Slashdot Mirror
Jigsaw Ransomware Deletes Your Files If You Don't Pay Or When You Reboot Your PC (bleepingcomputer.com)
An anonymous reader writes: Researchers found a new ransomware yesterday called Jigsaw which will first lock your files and ask for a 0.4 Bitcoin ($150 USD) payment. If users don't pay, every hour the ransomware deletes your files. If the user restarts their PC, the ransomware also deletes 1,000 more files. The good news is there's a free Decrypter available to unlock the ransomware. The Decrypter was built by Michael Gillespie, who announced yesterday on Softpedia the ID Ransomware service, which tells infected victims what kind of ransomware infection they have by allowing them to upload an encrypted file and the ransom note.
I have to wonder what would happen if you just kept turning the clock back on your computer every 45 minutes... I guess it depends on how lazy the programmer was.
Anecdote: I recently had a WIndows Auto-update give me the choice between now and in 10 minutes for an update. I wanted to watch a movie online so I set the clock back serveral hours.
It's not mentioned in the summary, but if you take the time to RTFA (Yes, I know this is Slashdot, but still...) you'll find that this is Windows specific. That's not to say that an infection can't be devastating, or that people using Windows deserve what they get, it's just making note of the fact that those of us who don't use Windows don't need to worry about it.
Good, inexpensive web hosting
What does someone like me that never jumped on the Bitcoin hype do? Just write the computer off as a lost cause?
-=This sig has nothing to do with my comment. Move along now=-
Before they start preventing downloads/disabling USB and allowing access to any website other than Bitcoin buying and their payment page.
Is this ransomware named after the antagonist in the movie "Saw"?
If so, maybe we're seeing a new trend of naming viruses after movie villains, and they might even share some characteristics!
I'm hanging out for the Mugatu virus.
Some people are true assholes, poor fucking users who run into this. Imagine what will happen in the future, with self driving cars and somebody figuring out a way to take over and not let you out of the car until you pay, but if you don't pay within a time limit they will crash your car, drive it off a cliff or something...
Security needs to become part of culture, but with people sharing every bit of their lives on sites like FB, etc., with people not caring about NSA stealing their data... I don't know, there will be deaths because of this eventually. System security has to become central when relying on more and more computers and robots, drones, it has to be done.
You can't handle the truth.
When someone finally finds the people who write and extort with this kind of ransomware, they should slowly and painfully delete body parts one by one until they pay up...
Bitcoin... That's sounds an awful lot like cash. Cash is by far the preferred choice of payment by criminals worldwide should we ban that too?
Minimum threshold fixed. Thanks!
This might be a good time for Windows users to discover an open source operating system. I use OpenBSD on all of my systems and I am not vulnerable to shit like this.
This might be a good time for Windows users to discover an operating system that nobody uses and doesn't get attention from exploiters. -fixed that for you.
"Cash is by far the preferred choice of payment by criminals worldwide should we ban that too?"
Has there ever been a single instance in the wild of ransomware for cash? Kidnapping for ransom died out in the US because of the increasing difficulty of making a cash drop. I predict that we are about to see kidnapping come back into style, for Bitcoin.
Cash is by far the preferred choice of payment by criminals worldwide should we ban that too?
At some point, that will probably happen.
I don't care if it's 90,000 hectares. That lake was not my doing.
Some variants of ransomware erase backup drives and cloud backups/network shares.
The real way to solve the problem isn't just having more data for ransomware to encrypt or destroy. Work on pull based backups, such as Windows Home Servers, Microsoft DPM, NetBackup, or some other mechanism. Preferably something that can use SSH or an existing known good protocol for security. This way, one of the worst things that malware can do is output garbage and try to fill up the backup server's hard disks with stuff from /dev/urandom. If QNAP or Synology adds deduplicating backups to their units in a way that home users could just "set and forget" until needed, this would be a major step in mitigating ransomware attacks.
Problem is that ransomware preys on the fact that people tend to not bother with backups, and that the backup methods used these days are absolute shit and vulnerable to a "rm -rf". In the past, desktop computers would be backed up to tape, and with basic common sense, setting read only switches and backup rotations, it would be virtually impossible for stashed data to be corrupted. However, with both tape and optical drives not updated to handle modern capacity, coupled with the "just stash it on the cloud", it is no wonder why ransomware has such easy pickings on the home, SOHO, SMB, and even the enterprise level.
As a stopgap, one can always back up to a network share, then have the share backed up, so if the share is trashed, it can be restored. However, the real ideal is pulling data from clients.
After deciding on different means, since a pull based backup isn't feasible without enterprise backup software, what I do is a dual stage process. First stage, is to have Veeam dump my Windows box to a NAS with RAID 1. Then, the NAS then backs the shares it has to an external HDD. This way, if something destroys a share from a PC, it can be reloaded from the external HDD.
Eventually, I plan to get another NAS whose sole function in life is to store backups (with RAID) from the "front-line" NAS models. Since the backend NAS isn't touching client PCs in any way, shape, or form, it should be fairly resistant to all but the most sophisticated ransomware.
It doesn't hurt to burn critical data to a BD-R drive either.
It's called a mugging "Give me cash or I delete your kidney"
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"
This might be a good time for Windows users to discover an operating system that nobody uses and doesn't get attention from exploiters. -fixed that for you.
Windows is just a poor proprietary client for a Linux world
Mugging is an extremely dangerous business. Ransomware is mostly safe.
TPTB are working on it right now. Mario Draghi of the ECB is advocating the discontinuation of the 500 Euro note and economists like Larry Summers in the USA want to ban the $100 bill. There is also talk of banning all large cash transactions. Government obviously wants to track ALL of your financial activity.
The bankers want to ban cash so they can set a negative interest rate. People will have to pay to keep their money in a bank, and without cash, there will be no recourse. They also want deposits to be treated like any other liability for the financial institutions. Liabilities that can be "restructured" in the event of the company filing for bankruptcy. i.e. the bank takes your money and gives you shares of stock in a new "recapitalized" bank.
We can't allow that to happen. Use cash!
There could be a little truth in that, but no OS make the same mistake of letting the sender of a file decides what is executable or not (sender call it .exe or .scr and it is executable). Only Windows allow the sender to define what icon will be show for a file (sender embed a Word document icon to an executable and that is shown).
There are many ways to make phishing at non Windows users, but then some kind of vulnerability must be used (when opening a document), not a simple stupid trick of sending an executable and people confusing it for other thing. I think the most common one
Not really. In Linux it's pretty easy to get a random user to run a random script. You just have to tell the user why'd they want to.
Wasn't there recently a case where a botnet was shut down of Linux users? Sure it was only 2000 machines, but still - 2000 people installed it.
The real reason is easy - software piracy. it's why Windows is usually attacked first - it has one of the largest proprietary software bases out there, so there are plenty of people looking for cracks, keygens, and downloads that you could apply a simple downloader wrapper to and infect them. It's easy.
OS X comes next - smaller base, but still, a bunch of people looking to get paid software for free.
Ditto Android, again, lots of people don't want to pay 99 cents for apps, so they pirate it and get all sorts of data stealing crap installed on their phones. Yes, you can stick with Google Play, but some people will just pirate software.
Linux is last, because there isn't that much proprietary software for it right now. There's some, but not much. What usually infects them are pirated Wordpress themes since most Linux installations are server based. But if the popularity of SteamOS and such increases to the point where there's a decent selection of games, expect Linux to be a sharply rising target. (At least, if gamers on Linux are like their Windows counterparts where it's mostly pirated and thus a very handy way to infect a computer).
Here's a hint: type Alt-F2, type "bash" there, and open a shell. Now, type {...}
Such a simple and straightforward procedure !
I wonder why everybody is complaining about Linux being hard to adapt to...
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
The Decrypter might recover files that weren't on the last known good backup (which, for the average Windows user, probably is the reinstall media). Save them on something, then do a full install.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
This is exactly why I run an autobackup of all my files to separate backup files every single night. The most I would ever lose is 24 hours of data.
This is 2016, folks. Ransomware shouldn't even be a blip on anyone radar by now.
Given that modern ransomware actively seeks out file shares and removable disks to prevent this kind of easy recovery, I'm curious to know what backup mechanism you're using. And also how far back that backup goes. Another strategy these things use (or could potentially use) is to encrypt things slowly over a long period of time so the backups are chewed up as well unless you're regularly taking snapshots onto read-only media or some kind of versioned filesystem.
I know that I shouldn't be explaining my joke, but I was sarcastically referring that your "in linux, it's also possible to do lots of dammage without being root" instructions are nearly as complicate as the copy-pasta troll that was once popular on /. about the difficulty to get Quake running with openGL in Linux.
(As opposed to Windows where such breakage happens almost entirely alone, without nearly any user intervention required).
Consider it as a variant of the "Does virus {NAME} runs under Wine? Nope? Exactly what I though: yet another part of the Windows experience we can't join..." joke.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]