Slashdot Mirror
Sneaky Blackmailing Virus That Encrypts Data
BaCa writes "Kaspersky Lab found a new variant of Gpcode which encrypts files with various extensions using an RSA encryption algorithm with a 1024-bit key. After Gpcode.ak encrypts files on the victim machine, it changes the extension of these files to ._CRYPT and places a text file named !_READ_ME_!.txt in the same folder. In the text file the criminal tells the victims that the file has been encrypted and offers to sell them a decryptor. Is this a look into the future where the majority of malware will function based on extortion?"
Question is, does the encryptor rewrite the data in-place, or just encrypt to a new file then delete the original? If the latter, the data is still recoverable with a simple undelete utility.
Do people still keep stuff in "My documents?". Ya'd think that after all of the very public worms, viruses, malware, and phoning-home that people would learn to make their own "My Stuff" folder(if not regularly back up and/or encrypt their important data).
...the Casino Virus. Perhaps because of the similar concept of "holding data hostage".
The virus takes your FAT and stores it in RAM. Then lets you play a slot-machine game. If you win, you get your data back. If you lose, you lose your data. Some other combination of characters (in the slot machine) gives you the virus-writer's phone number.
Vivin Suresh Paliath
http://vivin.net
I like
I thought of a virus along this line, but slightly different. What it would do is encrypt the data, decrypt on the fly until it is time to demand payment. All backups would have been encrypted too, if you have the correct hooks into the OS. I never tried it, since the dark side has a strong pull.
Fight Spammers!
But there are shortcuts to factorization. ie, if a long number ends in 0 or 5, it is divisible by 5. If the digits add up to 9, it is divisible by 9, etc. There may be similar but far more obscure shortcuts for larger primes.
Now, I am not a cryptanalyst or mathematician, and I'm not clear on how RSA works, so bear with me. Suppose I were to generate a list of prime numbers. This only has to be done once. Now suppose I take each prime and multiply it by every other prime on the list. Now if there are n primes, there are going to be n^2 products. Let's say we only store the last ten digits of the product, along with which primes generated it. There's only going to be a handful of primes who's product gives those same last ten digits. So, if the RSA depends on being able to decide which primes a large number is composed of, then would I not just have take the last ten digits of the large number, look up in my table to find the handful of primes that could multiply out to that, and just check those?
When our name is on the back of your car, we're behind you all the way!
Anyone heard about Onehalf? We're talking something like 1992-94 IIRC. :)
If my memory serves me right even further, the virus is from Kosice, Slovakia. It spread quite quickly (even though there was essentialy no Internet at that time in Slovakia) but later on, I believe ESET produced a utility to detect it and clean it up. Nice thing was, that it did not need to boot from clean boot floppy in order to do the clean-up (which was quite unussual at that time).
Funny thing then was, that few month later, as we though that Onehalf is - thanks to that utility - dead and old news, story came from USA that Onehalf reached there and that after a lot of trouble Norton was able to detect it. But not clean it. What a joke. If we've had email, we would happily mass-mail that ESET's anti-Onehalf utility to every one.
Maybe further info: ESET's One Half entry.
hany
Banking in Nigeria is not significantly less reputable than anywhere else.
The problem with Nigerian scams is because there are a lot Nigerians, and a significant fraction of them do not trust random people they don't know from Adam (or in some cases, members of their own family) and think that "europeans" must be a bunch of illiterate cretins if they are willing to believe things they read in random e-mails from strangers, and hence deserve to be scammed.
The main factor in Nigerian fraud, is that part of the Nigerian population that believe that God created cretins so they could be scammed. Not a very christian beliefe:
Yes its true, Christianity would stop Nigerian scams - send more missionaries :-)
Yes, I have been to Nigeria.
Sent from my ASR33 using ASCII
Oh, that last part about Christianity WAS funny, considering
However, I'd say depicted Nigerian attitude combined with wealth is a bit concerning matter: Of Guns, Germs (, Presumptuousness) and Steel, they seem to just lack a lot of steel to become yet another global PITA.