Slashdot Mirror
RansomWare Disassembly Reveals Evolutionary Path
flaws writes "The guys at Secure Science Corporation have written a revealing article demonstrating the relationship with the most recent Ransom-based Trojan (known as Glamour) and some previous data stealing trojans. They include an open source decrypting utility for unlocking your files if infected, and some stats that are a bit disturbing. According to their report, in the past 8 months, 152,000 victims have been infected, and over 14.5 million records were discovered to be logged by the trojan."
"Dear User: We are currently holding your pornography hostage. Unless you send us $300, you will never see Jenna Jameson and that beer can again."
Sure baby, I'll give you my phone number...in Hex
" RansomWare Disassembly Reveals Evolutionary Path"
Prehistoric Trojans. Were's the missing link?
From the report: "...it was quickly apparent that the files were not really encrypted with 4096-bit RSA....This is a bit bewildering...implementing real 4096-bit RSA is simple and would have made it extremely difficult, if not impossible, to produce a working decryptor without paying $300." Silly script kiddies.
. . .Trojan brand shown to BLOCK Evolutionary Path!
Do people still really open attachments from people that do not know or were not expecting? Are people really executing unknown .exe files?
What is the infection vector for these things? Is it email, P2P networks fooling people into believing that mp3 really is an EXE file?
although I cant believe that people are stupid enough to fall for a nigerian scam wanting to deposit 30 billion dollars in their accounts overnight either.
Do not look at laser with remaining good eye.
Can anyone explain what "Beware of geeks bearing graft" means? (QOTD)
This is a bit bewildering...implementing real 4096-bit RSA is simple and would have made it extremely difficult, if not impossible, to produce a working decryptor without paying $300." Silly script kiddies.
If you just XOR the data and tell people it's RSA-4096 99.44% of them are going to just accept that it's true (after googling to find out what RSA means) and send you the $300. How many are going to find out about this open source decryptor? I betcha 80% of IT consultants won't even know about it, and half of them will advise to pay up. The other half might refer to law enforcement, but how many of them are even going to have heard of the trojan. Etc., etc., etc.
Easier to just XOR the data and get back to surfing porn. Until somebody traces the bank transfers back to your pad and a tear gas can drops in your window...
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
They should disassemble WGA too. Amazing things in there!
Are you a scoremonkey?
nosig
If you just XOR the data and tell people it's RSA-4096 99.44% of them are going to just accept that it's true (after googling to find out what RSA means) and send you the $300.
No, they are going to look for a "free decoder program," ha ha ha. Oh, the joys of non free software.
Jokes aside, this trojan is aimed at corporate users. If it's easy to fix, big dumb companies will tell their sheep to bring forth their problems and fix them. If the creeps had been bright enough to use real encryption, there would be no solution and embarrassed users will try to fix the problem themselves. Of course, paying $300 to an extortionist will get you nothing more than another request for money unless they want to sell you back each file. For more evidence of this, see Vista pricing.
Friends don't help friends install M$ junk.
I just bought 72 condoms.
I just bought 144 condoms, and now I'm grossly oversexed.
Blank until
The entry should be a REG_DWORD named WinCode in the HKLM\SOFTWARE\Microsft\Windows NT\CurrentVersion location, and should have the value 31337
Call me old fashioned, but I like a dump to be as memorable as it is devastating - Bender
Most virus and trogen work because no matter how much awareness you put out there, in the end you can not increase the intelligence of people. People are still going to click on those links, still going to download their 'free' porn and still utilize p2p networks where these people can just fish with shotguns in. And lets say a corporate employee does some of this at work, gets this virus then half their companies documents are held hostage more then likely they are going to pay up $300 to hurry and get the fix. If you notice the main payload of this was programmed to reap the most monetary value within 5days, the file was compiled on 5 July released on 10 July and demanded payment on 15 July. Any employee who values their job and does non-authorize web surfing on work computer who jump at the chance to hurry and cover their tracks. I hope this was comprehensible it's pretty late here and very sleepy. Damn /dot
Vampires Vs. Werewolves
Never explain your jokes.
Read the report: http://ip.securescience.net/advisories/Glamour-Ran somWare.pdf page 15.
There is in fact a check for a value of "31337" in a "WinCode" registry key.
Microsoft has been doing this for years now. They call it an "operating system" and also "office suite". Those are just code names though, don't let it fool you!
I bought two score condoms, to score.
// MD_Update(&m,buf,j);
Evolution is nonsense. Surely this trojan was intelligently designed.
Which is why I've been telling people for years the first thing they should do after installing Windows (immediately after selecting the "Show hidden files and folders" option and unchecking (clearing) the "Hide extensions for known file types" and "Hide protected operating system files" options in Control Panel -> Folder Options, View tab) is to run REGEDIT and do a 'Find' for all occurrences of "NeverShowExt" and delete every single one found. All of them (spare none).
Yes, it is admittedly unappealing (at first) to see all your shortcuts (including those in your Start and Programs menus) with an ugly ".lnk" extension following them, but trust me, you get used to it pretty quickly.
Perhaps it's just me but I personally prefer my operating system not to lie to me by default. The above procedure ensures that it doesn't.
p.s. your example is a poor one; the ".exe" extension is always shown (never hidden) by default.
Now ".vbs" files on the other hand...
"Fish" (David B. Trout)
Vs lbh jnag gb ernq vg V fryy n qrpelcgbe sbe $300 abj fraq zr zl zbarl!
does it run on Linux?
Death is life's great reward. R. Hoek
the beginning. The part I don't get is "graft." Beware of geeks bearing political corruption?? it doe snot make sense.