Slashdot Mirror
Malware Operator Barters With Security Researcher To Remove Open Source Ransomware Code (softpedia.com)
An anonymous reader writes: The author of the Magic ransomware strain has agreed to release all decryption keys for free if Utku Sen, a Turkish security researcher, takes down his Hidden Tear open-source ransomware project from GitHub. Sen has released multiple open source ransomware projects, which contained backdoors and encryption flaws. The flaws disrupted the plans of several ransomware operators. This particular ransomware author is Russian, while Sen is Turkish, so just like Putin and Erdogan, the two struggled to come to an agreement. Utku Sen finally agreed to take down the Hidden Tear repository in three days, while the author of the Magic ransomware will provide all the encryption keys for free for the next 15 days.
And then not take it down after they pay.
What are the going to do? Sue?
excitingthingstodo.blogspot.com
Pull it down, get the keys, put it back up... and the ransom author is screwt.
Whats the big hubub about
You know what? It doesn't matter. I'm willing to bet that there are hundreds of Hidden Tear clones on the Darknet. This is a bitchslap party between a Russian and a Turkish guy.... these two countries have hated each other since the 1700s when they started battling each other for influence in the Balkans. And after the recent jet crash disaster, they'll hate each other for a couple of more years again.
I've seen all the stuff people wish to happen to spammers. But I think ransomware operators are worse, and need to be strung up by the fucking balls.
there are 338 forks on github (not to mention other copies floating around), it's not going anywhere.
although I hope that pointing out the obvious doesn't scuttle the deal
You know you really can't take down anything from github? If it's forked, it stays there.
No truce with the shadow. No quarter with the Enemy. No peace while they draw breath.
The first project he created was named Hidden Tear, and malware operators used it to create the Cryptear.B ransomware family. Unfortunately for the malware operators, the ransomware's encryption contained an encryption flaw, left intentionally by Utku in its source code, which allowed him and other security researchers to help victims decrypt their locked files without paying the ransom.
The second project was the EDA2 ransomware, which didn't contain an encryption backdoor, but came with a fully-working C&C server admin panel, which contained a backdoor account.
This second project was used for the Magic ransomware family. The problem is that the operator of this ransomware campaign decided to host the C&C server admin panel on a free hosting provider's infrastructure. Once the hosting provider discovered what the malware operator was up to, it shut down and deleted his account, inadvertently deleting the database with all the encryption keys.
Utku Sen publicly apologized for this incident, and then removed the EDA2 ransomware project from GitHub, but with no doubt, the project is still shared via underground forums and black markets.
So this guy made an open source ransomware project on GitHub with intentional backdoors, which was then downloaded and used, and security researchers then used the backdoors to thwart the ransomers?
I am totally in awe of this person. Bravo!
It wasn't a jet crash, it was Russia deliberately ignoring repeated warnings their jet was about to enter Turkish airspace and Turkey doing what they said they would.
It is also interesting to note how certain Russia was they never entered Turkish air space and had the jet black box data to prove it, right up until the chips in the black box were, unsurprisingly, damaged and their data unrecoverable.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Yet Lenin was the one who gave about 40000 rifles and ammunition and about 200 kilograms of gold to finance the Kuva-i Milliye, the militia fighting, what was later, going to be called as Turkish Liberation War, against the mostly British, French and Greek armed forces. People making such assertions as "they hate each other since such and such time" should at least know the history a little. The reason why Russia and Turkiye is now at this impasse was because the Puppet Turkish president, with the hopes of evading equivalent of being court-marshaled and defecting to the US, is playing the hand of US administration. Yes there might be an incursion to the Turkish airspace and if so, the Turkish air forces were in their right to down that plane etc but these are not what we, the eternal people, know the real truths about. It is the Kabuki theater play put forward for the masses to believe.
__________
The more I know people, the more I love animals
Let me help you. Your tinfoil hat must have fallen off.
This is a bitchslap party between a Russian and a Turkish guy.... these two countries have hated each other since the 1700s when they started battling each other for influence in the Balkans. And after the recent jet crash disaster, they'll hate each other for a couple of more years again.
Some people I guess are just a waste of perfectly good protoplasm. Extorting money I can understand, although I don't agree with it. But life is way too short; there's something pathetic about people who can't think of better things to do with theirs than rehash some conflict from centuries before they were born.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
maybe im watered down or wiser to know to install noscript and adblock but i dont see where these infections come from...people searching for free cat screensavers, opening email atachments...i can remember being in college and curious of viruses using altavista to search for such info and sites in the uni library...there was a site if an animated volcano(iirc) with a scrolling counter of infected..presumably from visiting the site??? this was when dsl was new and cool, yet i couldnget it in my apt due to infrastrucrure issues. isnit spear phishers? darknet wanderers?
They do know that the source control on GitHub is designed to be distributed? Taking it down there won't by any means stop its ability to remain version controlled...
here ya go:
http://pastebin.com/8JjSQyhP
Enjoy
What in the world could be the point of this? Suppose the deal goes through as described. From the security researcher's perspective, the code is already in the wild, downloaded repeatedly. Could easily be forked to a new project, hosted by someone else, etc. It will be back up and online the moment he takes it down. From the malware author's perspective, if he gives up all the existing keys, he loses his current "market", but he can just change the keys, and redeploy his malware. So, the malware author gains nothing because the project will undoubtedly remain online. The security researcher gains nothing, since the malware author can just deploy a new version with different keys. So, the exchange does nothing but generate headlines. Nothing else accomplished.
There is also the NATO radar logs which prove that the plane entered Turkish air space. There is not a hope in hell that Turkey would have had full NATO backing for their actions if that data did not exist.
Unfortunately the great hopes of 25 years ago are all coming crashing down. Russian's and in particular Putin are suffering from what I call "Pershing Syndrome", that is they don't believe they lost the cold war and we will have to do it all over again.
Someone infect Putin's personal computer and let the secret police remove this stain from the population.