Slashdot Mirror
Ransomware Creator Apologizes For "Sleeper" Attack, Releases Decryption Keys
colinneagle writes: Last week, a new strain of ransomware called Locker was activated after having been sitting silently on infected PCs. Security firm KnowBe4 called Locker a "sleeper" campaign that, when the malware's creator "woke it up," encrypted the infected devices' files and charged roughly $24 in exchange for the decryption keys. This week, an internet user claiming to be the creator of Locker publicly apologized for the campaign and appears to have released the decryption keys for all the devices that fell victim to it, KnowBe4 reported in an alert issued today. Locker's creator released this message in a PasteBin post, along with a link to a file hosted on Mega.co containing the decryption keys. The malware creator also said that an automatic decryption process for all devices that were affected by Locker will begin June 2nd.
However, the post did not mention anything about providing a refund to victims who paid the 0.1 bitcoin (equal to $22.88 at the time this was posted and about $24 last week) required for the decryption keys since last week. KnowBe4 CEO Stu Sjouwerman says the files released do not appear to be malicious after brief analysis, and that "it does contain a large quantity of RSA keys and Bitcoin addresses." But he warned those interested to only open these files "at your own risk until further analyses are performed." Sjouwerman speculated that the malware creator may have been spooked by attention from law enforcement or Eastern European organized crime syndicates that are behind most ransomware campaigns.
However, the post did not mention anything about providing a refund to victims who paid the 0.1 bitcoin (equal to $22.88 at the time this was posted and about $24 last week) required for the decryption keys since last week. KnowBe4 CEO Stu Sjouwerman says the files released do not appear to be malicious after brief analysis, and that "it does contain a large quantity of RSA keys and Bitcoin addresses." But he warned those interested to only open these files "at your own risk until further analyses are performed." Sjouwerman speculated that the malware creator may have been spooked by attention from law enforcement or Eastern European organized crime syndicates that are behind most ransomware campaigns.
That's better service then a lot of companies I intentionally do business with.... What's the would come to?
Strangely enough, you need someone very honest to "refund" anything via Bitcoin because he has to send the coins back himself, there's no "return/refund" mechanisms.
So, all we can say is that guy is a "really honest crook", as strange and contradictory as it seems.
Get free satoshi (Bitcoin) and Dogecoins
testing by slashdot engineer
Simply having skills isn't enough anymore. There's not enough jobs and companies want to pay less for the same jobs every year.
Get free satoshi (Bitcoin) and Dogecoins
Just so you know, the average malware jockey makes money that makes me wonder why I remain on this side of the fence. So much for "getting a good job that pays well".
Don't worry. He already has one.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
My stepdad was hit by one of these a who months ago (incidentally, I can't believe he fell for it - he isn't sure how he got it, but he's a super-techie, it's surprising he both somehow installed such nasty nalware, and also didn't have any recent backups of important files). Anyway, they asked for 500 bucks (he paid it, sadly, not that I necessarily blame him). $22.88... doesn't seem like a lot of money. I'd pay that without even thinking, if I were hit with it. $500 bucks I'd have to think more about.
Was a wrench involved in getting him to release them?
Simmer down, champ.
Feel better now?
Do you really think someone who makes a living out of blackmailing the technically illiterate would be in any way chastened, or even bothered by your blustering?
Right? That's what I fucking thought.
Did you sit there very long, with the cursor blinking, waiting for a response?
Right there with ya. I'm a software developer and system administrator...It'd probably take me a month or so to read up on malware techniques and come up with a delivery mechanism and a way to do distributed CNC via RSA or PGP key.
Still on this side of the fence. But I'm watching the other side carefully.
Bits of code, random ramblings: jakimfett.com
Honestly, it's a social skill - it requires communicating the user, or at least knowing what users want.
If you know how to do SEO, the absolutely easiest way to infect someone is offering free downloads of some commercial app. Like Office, Photoshop, even Windows. Or the keygens to it. The most common way is to wrap the keygen with your downloader so the user runs the wrapped app which then silently downloads malware while running the real keygen.
Until Google started censoring the results, you could type an app's name and the first few results would be "cracks" "keygen" "download" and "warez".
Hint: This applies for smartphone apps too. People are cheap. If they can save $1, they'll try.
Is that you Phil Sturgeon?
Do you even lift?
Don't the malware junkies make more money selling the patterns to the anti-malware firms on the side?
I mean, who buys Kaspersky if nobody gets paid to create the malware and Windows and Mac have "good enough" security?
Creating a market for malware is what keeps malware coming.
>>"ad space available -- low rates!!!"
Press any key to continue ...
Or any other U.S government for that matter. I think not.
My machine was hit by this ransomware and I got lucky enough to be doing something when it happened so I had the process suspended two minutes into the attack. Only about 30 of my actually useful files were hit with most of it just being a bunch of old unneeded data.
So when he released the keys and the rules to unencrypt them I found my key in the list, based on the data saved on the machine for exactly that purpose in case I purchased. This was both the bitcoin address I should have paid through and an XML copy of the public key.
I then threw together a quick C# program to unencrypt the files using the method he mentioned and it worked fine and I was able to recover all the files I wanted to get back.
Another user had a symbolic link issue that caused the ransomware program to chain encrypt a file almost 50k times and was able to chain unencrypt it using a program someone else wrote. He even turned out to be telling the truth about the ransomware unencrypting the files for free on June 2nd.
http://www.bleepingcomputer.com/forums/t/577246/locker-ransomware-support-topic/page-37
Perhaps the author created this for someone else and either didn't get paid for his work, or wasn't getting his cut.
Erh... detach yourself from the idea that malware is something some pimple faced 17-27 year old does in his mom's basement. Malware is a business. And of course with the relevant staff.
In other words, distribution is not your concern when you're a programmer. That's what marketing is for.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Don't worry. I've been in that business for a while. Trust me, there is no reason to create malware. Why bother? It's done for you. For free. Because they have a business model as well.
Quite seriously, even if you don't "trust" anti-malware companies to not create them themselves, simply follow the laws of the market: Why create a disease if it exists anyway? Why bother wasting money on something that is done for you without your intervention? It's like saying, I dunno, mobile home vendors are behind tornados in Kansas. Why the fuck bother, these things come themselves, no need to do anything. It happens. Free of charge.
That some vendors of AV kits go and blow every minor, insignificant malware release out of proportion and predict falling skies if we don't immediately buy their latest and greatest is another thing. Think of it as the computerized version of the Swine Flu.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.