? I think not. Also, the sun rises earlier in South Africa than in the US. We sometimes get news earlier than you do because New Zealand and Australia wake up looong before you do.
I just finished reading "Malicious Cryptography: Exposing Cryptovirology", and it talks greatly about exactly this. The problem is that, due to wonderful things like public-key encryption, evildoers could conduct an attack like this without leaving a trace.
I'd highly recommend the book (no, I don't know that author).
Wer mit Ungeheuern kämpft, mag zusehn, dass er nicht dabei zum Ungeheuer wird. --Nietzsche
Why not:
generate random key, encrypt data with it (symmetric),
encrypt that key with public one (stored in virus itself), destroy random key, give victim encrypted key.
Victim sends encrypted key to author, he decrypts it using his private key and sends it back.
I too was innocent on the subject of lemon party.
..
/.ers, please take my advise and do NOT google for it.
.. even though I don't really understand the 'lemon' part
I expected some funky game involving lemon juice and pie
Now I know as well.
This is even more gross than goatse, parrot or tubgirl! As a matter in fact I'm taking the rest of the day off, avoiding elderly people, to make sure my mind can recover.
Fellow
I won't be able to get the image I just googled out of my memory next time someone mentions a lemon
You can learn about lemonparty here, but browse without images...
m onparty
http://www.encyclopediadramatica.com/index.php/Le
Sneak teach kids Algebra using a game
Do you really think a virus is going to take spyware hostage and then demand $200 for the key to unencrypt it? I don't know about you, but even if it did, I sure wouldn't be happy with this kind of virus on my computer.
Plus the article mentions this paritcular infection affected only "at least fifteen types of data," most of which were presumably important to the user, like spreadsheets and the like. But again, even if it did encrypt malware ... I don't see how it could be a good thing. Let's introduce them to Ad-Aware, Spybot, etc. instead, and safe browsing habits--the lack of which probably allowed both this virus and the malware on the computer in the first place.
R.Mo
The encrypt-files-and-demand-ransom-trick has been tried before by criminals in 1989. A company sent out disks with software containing a trojan that encrypted the harddisk and then demanded money to decrypt it.
y -of-computer-viruses.html#C05
http://www.claws-and-paws.com/virus/papers/histor
http://securityresponse.symantec.com/avcenter/venc /data/trojan.pgpcoder.html
WATCH OUT!
There is a thumbnail!
so it's already been either bruteforced or cracked. My hunch is that a encryption program carried in a virus would be rather simplistic.
Apocalypse Cancelled, Sorry, No Ticket Refunds
It's not a command in the trojan that decrypts the files, it's a program the trojan author sends you after you send him $200. However, the encryption is trivial and just about any reverse-engineer could write a decryptor for you.
-Joe
Joe Stewart, GCIH
Senior Security Researcher
LURHQ http://www.lurhq.com/
Yes, funny funny. In context, though, you have to know the question the reporter asked me, which was, "Do you think this software was a test, or do you think it was malicious?"
-Joe
--
Joe Stewart, GCIH
Senior Security Researcher
LURHQ http://www.lurhq.com/
If you have just two files its still extremely hard... you need something like 2^23 files to do it in a reasonable amount of time (assuming RSA+IDEA).
This post is incorrect. Probably a semi-subtle troll rather than an honest error.
Neither RSA nor IDEA is vulnerable to a known-plaintext attack. In fact, any cipher that is vulnerable to such an attack is considered completely insecure, especially if only 2^23 "files" are needed.
If you get to choose the contents of one of the files its only about 2^17.
Neither RSA nor IDEA is vulnerable to a chosen-plaintext attack. There were some chosen-plaintext attacks against RSA a few years back (mid 90s), but proper padding eliminates them. And far more than 2^17 trials were required for typical key sizes. Again, no cipher that was vulnerable to such an attack would be considered secure.
Obviosly, if the keys are larger, it will take exponentially longer.
Larger than what? Are you assuming extremely small key sizes in order to achieve the numbers above? Actually, you don't get to pick the size of an IDEA key, because IDEA keys are 128 bits. Though you can arbitrarily fix key bits to produce a smaller effective key, there's no reason why the virus writer would want to do that.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Screenshots
You're probably referring to the "One-Half" virus, if I recall correctly from my days reading alt.comp.virus.
/mbr" from a boot floppy was a no-no.
This was the classic example as to why blindly running "fdisk
Too bad an FBI investigation/ prosecution costs over $200,000 on average. That's 1000x the $200 ransom. Bottom line; it would have to be a widespred thing for the FBI to give a shit.
If Tyranny and Oppression come to this land,
it will be in the guise of fighting a foreign enemy. -James Madison