Author Topic: Ransomware is about to get a lot worse, by holding your operating system hostage  (Read 5450 times)

0 Members and 1 Guest are viewing this topic.

Offline SZonian

  • Strike without warning
  • Hero Member
  • *****
  • Posts: 3,710
  • 415th Nightstalker
The threat of ransomware has grown at an unprecedented rate, rising from being a menace to becoming by far the most common form of malware delivered to victims by cyberattackers.

In the space of a year, ransomware appears to have evolved on from the simple but effective strategy of locking down the files of infected targets until they pay a ransom, to incorporating additional malicious elements, such as stealing personal or financial data from the victim's system.

While the success of ransomware demonstrates there are plenty of victims who'll pay cybercriminals in order to get their files back, there are also schemes such as No More Ransom which allow them to restore their computer without having to part with a penny.

Now cybersecurity researchers warn that new ransomware features could make life even worse for victims. Rather than just encrypting key files, ransomware could soon infect a computer to such an extent that the only two options available to the user would be to pay, or to lose access to the entire system.

[excerpted]
http://www.zdnet.com/article/ransomware-is-about-to-get-a-lot-worse-by-holding-your-operating-system-hostage/
Throwing our allegiances to political parties in the long run gave away our liberty.

Offline Sanguine

  • Hero Member
  • *****
  • Posts: 35,986
  • Gender: Female
  • Ex-member
Probably a dumb question, but if we have backups, what can they do?

Offline endicom

  • Hero Member
  • *****
  • Posts: 10,113
Probably a dumb question, but if we have backups, what can they do?


Backups are of data. If you've imaged your hard drive then you can reinstall your OS and apps. More correctly, you should be able to reinstall your OS and apps.

Offline SZonian

  • Strike without warning
  • Hero Member
  • *****
  • Posts: 3,710
  • 415th Nightstalker
Probably a dumb question, but if we have backups, what can they do?
You probably won't lose your files, but from the article:  "...variants of this type of ransomware, which is designed to modify the infected computer's Master Boot Record, the part of the system which controls the ability to boot into the operating system."

Sounds like you lose your 'puter unless you completely wipe it and start over.  FTA: "The inability to do anything with the system aside from viewing the ransomware note will only give victims two options: pay up, or have their system wiped completely."
Throwing our allegiances to political parties in the long run gave away our liberty.

Offline thackney

  • Hero Member
  • *****
  • Posts: 12,267
  • Gender: Male
Probably a dumb question, but if we have backups, what can they do?

No mini-bar for you: Luxury hotel pays up after virus locks guests out of rooms
http://www.digitaltrends.com/computing/ransomware-hotel-key-cards/
January 30, 2017

The targets for ransomware attacks continue to get stranger. Over the weekend it was reported that a luxury hotel in Austria paid about $1,600 in bitcoin to retrieve its systems. The attack had even compromised the hotel’s electronic key card network, locking guests out of their rooms.
The Romantik Seehotel Jaegerwirt hotel in Turracher Höhe, Austria, said it has been targeted numerous times by ransomware attacks, but is only going public with this information now as a warning to others....
Life is fragile, handle with prayer

Offline InHeavenThereIsNoBeer

  • Hero Member
  • *****
  • Posts: 4,127
You probably won't lose your files, but from the article:  "...variants of this type of ransomware, which is designed to modify the infected computer's Master Boot Record, the part of the system which controls the ability to boot into the operating system."

Sounds like you lose your 'puter unless you completely wipe it and start over.  FTA: "The inability to do anything with the system aside from viewing the ransomware note will only give victims two options: pay up, or have their system wiped completely."

Nah, the MBR can be overwritten anytime without affecting anything (if you know what to write, which you'll have from backup at least in Llinux).  Actually, if (almost) all it did was overwrite the MBR, recovery would be a very simple process.
My avatar shows the national debt in stacks of $100 bills.  If you look very closely under the crane you can see the Statue of Liberty.

Online roamer_1

  • Hero Member
  • *****
  • Posts: 43,815
Probably a dumb question, but if we have backups, what can they do?

The problem with that is that data has become so large that most backup scenarios are automated... So if the live file becomes 'infected' by way of being encrypted, the file's date is changed, which means the backup program will automatically copy the encrypted file into the backup store. The only thing presumably unaffected would be manual backups that are not network connected - Like a USB external drive that is only plugged in for backup purposes, and then disconnected again.


Offline Sanguine

  • Hero Member
  • *****
  • Posts: 35,986
  • Gender: Female
  • Ex-member
The problem with that is that data has become so large that most backup scenarios are automated... So if the live file becomes 'infected' by way of being encrypted, the file's date is changed, which means the backup program will automatically copy the encrypted file into the backup store. The only thing presumably unaffected would be manual backups that are not network connected - Like a USB external drive that is only plugged in for backup purposes, and then disconnected again.

That's exactly what I use.  Backup once a week and the backup is kept separate from the computer.

Offline SZonian

  • Strike without warning
  • Hero Member
  • *****
  • Posts: 3,710
  • 415th Nightstalker
Nah, the MBR can be overwritten anytime without affecting anything (if you know what to write, which you'll have from backup at least in Llinux).  Actually, if (almost) all it did was overwrite the MBR, recovery would be a very simple process.
Probably for the more computer "literate" in our midst... :tongue2:

Throwing our allegiances to political parties in the long run gave away our liberty.

Online roamer_1

  • Hero Member
  • *****
  • Posts: 43,815
Nah, the MBR can be overwritten anytime without affecting anything (if you know what to write, which you'll have from backup at least in Llinux).  Actually, if (almost) all it did was overwrite the MBR, recovery would be a very simple process.

Unless it sets the encryption bit, or pwd protects the hdd... very few techs can fix that. I can usually crack a HDD pwd, but I still don't have a reliable means of recovering an encrypted drive.

Offline ShadowAce

  • Hero Member
  • *****
  • Posts: 157


@BikkFire @geronl @Smokin Joe @roamer_1 @Blizzardnh @markomalley @VarmintAl @Doug Loss @Unlimited @guitar4jesus
@kevindavis

Online roamer_1

  • Hero Member
  • *****
  • Posts: 43,815
That's exactly what I use.  Backup once a week and the backup is kept separate from the computer.

Good for you (n this case)- though that is uncommon anymore... and not enough, btw... Always have two chains of backup. Doing what you do AND having an automated backup to an external drive tied to your router (as an instance) might just save you... What happens if the external you use becomes corrupted or fails? Always have two.
« Last Edit: January 31, 2017, 07:43:02 pm by roamer_1 »

Offline Sanguine

  • Hero Member
  • *****
  • Posts: 35,986
  • Gender: Female
  • Ex-member
Good for you (n this case)- though that is uncommon anymore... and not enough, btw... Always have two chains of backup. Doing what you do AND having an automated backup to an external drive tied to your router (as an instance) might just save you... What happens if the external you use becomes corrupted or fails? Always have two.

Good advice; thanks.

Offline InHeavenThereIsNoBeer

  • Hero Member
  • *****
  • Posts: 4,127
Unless it sets the encryption bit, or pwd protects the hdd... very few techs can fix that. I can usually crack a HDD pwd, but I still don't have a reliable means of recovering an encrypted drive.

That's true, but, if they do anything that protects the MBR with a password, they're probably losing most of their  "customers".  Once an infected system is rebooted, if you can't access the MBR you can't get to the message about where to send your money.

Of course, if they're not after the money...
My avatar shows the national debt in stacks of $100 bills.  If you look very closely under the crane you can see the Statue of Liberty.

Online roamer_1

  • Hero Member
  • *****
  • Posts: 43,815
That's true, but, if they do anything that protects the MBR with a password, they're probably losing most of their  "customers".  Once an infected system is rebooted, if you can't access the MBR you can't get to the message about where to send your money.

Of course, if they're not after the money...

It's hard to understand what the press means - their lack of expertise may lead to misunderstanding. If it is indeed only an MBR overwrite, then replacing it would be so simple that an NT rescue disk could probably do it automatically - which is saying something... Pretty easy to find the PARTS and see which one is active...

If all the bug does is set some tiny PART off the end of some drive, and direct the MBR to hand off to that PART (make it active)...

Or if it is firing itself from the MBR (a boot manager w/o choices)...

Simple things to fix.

Oceander

  • Guest
That's true, but, if they do anything that protects the MBR with a password, they're probably losing most of their  "customers".  Once an infected system is rebooted, if you can't access the MBR you can't get to the message about where to send your money.

Of course, if they're not after the money...

Drop in a custom MBR that points to a custom mini-OS that boots up and runs just enough code to provide the victim with the place to send the ransom and a field to enter the unlocking code.

Online Fishrrman

  • Hero Member
  • *****
  • Posts: 35,604
  • Gender: Male
  • Dumbest member of the forum
Over on the Mac side, "ransomware" isn't a problem -- at least, not yet.

There has been only one instance of ransomware on a Mac:
A ransomware app buried in a release of the "Transmission" bit torrent application.
It was quickly identified, and a fix was issued in a day or two.

That was some time ago.
Nothing since...

Oceander

  • Guest
Over on the Mac side, "ransomware" isn't a problem -- at least, not yet.

There has been only one instance of ransomware on a Mac:
A ransomware app buried in a release of the "Transmission" bit torrent application.
It was quickly identified, and a fix was issued in a day or two.

That was some time ago.
Nothing since...

The middle of 2016 - not so long ago - and there has been AFAIK one *nix-based ransomware that was discovered in 2015 and, allegedly, infected "tens of users".  Might want to consider linux instead of MAC if that's your primary concern.

Online roamer_1

  • Hero Member
  • *****
  • Posts: 43,815
Drop in a custom MBR that points to a custom mini-OS that boots up and runs just enough code to provide the victim with the place to send the ransom and a field to enter the unlocking code.

@Oceander

Right, but if that's all it does, I can fix that in my sleep... if it is actually encrypting, that's a whole nuther matter.

Oceander

  • Guest
@Oceander

Right, but if that's all it does, I can fix that in my sleep... if it is actually encrypting, that's a whole nuther matter.

Very true.  Unfortunately, most people don't know how to do that and a significant fraction would probably pay up.

Online roamer_1

  • Hero Member
  • *****
  • Posts: 43,815
Very true.  Unfortunately, most people don't know how to do that and a significant fraction would probably pay up.

But in the meantime, I'll write an automated fix, my 5 station pre-test bench will fill up, and I'll be makin bank on my $50 minimum...

 888high58888

Not that i'd wish it on anyone...

Oceander

  • Guest
But in the meantime, I'll write an automated fix, my 5 station pre-test bench will fill up, and I'll be makin bank on my $50 minimum...

 888high58888

Not that i'd wish it on anyone...

Ahhh!  The truth will out!  Perhaps you're the one who wrote this stuff!!   :silly:

Online roamer_1

  • Hero Member
  • *****
  • Posts: 43,815
Ahhh!  The truth will out!  Perhaps you're the one who wrote this stuff!!   :silly:

Actually, for a change, bugs have not been profitable... I fully expected a massive surge as Win10's exploitable code becomes discovered... but no such boom occurred, unlike every other major version change in Windows*.

*Begrudging kudos, harrumphing all the same.

Oceander

  • Guest
Actually, for a change, bugs have not been profitable... I fully expected a massive surge as Win10's exploitable code becomes discovered... but no such boom occurred, unlike every other major version change in Windows*.

*Begrudging kudos, harrumphing all the same.

I'm sure it's just a temporary vacation!

Online roamer_1

  • Hero Member
  • *****
  • Posts: 43,815
I'm sure it's just a temporary vacation!

Do you remember 2k's release?? Or XP gold through SP-2? O.M.G! Horror highway (exponentially so with no ready bootdisk available). I was buried under bugs for months, literally working around the clock to try to keep up.

This unexpected lull is well worthy of mention.