Slashdot Mirror
New Ransomware Poses As A Windows Update (hothardware.com)
Slashdot reader MojoKid quotes an article from Hot Hardware: A security researcher for AVG has discovered a new piece of ransomware called Fantom that masquerades as a critical Windows update. Victims who fall for the ruse will see a Windows screen acting like it's installing the update, but what's really happening is that the user's documents and files are being encrypted in the background...
The scam starts with a pop-up labeled as a critical update from Microsoft. Once a user decides to apply the fake update, it extracts files and executes an embedded program called WindowsUpdate.exe... As with other EDA2 ransomware, Fantom generates a random AES-128 key, encrypts it using RSA, and then uploads it to the culprit. From there, Fantom targets specific file extensions and encrypts those files using AES-128 encryption... Users affected by this are instructed to email the culprit for payment instructions.
While the ransomware is busy encrypting your files, it displays Microsoft's standard warning about not turning off the computer while the "update" is in progress. Pressing Ctrl+F4 closes that window, according to the article, "but that doesn't stop the ransomware from encrypting files in the background."
The scam starts with a pop-up labeled as a critical update from Microsoft. Once a user decides to apply the fake update, it extracts files and executes an embedded program called WindowsUpdate.exe... As with other EDA2 ransomware, Fantom generates a random AES-128 key, encrypts it using RSA, and then uploads it to the culprit. From there, Fantom targets specific file extensions and encrypts those files using AES-128 encryption... Users affected by this are instructed to email the culprit for payment instructions.
While the ransomware is busy encrypting your files, it displays Microsoft's standard warning about not turning off the computer while the "update" is in progress. Pressing Ctrl+F4 closes that window, according to the article, "but that doesn't stop the ransomware from encrypting files in the background."
Sounds like any other window update. Especially the one with the "Upgrade to Windows 10" popup... :D
Seriously? Why is this allowed in modern web browsers? I haven't seen one in forever, though part of that may be my use of various addons like ad-blocks and No-Script.
It seems there's NO excuse at all, at ALL, for unauthorized pop-up windows nowadays.
"Get off my turf, punk!"
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
I hate people who do this. If you can write software, you can have a comfortable life without doing shit like this. What a waste.
TFA misses the most important part of the story. What is it we might do that exposes us to this malware?
(Apart from running Windows that is)
As far as I know my browser cannot access my files so nothing on the web I click on can cause this problem. In theory.
If there is a buggy browser that allows this I want to know which it is.
Anyone have a link to the ransomware site?
No reason people who create/operate this kind of stuff should not be hunted down and summarily executed.
The FBI operates in all countries outside of ISIS territory now, and can be invoked to do your bidding so long as you can show that the ransomware violated someone's copyright.
That would seem to be important, no?
Thanks.
P.s. TFA does not specify.
You know, it's kinda funny that there's not yet a service where someone who knows that kind of trash would grab them, hang them from their toes and sell viewing rights to see them being tortured for a few hours.
Send 1 bitcoin and watch the ransomware asshole being sliced millimeter by millimeter, starting at the soles of their feet...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
No, c'mon, stop the propaganda. Windows is very well capable of this feat even without any updates!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Is it a game changer? Previously, ransomwares were encrypting your files silently in the background, and now it does the same while displaying a Windows update box. No big change.
It only forces you to pay once, while the actual windows 10 update forces you to pay continually.
Non sequitur: Your facts are uncoordinated.
Anyone affected has a pretty good case to have Microsoft reimburse them for any losses - after all, MS has been using these exact same tactics for the past year, so at this stage, users won't hesitate to run anything MS sends them - particularly if it carries the promise of finally fixing some of these game-breaking bugs that have been thrust upon us my our most gracious overlords at Microsoft - also, Windows 10 is SO secure, it would never let the cryptolocker run - and certainly not in the background.