Slashdot Mirror
Ransomware Creator Apologizes For "Sleeper" Attack, Releases Decryption Keys
colinneagle writes: Last week, a new strain of ransomware called Locker was activated after having been sitting silently on infected PCs. Security firm KnowBe4 called Locker a "sleeper" campaign that, when the malware's creator "woke it up," encrypted the infected devices' files and charged roughly $24 in exchange for the decryption keys. This week, an internet user claiming to be the creator of Locker publicly apologized for the campaign and appears to have released the decryption keys for all the devices that fell victim to it, KnowBe4 reported in an alert issued today. Locker's creator released this message in a PasteBin post, along with a link to a file hosted on Mega.co containing the decryption keys. The malware creator also said that an automatic decryption process for all devices that were affected by Locker will begin June 2nd.
However, the post did not mention anything about providing a refund to victims who paid the 0.1 bitcoin (equal to $22.88 at the time this was posted and about $24 last week) required for the decryption keys since last week. KnowBe4 CEO Stu Sjouwerman says the files released do not appear to be malicious after brief analysis, and that "it does contain a large quantity of RSA keys and Bitcoin addresses." But he warned those interested to only open these files "at your own risk until further analyses are performed." Sjouwerman speculated that the malware creator may have been spooked by attention from law enforcement or Eastern European organized crime syndicates that are behind most ransomware campaigns.
However, the post did not mention anything about providing a refund to victims who paid the 0.1 bitcoin (equal to $22.88 at the time this was posted and about $24 last week) required for the decryption keys since last week. KnowBe4 CEO Stu Sjouwerman says the files released do not appear to be malicious after brief analysis, and that "it does contain a large quantity of RSA keys and Bitcoin addresses." But he warned those interested to only open these files "at your own risk until further analyses are performed." Sjouwerman speculated that the malware creator may have been spooked by attention from law enforcement or Eastern European organized crime syndicates that are behind most ransomware campaigns.
That's better service then a lot of companies I intentionally do business with.... What's the would come to?
Thanks, buddy, but I don't need your fucking keys. I don't stick my electronic dick into every fucking Internet outlet, so I don't get fucking viruses like fucking average fucking joe. Take your fucking keys, print them out on thick card stock, soak them in petrol, stick them far far up your asshole, then go smoke some cigs, you fucking ignorant piss-stained teen bitch script-fuck. I shit more interesting solutions than whatever fucking cracks you simpleton coders conjure up in your wildest fucking dreams. Fucking douchbags. When you get some *real* skills, then try getting a good job that pays well. Let me guess, too fucking hard for you. Right? That's what I fucking thought. You're fucking dismissed now, to fuck off in new exciting ways!
This is the NSA, we're gonna geet U h@x0r5! Also, what is a h@x0r5?
Strangely enough, you need someone very honest to "refund" anything via Bitcoin because he has to send the coins back himself, there's no "return/refund" mechanisms.
So, all we can say is that guy is a "really honest crook", as strange and contradictory as it seems.
Get free satoshi (Bitcoin) and Dogecoins
testing by slashdot engineer
My stepdad was hit by one of these a who months ago (incidentally, I can't believe he fell for it - he isn't sure how he got it, but he's a super-techie, it's surprising he both somehow installed such nasty nalware, and also didn't have any recent backups of important files). Anyway, they asked for 500 bucks (he paid it, sadly, not that I necessarily blame him). $22.88... doesn't seem like a lot of money. I'd pay that without even thinking, if I were hit with it. $500 bucks I'd have to think more about.
Was a wrench involved in getting him to release them?
Thank you for your interest in joining the GIMP Windows Advertisers of DICE* (GimpWAD)! GimpWADs worldwide are happy that you'd like to become part of our
constantly enlarging member ship (come sail away 8======D~)
Unlike other geek fraternities that you might have heard about, GimpWAD accepts members of all races, creeds, and colors. We don't even have a technical inclination requirement. As our founders stated in the Annals of GimpWAD, Chapter 1: "You don't have to be a geek, as long as you like it Greek." They were, of course, referring to the penis in anus style of sexual relations. Don't despair, as attaining full fabulous lifetime status in GimpWAD is easy. The only prerequisites for membership in Gay Wigger Association of DICE* are that you meet all of the following conditions:
To submit your Gay Wigger Association of DICE* Membership Application, simply do nothing. Congratulations, you're now a GimpWAD!
If you require a specific membership number for purposes such as framing, docking, or prestigious inclusion upon your business cards and resume, please take down this number: 69.
Optionally, you may complete the following survey by replying to this post, indicating affirmative responses with an X in each appropriate box:
GimpWAD Membership Survey (OPTIONAL)
[ ] I am gay
[ ] I am a wigger
[ ] I have used SLASHDOT VIDEO to find a sex partner
After completion of this optional survey, your Slashdot post ID shall serve as your unique Gay Wigger Association of DICE* membership ID.
Your GimpWAD membership kit** is on its way.
* GimpWAD is neither affiliated with nor endorsed by DICE.COM.
** GimpWAD membership kit no longer includes HIV self-test catheter.
Press any key to continue ...
Or any other U.S government for that matter. I think not.
My machine was hit by this ransomware and I got lucky enough to be doing something when it happened so I had the process suspended two minutes into the attack. Only about 30 of my actually useful files were hit with most of it just being a bunch of old unneeded data.
So when he released the keys and the rules to unencrypt them I found my key in the list, based on the data saved on the machine for exactly that purpose in case I purchased. This was both the bitcoin address I should have paid through and an XML copy of the public key.
I then threw together a quick C# program to unencrypt the files using the method he mentioned and it worked fine and I was able to recover all the files I wanted to get back.
Another user had a symbolic link issue that caused the ransomware program to chain encrypt a file almost 50k times and was able to chain unencrypt it using a program someone else wrote. He even turned out to be telling the truth about the ransomware unencrypting the files for free on June 2nd.
http://www.bleepingcomputer.com/forums/t/577246/locker-ransomware-support-topic/page-37
Perhaps the author created this for someone else and either didn't get paid for his work, or wasn't getting his cut.