This initiative wants to help ransomware victims decrypt their files for free

[SZonian]

Europol, Dutch Police, Intel Security, and Kaspersky Lab have teamed up to launch the 'No More Ransom' scheme, in an effort to fight the threat of extortion by hackers.

It's easy for those infected with ransomware to believe that it's game over, and the only way they're going to get their data back is to give in to cybercriminals' demands and hand over a fee.

With ransomware increasingly targeting corporate networks as well as consumer machines, there's even more scope for hackers who don't get the ransom they desire to do huge amounts of damage by deleting vital files.

But now law enforcement agencies and security firms have teamed up to launch a scheme designed to help ransomware victims retrieve their data without succumbing to the will of cyber extortionists.

The "No More Ransom" initiative sees Europol, the Dutch National Police, Intel Security, and Kaspersky Lab join forces to create a portal that provides keys to unlocking encrypted files, as well as information on how to avoid getting infected in the first place.

[excerpted]

http://www.zdnet.com/article/this-initiative-wants-to-help-ransomware-victims-decrypt-their-files-for-free/

[Suppressed]

Good.

Then execute the criminals when caight.

[roamer_1]

Good.

Then execute the criminals when caight.

I got hit... I am loooong past being able to do manual backups or DVD backups... My main file store is several hundred gigabytes...

So I have had automated backups for years and years - Actually a pretty sophisticated system. The one thing it is susceptible to is ransom-ware.  Because it is automated, unless you stop the automation, it naturally overwrites the older versions in the multiple backup locations with the encrypted/infected files (they have a newer change date and file date).

And, when I got hit, all of my regular machines got infected over the LAN - The only ones remaining infection free were my core machines, which are protected by Kaspersky instead of relying upon Microsoft's MSE/Defender...

FORTUNATELY, I have an old server doing nothing... I couldn't stand throwing it out, because it still worked great, so I kept it, and set it up as an auxiliary to my main server so that I could switch to it if the main broke down... Once a month or so I physically turn it on and let it sync to my main server, which includes my central backup store. Otherwise, it just sits there /off... Luckily I realized I was infected before firing that one up.

By far and away, my massive data set was sitting there, pristine. The other normal stores, were all infected and almost worse than 'entirely encrypted', I would hve had to open each file to see if it had been encrypted or not - Making the whole thing useless as the time to do that would be impossible anyway.

My real-time/critical stuff was safe, because it is synced variously online to make it available to tablets and phones...
For instance, since the local mail became encrypted, the sync to online failed, and thus my mail and PIM were saved online.

So really, the only thing that was in peril was my DEV platform, and that, only for less than 30 days worth... I was able to reconstruct that from dated backups (I keep recursive images for 90 days on critical data).

I wound up with a full skate, other than the hours it took to RD the infected stores and back feed them from the preserved one... And the time restoring the <30 day files back into Development. But one way or another, I never lost a single file, which is the main point.

There is a lesson in that. I am now firmly convinced that a backup location of some kind must remain manually operated and otherwise offline. Only to be used after rigorous scanning to be certain the data going onto it is clean.

It is way to easy to habituate automated backups and way too easy to get caught holding the bag.
 

[Suppressed]

I got hit... I am loooong past being able to do manual backups or DVD backups... My main file store is several hundred gigabytes...

So I have had automated backups for years and years - Actually a pretty sophisticated system. The one thing it is susceptible to is ransom-ware.  Because it is automated, unless you stop the automation, it naturally overwrites the older versions in the multiple backup locations with the encrypted/infected files (they have a newer change date and file date).

...

There is a lesson in that. I am now firmly convinced that a backup location of some kind must remain manually operated and otherwise offline. Only to be used after rigorous scanning to be certain the data going onto it is clean.

It is way to easy to habituate automated backups and way too easy to get caught holding the bag.

I'm at multiple terabytes, and I really should get into a manual backup system.  Thanks for the reminder!