Slashdot Mirror
New Ransomware Poses As A Windows Update (hothardware.com)
Slashdot reader MojoKid quotes an article from Hot Hardware: A security researcher for AVG has discovered a new piece of ransomware called Fantom that masquerades as a critical Windows update. Victims who fall for the ruse will see a Windows screen acting like it's installing the update, but what's really happening is that the user's documents and files are being encrypted in the background...
The scam starts with a pop-up labeled as a critical update from Microsoft. Once a user decides to apply the fake update, it extracts files and executes an embedded program called WindowsUpdate.exe... As with other EDA2 ransomware, Fantom generates a random AES-128 key, encrypts it using RSA, and then uploads it to the culprit. From there, Fantom targets specific file extensions and encrypts those files using AES-128 encryption... Users affected by this are instructed to email the culprit for payment instructions.
While the ransomware is busy encrypting your files, it displays Microsoft's standard warning about not turning off the computer while the "update" is in progress. Pressing Ctrl+F4 closes that window, according to the article, "but that doesn't stop the ransomware from encrypting files in the background."
The scam starts with a pop-up labeled as a critical update from Microsoft. Once a user decides to apply the fake update, it extracts files and executes an embedded program called WindowsUpdate.exe... As with other EDA2 ransomware, Fantom generates a random AES-128 key, encrypts it using RSA, and then uploads it to the culprit. From there, Fantom targets specific file extensions and encrypts those files using AES-128 encryption... Users affected by this are instructed to email the culprit for payment instructions.
While the ransomware is busy encrypting your files, it displays Microsoft's standard warning about not turning off the computer while the "update" is in progress. Pressing Ctrl+F4 closes that window, according to the article, "but that doesn't stop the ransomware from encrypting files in the background."
Sounds like any other window update. Especially the one with the "Upgrade to Windows 10" popup... :D
No reason people who create/operate this kind of stuff should not be hunted down and summarily executed.
Seriously? Why is this allowed in modern web browsers? I haven't seen one in forever, though part of that may be my use of various addons like ad-blocks and No-Script.
It seems there's NO excuse at all, at ALL, for unauthorized pop-up windows nowadays.
"Get off my turf, punk!"
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
I hate people who do this. If you can write software, you can have a comfortable life without doing shit like this. What a waste.
TFA misses the most important part of the story. What is it we might do that exposes us to this malware?
(Apart from running Windows that is)
As far as I know my browser cannot access my files so nothing on the web I click on can cause this problem. In theory.
If there is a buggy browser that allows this I want to know which it is.
Anyone have a link to the ransomware site?
So within a few minutes everyone'll have updated AV definitions, won't they?
Does your browser not allow you to download executable software from the internet and then choose to run it? That's what's happening here. People are dumb enough to say "oh this web page says I MUST download something and then click through all the warnings telling me I'm about to run software from the internet, but since I'm a total dumb ass I'm going to do just that anyway." No clever exploits needed (other than navigating to the bullshit warning page in the first place).
This is what backups are for.
Glad I already stopped downloading Windows updates! Yes, this bad.
Swap windows update and ransomware.
Should be "New Windows Update Poses As Ransomware"
That would seem to be important, no?
Thanks.
P.s. TFA does not specify.
Windows Update itself is malware?
Is it a game changer? Previously, ransomwares were encrypting your files silently in the background, and now it does the same while displaying a Windows update box. No big change.
It only forces you to pay once, while the actual windows 10 update forces you to pay continually.
Non sequitur: Your facts are uncoordinated.
Anyone affected has a pretty good case to have Microsoft reimburse them for any losses - after all, MS has been using these exact same tactics for the past year, so at this stage, users won't hesitate to run anything MS sends them - particularly if it carries the promise of finally fixing some of these game-breaking bugs that have been thrust upon us my our most gracious overlords at Microsoft - also, Windows 10 is SO secure, it would never let the cryptolocker run - and certainly not in the background.
If you don't know how to translate your vernacular into English, try to ask someone on facebook to translate it for you. My brain almost short circuited after reading your post.
captcha check for this post was funny: resistor
You mean ALT-F4?