Slashdot Mirror
Badly-Coded Ransomware Locks User Files and Throws Away Encryption Key (softpedia.com)
An anonymous reader writes: A new ransomware family was not tested by its developer and is encrypting user files and then throwing away the encryption key because of an error in its programming. The ransomware author wanted to cut down costs by using a static encryption key for all users, but the ransomware kept generating random keys which it did not store anywhere. The only way to recover files is if users had a previous backup. You can detect it by the ransom message which has the same ID:qDgx5Bs8H
So it's like the old fashion viruses that actually cause damage to your system then.
If the author decided on an open source project, the community could have found and developed a fix during beta testing.
I always thought we should lock up those bastards and throw away the key. Shall we take it as a recommendation how he wants to be treated when we catch him?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Disasters Usually Motivate Backups
== Jez ==
Do you miss Firefox? Try Pale Moon.
The malware producers release the keys mostly, because people that are infected hear about that and are more willing to pay up...
Get a virtual machine up and running or an older MacBook off eBay and it does Internet and all downloads.
Any crap needs to be isolated to the VM or email machine.
Nope, apparently they do give you the decryption key, once you pay. If word of mouth was that it doesn't help to pay, then a lot less people would pay the ransom.
So this guy is destroying a very lucrative business model for some very evil people. It will probably not end well for him.
For optimal software testing, you need several types of testers.
The dev - Someone who knows how to code and what this software is supposed to do, and intimately.
The hacker - Someone who knows how to code, and doesn't care what the software wants because dammit, he's going to make it dance a frigging jig for giggles.
The user - Doesn't know coding, but knows the subject the software is based around because he's the one that uses it. He knows exactly what it needs to do and what he wants it to do and will gladly tell you how you are failing in that.
The ignorant - Can't code, doesn't want to, isn't sure if this computer thing is actually filled with enslaved magic pixies. If there's anyone that will do something no intelligent rational person will ever think of, the ignorant is king. You'd be amazed how many show-stopper bugs have been found by them.
This is why we can't have nice hostages.
Now that we've decided to help bug-fix ransomware, anyone consider its usability?
"Once launched with administrator privileges, the Trojan loads into the memory of its process files containing cybercriminals' demands:"
In other words, it probably goes something like this:
% tar -xf "ransomware-dontrunme-whatareyouanidiot?.tar" ./configure > /dev/null 2>&1
/dev/null 2>&1
/dev/null 2>&1
./runransomware
% cd ransomware-dontrunme
%
% make >
% make install >
%./runransomware
Error: Permission denied. Please run as root.
% sudo
Password:
Segfault in libc.so. Please reinstall.
Followed by much sighing, and trying to google what the problem is.
See, this is the problem with the Linux desktop. Even installing malware is just too darned complicated.
And how exactly does someone get infected with this anyhow? According to your link: "The malware requires administrator privileges to run and, presumably, a sysadmin who would allow for such a program to run unbridled." There's no mention on that page, or the "Dr. Web" page it links to, how anyone actually gets infected with this thing other than somehow getting themselves a copy and then intentionally running it as root. If there is an infection path it takes in the wild, these pages aren't specifying.
It's also mentioned that it works on systems running MySQL and Apache. Who runs Apache any more? Every serious Linux webserver is running Nginx now.
Finally, you're comparing apples to oranges. The Windows malware is for desktop and/or server Windows. The Linux malware appears to only be targeted at webservers. I don't know about you, but I don't run a webserver; for my websites I just use simple shared hosting and let someone else worry about that stuff (if my web host gets infected, no big deal, I'll just reload from backups). I'm worried about my desktop (/laptop) PCs, but since I run Linux there, I don't have to worry about any *serious* malware threats. No one has yet proven that there is any *serious* malware threat for desktop Linux.
A malware app that someone has to be dumb enough to manually install is one thing, getting infected with something because your web browser or your email program is vulnerable is another. Most of the Windows malware I've heard about doesn't require someone to manually install software, it's as easy as clicking on the wrong link in IE.
Also, a lot of Windows malware seems to thrive because Windows is homogeneous. Remember that Lenovo malware that was (still is I think) baked into their laptops' BIOS, and would replace a critical Windows system DLL? That stuff only works because Windows is so uniform. If someone has Windows 8.1 installed, then you can count on that DLL being there, and you can count on being able to replace it with a modified DLL and have things work out the way you expect. This just isn't the case with Linux: every distro is different, files are in different places, files are not binary compatible (you can't just take libfoo.so.4.2.1.0 from Ubuntu and drop it into an Arch install and expect it to work), distros change versions every 6 months (so libfoo.so from Mint 17 is incompatible with libfoo.so from Mint 17.1), systems don't even use the same init system and low-level utils (Ubuntu and Mint still use upstart, Slackware still uses sysvinit), etc. Everything works fine because of package management and distros building everything all together at once, but malware expecting to monkey with the internals simply won't work because there's too many variables.
Yes, if someone distributes some Linux dancing-monkey malware, there's nothing you can do to prevent people from being stupid and installing it, but I haven't heard about this attack vector being a serious problem on *Windows* for a long time. Even the Windows users aren't that naive any more; they've had this stuff drilled into their heads for years. They're getting infected in other ways.
What the hell is wrong with people like you? It's not that the guy isn't a first class cunt, but what sort of poorly controlled emotion causes a person to warm to the idea of torture and death? I sometimes wonder whether some humans have a repressed bloodlust and they use righteous indignation as an excuse to bring it out.
Sure, lock the guy up, seize everything, whatever, following due process. Be more civilised than he is, not less.
You're really one tough old guy, JustAnotherOldGuy.
If you choked on your bagel tomorrow, I wouldn't give a shit