Destructive KillDisk Malware Turns Into Ransomware (securityweek.com)

wiredmikey writes from a report via SecurityWeek: A recently discovered variant of the KillDisk malware encrypts files and holds them for ransom instead of deleting them. Since KillDisk has been used in attacks aimed at industrial control systems (ICS), experts are concerned that threat actors may be bringing ransomware into the industrial domain. CyberX VP of research David Atch told SecurityWeek that the KillDisk variant they have analyzed is a well-written piece of ransomware, and victims are instructed to pay 222 bitcoins ($210,000) to recover their files, which experts believe suggests that the attackers are targeting "organizations with deep pockets." From the report: "The ransomware is designed to encrypt various types of files, including documents, databases, source code, disk images, emails and media files. Both local partitions and network folders are targeted. The contact email address provided to affected users is associated with Lelantos, a privacy-focused email provider only accessible through the Tor network. The Bitcoin address to which victims are told to send the ransom has so far not made any transactions. Atch pointed out that the same RSA public key is used for all samples, which means that a user who receives a decryptor will likely be able to decrypt files for all victims. According to CyberX, the malware requires elevated privileges and registers itself as a service. The threat terminates various processes, but it avoids critical system processes and ones associated with anti-malware applications, likely to avoid disrupting the system and triggering detection by security products."

Comments

Lol

[Anonymous Coward]

My meme folders aren't worth $210,000!

Fraud, Bitcoin and Tor

[Anonymous Coward]

Color me shocked.

222 Bitcoins

[Anonymous Coward]

222 BTC ~ 216K US dollars

and climbing fast

Yet another damn update

[Cajun Hell]

So can every KillDisk user upgrade now, to fix the deleted-files problem? Or does the ransom change need to be pulled by a bunch of different branch maintainers first?

More vector information please.

[Anonymous Coward]

Writing a program that encrypts files is pretty straightforward. Getting it to run on the victim's computer is the tricky bit. Can anyone provide more information about how the payload is delivered?

Re:More vector information please.

[Anonymous Coward]

It is not "tricky" to get an organization over a few people total to run anything you want. You merely have to ask, and someone will. Always. People do not think about their actions, so it is trivially easy to get them to run malware just by asking.

This is the price of mass technical illiteracy.

Re:More vector information please.

[CaptainDork]

This is the price of mass technical illiteracy.

No.

This is the price of mass technical incompetence in the business space (not the technical staff).

Businesses don't want to, and don't have to, pay upfront for best-practice implementations that IT departments have been asking for, for years.

Blaming the user is a cheap cop-out.

It's a fucking computer. It has the ability to be predictive and "mentally" read the intentions of malware and say:

STOP! This action is not coming from the operator via user interface. It will encrypt data files and that action is not allowed on this computer. This computer is locked. Notify the IT department.

A lot of malware comes to us from phishing where executables are wrapped in .zip files attached to an email.

How fucking hard is it to allow ONLY administrators to open a .zip that has a .scr, .bat, .exe, .com (continue common list here)?

I have to think of everything.

Re:More vector information please.

[Anonymous Coward]

Nope.User treat their working computer as a tool belonging to the employer, so they don't give a flying fuck what happens to it.

Re:More vector information please.

[Anonymous Coward]

What you are talking about is, when you get right down to it, a solution to the halting problem.

There's this guy called Alan Turing, lived in the first half of the 20th century, died in 1954. He had something to say about that...

Re:More vector information please.

[khz6955]

"Writing a program that encrypts files is pretty straightforward. Getting it to run on the victim's computer is the tricky bit. Can anyone provide more information about how the payload is delivered?"

That's because KillDisk only runs on Microsoft Windows. Which must never be mentioned in relation to Windows.

Re:More vector information please.

[fbobraga]

Ora, ora, we have a Xeroque Romes here!

Entries for hosts that block this

[Anonymous Coward]

0.0.0.0 lelantos.org
0.0.0.0 srv70.putdrive.com
0.0.0.0 api.telegram.org
0.0.0.0 putdrive.com
0.0.0.0 telegram.org
0.0.0.0 smtp-mail.outlook.com
0.0.0.0 api.telegram.org
0.0.0.0 telegram.org

* Per source article(s) from https://www.incapsula.com/blog/650gbps-ddos-attack-leet-botnet.html/ http://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/ https://cyberx-labs.com/en/blog/new-killdisk-malware-brings-ransomware-into-industrial-domain/ http://www.securityweek.com/destructive-killdisk-malware-turns-ransomware/ as this malware/botnet descends from others before it...

APK

P.S.=> Those are it's C&C's + other compromised sites/hosts/domains-subdomains & THIS IS THE 10th BOTNET HOSTS CONQUER IN THE PAST 2++ WEEKS - here's the others (many before it, but not as many as recently so fast & clustered together) https://news.slashdot.org/comments.pl?sid=10020701&cid=53529963/

Re:Entries for hosts that block this

[fbobraga]

0.0.0.0 api.telegram.org [...] 0.0.0.0 api.telegram.org 0.0.0.0 telegram.org

what is the relation of Telegram whit this KillDisk?

same solution as ever

[Anonymous Coward]

These things all have the same solution: restore from your daily backup, which should not be pushed from the machine in question, and should be well tested for recoverability. Even for personal in-home computing, the refrain since the 1970's has been "make backups". If you are still not doing t his in 2016, you deserve what you get. It isn't just malicious hackers that are a threat, it's hardware failures, accidents, and more.

There is no reason to ever consider paying such ransom.

And also, secure your systems so it doesn't happen to you again in the future.

Re: same solution as ever

[Anonymous Coward]

Just curious, I what popular OS is the most valuable? ;)

Re:same solution as ever

[FrankHaynes]

These things all have the same solution: restore from your daily backup, which should not be pushed from the machine in question

If the backup is not "pushed" from the machine in question, then how is the backup created?

Or do you mean don't backup the infected/ransomed machine AFTER it has been infected?

Re:same solution as ever

[tepples]

Until you discover that your backups are also infected.

Re:same solution as ever

[knorthern knight]

>> These things all have the same solution: restore from your daily backup, which should not be
>> pushed from the machine in question

> If the backup is not "pushed" from the machine in question, then
> how is the backup created?

The Windows machine grants read access to a remote backup machine (linux/bsd/whatever) on the network. The remote machine reads the current file version and backs it up. Note that *THE WINDOWS MACHINE MUST NOT HAVE WRITE ACCESS TO THE BACKUP MACHINE*. An infected Windows machine can encrypt anything it has write access to. It's not just the local hard drive or a USB key in a USB port. A samba or nfs ahare on a linux or bsd machine is designed to emulate a local hard drive. That includes writing to it, if given the necessary permission.

> Or do you mean don't backup the infected/ransomed machine AFTER it has been infected?

That's what *VERSIONING BACKUPS* are for. It's not a new idea. Ask any software developer about git, subversion, mercurial, etc. They can go back to a snapshot at a specific point in time. E.g. if a developer updates a program, and discovers... oh bleep; the update makes it crash on startup on other peoples' machines... then they can "revert" the update and go back to the previous working version. Similarly, if the latest backup of your important spreadsheet is encrypted, the versioning backup can step back to the latest non-encrypted version.

Re:same solution as ever

[knorthern knight]

> Until you discover that your backups are also infected.

That's what *VERSIONING BACKUP SOFTWARE* is for.

Re:same solution as ever

[tepples]

This fails in two ways. First, particularly sophisticated ransomware has in the past managed to infect the device running the versioning backup software and corrupt old versions. Second, what fraction of home users can be trusted to install and run versioning backup software correctly?

People have to bypass stuff to do their jobs...

[Anonymous Coward]

I get mails all the time that require me to rename z_p, piz, txt and whatever else to zip to open them because things are so locked down that the administrators can't even do their jobs to get security patches for their products due to some overzealous corporate firewall that tries to block any info from getting in. Try to loosen the rules and you're looking at a month spent on a change request that will probably never go anywhere. Some of them have somehow added their own vendors' sites to blocklists and not even public ones so we have no idea who to even appeal to. This is quite common in the military where some McAfee product will always be causing severe harm and I'm sure they pay out their rear ends for "support" that doesn't amount to anything. Or perhaps they suffer breakage based on ridiculous settings that got added to a STIG.

Re:People have to bypass stuff to do their jobs...

[fbobraga]

because things are so locked down that the administrators can't even do their jobs to get security patches for their products due to some overzealous corporate firewall that tries to block any info from getting in.

Wrong: this is caused by a poor desktop O.S. (that, up to a recent past, made a simple user account administer the entire system without the "hassle" that use another user account...) - know what O.S. I'm talking about here?

Re:People have to bypass stuff to do their jobs...

[fbobraga]

This is quite common in the military

Not all military use only Microsoft software (ops, got it: you are talking about U.S. as if they're the entire world, huh?)

APK declares his own 'tool' best in class

[Anonymous Coward]

Hosts add speed (hardcodes/adblocks),

Trivial speed increase. Post benchmarks on a modern system and show how much you 'save'.

security (.../poisoned dns), reliability (dns down), & anonymity (requestlogs/trackers) natively.

Edge cases, at best.

Avg. page = big as Doom

from the article - "There's also the fact that we're no longer living in a world of PCs with 4MB of RAM, 33MHz processors, text-only BBSes and 33kbps modems – everything's scaled up, including the complexity and size of internet downloads."

& ads = 40% of it

No where in the linked article do they talk about advertisements. They say that images account for most of the size of a web page (1.4MB on average, of the 2.3MB average page size).

Hosts != ClarityRay blockable

Name one site that uses ClarityRay, detects a browser add-on and blocks it.

Less power/cpu/ram + IO use

Your own figures (quoted elsewhere) show that on even an average system, the difference in resource use is around 1-2%

Gets data via 10 security sites

But cannot tell when a given entry was added.

Verified by Malwarebytes' S. Burn

Link to a forum post that's locked to new users. No way to check or verify.

Try to reply without just restating your position, attacking me or demanding to know what I've done or devolving into name calling or childish 'I win' posts.
Bonus points if you show you've actually read and understood what you are replying to.

YT

Re:APK declares his own 'tool' best in class

[tepples]

Post benchmarks on a modern system

To avoid "no true Scotsman" fallacies, please define "modern" first. I tried to use Google Search to find benchmark results, but "hosts" kept bringing up web hosting, and "APK" kept bringing up Android packages that can be installed through Unknown sources. The best I could find was this question on Super User.

Name one site that uses ClarityRay, detects a browser add-on and blocks it.

I know of three popular sites that use ClarityRay-like scripts: WIRED, the INQUIRER, and The Atlantic. All three of them admit that they can't tell the difference between tracking blockers, such as Ghostery, Disconnect, and Firefox Private Browsing, from ad blockers.

Re:APK declares his own 'tool' best in class

[Anonymous Coward]

To avoid "no true Scotsman" fallacies, please define "modern" first

A fair criticism.

Windows 10 recommends a minimum of 2GB of RAM (64 bit). I couldn't (quickly) find an authoritative source for a 'recommended' requirement, but this article from PCAuthority from 2014 compares performance for 2GB, 4GB and 8GB and mentions "typically, today’s budget PCs come with 4GB of RAM".

Apple sells Macbooks and Macbook Pros with a minimum config of 8GB of RAM and has done so for some years. The Mac Mini and Macbook Air have 4GB as a minimum conifg.

Steam users are not necessarily typical - gamers may well have higher specced machines - but the hardware survey is at least another data point. Currently over 80% of users have 4GB of RAM or higher.

I would argue that 4GB of RAM is a reasonable definition of a modern system.

I am concentrating on RAM as that is the only statistic that APK has mentioned. He links to the Super User thread you do as well as another source that shows uBlock using 60MB of RAM and Adblock Plus as using 100MB. This is between 1-3% of RAM on a system with 4GB

I'm happy to continue in this vein to try and work out what could reasonably be called a 'modern' machine in terms of CPU and IO, but as there's even less evidence for host file improvement for these specifications, it seems moot.

I've read the Super User thread you link to - APK links to it, frequently. Someone comments that disabling their adblocker seemed to increase browser speed. Someone else links to a 2011 article from Mozilla that shows a 250 millisecond difference in startup time. There's some discussion about Firefox memory use ... etc. It's subjective (and that's both 'it seemed to speed things up and 'there's no difference) and not well attested.

I agree that turning off an adblocking extension is going to use less resources than when it is on. I've yet to see anything that suggests that this is more than a negligible improvement, even if it is perceptible.

The claim that listing favourite sites in the hosts file speeds performance is similar.

I know of three popular sites that use ClarityRay-like scripts: WIRED, the INQUIRER, and The Atlantic

I'm using uBlock Origin, SafeScript and PrivacyBadger in Chrome on Windows 7, located in Australia. None of these sites (I assume the Inquirer is http://http//www.theinquirer.n...) balked at my adblocker. Even disabling SafeScript didn't cause a problem (although now the cookies nag showed up). I could browse the articles and no ads were displayed, nor did I get a nag screen asking me to turn my adblocker off.

As far as I can tell extension detection is a cat and mouse game that eventually gets abandoned.

YT

Systematically annihilating u again "YeTi"

[Anonymous Coward]

Every increase helps Mr. "Eating your words" https://slashdot.org/comments.pl?sid=9986237&cid=53480147/

REAL attacks stalled by hosts & not 'edge' (hosts stop 10 botnets in 2++ weeks https://news.slashdot.org/comments.pl?sid=10020701&cid=53529963/ - this is YET another!

PROOF ads = up to 40% of a site's pages via bandwidth analysis http://www.silicon.co.uk/e-marketing/adblock-plus-adblocking-network-traffic-172245/

Gb's of RAM = DNS vs. Mb's = hosts? Dumb trying "%'ages"! Addons use more vs. hosts & do less too!

(You think people here =e STUPID to fall for weak "jedi mind tricks" when ORDERS OF MAGNITUDE are a difference?)

My program = best (hostsman != 64-bit & can't speed up fav site resolution securing you vs. DNS redirects)

U get 100mpg/100hp (hosts) OR don't (adblock) letting ads in to f you OR get 10mpg/10hp using other 'solutions' (full of security bugs/inefficiency (antivirus/locally installed DNS)).

APK

P.S.=> YOU've done better?

Tepples here's proof... apk

[Anonymous Coward]

"I know of three popular sites that use ClarityRay-like scripts: WIRED, the INQUIRER, and The Atlantic. All three of them admit that they can't tell the difference between tracking blockers, such as Ghostery, Disconnect, and Firefox Private Browsing, from ad blockers" - by tepples ( 727027 ) on Wednesday December 28, 2016 @09:58PM (#53569297)

Detecting browser addons = trivial & here's the proof (dumping them via script) https://webdevwonders.com/detecting-firefox-add-ons/

Thus, If clarityray wants to detect ANY browser addons?? That's how EASY it is to block them!

Can't do that to hosts that way (not an addon running in SLOWER usermode clotting up browsers w/ messagepassing, ram/cpu & other forms of I/O overheads - hosts are kernelmode FASTER & do the job BEFORE addons work!)

APK

P.S.=> My other post annihilates "YeTi" easily POINT by "so-called 'point'" too, lol https://it.slashdot.org/comments.pl?sid=10053539&cid=53569549/

Re:Tepples here's proof... apk

[Anonymous Coward]

Detecting browser addons = trivial & here's the proof

From 2010. Do try to keep up.
I ask for proof that ClarityRay is in use and blocking extensions, and you provide a code snippet from 2010. Does it still work? Does it work if I have a script blocking extension? Does it in any way answer, (let alone annihilate) the contention that ClarityRay is not in use?

Would you like to;
a) change the topic?
b) answer with something irrelevant?
c) restate the original contention?
or
d) attack me personally?

Thus, If clarityray wants to detect ANY browser addons?? That's how EASY it is to block them!

Then it should be EASY for you to provide some examples where it does? No? Can't? Could it be that ClarityRay is vapourware? That the 'arms race' between browser extension detection and hiding has left them behind?

My other post annihilates "YeTi" easily POINT by "so-called 'point'"

Yup. Just like here. Good thing you keep pointing out that you are 'annihilating' me, otherwise I might not have noticed. I seem to have different ideas about what constitutes and argument, rebuttal, proof etc.

YT

Best hosts file maker (4 protection & speed)

[Anonymous Coward]

APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?...

Ads rob speed, security (malvertising) & privacy (tracking).

Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively.

Works vs. caps & PUSH ads.

Avg. page = big as Doom http://www.theregister.co.uk/2... & ads = 40% of it.

Hosts != ClarityRay blockable (vs. souled-out to admen inferior wasteful redundant slow usermode addons)

Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus (slows you) + less security issues/complexity.

Compliments firewalls (blocking less used IP addys vs. hosts blocking more used domains) & DNS (lightens dns load).

Data via 10 security sites & 64-bit + hardcoded favs (hostsman isn't & can't).

APK

P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "seen the code & it's safe" http://forum.hosts-file.net/vi... )

This space reserved for APK victory claim

[Anonymous Coward]

Every increase helps

No. I use resources for results. Saving 60MB of RAM by turning of my extensions is not a 'saving'.

REAL attacks stalled by h0sts & not 'edge'

I'm calling your DNS protection (poisoned, down, request tracking) 'edge'. Learn to read.

and ... your file stopped a bunch of stuff. One of which you claim in the list was Stegano. Which went undetected for 2 years. Your 'solution' was useless and what kept you safe was preventing scripts from running. But you go ahead and gloss over that because it doesn't fit your narrative.

PROOF ads = up to 40% of a site's pages via bandwidth analysis

Do you _ever_ read anything you link to, or do you just skim?

The study looked at the effect of Adblock Plus (win for extensions!). The 40% figure was arrived at by considering video only. More, the page itself was not 40% ads (as you originally claimed). Looking at the study, the increase in sessions suggest that the ads were spawned as separate pages/connections.

Gb's of RAM = DNS

The last time you referenced this you seemed to link to a list of problems with Windows Server 2008 running a DNS server. Is this what you are talking about? I've run DNSmasq on routers with a total of 32MB or RAM. Orders of magnitude my ass.

You think people here =e STUPID to fall for weak "jedi mind tricks" when ORDERS OF MAGNITUDE are a difference

No. I don't think you are stupid, either. I do think you are obsessed and unable to argue rationally or evaluate evidence that contradicts the position you are so heavily invested in. OK, to be fair, I've just called you a crank.

My program = best

Yup and you've got the awards from a decade ago to prove it.

P.S.=> YOU've done better?

ad hominem. Fail.

YT

Always a pleasure blowing you away "YeTi"

[Anonymous Coward]

See subject "YeTi" & a link where I systematically annihilate u using "%" vs. orders of magnitude https://it.slashdot.org/comments.pl?sid=10053539&cid=53569549/

* You make australians look BAD!

Using 3 addons that use more cpu/ram & other forms of I/O in slower usermode that is EASILY determined & blocked https://it.slashdot.org/comments.pl?sid=10053539&cid=53569609/ vs. hosts that do far more for far less & you NATIVELY already have hosts (not "Bolting on 'MoAr'" stupidly)?

APK

P.S.=> You never seem to answer this question too: HOW DID IT TASTE "EATING YOUR WORDS" after you attacked me here stupid https://slashdot.org/comments.pl?sid=9986237&cid=53480147/ ?

Bit like the BITTER TASTE of SELF-defeat? Washing them down w/ YOUR FOOT IN YOUR MOUTH shoving them down?? LMAO!

Man - must be one hell of a case of indigestion (butthurt is more like it) that you keep coming to your dismay (let alone MALNUTRITION as "eating your words" != good nutrition - hopefully you die of starvation soon if not shame)... apk

Yes it seals my victory (too easy)

[Anonymous Coward]

You use bs: Hosts use many orders of magnitude less vs. addons & DNS. Using more = better (doing less)? Avg. 6mb hosts = FAR LESS vs. 64mb UBlock (or 128mb Adblock) & hosts do more for less.

Your "illogic logic" astounds, lol!

AVOIDING DNS avoids it's MANY issues (enumerated here by the 100's in efficiency & security bugs galore https://news.slashdot.org/comments.pl?sid=9007355&threshold=-1&commentsort=0&mode=thread&pid=51969075/ - they're NOT 'edge cases'!

THEY SURE GIVE HOSTS A "WINNING EDGE"!

My post in bandwidth analysis proves savings of 40% blocking ads & hosts do it better vs. addons (by far) doing more for less.

My work's seen awards _+ commercial code sale too to MS certified partners - & you?

APK

P.S.=> You're made me HAVE to say this (& I haven't done THIS in a long time):

This was just "too, Too, TOO EASY - just '2ez'"!

You did it to yourself...apk

Scripts detect browser addons

[Anonymous Coward]

See subject: Once listed you can block ANY extension! Can't w/ hosts thus - hosts != addon (& hosts do more for less by FAR vs. hosts & are inferior on nearly EVERY level imaginable including ability + efficiency w/ what you NATIVELY already have operating in far faster kernelmode (vs. slower usermode which addons compound even more in excessive ram/cpu & I/O use in messagepassing + more...)

Attack YOU? YOU attack ME 1st & "ate your words" for it here https://slashdot.org/comments.pl?sid=9986237&cid=53480147/

You keep trying it & FAIL!

(I bookmark EVERY time you do (I can't to you, you post ac (even though you have a "registered 'luser'" account on /.) - I have YET to attack you 1st - I just annihilate you w/ facts!)

APK

P.S.=> You're on your "last leg" limping badly (you did it to yourself) humiliating yourself. Try saying "Satan get thee behind me" & get that devil monkey OFF your back (so you stay off mine + save your own face)... apk

Try starting your sentence in the 'Comment' field

[Anonymous Coward]

Scripts detect browser addons

Like the script blocker that's stopping them from running? Tell me how that works,again.

And you are still avoiding providing an example of ClarityRay in use. Tell me again how I'm failing.

(I bookmark EVERY time you do

I know. It's creepy. And then you claim that people stalk _you_.

I have YET to attack you 1st

Lie. I criticise your off-topic or 'spammy' posts. That's not attacking you. You, on the other hand, never fail to call me names, mock me, or wish that I were dead. That's attacking me. Not my arguments. Not my words or ideas. Me. I have not attacked you. I've attacked your ideas. I've attacked your posts. But not you. Do you understand? Can you read? Have you read this, or are you just skimming it so you can 'beat' me with some off-topic link or 'proof'?

There's a difference. It's important to me. Perhaps not so much with you.

facts!

Right. Like your 6 year old code snippet that only runs if I allow scripts that you offer as 'proof' when I ask for an example that ClarityRay is in use.

Yeah. Great work.

YT

It's only 'too easy' because you skip the hard bit

[Anonymous Coward]

60MB memory is trivial on a machine with 4GB RAM. You fail to address this and just keep parroting 'more for less'. Boring.

I can run DNSmasq on a router with 32MB of memory, but you keep going on about errors on Windows 2008. You don't even bother addressing this. Weak.

You didn't post a bandwidth analysis. You made a claim. It was exaggerated. You corrected and posted a summary of a study which looked at bandwidth. Which you still haven't read. And which recommended Adblock. Exaggeration. Citation fail.

DNS ... linking to a spam of other links that are an undifferentiated mess of everything you can find that has the word 'DNS' and 'problem' in it is neither an argument nor proof/disproof. I made specific criticisms of your position. I read, tried to understand and replied. If you cannot do the same, then there is little point in continuing this.

Another time, APK. We'll see if you are capable of a realy argument, yet.

YT

Re:Best hosts file creator (for protection)?

[Anonymous Coward]

Don't use software written by a forum spammer who stalks anyone who criticizes his software or advertising methods. Do you really trust a closed source app that spends hours just sorting a list when there's plenty of open source solutions that do the exact same than much more quickly? What's with the virustotal results trumpeted out in every post? Trying to make people feel safe? Perhaps with only a few dozen users the malicious actions of your software havent been discovered yet? Why even risk it when there's better open source software out there anyway written ny people that won't stalk your forum posts with nonsense?

Do not reply to this post from a logged in account, APK will stalk you relentlessly with his delusional bullshit until you're forced to register a new account to escape the programmer version of Chris-Chan.

100's of mb savings != "trivial" efficiency

[Anonymous Coward]

See subject: ~6mb (hosts) is FAR less than 151mb (adblock) or 64mb (ublock) or DNS (gigabytes) + hosts run in a FAR faster more cpu serviced level vs. usermode addons run in (kernelmode).

Routers are LOADED w/ errors &/or exploits galore too https://it.slashdot.org/comments.pl?sid=9995967&cid=53488785/

I didn't post a bandwidth savings analysis of 40%?? Bullshit I didn't http://www.silicon.co.uk/e-marketing/adblock-plus-adblocking-network-traffic-172245/ - that's what ads cost you & hosts blocks ads more efficiently & do more than addons BY FAR!

You got your ass handed to you on DNS issues galore (both in memory inefficiency & security issues too) https://news.slashdot.org/comments.pl?sid=9007355&threshold=-1&commentsort=0&mode=thread&pid=51969075/

APK

P.S.=> There won't be another time - You are OUT of time & annihilated by documented facts I produce in favor of hosts... apk

Script blockers like inefficient NoScript?

[Anonymous Coward]

See subject: Hosts stop ads stopping adscript sources before NoScript runs (how ads work https://news.ycombinator.com/item?id=10221859/ parsing page tags (tons more effort/resources expended in CPU + RAM to do so stupid) - hosts do it 1 step in fast kernelmode (not slow usermode like addons).

Tepples gave examples & I show how clarityray workshttps://it.slashdot.org/comments.pl?sid=10053539&cid=53569609/ (using script to detect addons - can't do it to hosts - hosts != browser addon).

I bookmark when you start w/ me - you're sado-masochist bringing beatings on yourself - I blow you away easily.

My posts on hosts = on topic. Your bs isn't (see below).

APK

P.S.=> I don't WISH you dead - you KILL YOURSELF for me attacking ME 1st (I can't you as you post unidentifiable ac though you HAVE an acct here weasel) & you EAT YOUR WORDS for it https://slashdot.org/comments.pl?sid=9986237&cid=53480147/ doing it to yourself DYING of malnutrition... apk

Re:Script blockers like inefficient NoScript?

[fbobraga]

Wow: so many info from Anonymous Cowards!

Re:Script blockers like inefficient NoScript?

[Anonymous Coward]

I don't WISH you dead

and

hopefully you die of starvation soon if not shame

from https://it.slashdot.org/commen...

You are wrong. You did 'wish' me dead. Can you admit you were wrong? No? Didn't think so.

YT

"YeTi" I'm on topic & hosts work here

[Anonymous Coward]

See subject: Do addons? No. You stalk me as can be seen earlier above as you post anonymous unidentifiably.

OpenSores mistake Google & EFast (chrome doppleganger abused for malicious purposes) is NOT for me (for idiots like you, yes - not me but I actually have a good working app others here like & use - do you? No).

Per my subject: THIS IS THE 10th BOTNET HOSTS STOPPED IN ~ a WEEK https://news.slashdot.org/comments.pl?sid=10020701&cid=53529963/

* I post verifiable concrete & undeniable proofs of my program's safety to defend myself vs. loons like yourself. Nothing wrong w/ that (everything RIGHT is with it).

(My program is 100% safe & FREE too outperforming addons (inefficient &/or crippled) + dns/routers (both either crippled or loaded with inefficiency + security issues)

APK

P.S.=> You're a serious LOON who likes taking a beating he administers on himself & not all your "gossip fake news" bs weasels like YOU try will never EVER win vs. myself using documented facts to let you destroy yourself (as you EAT YOUR WORDS that way vs. me https://slashdot.org/comments.pl?sid=9986237&cid=53480147/ ... apk

Re:"YeTi" I'm on topic & hosts work here

[Anonymous Coward]

Dear gods, APK, can't you tell the difference between posts? Word choice? Sentence structure? The fact that I sign, everything, now because of your reading 'difficulty'?

Other people have issues with your behaviour, too. How does it feel to have people warned about replying to you because of your behaviour?

Oh, of course. It's critical of you so it must be a troll and can safely be ignored.

YT (see? This one is from me. The other one isn't.)

You Forgot to Mention the OS

[Anonymous Coward]

Let me guess. The operating system affected is Windows?

"Ask & ye SHALL receive" (what to block)

[Anonymous Coward]

See subject & https://it.slashdot.org/comments.pl?sid=10053539&threshold=-1&commentsort=0&mode=thread&pid=53567893/ + a tool that's blocked 10 botnets this past week or so https://news.slashdot.org/comments.pl?sid=10020701&cid=53529963/ including THIS one per the 1st link above...

* Lastly too, of course? What stops all those other botnets + MANY more from the past https://it.slashdot.org/comments.pl?sid=10053539&cid=53569639/

APK

P.S.=> Why do I do it? Like the original "TERMINATOR" film?? I'm here to help you - I'm Reese: Sgt. TechComm VN38416 assigned to protect you... YOU'VE BEEN TARGETTED FOR TERMINATION! & the more of you that stay clean, less chance of you 'spreading the disease' of these botnet machinations... apk

Mine's overall unquestionably best: How/Why?

[Anonymous Coward]

See subject: Nearest = hostsman - not 64-bit & can't do hardcoded fav sites speeding you up + securing you vs. DNS security issues galore!

Plus, it's got dependencies on SQLite (mine doesn't - I wrote the code myself) doing it's dedups - it gets a bug? Hostsman's fucked until they get an update... untrue for MY work vs. hostsman. I can patch MY own multithreaded single .exe design work fast (& users can 'patch ' edit hosts easily using text editors even).

* You've done better "YeTi'? Hell no... lol!

(I don't like cutting down hostsman this way but YOU force it & it is nothing but fact/truth...)

APK

P.S.=> What YOU do vs. me EVERY SINGLE TIME YOU TROLL ME (& you always instigate this like a sado-masochist)? You "EAT YOUR WORDS" chump https://slashdot.org/comments.pl?sid=9986237&cid=53480147/

Ancestral vestiges of other botnets iirc

[Anonymous Coward]

See subject & all the links I posted in the reply of mine you responded to asking your question (you'll find them in there).

* It's a DAMN shame that 'good' companies (or CLOUD for years now for instance) get abused thus - makes for a bad name for them (happens to many sites, even sourceforge, whiplash's other site sister to /.)

It was some 'digging' for me but per my other "terminator" posts earlier in keeping w/ that theme?

"Very hard to spot - I had to wait until he moved on your so I could 'zero' him...

They don't make things like that yet? No, the FUTURE is truly, now... each botnet gets more 'clever' each iteration ala:

"The terminator's an infiltration unit - part man, part machine: Underneath it's a HYPER-ALLOY combat chassis. Microprocessor controlled - fully armored, very tough... the 600 series had rubber skin, we spotted them easy"

&

"LISTEN & UNDERSTAND: That terminator is OUT there - it can't be bargained with, it can't be reasoned with! It doesn't feel pity or remorse or fear & it absolutely WILL NOT STOP, ever... until YOU are dead!"

APK

P.S.=> So, "I'm here to help you: I'm Reese - Sgt. TechCom VN38416 assigned to protect you... YOU'VE BEEN TARGETTED FOR TERMINATION!"... apk

Re:Ancestral vestiges of other botnets iirc

[fbobraga]

An unhelpful AC! It's a bot?

Not a (ro)bot - cybernetic organism!

[Anonymous Coward]

"Can u stop it?" answer = "With these weapons?" I do know vs. 10 botnets recently https://news.slashdot.org/comments.pl?sid=10020701&cid=53529963/ + this week++ alone & TONS MORE over years now... via hosts (which is what MOST malware/botnets use vs. IP addresses). :)

* Pats self on back (& those providing the data in the security community)

APK

P.S.=> LOL - hope you liked my other posts' "terminator" replies (especially after I 'terminated' good ole' unidentifiable anonymous troll "YeTi" all day long easily in most replies here w/ tepples' assist)... apk

"Come w/ me if you wanna live..."

[Anonymous Coward]

See subject - in keeping w/ my 'terminator' replies to you https://it.slashdot.org/comments.pl?sid=10053539&cid=53572131/ & others earlier... lol!

* Imo, it truly fits...

APK

P.S.=> Picture what Kyle Reese does to the 'terminator' in the bar scene w/ his shotgun blasts - that's what my posts DO to botnets galore (10 this week alone https://news.slashdot.org/comments.pl?sid=10020701&cid=53529963/ & many more in the past - just not as 'clustered/concentrated' as this week's been)... apk

Ya don't say

[rebelwarlock]

Thank you, experts, for informing us that the type of people targeted by a demand for a rather large amount of money are those with deep pockets. I thought they were hitting up low income housing for $210k just to be assholes.

Re:Best hosts file creator (for protection)?

[Anonymous Coward]

Chris-chan! That's it!

I knew I recognised this behaviour from somewhere else.

Damn. Then it's probably not something that is ever going to change. Congenital, not just deeply rooted.

YT

"YeTi" eats his words, lol... apk

[Anonymous Coward]

See subject & see YOU do it absolutely "LiVe" in concert, lol https://slashdot.org/comments.pl?sid=9986237&cid=53480147/ Gonna downmod "hide" it again too?

"Sure, sure it's not you" (man of a 1,000 faces/sockpuppets & unidentifiable trolling/stalking me even when you HAVE a "registered 'luser'" FAKE NAME for your FAKE LIFE account!)

APK

P.S.=> Come on Mr. Bernays, lol - don't worry, I've got a BETTER technique now than merely technically annihilating you @ every turn - now it's "Cardinal Richelieu" time for you - I'm gonna have a FIELDDAY on you boy & best part is, you did it to yourself constantly trolling me & failing, lol... apk

"YeTi" how'd it taste "eating your words"? lol

[Anonymous Coward]

"YeTi" how'd it taste "eating your words"? lol

See subject & see YOU do it absolutely "LiVe" in concert, lol https://slashdot.org/comments.pl?sid=9986237&cid=53480147/ Gonna downmod "hide" it again too?

APK

P.S.=> Come on Mr. Bernays, lol - don't worry, I've got a BETTER technique now than merely technically annihilating you @ every turn - now it's "Cardinal Richelieu" time for you - I'm gonna have a FIELDDAY on you boy & best part is, you did it to yourself constantly trolling me & failing, lol... apk

I don't wish you dead

[Anonymous Coward]

See subject pussy: You keep KILLING YOURSELF for me from the start of YOU stalking me stupid https://slashdot.org/comments.pl?sid=9986237&cid=53480147/ & your tech screwups do the rest!

* Thank you for committing suicide for us all to enjoy!

APK

P.S.=> You pitiful little weasel... apk