Sneaky Blackmailing Virus That Encrypts Data

BaCa writes "Kaspersky Lab found a new variant of Gpcode which encrypts files with various extensions using an RSA encryption algorithm with a 1024-bit key. After Gpcode.ak encrypts files on the victim machine, it changes the extension of these files to ._CRYPT and places a text file named !_READ_ME_!.txt in the same folder. In the text file the criminal tells the victims that the file has been encrypted and offers to sell them a decryptor. Is this a look into the future where the majority of malware will function based on extortion?"

Comments

But were they smart, or stupid?

[pclminion]

Question is, does the encryptor rewrite the data in-place, or just encrypt to a new file then delete the original? If the latter, the data is still recoverable with a simple undelete utility.

Re:But were they smart, or stupid?

[Cajun Hell]

It displays a message when it does it, presumably so that the virus-runner will know that they need to pay someone to decrypt their file. That makes it pretty un-scary: it tells you when to restore. Of course, since your machine is compromised, maybe the "restore" really just overwrites your tape.

It might take months before I realize they are corrupted

In which case the virus writer never gets payed, since his yahoo email account is probably long disabled by then.

There's no point in delaying extortion. The kind of people who decide to run malware, are the same kind of people who don't have any backups, so they're ready to collect from, immediately.

Re:But were they smart, or stupid?

[Niten]

He did say "good corporate citizen", so if you are not paying for it, you obviously have something to hide and should be reported.

You may think this is just a joke, but when my second college roommate saw me using an unfamiliar operating system, he naturally started asking me about it. "What's it called?" "Red Hat Linux." "How much does it cost?" "Nothing, it's free." He freaked out: "Oh my God, how can that be legal? That could cost Microsoft so much in lost profits! That should really be illegal..."

The worst part? He was a business major, an honest-to-goodness PHB in training...

Re:But were they smart, or stupid?

[Anonymous Coward]

Call me silly, but I "paid" for my copy of Linux. Instead of a licensing fee, I paid some in donations to various projects of utilities I use daily, from Firefox, to OpenOffice, to TrueCrypt, etc.

Re:But were they smart, or stupid?

[the_womble]

Every time I go to a supermarket they seem to be handing out free samples of something. Does he think that should be illegal? If he has taken an economics course and managed to understand it (although that sounds unlikely), you could have pointed out that the marginal cost of production of a downloaded copy of Linux is much less than that of a free sample of any physical product. I wonder if he thinks that free websites and web services should be illegal as well? Should Internet Explorer be banned because it lost Netscape a lot of money? Did you ever mange to explain to him that there is actually a sound business model behind Red Hat?

Re:This has been done before

[Ethanol-fueled]

Do people still keep stuff in "My documents?". Ya'd think that after all of the very public worms, viruses, malware, and phoning-home that people would learn to make their own "My Stuff" folder(if not regularly back up and/or encrypt their important data).

Reminds me of...

[vivin]

...the Casino Virus. Perhaps because of the similar concept of "holding data hostage".

The virus takes your FAT and stores it in RAM. Then lets you play a slot-machine game. If you win, you get your data back. If you lose, you lose your data. Some other combination of characters (in the slot machine) gives you the virus-writer's phone number.

Re:Oh please! We all know there aren't any REAL ba

[Anne Thwacks]

owned by the ruling ethnic groupNo. owned by the shareholders, or subsidiaries of well-known internaitonal banks (British, American, etc).

Banking in Nigeria is not significantly less reputable than anywhere else.

The problem with Nigerian scams is because there are a lot Nigerians, and a significant fraction of them do not trust random people they don't know from Adam (or in some cases, members of their own family) and think that "europeans" must be a bunch of illiterate cretins if they are willing to believe things they read in random e-mails from strangers, and hence deserve to be scammed.

The main factor in Nigerian fraud, is that part of the Nigerian population that believe that God created cretins so they could be scammed. Not a very christian beliefe:

Yes its true, Christianity would stop Nigerian scams - send more missionaries :-)

Yes, I have been to Nigeria.