Slashdot Mirror
New Crypto-Ransomware Encrypts Video Game Files
An anonymous reader writes A new piece of ransomware that (mis)uses the Cryptolocker "brand" has been analyzed by Bromium researchers, and they discovered that aside from the usual assortment of file types that ransomware usually targets, this variant also encrypts file types associated with video games and game related software. It targets files associated with single-user games Call of Duty, Star Craft 2, Diablo, Fallout 3, Minecraft, Half-Life 2, Dragon Age: Origins, The Elder Scrolls and specifically Skyrim-related files, Star Wars: The Knights Of The Old Republic, WarCraft 3, F.E.A.R, Saint Rows 2, Metro 2033, Assassin's Creed, S.T.A.L.K.E.R., Resident Evil 4, Bioshock 2; and online games World of Warcraft, Day Z, League of Legends, World of Tanks, and Metin2. Here's the Bromium Labs report.
Targeting files that can easily be replaced by exactly the same means that they were gotten in the first place doesn't seem like a super brilliant move.
All of these crypto ransomware things are actually a plot to make people associate "encryption" with something bad, so that people will stop using things like encrypted-by-default phones.
apparently already blocks this Teslacrypt variant. Finding niches in the world to exploit becomes a sport it seems, I wonder what the next niche will be. I will be busy asserting my Linux security in the meanwhile.
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd
As long as it doesn't affect DOOM. And by that I mean the original, which I'm still playing after 2 decades.
If telephones are outlawed, then only outlaws will have telephones.
At least I'll be able to keep playing Dwarf Fortress and NetHack for another 10mins, until I die. Again.
YASD.. fun!
Betcha their ransom pay rate is way higher with gamers. Smart move, fuckers...
Physics is nothing like religion. If it was, we'd have an easier time trying to raise money!
So long as they leave Sniper Elite 3 alone, I'm safe.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
While all the game files download again.
It targets files associated with single-user games Call of Duty, Star Craft 2, Diablo, Fallout 3...
Seriously Diablo?? WTF is that a typo and supposed to be DIablo II or 3, are people still playing single player Diablo, a few years back I installed it in a VM to get some nostalgic gameplay and it was horrible.
Are they a venture backed startup full of bronies?
You can tell how powerful someone is by the magnitude of the crime they can commit and be able to get away with.
Yes, but compared to what EA did to the game, it causes hundreds of dollars in improvement.
Nobody is going to pay to get their saved game data back. Plus gamers have no money,.
only if you type in swear words.
So how does the whole per-file random AES key work? Since they're only shipping over the one 'key' parameter, the individual file keys have to be somehow deterministic right?
Your hair look like poop, Bob! - Wanker.
out of all the games listed, that's the only one I actually play!
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
> Gosh. Javascript and Flash. Two great tastes that broke the web together.
but doesn't WoW and all MMO games save all character data on the server?
It says this malware refuses to do anything if it detects VM. How to make my computer look like a VM?
My first guess is install vmware tools so it looks like a guest os?
I have actually wondered why they wouldn't check for things like that and use them as an attack vector for the host computer.
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
I mean it isn't like it is an online game where Blizzard stores all your character data, key settings, macros and other stuff on the server! Oh, wait, yes it is.
Seriously, why would they do WoW? You just run a repair in the Blizzard client, redownload any mods, and you are up and running. They do it so you can easily play on multiple computers.
Looking at the Bromium report, it appears that it's checking for various drivers that Vm programs would typically install as part of their guest tools. It looks like if you were to install something as simple as the VMware mouse driver it would think you're in VMware. It also checks for Fiddler so you could simply install that.
Gotta give them credit, that's clever.
Ferret
Sic gorgiamus allos subjectatos nunc
It targets files associated with single-user games Call of Duty, Star Craft 2, Diablo, Fallout 3...
So this is how Tristram falls...
Nothing posted to
If it got installed in the first place, the damage is already done. It won't decrypt files on the way out of its own accord or via forced removal.
Life is not for the lazy.
I wonder if Valve will expand the Steam Cloud in response. Steam already warns you on game launch if your savegames don't match what's in the cloud so broken savegames can be recovered as long as you don't sync. The flaw in that is that syncing happens whenever you exit the game so you'd have to force-kill Steam if you notice that everything is corrupt. (Perhaps this only applies if your game actually saved something but some games are very save-happy.)
If Valve adds a simple versioning system, even if it just offers the current version and the one before that, crypto-ransomware will become completely useless against Steam titles.
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
For you and me, this is a non-issue. Games are supposed to be fun. For my roommate who's a real achievement/gamerscore whore, I'd have to hear him bitching about him having to re-do all the back-bending he's done to get those obscure achievements. He goes after these things like he's actually making money off of them, instead of realizing that it's sucking his wallet and soul dry. For people like that, games are work; while they'll say they're having fun, their attitude doesn't show it one bit.