Slashdot Mirror
Koolova Ransomware Decrypts For Free If You Read Two Articles About Ransomware (bleepingcomputer.com)
An anonymous reader quotes a report from BleepingComputer: We have a new in-development variant of the Koolova Ransomware that will decrypt your files for free if you educate yourself about ransomware by reading two articles. Discovered by security researcher Michael Gillespie, this in-development ransomware is not ready for prime time. In fact, I had to mess with it a bit and setup a local http server to even get it to display the ransom screen. In its functional state, Koolova will encrypt a victim's files and then display a screen similar to the Jigsaw Ransomware where the text is slowly shown on the screen. This text will tell the victim that they must read two articles before they can get a decryption key. It then tells you that if you are too lazy to read two articles before the countdown gets to zero, like Jigsaw, it will delete the encrypted files. This is not an idle threat as it actually does delete the files. The articles that Koolova wants you to read are an article from Google Security Blog called Stay safe while browsing and BleepingComputer's very own Jigsaw Ransomware Decrypted: Will delete your files until you pay the Ransom article. Once you read both articles, the Decripta i Miei File, or Decrypt My Files, button becomes available. Once you click on this button, Koolova will connect to the Command and Control server and retrieve the victim's decryption key. It will then display it in a message box labeled "Nice Jigsaw," in reference to the Jigsaw Ransomware, that displays your decryption key. A victim will then be able to take that key and enter it into the key field in order to decrypt files.
How does it know if you really read the articles?
I suspect the moron actually believes he's doing someone a favor - but there is never an ethically appropriate way to damage or steal information that isn't yours on equipment that isn't yours. As I recall, wasn't there some clod that released a virus a decade back that actively (attempted to) hunt down and remove other virii from infected computers, ostensibly as a public service? The idea ended up conceptually integrated into other exploits as a way to ensure that a given bot was only enslaved by one botnet at a time, a very valuable idea for botnet operators but hardly a public service.
That's it. I'm making my own Internet, and nobody else can be on it.
with no threat of damage would be more effective. Not very, but at least more than really putting people's data at risk
Am I the only person thinking these security researchers are the authors of the various forms of malware of late? Gotta keep the grant funding machine lubricated in academia afterall.
This is a fun example, but it suggests that ransomware can be used to induce people to do much more than paying a fee. On the more benign side, you could easily see some ransomware require you to click on a dozen or so affiliate links. More troubling, in another iteration the ransomware would only decrypt your files if you order products using a stolen credit card that is provided to you, or if you transfer some child porn from server A to B. Sounds like it could be out of a Black Mirror episode.
Fast Federal Court and I.T.C. updates
If you don't read this article about why guns are bad I'm going to keep shooting kittens.
Common Sense 2017 just came out. Make sure you upgrade and spread the word!
In a strange coincidence of "one thing happening after two other things happen", the "please stop breaking my knees" button becomes available after the ransomware's author has had both of his knees broken.
There is no doubt that this is both unethical and illegal in most jurisdictions.
It also won't work. Regular computer users are not knowledgeable. Even experienced users, even people with college degrees in computer security will err. People will mistake the dialogue box for an ad, people will think that it will go away with a reboot, etc. That users err is a natural law, the first thing they teach you in User Interfaces 101.
It won't be fool-proof. Even perfect software has bugs. The Internet has outages. People don't always unfiltered Internet access: people travel with their computers, people use their company's computers behind high corporate firewalls etc.
It will be dangerous. People will get their files deleted, and then they will get angry.
Even if the author's actions may be legal within the jurisdiction in which he lives (which is doubtful)... he will have made himself a target.
Delete the files of the wrong person, and he might end up with a busted skull with his blood on the pavement.
"We mustn't be caught by surprise by our own advancing technology" -- Aldous Huxley
When I click on the link "stay safe while browsing", I get a Google Security Blog, and the rest of the page is blank. Am I doin it right? :)
It's never legal to do something like this, but ethical? Absolutely. Different people have different ethics, you shouldn't push yours on other people.
The author of this ransomware is doing exactly that though: forcing others to accept his ethics. So using your own definition of ethical behaviour this is still unethical. Arguing that this is an ethical way to motivate learning is the same as arguing that spreading curable STDs is an ethical way to educate people into having safe sex.
"Uh-oh, boss. I've been reading about this a lot, but ... *sigh* never even thought that we would be victimized
"Wait a second, er maybe we don't need to call my friend..."
"I think we're in the clear.
These lines, tossed in at the appropriate times, with the proportionate grim look, and a reach for the phone (land line a must!) will get you that raise. Or that walk-in movie role.
What could possibly go wrong?
Just delete my files, I'm not going to sit down and let a computer lecture me.
“Common sense is not so common.” — Voltaire
Given that morons still click christmas_card.exe, and some of those click happy morons are executives and sysadmins, I have no need to double my workload by creating more problems to fix. The bad guys and the sloppy users create plenty enough problems.
Either they will finally educate themselves about computer security. Or their e-mails and stuff will get erased, which is probably for the best given how embarrassing it is whenever we get a look at it.
If you're going to "educate" people like this, you could at least use a weaker encryption for when your command and control goes offline people have a way to break it.
Even *if* they can read English and might be able to follow these instructions...
While this is unethical and dangerous to release to the wild, it is somewhat comical in that it encourages user to educate themselves on safe browsing practices.
It won't work, people will still lose files, and they will get angry, but it does bring up a good point...How do we educate the general public on safe browsing?
The average user won't go out and educate themselves. They might pick up a little if they get burned, but that's unlikely. This method forces them to stare at a screen and "read" the article, but a panicking user afraid of data loss is in no mood to be educated.
Should we thwapp them over the head? Should we beg and plead with them? Continue educating them? Or resign ourselves that it's a lost cause...
Most internet denizens don't want to hear about safe browsing ideas. Clicking on adds are bad. Movie streaming services hosted in Russia are probably full of malware. Rogue_One_free_HD1080p.exe is not what you think it is...I've explained it to friends, only to be back over, helping them recover from yet another mistake.
I personally like the bat idea...
Morpheus : The Matrix is a system, Neo. That system is our enemy. But when you're inside, you look around. What do you see? Business people, teachers, lawyers, carpenters. The very minds of the people we are trying to save. But until we do, these people are still a part of that system, and that makes them
our enemy.
A woman walks by, standing out from all the people in suits, as she is wearing a bright red dress, and bright red lipstick. Neo stares.
Morpheus : You have to understand, most of these people are not ready to be unplugged. And many of them are so inert, so hopelessly dependant on the system, that they will fight to protect it.
Morpheus : Were you listening to me, Neo? Or were you looking at the woman in the red dress?
Neo : I was...
Morpheus : Look again..
Neo turns around, to see that the woman in the red dress has turned into an agent, and is pointing a gun at his head. Neo ducks, covering his head with his hands.
Morpheus : Freeze it.
[You have now been educated about the dangers of malware - including ransomware - scrambling data / scrambling brains. Next time you might not be so lucky.]
"Morpheus : You have to understand, most of these people are not ready to be unplugged. And many of them are so inert, so hopelessly dependant on the system, that they will fight to protect it"
See subject & it's not INERT - it's INURED https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=what+does+inured+mean%3F&btnG=Google+Search&gbv=1/
APK
Generally I believe in "thou shalt not kill", but I think the filth that make ransomware and most other malware should be slowly fed into a wood chipper feet first.