Slashdot Mirror
New Ransomware Written Entirely In JavaScript (scmagazine.com)
An anonymous reader writes: Security researchers have discovered a new form of ransomware written entirely in JavaScript and using the CryptoJS library to encode a user's files. Researchers say the file is being distributed through email attachments, according to SC Magazine, which reports that "Opening the attachment kicks off a series of steps that not only locks up the victim's files, but also downloads some additional malware onto the target computer. The attachment does not visibly do anything, but appears to the victim as a corrupted file. However, in fact it is busy doing its dirty work in the background. This includes deleting the Windows Volume Shadow Copy so the encrypted files cannot be recovered and the ransomware is set to run every time Windows starts up so it can capture any new information."
"It's a little bit unusual to see an actual piece of ransomware powered by a scripting language," one security executive tells the magazine, which suggests disabling e-mail attachments that contain a JavaScript file.
"It's a little bit unusual to see an actual piece of ransomware powered by a scripting language," one security executive tells the magazine, which suggests disabling e-mail attachments that contain a JavaScript file.
https://it.slashdot.org/story/...
Why do browsers and email programs have -any- access to anything? Sandbox the fuckers and call it a day. The fact that they aren't is a sign that companies aren't concerned enough about the problem.
Bye!
What has it been, maybe three decades of this kind of thing? At some point, do we expect people to develop enough technical literacy to avoid this kind of problem?
Note that I'm not saying it is the user's fault. It is the fault of the people writing the ransomware, pure and simple. But it's like walking through the bad part of Philly at night flashing bling all over and being visibly drunk. Yes, it's the muggers fault when you get mugged... but it is still worth pointing out that maybe your choices made your risk be higher than it had to be.. That is not "victim blaming". It's victim helping.
Since malware has been around for a long time, it's pure wishful thinking to imagine it's going away any time soon. So, you have to protect yourself.
Running executable and/or scripted email attachments from NigerianPrice204@notmalware.ng or ThisIsBeckyFromAccounting@No.Really is not how you protect yourself. It's been 30+ years of this. The details change, but the problem remains. Maybe it's time for people to start learning.
there are more and more internet users every day, not everyone knows not to open that .js email attachment
Can someone please just kill the damn shit already? Javascript has always been shit and will always be shit. People who write javascript are shit and will always be shit.
Support your local school shooter, give them your firearms.
A Star Trek actor died, and there's no post?
Did you submit a story about it? That's how Slashdot works...
#DeleteChrome
But does it run on Linux?
Looks like JScript (Windows only).
I don't read your sig. Why are you reading mine?
... of doing something like this in JavaScript if it isn't even going to be cross platform?
File under 'M' for 'Manic ranting'
Surely Javascript gets sent to the browser. And doesn't the browser prevent it accessing the file system?
Some drink at the fountain of knowledge. Others just gargle.
So ... stupid question, what's stopping people from obtaining the ransomware, and messing around with it, modifying it?
If you believe in privacy, and believe you have "nothing to hide" at the same time, you're a goddammed idiot
That's it, I'm calling for the arrest of *all* JavaScript developers. Haven't we suffered enough? Also we should arrest whoever did whatever they're talking about in this article because that sounds bad too.
Either the mail client executes JS with access to full filesystem, or it passes it to the browser that does it.
Clearly there is a sin here: executing non trusted JS with filesystem access. What are the faulty softwares that do this? No names are given here.
This isn't entirely true. The initial dropper uses Javascript. This dropper contains a second-stage in base64-encoded form. The initial dropper than loads the second-stage on the target machine. The second-stage is not in JavaScript, only wrapped in it. This is merely FUD.
Comment removed based on user account deletion
Comment removed based on user account deletion
That will help, but a more effective strategy is to find the breaker box and flip them all off and stuff.
However, be aware that the FBI can, and does, monitor the water flowing up to your house for subtle vibrations caused by voices and footsteps.
They do the same thing with natural gas.
They even put vibration sensors on the cable, telephone, and electrical lines that physically attach to your home from that pole out there.
The only real solution is to move out.
They will know you did, though.
It little behooves the best of us to comment on the rest of us.
Outlook not so good.
Clicking on the subject is enough to open the email and "helpfully" run the script via Internet Explorer.
Absolute fucking insanely bad software design is why we are living knee deep in a malware swamp beyond the dreams of bad science fiction.
Will turn browser into an OS and Windows as a poorly debugged set of device drivers.
How does the marco run considering autorun macros were disable by default on Microsoft Word and how does the rest of it execute without the user providing the admin password. Sounds to me like a veersion of any old word macro virus.
A long white back, for a PhD project, a guy named Alexia (or previously Henry, the name the thesis was submitted under) Massalin, wrote an OS kernel called Synthesis. The aim there was to improve efficiency by using runtime code synthesis. In the modern world, along with sandboxing using processes and memory protection, given that we now have LLVM, it would be worth someone exploring an OS where binaries are more akin to the LLVM representation (or some high level representation), and importantly, there is no static list of kernel syscalls: rather at install time, a list of required syscalls is compiled, and possibly custom versions synthesised so that the process is restricted, at the binary level, to what it can access. Something like that. If you look at the system calls a process makes, how many of the available ones does it use? And of the calls that modify files, or use network sockets, how much of the potential of those calls actually gets used? What I am suggesting is basically using LLVM to enforce something close to the principle of least authority at the kernel syscall level using code synthesis.
John_Chalisque
Have these people ever actually written a stable piece of code they would be willing to stake their life or the life of a close relative on?????
If "mother-in-law" counts as a close relative...
Linux/osx is not dumb enough to make it easy to run an attached javascript file. It can be done, but those who knows how, also knows not to run any sw they get from strangers in the mail.
Seriously, nobody need ability to easily execute stuff that came in the mail. Especially not those who don't understand the implications. So it is not made easy.
Also, even when you succeed in tricking a linux user, the software can't reliably take over the machine. It may still ransom stuff in his account, but the infection does not spread like it does on windows.
Ransomware is a simple concept, other OSes are not immune to it. All it needs is some way to get the user to execute a script or binary.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
A solution that would greatly reduce those kind of problems:
All installable programs should be only available thru a signed repository or store.
The only process able to install programs should be the Store application
No code should be allowed to execute if it hasn't been installed using the Store app.
All app should be sandboxed
That would solve tousand of security problem. But that would also break security software industry. Look at iOS and how many antimalware, antivirus and such exists? None. The process of running signed code in an arbitrary way is so complex that such code (excep proof of concept and jailbreak software) almost doesn't exists.
Of course, malware would still exists and try other infection vector like infect the store itself, but it has been proven up to now that even it this threat exists, it stay marginal and at least is far less spread that current classical virus/malware/spyware.
I can't see that many people paying into it... I mean, if a criminal promised to give me X back if I payed them $Y, I'm not sure I'd trust them. Wouldn't it be more effective to create a worm that secretly installs some software to mine bitcoin for the author or something?
We need a computer that can easily be discarded when it is too much trouble to clean, like plastic forks.
“Common sense is not so common.” — Voltaire
There is a hole in the sandbox. It only requires the user to save the file to disk and agree to run it locally.
“Common sense is not so common.” — Voltaire
good, now websites will be forced to present a version of themselves which is still usable without JavaScript.
What did that poll say, a quarter of /. readers surf with JavaScriopt disabled by default. God knows I do.
Sad to say, at some point around 2013 it became less about what the web could do for me and more about what the web could do to me.