Slashdot Mirror
RansomWare Disassembly Reveals Evolutionary Path
flaws writes "The guys at Secure Science Corporation have written a revealing article demonstrating the relationship with the most recent Ransom-based Trojan (known as Glamour) and some previous data stealing trojans. They include an open source decrypting utility for unlocking your files if infected, and some stats that are a bit disturbing. According to their report, in the past 8 months, 152,000 victims have been infected, and over 14.5 million records were discovered to be logged by the trojan."
"Dear User: We are currently holding your pornography hostage. Unless you send us $300, you will never see Jenna Jameson and that beer can again."
Sure baby, I'll give you my phone number...in Hex
. . .Trojan brand shown to BLOCK Evolutionary Path!
Well, considering that Windows by default doesn't show the file extension for known filetypes, as far as all the noobs can tell, the file they just double-clicked was "Artist - song.mp3", since they wouldn't even see the .exe at the end. Sweet deal eh?
.... and so on and so forth. You can imagine how quickly someone will eagerly download and run a keygen they've been looking for for ages that they couldn't find anywhere else.... ;)
If you've used any common p2p apps like eDonkey or the like, you'll notice that when you search for something, even if you type some arbitrary crap like "huoshgahgauoiwhrgoaghnaj" you'll also get "huoshgahgauoiwhrgoaghnaj.mp3.exe" and "huoshgahgauoiwhrgoaghnaj pics xxx mpeg avi.exe" or similar shit. So someone searching for a keygen is going to get "exactly the keygen they wanted.exe"
If you just XOR the data and tell people it's RSA-4096 99.44% of them are going to just accept that it's true (after googling to find out what RSA means) and send you the $300.
No, they are going to look for a "free decoder program," ha ha ha. Oh, the joys of non free software.
Jokes aside, this trojan is aimed at corporate users. If it's easy to fix, big dumb companies will tell their sheep to bring forth their problems and fix them. If the creeps had been bright enough to use real encryption, there would be no solution and embarrassed users will try to fix the problem themselves. Of course, paying $300 to an extortionist will get you nothing more than another request for money unless they want to sell you back each file. For more evidence of this, see Vista pricing.
Friends don't help friends install M$ junk.
The entry should be a REG_DWORD named WinCode in the HKLM\SOFTWARE\Microsft\Windows NT\CurrentVersion location, and should have the value 31337
Call me old fashioned, but I like a dump to be as memorable as it is devastating - Bender
Read the report: http://ip.securescience.net/advisories/Glamour-Ran somWare.pdf page 15.
There is in fact a check for a value of "31337" in a "WinCode" registry key.
Which is why I've been telling people for years the first thing they should do after installing Windows (immediately after selecting the "Show hidden files and folders" option and unchecking (clearing) the "Hide extensions for known file types" and "Hide protected operating system files" options in Control Panel -> Folder Options, View tab) is to run REGEDIT and do a 'Find' for all occurrences of "NeverShowExt" and delete every single one found. All of them (spare none).
Yes, it is admittedly unappealing (at first) to see all your shortcuts (including those in your Start and Programs menus) with an ugly ".lnk" extension following them, but trust me, you get used to it pretty quickly.
Perhaps it's just me but I personally prefer my operating system not to lie to me by default. The above procedure ensures that it doesn't.
p.s. your example is a poor one; the ".exe" extension is always shown (never hidden) by default.
Now ".vbs" files on the other hand...
"Fish" (David B. Trout)