Slashdot Mirror
Ransomware Making a Comeback
snydeq writes "Ransomware is back. After a hiatus of more than two years, a variant of the GpCode program has again been released, kidnapping victims' data and demanding $120 for its return, InfoWorld reports. 'Like the ransomware programs before it, GpCode encrypts a victim's files and then demands payment for the decryption key. The new version of GpCode — labeled GpCode.AX by security firm Kaspersky — comes with a bit more nastiness than previous attempts. The program overwrites files with the encrypted data, causing total loss of the original data, and uses stronger crypto algorithms — RSA-1024 and AES-256 — to scramble the information.'"
Simple solution: Back up your data. In other news, make sure you patch software and operating system vulnerabilities and don't run executables from unknown sources.
You can have your first post unencrypted if you pay $110 to me
Simple solution: Back up your data. In other news, make sure you patch software and operating system vulnerabilities and don't run executables from unknown sources.
Slashdot really needs to add a spam moderation that gives 2x the negative karma of normal downmods.
Monstar L
You sure have some nice data here. Would be a shame if something were to happen to it now wouldn't it?
All my data is already encrypted you insensitive clod!
Excuse me, but please get off my Pennisetum Clandestinum, eh!
I remember back when I was running MSDOS 5, and at first Bootup it cut to a screen with a Slot Machine that said it was a Virus holding my MBR and File Allocation Table ransom until I get such and such combination after I pull the Arm. It also said if I tried to turn-off the computer, then all my data is already gone unless I got the sequence in this game to restore my MBR and FAT.
Needless to say, I left the computer on all day and drove to my grandmother's Insanitarium/Old-Folk's home and said I didn't come visit these past 10 years because I've always given her bad luck and now I need her more than ever. She stopped taking her pills, said goodbye to the trees and bushes and pigeons as I walked her to my car, and upon arriving at my desk she knew exactly what to do: she pulled-out her vile of lipstick, puckered some on her mouth, and gave the computer screen a kiss. She was insane again.
Fuck you Slot Machine! I pulled the Arm, and I won back my MBR and FAT. I told my grandmother she could walk back home, and so I gave her $10 to buy some cigarettes and lunch, and I and her Retired-Living Facility have never seen her since.
Kaspersky might have labeled it, but only running AVG ensures there's no chance of catching it ;)
The whole point of these malware authors is to ransom data for cash, right?
How the hell do they get paid? And if that is an answerable question, that brings question number two.
Why the hell can't the law find them?
There would be a money trail of some sort. The money has to go from victim to the criminal. That is traceable.
Isn't this really just a gigantic "kick me" sign?
Weaselmancer
rediculous.
Fortinet did an analysis of this. http://blog.fortinet.com/all-your-drives-are-belong-to-us/ It simply backs up the partiton table and rewrites the MBR. It's fixable without paying the ransom.
That won't be abused.
I'd feel a little better about the proposed solution (let a disk utility recover the partitions) if they had actually tried a disk utility to see if it could in fact find the partitions and restore them. It does seem like it should work... and copying that thing back by hand is not a task I'd take on lightly with anyone's data but my own.
Also wouldn't the thing that messed up the MBR in the first place still be in your Windows installation? I didn't see that they tried to boot from that drive after repairing the MBR. It could be the ransomware is just waiting for you to reboot and will do something nasty if you've not entered the password. It seems like even after a recovery you should take the drive to a different system and back it up immediately before you tried to boot from it again, but they do not mention that.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Funny how these crooks can write ransomware but they can't count to three: 1) 2) 2)
What one fool can do, another can. (Ancient Simian Proverb)
Maybe it could rot13 the text of the comment, and then have a javascript autotranslate on click thing. That way it would be worthless for SEO type stuff.
If it got any positive mods whatsoever it wouldn't do it to avoid it being used as a "I disagree" option on otherwise decent posts.
Who would actually trust those people to give access to the data after receiving payment? What is the most profitable thing to do after somebody have paid? Give them their data back or demand more money. Granted, very few people would be stupid enough to pay twice. But even if one person would fall for that, it would mean more money to them. And people are more likely to pay more money if they can make it look like the sucker was just unlucky and they didn't intentionally fail to give the data back. For example make the browser crash at the point where it "should" have shown the password.
Do you care about the security of your wireless mouse?
It gets swooped on pretty damn quick.
I have to say I find it kind of funny. As though we're going to read the comment and think "Gosh - that's an insightful comment and not spam at all. Now I must buy a Chanel bag because that would be the perfect accessory for my think geek T-shirt"
It's not enough to back up your data! You'll only end up with encrypted backups, at least if the author did the smart thing and covertly encrypted the data over a period of time (until all unencrypted backups have been deleted). This has happened in many companies.
What you really need to do is to manually verify which files have changed since last backup, and whether that change was legitimate. Easily done using hashes. This approach also prevents general file corruption, which is at least as big of an issue.
Comment removed based on user account deletion
Or teach your backups to be smart and warn you if they notice a significantly larger number of files changing.
In a company (or with you at home), there is usually a fairly stable number of documents getting modified per day and thus their backups need modification. So unless that malware does it REALLY slowly (read: a handful of files per day, tops), you do notice a significant spike of changes.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I have an uneasy feeling about Kaspersky in all sorts of situations, including this one. Just saying that the 3 ways to gain from this activity is either to be building the virus or to be building and selling the antivirus.
The third possibility is left to the imagination and that's the one that makes me uneasy.
You can't handle the truth.
There, corrected the title ...
CrashPlan is excellent. $50/year for one computer and unlimited space, indefinitely-kept versioning and deleted files, and a daemon that runs in the background all the time, with a separate GUI frontend.
I wish there were a referral plan so I could get something from this plug, but as of now, there's not. :/ haha Anyway, check it out. For a long time I used Duplicity to a web hosting account, but CrashPlan is easier and more reliable.
"Those who consume the bulk of goods are those who make them. We must never forget this secret of our prosperity."
If it got any positive mods whatsoever it wouldn't do it to avoid it being used as a "I disagree" option on otherwise decent posts.
Which would in turn be abused by trolls who upvote spam. Gotta love the Internet ;)
You might not think that the archive of emails my wife and I sent each other the last ten years is critical, but it means enough to me that I have three offsite backups.
I write sci-fi for metalheads
For 90% of victims changing the file name would be adequate "encryption". Simpler yet would be to just delete the files, collect $120 for returning them, and move on to the next victim. After all, these people have already demonstrated their stupidity by downloading the malware in the first place.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Will any makes of Ransomware try to use the DMCA to force you to pay?
Or maybe even on the fake AV apps may try that some day.
Imagine if a semi-legtimate company did this. Would they be legally allowed to do it if the EULA said they would?
Whenever I see family/friends/co-workers using external drives for "backup" I have to repress the urge to launch into a lecture on the absurdity of relying on a local, always mounted backup.
So just tell them to unmount/disconnect after backing up! While you're at it, counsel them to get at least one additional drive to put into backup rotation. As far as offsite backup, a 32GB stick with the really critical data copied to it may be better than trusting your data to a third party.
External drives, along with memory sticks, are very effective when used properly.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
Whenever I see family/friends/co-workers using external drives for "backup" I have to repress the urge to launch into a lecture on the absurdity of relying on a local, always mounted backup.
Its a far better solution than the previous one: doing nothing. I'd wager accidental deletion or hardware failure is a bit more common than ransomware and other related malware threats to data.
An external drive provides absolutely no protection from any kind of malicious attack or catastrophic disaster (flood, fire, theft).
When evacuating the house due to fire/flood/tornado/earthquake etc one could quickly unplug and grab the external hard drive.
The only real backup solution is an off-site backup.
Yes and no. Online backup solutions are fine but not really the only option. Get a small external HD (often USB powered and designed for portability) and periodically copy everything to it and put it in a bank safe deposit box, or buy a firesafe for at home. With respect to firesafes be careful to get one that is rated for electronic data, most are only related for paper and temperatures will get hot enough to kill electronics.
Lets see here ... anyone ever heard of the concept
of "backup" - you know, making copies of your files, so you can recover them in case of situations like this???
Only the stupid get penalized in a scam like this.
I do like the 1TB Western Digital mybook I have (best gift received for Christmas 2009)
However, I want that on-site because it serves a dual purpose: in addition to backing up stuff on C:\, I also use it as expansion capacity for stuff that can't fit on C:\. Likewise, I keep my USB drive handy (which backs up some files) because I also use it for file portability.
I could also put the core of my files collection (i.e cut down on the space-guzzling files) on USB flash drives, and put them at other convenient locations. Other rooms of your own house / your other PCs might be useful in cases of really localized damage.
Fine for reverting to good versions of specific files, too.
Frankly, local backup at least seems to be a good consumer-grade solution if you're not paranoid.
I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
"Real men don't use backups. They just upload their stuff via BitTorrent & one-click hosting sites and file, and let the rest of the world mirror it."
Well, this would be useful for collections of creative content that would be a PITA to rebuild. That reduces your backup challenge towards mainly smaller-size personal document files, which can't hurt.
I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
This would require a registered account with decent karma. So just keep track of the spam upvoters, and don't give them mod points for a while.