Here's another screenshot, with a different address: https://img.jes.xxx/1472
Also appears to be paid: https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNX...
Appears to be paid twice in fact, honestly I'd bet that it's people paying these as a joke rather than the NHS.
And multiple payments could occur if the software has a pre-populated list of addresses rather than generating a new one for each infected machine.
Of course, it could be the attacker sending money to himself to try to make victims think other people are paying.
I don't know what to do with it. I mean some stores support it, and I found you can buy Amazon gift cards.
It's not like you just "turn it into cash" and Xappo is not supported in the US. I realize there are alternatives.
I don't have much anyway, but it's crazy! Worth more than gold. I wonder about that 4K $ value that someone estimated.
I'm just buying for FOMO I guess.
By not developing an unlock in the first place they can get it out quicker and have less risk. Sure, the next hacker may not get paid because they aren't trusted but for the most part we're talking about individual operations.
Not at all. This is run-of-the-mill encryption. You pay the bitcoins, your computer receives the decryption key. There is no possible way to crack it, otherwise the entire internet would be broken. (i.e. TLS)
Similar to the entire internet, while the tools to securely encrypt things exist, incompetence can cause people to roll their own, or roll things out improperly.
Whereas throwing together a program that corrupts every file on the hard drive is not too difficult.
You were wrong.
> This is not really a mistake from the ransomware authors, as they properly use the Windows Crypto API. Indeed, for what I've tested, under Windows 10, CryptReleaseContext does cleanup the memory (and so this recovery technique won't work)
(From https://news.ycombinator.com/item?id=14377328)
So it's yet another security bug in Windows that lets people recover those keys.
If a sufficiently large proportion of cryptolocker malware didn't actually have an unlock mechanism, it would become apparent quite quickly. We'd see reports on places like HN and SO, ultimately trickling out into the popular press. Only the most naive victims would ever bother paying the ransom, because it would be common knowledge that it doesn't work.
In the long run, ransomware is only successful if paying the ransom usually works. There may be an element of collusion amongst organised criminals, or simply a sense of personal pride by the authors.
Everybody understands that it is in their future business interest to unlock.
[1]: https://www.bleepingcomputer.com/news/security/development-v...
Are there any examples where that's not the case? Where regardless of payment, you're still fucked (either by files not being decrypted or by them deleting regardless of payment?)
1. Anecdote about the "logical" argument you already described
2. Anecdote from an internet person about an unnamed professor
3. A call to selection bias, with no hard evidence
For a rather generous interpretation of "honest" :)
Other people are definitely paying. The scheme stops working as soon as word gets out that paying doesn't restore your files.
Edit. Corrected currency to the Pound.
(UPDATE: sounds like there are many more impacted parties since I first commented, so my comment is likely much less correct.)
Typically it's just hard-coded and then they ask you to just email them with which transaction is yours to unlock. So you could just wait for somebody else to pay and then quickly claim their transaction first..
Apart from that, I agree: I suspect it has a hardcoded list of addresses and it picks one at random.