Slashdot Mirror
Microsoft Warns of ZCryptor Ransomware With Self-Propagation Features (softpedia.com)
An anonymous reader writes from a report issued by Softpedia on May 27: Microsoft and several other security researchers have detected the first ransomware versions that appears to have self-propagation features, being able to spread to other machines on its own by copying itself to shared network drives or portable storage devices automatically. Called ZCryptor, this ransomware seems to enjoy quite the attention from crooks, who are actively distributing today via Flash malvertising and boobytrapped Office files that infect the victim if he enables macro support when opening the file. This just seems to be the latest addition to the ransomware family, one which recently received the ability to launch DDoS attacks while locking the user's computer.
They're the king of ransomware, forcing Windows 10 installations.
Good old retro boot sector viruses.
Ice Cream has no bones.
It disguises itself as the Windows 10 upgrade notification.
and data. After twenty years of problems with code in documents, including some that would wipe-out your partition table, they still allow code in a document to execute.
Also, this might be the first malware that infected network files, but it certainly isn't the first to affect Office documents. We've been hit several dozen times.
More proof that everyone should be using an adblocker to keep their computer and friends computers safe.
Dear website owners.... WAHH about your lost revenue. start hosting the ad's on your own servers and VET THEM to be safe and not an attack vector.
Do not look at laser with remaining good eye.
This stuff is nasty.
1- Have spotless offline backups of everything
2- Lock down share permissions
3- Lock down admins on permissions domain level
4- Lock down admins on local machine level
5- Pray
I had to deal with this garbage once earlier this year on a custom domain with awful permissions management. It was bad enough from a single source\spread to shares perspective. I can't imagine the damn thing acting like a worm at the same time. Potentially career ending because 1- your enterprise gets owned so hard and 2- you never want to touch a computer again once you have to try to clean it up.
a VM can be contained pretty well. I was used to installing office on my local pc, but now I'm starting to think its going to be safer inside a VM and I'll just run the VM for the few times I have to actually edit word docs. viewing them is ok on libreoffice or similar, but I would not use the free versions to edit ms docs (sigh).
--
"It is now safe to switch off your computer."
BREAKING NEWS: Microsoft warns about a new self-installing malware called "Windows 10"
That convinced me to disable Flash forever. No way I want that kind of crap sneaking onto my PC.
not to use flash. I understand that there are many companies with a significant investment in flash-based code. But flash has proven to be a persistent security hole. HTML 5 is a viable alternative to flash. time for those companies to suck it up.
linquendum tondere
Might be easier to just install Linux.
I don't read your sig. Why are you reading mine?
Why would I want to install Linux - it's already installed and running on my machines :-)
Then why are you going full agro?
I don't read your sig. Why are you reading mine?
And end up in a situation like Android Linux, which has more malware than Windows ever had.
Wealth is the gift that keeps on giving.
Given the number of viruses out there that use Microsoft Office documents as a transmission vector, why hasn't Microsoft locked down VBA and macros so that macros in an Office document file cant do anything dangerous.
Web browsers sandbox JavaScript code these days to prevent exploits and improve security, why not do the same for Office documents?
That way, rogue macros can't download and install further malware or access data files all over the disk or mess with Windows system folders/files/data.
The issue stays the same. If you have data in the file that gets interpreted a certain way ( say, for formatting, a malformed URL, weird characters, ...), but the interpretation is buggy and prone to buffer-overflows or other when reading the wrong data, you're still at risk.
This one tries to propagate almost as hard as the Windows Update.
Past proper propagation probably plethoras of problems perceived.
They that out loud three times.
"we are all atheists about most of the gods that societies have ever believed in. Some of us just go one god further."
and data. After twenty years of problems with code in documents, including some that would wipe-out your partition table, they still allow code in a document to execute.
Also, this might be the first malware that infected network files, but it certainly isn't the first to affect Office documents. We've been hit several dozen times.
By default the latest Office programs save files in a format that prevents macros from running. You have to specifically change the file type to allow macros. When you open macro enabled office files, it will, by default, disable active content and show a warning box. You have to actually click on the box to allow macros and vbscript.
Good thing that Microsoft's strongarm tactics trying to force Win 10 upgrades resulted in some people permanently disabling Windows Update on their boxes.
Not only will those people get owned, but their machines can act as distribution centers to attack other machines, including distributing future malware even if MS releases a patch to help protect against this.
500 Rupees have been deposited into Satya Nadella's account care of the Russian malware alliance.
I'm curious, what exactly would the difference in a document be between code and data, or preferably how would your implementation look like to prevent executing malware?
Because the word processor or spreadsheet doesn't have any ability to execute anything outside of its own document?
Why the fucking fuck would a word processor or spreadsheet need to execute anything or operate in any way outside of their own document? What could possibly go wrong? Oh... wait...
In the free world the media isn't government run; the government is media run.
Have Microsoft ever considered looking at their own Source Code. Considering Microsoft is primarily responsible for the malware infestation. That would be like describing Dr. Hannibal Lecter as a food nutritionist researcher.
After twenty years of problems with code in documents, including some that would wipe-out your partition table, they still allow code in a document to execute.
Except by default "they" do not allow it. You must enable macro support after clicking through warnings. You may also download whatever binary you want and click through the warning advising you the certificate, issued to "Skripty and the Kidz" is not trusted.
The Daddy casts sleep on the Baby. The Baby resists!
At one of my clients, we use MailScanner plus clamd to scan incoming mail. Clamd has a switch to treat all Office files with macros as viruses so they get sent to quarantine. At this particular client no one has the need to exchange macro-enabled Office files so this is an effective defense. Of course, other organizations might have valid uses for such files. I'd solve that by whitelisting particular senders while continuing to ban any other macro-enabled Office documents.
At one client's site an enduser got such a document. It requested that the recipient click the button to enable active content. Of course someone did just that and promptly got infected. Now we just block all macro-enabled documents with clamd.
It's evolution in action.