Slashdot Mirror
Microsoft Warns of ZCryptor Ransomware With Self-Propagation Features (softpedia.com)
An anonymous reader writes from a report issued by Softpedia on May 27: Microsoft and several other security researchers have detected the first ransomware versions that appears to have self-propagation features, being able to spread to other machines on its own by copying itself to shared network drives or portable storage devices automatically. Called ZCryptor, this ransomware seems to enjoy quite the attention from crooks, who are actively distributing today via Flash malvertising and boobytrapped Office files that infect the victim if he enables macro support when opening the file. This just seems to be the latest addition to the ransomware family, one which recently received the ability to launch DDoS attacks while locking the user's computer.
They're the king of ransomware, forcing Windows 10 installations.
Good old retro boot sector viruses.
Ice Cream has no bones.
Microsoft and several other security researchers have detected the first Microsoft Windows ransomware versions that appears to have self-propagation features, being able to spread to other Microsoft Windows machines on its own by copying itself to shared Microsoft Windows network drives or portable storage devices automatically. Called ZCryptor, this Microsoft Windows ransomware seems to enjoy quite the attention from crooks, who are actively distributing today via Microsoft Windows Flash malvertising and boobytrapped Microsoft Windows Office files that infect the Microsoft Windows victim if he enables macro support when opening the file. This just seems to be the latest addition to the Microsoft Windows ransomware family, one which recently received the ability to launch DDoS attacks while locking the Microsoft Windows user's computer.
It disguises itself as the Windows 10 upgrade notification.
and data. After twenty years of problems with code in documents, including some that would wipe-out your partition table, they still allow code in a document to execute.
Also, this might be the first malware that infected network files, but it certainly isn't the first to affect Office documents. We've been hit several dozen times.
Does this, by chance, stop the Windows 10 "upgrade"? If so, could someone kindly direct me to a site where I can acquire this fine piece of software?
More proof that everyone should be using an adblocker to keep their computer and friends computers safe.
Dear website owners.... WAHH about your lost revenue. start hosting the ad's on your own servers and VET THEM to be safe and not an attack vector.
Do not look at laser with remaining good eye.
MS is already on the end-game push for the Windows store (RIP Windows Phone.. time to find an Android phone for me) and has already sent out ransomware/malware called the Get Windows 10 update and now calls foul? To quote Phoebe from "Friends"
"Friends: The One with All the Poker (#1.18)" (1995)
Phoebe: I just realized something. Joker is poker with a j... coincidence?
Chandler: Hey, that's "joincidence"... with a c.
Rachel: God, could you believe what a jerk Ross was being?
Monica: Oh I know he can get really competitive.
Phoebe: [laughs]
Monica: What?
Phoebe: [pretends to pick up a phone] Hello kettle? This is Monica. You're black!
This stuff is nasty.
1- Have spotless offline backups of everything
2- Lock down share permissions
3- Lock down admins on permissions domain level
4- Lock down admins on local machine level
5- Pray
I had to deal with this garbage once earlier this year on a custom domain with awful permissions management. It was bad enough from a single source\spread to shares perspective. I can't imagine the damn thing acting like a worm at the same time. Potentially career ending because 1- your enterprise gets owned so hard and 2- you never want to touch a computer again once you have to try to clean it up.
a VM can be contained pretty well. I was used to installing office on my local pc, but now I'm starting to think its going to be safer inside a VM and I'll just run the VM for the few times I have to actually edit word docs. viewing them is ok on libreoffice or similar, but I would not use the free versions to edit ms docs (sigh).
--
"It is now safe to switch off your computer."
BREAKING NEWS: Microsoft warns about a new self-installing malware called "Windows 10"
That convinced me to disable Flash forever. No way I want that kind of crap sneaking onto my PC.
not to use flash. I understand that there are many companies with a significant investment in flash-based code. But flash has proven to be a persistent security hole. HTML 5 is a viable alternative to flash. time for those companies to suck it up.
linquendum tondere
I have a permanent solution to this crap once and for all. Hunt them down, all of them, and then execute them publicly on Pay Per View. Because we're sick of this stupid shit.
I'm curious, what exactly would the difference in a document be between code and data, or preferably how would your implementation look like to prevent executing malware?
Given that this sounds like some of the propagation features of stuxnet, I'm wondering if some of it's "features' have been reverse engineered or copied into this worm. It's something I've wondered about, ever since reading about stuxnet, that the features in it would be propagated to the larger criminal world.
Given the number of viruses out there that use Microsoft Office documents as a transmission vector, why hasn't Microsoft locked down VBA and macros so that macros in an Office document file cant do anything dangerous.
Web browsers sandbox JavaScript code these days to prevent exploits and improve security, why not do the same for Office documents?
That way, rogue macros can't download and install further malware or access data files all over the disk or mess with Windows system folders/files/data.
The issue stays the same. If you have data in the file that gets interpreted a certain way ( say, for formatting, a malformed URL, weird characters, ...), but the interpretation is buggy and prone to buffer-overflows or other when reading the wrong data, you're still at risk.
This one tries to propagate almost as hard as the Windows Update.
Past proper propagation probably plethoras of problems perceived.
They that out loud three times.
"we are all atheists about most of the gods that societies have ever believed in. Some of us just go one god further."
The only "safe" way to run Microsoft software, is inside a very tightly controlled virtual machine.
-No access to hardware directly
-No access to the network - ever
-No access to more files than it absolutely needs
ie: I have a scratch USB drive that I use for any MSFT related activities. It is scanned by Linux AntiVirus, and only the files I absolutely need the MSFT software to see are present.
That way, the MSFT software can not corrupt my files with its Digital-Restrictions-Management, or any other malware.
MSFT Software runs great, I'd say even better on a virtual machine, than native hardware. MSFT deals much better with a simplified hardware model than it does with real hardware. Sound works, video works, suspend and sleep even work!
Since the hardware is much simpler, windows driver updates don't break the hardware.
There is no real BIOS for MSFT to corrupt, no disks that it can break, etc.
From TFA:
Given the underhanded tactics already employed by Microsoft, one can't help but wonder...
and data. After twenty years of problems with code in documents, including some that would wipe-out your partition table, they still allow code in a document to execute.
Also, this might be the first malware that infected network files, but it certainly isn't the first to affect Office documents. We've been hit several dozen times.
By default the latest Office programs save files in a format that prevents macros from running. You have to specifically change the file type to allow macros. When you open macro enabled office files, it will, by default, disable active content and show a warning box. You have to actually click on the box to allow macros and vbscript.
Good thing that Microsoft's strongarm tactics trying to force Win 10 upgrades resulted in some people permanently disabling Windows Update on their boxes.
Not only will those people get owned, but their machines can act as distribution centers to attack other machines, including distributing future malware even if MS releases a patch to help protect against this.
500 Rupees have been deposited into Satya Nadella's account care of the Russian malware alliance.
I'm curious, what exactly would the difference in a document be between code and data, or preferably how would your implementation look like to prevent executing malware?
Because the word processor or spreadsheet doesn't have any ability to execute anything outside of its own document?
Why the fucking fuck would a word processor or spreadsheet need to execute anything or operate in any way outside of their own document? What could possibly go wrong? Oh... wait...
In the free world the media isn't government run; the government is media run.
Have Microsoft ever considered looking at their own Source Code. Considering Microsoft is primarily responsible for the malware infestation. That would be like describing Dr. Hannibal Lecter as a food nutritionist researcher.
Direct Download from official site:
http://download.bitdefender.co...
It may not stop ALL ransomware, but it receives updates and protects against some of them. The link above will probably remain the same throughout new versions/updates. It will launch and appear in your tray once you install and reboot your computer. I like it, it's simple and free(ware). I wish it was open source though.
After twenty years of problems with code in documents, including some that would wipe-out your partition table, they still allow code in a document to execute.
Except by default "they" do not allow it. You must enable macro support after clicking through warnings. You may also download whatever binary you want and click through the warning advising you the certificate, issued to "Skripty and the Kidz" is not trusted.
The Daddy casts sleep on the Baby. The Baby resists!
At one of my clients, we use MailScanner plus clamd to scan incoming mail. Clamd has a switch to treat all Office files with macros as viruses so they get sent to quarantine. At this particular client no one has the need to exchange macro-enabled Office files so this is an effective defense. Of course, other organizations might have valid uses for such files. I'd solve that by whitelisting particular senders while continuing to ban any other macro-enabled Office documents.
At one client's site an enduser got such a document. It requested that the recipient click the button to enable active content. Of course someone did just that and promptly got infected. Now we just block all macro-enabled documents with clamd.
It's evolution in action.