Slashdot Mirror
Hacker Behind Massive Ransomware Outbreak Can't Get Emails From Victims Who Paid (vice.com)
Joseph Cox, reporting for Motherboard: On Tuesday, a new, worldwide ransomware outbreak took off, infecting targets in Ukraine, France, Spain, and elsewhere. The hackers hit everything from international law firms to media companies. The ransom note demands victims send bitcoin to a predefined address and contact the hacker via email to allegedly have their files decrypted. But the email company the hacker happened to use, Posteo, says it has decided to block the attacker's account, leaving victims with no obvious way to unlock their files. [...] The hacker tells victims to send $300 worth of bitcoin. But to determine who exactly has paid, the hacker also instructs people to email their bitcoin wallet ID, and their "personal installation key." This is a 60 character code made up of letters and digits generated by the malware, which is presumably unique to each infection of the ransomware. That process is not possible now, though. "Midway through today (CEST) we became aware that ransomware blackmailers are currently using a Posteo address as a means of contact," Posteo, the German email provider the hacker had an account with, wrote in a blog post. "Our anti-abuse team checked this immediately -- and blocked the account straight away.
While this doesn't do anything to improve life for the poor folks trying to retrieve their files, this type of aggressive approach may be required to eliminate the incentives for ransomware creators. It's truly the nuclear option, as the fallout is likely to hurt many unintended targets, but it could end the war.
Looks like hackers need to use email servers from companies that don't give a shit, or make their own.
They could've just cooperated with the authorities to unmask the scumbag.
It just take a moment of inattention on his part to not use a vpn/tor/whatever else that mask his IP.
From the article: "The Chernobyl nuclear power plant has also had to monitor radiation levels manually after its Windows-based sensors were shut down."
That statement by itself is disturbing enough as it is.
Let the scammer's email addy active and be accused of being accessory to racketeering?
Tough shit for the ransomware victims, but they just had to do it.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Stop paying fucking ransoms you fucks.
Almost 700 years ago a massive plague wiped out tens or maybe hundreds of millions of Europeans and today a computer virus caused massive outages of service for retailers, banks, manufacturers, airports and government offices (the most irrelevant of all problems, maybe an actual benefit even). Obviously this is all connected and it's Russia that caused it obviously (Petia - diminutive of Petr or Peter if you like.)
You can't handle the truth.
It would be funny, except that people are paying the ransom and not getting their files back. Perhaps there will be a positive result here and people will start to get the idea that it is never worthwhile to pay the ransom and to keep backups instead. Oh, who am I kidding? That is #5 of The Six Dumbest Ideas in Computer Security.
lawsuits will be forthcoming
about having to ransom their gizmos? another madison ave. smoke & mirrors debacle? cease fire stand down applies.. sing along.. https://www.youtube.com/watch?v=3TrSMaOZm3Y
What systems are affected? Windows and...? What is the attack vector, do you have to click on a suspicious link or is it like Wannacry where you don't have to do anything to get infected, just have a machine connected to the internet?
I did scanned TFA briefly but is skimpy on details.
There will always be people who pay the ransom. Just like saying "do not feed the trolls" for decades hasn't stopped people from trolling and getting bites, you won't stop ransomware that way. But there are some better ideas:
1) The NSA needs to be held accountable for hoarding vulnerabilities. The American people need to demand this, and perhaps massive ransomware infections will make it evident that these organizations prioritize their hacking ability ahead of real security.
2) This is a business opportunity for cloud-based or offline backup systems. There's a lot of money to be made of more people and businesses start making backups.
3) There could be OS-level protections that would make it harder for ransomware to operate. I'm thinking something along the lines of keeping shadow copies of files around that have been overwritten, and can't be deleted without direct user confirmation. Basically, you can encrypt a copy of the file, but there's a shadow copy residing on the disk that the OS prevents from being encrypted or deleted without direct authorization from the user. When that shadow storage space fills up, the user is promotes to clear it or the disk is treated as full and writes to files are prevented until there's space in the shadow storage area.
Entirely hacks possible hacks to hacks write hacks this hacks without hacks invoking hacks the hacks cyber hacks bogeymen hacks of hacks teh hacks intarwebz.
So hacking pick hacking your hacking sources, hacking you hacking lazy hacking failures hacking of hacking editors.
Fairly certain extortion is illegal in Germany too, so once the email provider was made aware of the criminal acts occurring on their system, they have to shut it down, lest they be considered accomplices (witting or otherwise) in the criminal endeavor.
That you didn't realize this is no surprise to me, as your random capitalization of words and parroting of political talking points already outed you as a fucking moron who was likely unable to think critically.
It's a private company. They set the terms of service and decide who can and can not use their products/services and for what purposes. I wouldn't be surprised if there was clause in the TOS stating that the service can be terminated for any reason and without notice.
I don't think so. Deleting email may be illegal, but if they keep all the mail and offer the account-owner a chance to get it by identifying himself, this is legally quite above board. It is also very likely that the account owner is violating the TOS of Posteo.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Because if they did, they would have to also cover the original source, which is the N$A. If the U.S. starts to get flack for creating this kind of software, then an actual investigation will have to be made. That puts a security risk because the investigators would be someone outside of the agency, to which is not going to have better security. It will leak. Then, the other four of the Five Eyes may be forced to be investigated as well. I don't think the people in the UK and EU realize how badly they are being spied on 24/7; it's become normal to them.
Or more reasonably terminated for criminal activity.
What LAW would That be?
These hidden cybercriminals should be catch and sent to jail.
Make DDoS to Bitcoin's servers.
Make DDoS to Tor's servers.
If you see this text, then your emails are no longer accessible, because you are a piece of $h1t.
Now we have a way to disable ANYONE's Posteo account: send a few emails saying "here's the proof I paid my ransom, please unlock my files!!", then tell Posteo that x's email is being used to receive ransomware confirmations. Their anti-abuse team will read the poor guy's email, see the ransom mail, and block the account straight away.
Out of curiosity, why don't anti-viruses create a random file on disk and flag any process that modifies it as a suspected ransomware (for manual or automated intervention)?
Maybe instead of pumping all that money into trying to get little nippers to think CS is da bomb, they could funnel those funds into adult-ed style courses that cover things like:
How to setup your computer so you're not running as a privileged user.
How to backup your important user files in case of a catastrophe.
How to avoid falling victim to phishing/ransomware scams.
(with a focus on safer e-mail and browsing behaviors)
These kind of courses probably wouldn't cost as much, wouldn't take as long, and would be more beneficial to a wider audience in the long run.
Privacy is constitutionally protected. It's illegal for their anti-abuse team to "check" someone's account, no matter how well-intended they might be. The starting point of any action must a police investigation, the issue of a warrant, and inspection of the account by an officer. During this process the company's anti-abuse team never gets to see anything.
The irony. Its delicious.
Maybe the guy can publish his postal address, so people can mail their info to him.
It must have been something you assimilated. . . .
You're thinking that Germany passed a law saying that email providers are required to always provide users with free access to their account, even if that email account is used as part of a crime? For example, trading child pornography, trading copyrighted content, facilitating money laundering or extortion, etc? Why would any country pass a law like that? I can't think of a single country which WOULD have a law like that.
But, don't let simple rational logic stop you from contacting the real "News Media" and asking them to investigate Germany over this. The world still needs humor.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
What German constitutional statute?
Privacy is constitutionally protected.
What, you mean in the United States, by the United States Constitution, which wouldn't apply to Germany anyway? Are you talking about the fourth amendment? Because, and I'm not a lawyer or anything, but I bet that if a ransomware campaign publishes an email address to use to send extortion payment info, I'm pretty sure that investigation of that email account would not be classified as "unreasonable search". That search sounds pretty reasonable to me. In fact, deciding to deactivate access to this account just because the address appeared in the actual malware doesn't even require that they look at the emails in the account. They can just disable access to it, they don't even have to delete any of the emails or reject new emails in order to do that, they can just turn off the ability to check emails on the account.
But, let's face it. The fourth amendment has been eating shit for the past 16 years, with no end in sight. Disabling an email account that is used in an extortion campaign is the least of our worries at this point, not even mentioning the fact that the US Constitution has nothing to do with this story.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Hard on the victims that paid. Perhaps the word should be out that criminals won't necessarily give you anything for your bit coins. About time someone had nerves. Thanx.
It is always a temptation to an armed and agile nation
To call upon a neighbour and to say: --
"We invaded you last night--we are quite prepared to fight,
Unless you pay us cash to go away."
And that is called asking for Dane-geld,
And the people who ask it explain
That you've only to pay 'em the Dane-geld
And then you'll get rid of the Dane!
It is always a temptation for a rich and lazy nation,
To puff and look important and to say: --
"Though we know we should defeat you, we have not the time to meet you.
We will therefore pay you cash to go away."
And that is called paying the Dane-geld;
But we've proved it again and again,
That if once you have paid him the Dane-geld
You never get rid of the Dane.
It is wrong to put temptation in the path of any nation,
For fear they should succumb and go astray;
So when you are requested to pay up or be molested,
You will find it better policy to say: --
"We never pay any-one Dane-geld,
No matter how trifling the cost;
For the end of that game is oppression and shame,
And the nation that pays it is lost!"
People who develop ransomware are candidates for pubic execution. And it should be made illegal to pay their ransom.
Maybe they're referring to The Basic Law for the Federal Republic of Germany
They probably have no idea what is in that law, but you know, 'Merica
These crypto-bandits don't need to provide anything once paid.... think about it.. they don't need the email address.
It's called "dignity of Man", and it is part of the preamble of the German constitution. From there, the so called "Census decision" of 1983 derived the right to informational self-determination.
Wow. You have a serious psychological problem. Your data hoarding is just a scratch of the surface. 9 storage units and a house? You need psychological help, and maybe medication.
The hacker is still getting his money, the people have already paid, and not receiving emails at this address does not prevent him from accessing his money.
The poor sods who's data has been encrypted on the other hand, now cannot get their keys, despite the fact that they have already paid.
This is probably not a real ransomware attempt. It's either a test that got released into the wild, or it's a simple malicious virus that was released and is masquerading as ransomware. Because it was initially released via a Ukrainian government website that businesses there need to use, it seems possible that this is another attack on Ukraine by the Russian government.
Most ransomware infections use a different wallet code for each victim; this one has just one. Most ransomware also takes communication via TOR so it can't be blocked; this one used a public email. The dichotomy between the competence of the infection and the incompetence of the ransomware portion is what gives the impression that this is not really ransomware.
"I will trust Google to 'do no evil' until the founders no longer run it." Hello Alphabet.
Rubbish, Once the "theoretical good version of an NSA" disclosed the vulnerabilities, they would be patched and useless to everyone.
Why not alert the authorities and allow the hackers to use the email. They have to login and read the emails send to that address after all. And yes, I know, tor etc etc redirects, bouncing across 20 different networks etc etc. But surely the authorities can track this shit?
People need to patch their software
Software companies need to provide fixes and better test to eliminate these security problems before they get into the wild
AND governments need to tell the software companies about vulnerabilities that they have found and STOP using those vulnerabilities to make hacking software
This war needs to stop, or it will end very badly.
This is why we can't have nice things