Slashdot Mirror
CryptoLocker Gang Earns $30 Million In Just 100 Days
DavidGilbert99 writes "A report from Dell Secureworks earlier this week reported that up to 250,000 systems have been infected with the pernicious ransomware known as CryptoLocker. Digging a little deeper, David Gilbert at IBTimes UK found that the average ransom being paid was $300, and than on a very conservative basis just 0.4% of people paid the ransom. What does this all add up to? $30 million for the gang controlling CryptoLocker — and this could be 'many times bigger.'"
The link is wrong
Or was this meant to trick us into reading about Zuckerberg?
In Xanadu did Kubla Khan
A stately pleasure dome decree
Here is the correct link: http://www.ibtimes.co.uk/cryptolocker-criminals-earn-30-million-100-days-1429607
Silence is a state of mime.
Here is the correct link to the CryptoLocker story http://www.ibtimes.co.uk/cryptolocker-criminals-earn-30-million-100-days-1429607
Does CryptoLocker actually do what it says when a person pays? That's better than a lot of commercial software I've used. The gaming, media, and high-level engineering software industries are particularly bad on this point.
You're in every goddamn device on the planet but you can't shut this sort of shit down?
Another reason to execute y'all for treason.
Just look at those guys: they don't need to take our freedoms with draconian DRMs and bought legislation. Their programs can be freely copied, in fact, their whole business model depends on the software being copied at no cost!
What do they earn their money with, you ask? With high-quality cryptographic security service! Truly, a business model of the future.
They are not blaming pesky pirates for their losses, they don't whine that someone uses their work without permission. They work harder, are creative and produce high-quality product. And that is their key to success!
Where are the vaunted security agencies in providing protection for citizens? Should not the government have a hand in protecting its citizens?
250,000 * .004 * $300 = $300,000, not $30 million. I think someone confused 0.4% with 40%.
I can't tell if you're a troll or just an average AC....
My guess is a government alphabet soup (KGB/CIA/NSA/whatever) agency. Seriously. Times are tough. Governments around the world are strapped for cash. How else is a government agency going have an operations budget? More importantly, why wouldn't an agency do this?
You must be so confused. It's ransomware: it encrypts your files with a public key. The private key is controlled by the gang. You don't pay, you end up with a bunch of random-looking data substituted for your files, since the gang destroys the unique private key after the time is up. Yes, you're basically just back to where you were, before you "installed" the software. The "bother" is with the software being ransomware. It's malware. It installs itself when you don't pay attention, like most people out there...
A successful API design takes a mixture of software design and pedagogy.
That's where the Mark Zuckerberg Link comes in. Zuckerberg will sell FB stock worth 2.3 billion$ & give the CryptoLocker guys 30 million $ from that.
Are you sure it is unrelated? Facebook seems to be asking a lot of money for nothing tangible too...
We got hammered by CryptoLocker twice in November. Unfortunately, the backups of one of our affected fileservers crashed the same day, but we still lost very little data (none critical). The worst part is that it hits every mapped drive that the user has write-access to, and some of our legacy accounting and payroll systems require exactly those permissions. It's a real eye-opener, but what really gets you going is when you realize that CryptoLocker is actually pretty tame compared to what it could be - it only targets certain extensions, is easy to remove, is easy to block, and doesn't touch Windows.
"So, do you have a current backup?"
-- Every tech support number you'll call, anywhere. Ever.
And yet, the single most basic thing you can do to protect your data gets overlooked by hundreds of millions of people, because it's just too burdensome to drag and drop from "My documents" to "My external drive". Viruses, malware, and crap like this would have gone the way of the dodo bird if people would just follow the most basic. advice. ever. regarding the maintenance of their computer. You wouldn't run your car out of oil after neglecting to change it for 15,000 miles, would you? So why do you do it to your computer?
#fuckbeta #iamslashdot #dicemustdie
Come on, that was sarcasm.
Crypto-Smasher V3.10 was used by Gary and Wyatt to make Lisa... just sayin.
Your data is far more important to most people that windows. You could just re-install if that is the case (which you probably should consider if you were hit with this). One issue I have with security is that almost everyone stores their most valuable files in a location that any program they start can edit. Its really easy for users, but means things like this are so much worse.
They should popularize a system where you can choose what programs have access to particular directories. I would imagine it would work something like the permissions for android, where when installing it says that it needs access to these particular permissions and your music library. For instance, I could have a documents folder that only my word processor can access, I could have a video folder that only vlc can access, and I could set it so my browser could not access anything but its configuration directory. Browsers already try to do this, but it would be nice to force it from the system. It doesn't stop a stupid user from downloading bad programs, but it should help reduce the effect of application bugs being exploited.
This. I found this bit of info on Bitlocker surprising as well: "When first run, the payload installs itself in the Documents and Settings folder with a random name, and adds a key to the registry that causes it to run on startup." Is this still even possible on modern (ish) operating systems (Windows 7 / Windows 8). Windows seems to ask for permission whenever an .exe is executed, and you'd certainly think it would ask for permission when a program modifies that part of the registry.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
Who, Zuckerberg?
I am still deciding...
I wish I had some mod points to mod this side conversation about .4% as "funny." Like, who exactly has infiltrated /. that doesn't understand this? Soon, they're going to need to remove "News for Nerds" as false.
One issue is that it doesn't just affect the infected machine, but also every mapped drive. Reinstalling all of those systems would have been a nightmare's worth of downtime. Unfortunately, most of the mapped drives are a result of legacy systems with very finicky requirements that we can't move off of yet for one reason or another. I agree, your access control system would be nice (although I imagine the initial implementations would be a minor nightmare as proprietary apps try to lock out other programs that could otherwise read that data).
It requires the user to run it in the first place, usually as an email attachment. And users have long since been conditioned to click Yes/Run/Continue on every pop-up box that gets between them and their perceived goal. As annoying as it is, I like the things that ask "Block? Yes/No" rather than "Allow? Yes/No" because it helps stop some of this click-yes-without-reading behavior.
The bright side of CryptoLocker's registry access is that it leaves a list of every file that it hit, which helped a lot when restoring from backups as we didn't need to test or restore absolutely every file.
Maybe this technology is related to Facebook.
Imagine, Facebook's users are generating unique, pithy, substantive and deep posts to put on Facebook, but this crypto locker stuff is just converting those awesome posts into worthless drivel about piddly silly details about the Facebook breakfast or exercise routine.
IMHO, CryptoLocker is just the first shot across the bow.
Long term, maybe it will be a good thing, similar to the old PC days where BIOS killing viruses finally got people to actually care about average security or else keep buying new computers.
Of course, malware like this pretty much trashes almost every single backup system known to man. The enterprise is less affected because of programs like NetBackup that pull data, so malicious software is unable to touch previous backups. However, the main form of backups people do (if they bother to do anything) is copying to a secondary hard disk, which allows the backups to be accessed by malware and destroyed. Services like Mozy sort of help, but they might not keep a previous version of a file that hasn't been corrupted by ransomware, especially if the software is relatively slow and encrypts files over a long period of time to escape detection.
What I am waiting to see is Cryptolocker's descendant. This software will install itself through a hole in a Web browser or add-ons. It will install a low level Windows driver. It will then generate a private key and keep it local to the machine, sending a backup to the ransomware's servers. The software will gradually encrypt files over time. However, when an encrypted file is accessed, it will decrypt it on the fly... for a time.
Then, once it completes encrypting files, it will stop decrypting on the fly, purges the private keys it used, then demand ransom. Since this was done over a period of weeks to months, even backups stored on Mozy or other places will be locked out.
It's ransomware: it encrypts your files with a public key. The private key is controlled by the gang. You don't pay, you end up with a bunch of random-looking data substituted for your files, since the gang destroys the unique private key after the time is up.
Unfortunately, I couldn't afford the $300. Fortunately, I never liked my data anyway.
Since 2001-09-12, the day after a terrorist attack on the World Trade Center, the list of things deemed "giving [enemies] Aid and Comfort" has exploded.
First, make them pay back everybody they ransomed, times 10, then execute them. If they don't have the money to pay back times 10 then we can find a company to pay back everybody times 10 and then make the perpetrators have to work for that company for free until their debt is paid off.
If you are not allowed to question your government then the government has answered your question.
The definition of DRM requires that the owner of the data and the attacker be the same entity.
If CryptoLocker has a chance to run, then the attacker has pretty much owned the machine.
Microsoft's brain-dead default of "hide file extensions" is cited in the article as part of the social engineering aspect that gets users to click on the files. It's the gift that keeps on giving... to black hats.
Hiding the file extension does NOTHING to make things easier on the user or make the UI any cleaner. It's not like we have 40 column displays where the file extension is "too long" and going to take away "screen real estate".
This has been going on literally for DECADES NOW. How can Microsoft be so blind? Whenever I get a new Windows box, it's the first thing I disable because if I don't, I'll just end up creating files with names like, "DailyLog.txt.txt".
Whoever is at MS, insisting that this remain the default needs to be hauled out, shot, drawn, quartered, and the pieces sent to be displayed in the lobbies of their 4 largest offices.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
What I am waiting to see is Cryptolocker's descendant. [...] The software will gradually encrypt files over time. However, when an encrypted file is accessed, it will decrypt it on the fly... for a time.
Then, once it completes encrypting files, it will stop decrypting on the fly, purges the private keys it used, then demand ransom. Since this was done over a period of weeks to months, even backups stored on Mozy or other places will be locked out.
Wouldn't the backup software also get the decrypted data? Or is the ransomware treating requests by the backup software differently than requests by other programs?
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat
I believe I got hit by this about a week ago when I clicked on an advert linked on Chicago Tribune's website.
A fullscreen message appeared saying my computer had been encrypted and I had to pay $300 to decrypt it. I pulled my network cable out and had to power off my PC because the keyboard would not work. I was able to boot back up, but when I logged in both regularly and in Safe-Mode, a full white screen saying "please connect to the Internet" appeared and I couldn't use the keyboard again.
I pressed F8 on boot and booted into Safe-Mode Command line only. Once I logged in and saw the command line, I typed rstrui.exe (windows System Recovery) and using the Restore Wizard, restored to a checkpoint from a day earlier. I restarted my PC again and let it boot normally and once I was able to log in without seeing the message, reconnected my network cable.
My PC was never encrypted. The message only said it was. The clincher was before I booted Windows in Safe-Mode, I used a Knoppix DVD to mount the Windows partition and copy off my personal data before I started the recovery process. The data was perfectly readable and not encrypted.
It is easier to build strong children than to repair broken men. -Frederick Douglass
Depends on OS. Windows uses snapshot functionality, and in theory, it wouldn't be hard for malware to not bother intercepting the files opened under a backup context so they get backed up encrypted compared to files opened directly by the user.
EFS on NTFS works in a similar fashion. If I back up a directory full of EFS protected files, they are stored encrypted. If I fire up a utility like WinRAR which opens files as an application does, Windows will decrypt the files automatically.
I've been hacking together a system on a Windows Server 2012 box, where the clients copy their documents to a directory in their own individual shares, then when done, the directories get moved to another directory not accessible to the clients. Then, later in the night, the deduplication process fires off, so for the most part, only changed in the stored documents are stored. Of course, this may not help if the malware is smart enough to do its dirty work slowly over a period of time where old backups are cycled out.
As the parent stated, probably the best way to deal with this is what the parent stated -- something like the Qubes OS project where every application not just has its own memory space, but has its own filesystem completely separate from the other programs. Add to this a backup program that pulls data from a machine (where the client can only start backups, but cannot access backed up info unless it is directly pushed from the server), and this would provide some answer to ransomware.
The scary thing: Ransomware has been around, but CryptoLocker is really the first shot across the bow that uses browser (or browser add-on) holes, Trojans, and other weaknesses to actively do its dirty work. It also is extremely well engineered where the keys are not findable once the software does its nasty deeds.
Depends on the OS. Server operating systems will have a SmartScreen filter that requests to be set up once the machine is running, and will immediately prompt if it encounters unsigned applications and disallow them to run.
This capability is present in Windows 7 and newer (AppLocker), but it isn't turned on unless someone has the "pro" version and access to gpedit.
I'm seriously in love with your sig. Thank you for making the interwebs a better place.
Chuuch. Preach. Tabernacle.
Now if we can only determine the connection between Zuckerberg and Verizon, we can blow this CryptoLocker thing wide open.
http://verizonmath.blogspot.ca/2006/12/verizon-doesnt-know-dollars-from-cents.html
Its amazing that this is the only comment that mentioned Verizon math. Maybe I'm not on the right site. This is Slashdot correct?
If Zuckerberg is 50% as sleezy as depicted in "The Social Network", ...
Not that I'm defending him, but you do know that was a Hollywood production, yes? When have that bunch *ever* portrayed an actual event with any degree approaching accuracy?
"Tongue tied and twisted, just an Earth bound misfit
Good luck fitting your laptop back in its case with the USB flash drive hanging out of it. Or do you work only with desktop users?
If the data is stored on SSD, it even is easier... just encrypt the files and force a TRIM on empty space.
Previous to this, ransomware was in the wings, but it was relatively amateurish. It used relatively small keys, or spread via a vector that was already plugged by most AV stuff. Now, with zero-days used to get the software onto machines, this is not just a threat, but a big money-maker for the bad guys.
In my residential IT practice, I have encountered users - business professionals - who insist on keeping file extensions hidden.
[Y]ou do know that was a Hollywood production, yes? When have that bunch *ever* portrayed an actual event with any degree approaching accuracy?
Primary Colors? Granted, the real Bill Clinton seems fictional.
Wag The Dog? We live that every day.
Sneakers? Surprisingly accurate about real hacking.
Max Headroom? Just around the corner...about twenty minutes from now, in fact.
Robocop? Could be shot in present-day Detroit. No need for expensive sets!
I could go on. Hollywood gets it right occasionally.
"Once we've identified and embraced our sickness, we'll have strength...and that's when we get dangerous." - John Waters
'Twas detector malfunction, please accept my apologies ;)
A successful API design takes a mixture of software design and pedagogy.
Change title from earns to extorts. It is ransomware.
The truth shall set you free!
Laptop users that I've worked with tend to use cloud backup, which I tend to encourage
Guess what a laptop user does when he runs into the cloud backup service's storage cap. He cuts down the set of folders that get backed up. Expanding offline backup capacity doesn't have an annual fee per GB like what iCloud, Dropbox, and SkyDrive charge.
I agree whole-heartedly with this.
I used to have a whole list of tweaks I would do to explorer on an XP machine to make it "ready for use". The first item on that list was to turn off Hide Extensions.
That, and show hidden files, are the only one's I still do routinely.
The first time an email cropped up exploiting the malware.jpg.exe "oo lookie, a picture" issue this (hiding information from the user) should have been dropped as the default.
Since when has hiding information ever made anything better? But what should we expect when they deciding to remove visual cues from their latest OS? Flat buttons anyone? Hidden magic corners (Linux distros jumped on board with that one too). Mobile OS's using picture buttons when you can't hover to see what it's going to do before clicking on it... but I digress
I refuse to sign