How My Mom Got Hacked
nytimes.com
nytimes.com
sure, there are many different levels of extortion. Some outfits are very upfront i.e. "your PC has been locked..." others are much more subtle and appear to come across as a legit operation and it isn't until you speak to your techie son-in-law that you find out you've been hit.
IMHO the best way to nab these guys is the phone rooms. More and more cities / states are requiring these rooms to have licenses and in my city the FBI has set up a temporary shop to go after these guys.
Here's a short article explaining the process and the Verge covered the subject in length: http://ipensatori.com/2014/05/27/tech-support-scams-what-lie...
http://www.theverge.com/2012/5/10/2984893/scamworld-get-rich...
Think of this as a natural balance to the ridiculously insecure internet and people's tech culture. If we are all going to live in a world where we use internet and technologies everyday, we should have a minimum of knowledge on how it works and not blindly trust everything.
One other point, it's useless to try stopping these guys, they are selling the software on the blackmarket with source code, the more you catch the more room you give to new criminals and the better breed the virus becomes ...
When I was younger the internet terrified people. I learned all kinds of simple "don'ts" in the 90s that it seems all got completely forgotten within a decade and now no-one learns anything anymore.
I didn't even use my real name online until a couple of years ago. It was like the first rule of the internet: never put your real-life details on the internet.
Now we have Facebook.
News stories and Outlook viruses made it abundantly clear that you should never ever ever click an attachment if you didn't specifically request it and know exactly what it is (And even then, best to double check).
Now there's a whole bloody black-market industry built on attachment malware.
I was told to never re-use passwords, never write them down, and never give my password to anyone.
Now we have apps that conveniently collect every single one of your passwords to provide a single-point weakness where one password unlocks your entire bloody online identity, and the point of even having separate passwords is completely lost. And it's somehow supposed to be 'more secure'.
I don't understand the internet anymore.
The point is you only trust one security specialist company rather than many non security specialist companies.
It's getting to the point where if you don't use something like lastpass, then reusing passwords to some extent is needed - or do you remember 20 different passwords for each site you visit, even when you visit them only once a year?
I just have this weird cognitive dissonance when I see the 'big threats' that get posted sometimes online. The other day I read a Reddit post about some Dangerous New Threat to Bitcoiners, that amounted to nothing a slightly-more-clever-than-average attachment virus. I don't understand how anyone managed to get as far as even operating a Bitcoin wallet and somehow never learned basics like "don't click blindly on email attachments".
Perhaps you're not the best person to be giving security advice if you don't understand why people - even those who should know better - click on email attachments?
The virus is thought to infiltrate your computer
when you click on a legitimate-looking attachment
or through existing malware lurking on your hard
drive, ...
Don't get me wrong, it's an interesting article, interesting to read about the process that ensues once you've been hacked, and I've up-voted it, but I'm disappointed not to see anything about how it happened.
For what it's worth, I found your comment somewhat snarky.
I agree about the snarkiness though.
But anyway after reading the article it's clear what happened. Evil mail attachement --> infection.
Just as bad if you ask me. There's still nothing about how she caught it.
Think "How I Met Your Mother", which has little to do with the mechanics of Ted meeting his future wife, but rather the story surrounding it.
Apparently anything that is not 100% dull now is clickbait.
But I didn't. It was a great story about what happened after her mom got hacked, and it was interesting, and mildly engaging, but it simply wasn't what it said.
Calling it something like "Paying the hackers" or something like that would have been accurate and just as intriguing.
Is it too much to ask reporters to title the article with something that actually refers to what is in it?
(you can swap in "publications" without really changing what you meant, but I guess it's fair to not blame reporters)
It's not new for organized crime to consider its reputation.
In fact you could argue that organized crime exists solely based on its reputation, and I would certainly argue that for CryptoWall. If nobody trusted that paying them would work, they would lose virtually all reason to do what they do.
I'm not going to defend digital extortion, but it exists because people pay it, and articles like this are part of the problem by making it known to Googlers that paying works.
It's complicated and I think we should think hard about where where we point fingers if we want to fix this.
No amount of educating end users will magically fix these kind of attacks, whether or not people write articles about their ransom payments.
One thing that I think is destructive though is "blaming the criminals", since a) we don't even know who they are, b) their business model depends entirely on them being promoted as a legitimate threat you can pay to fix, and c) blaming them distracts from finding a real solution.
How does blaming the criminals distract from finding a real solution? (You haven't yet even suggested a viable solution that we could be distracted from)
Or in another example, if nobody took a job for a shitty company there would be no shitty companies right? So why are people taking shitty company jobs?
Fortunately, he never had a PC (he was in his mid 80s) so it was obviously a scam but we were all appalled at the cheek of such an approach and the for the fact that a lot of people, particularly the elderly in a moment of stress, would fall for such as scam.
Their hope is that the surviving member will pay up to avoid embarrassment. Yeah, you have to be a sicko to think this stuff up.
> "So what can we all do to protect ourselves? Keep our computers backed up [...] and most of all, Beware the Attachment."
Ah, so the Attachment is what got Mom!
You know, the above should really be "Beware the Attachment processed on a Microsoft Windows box using the default and/or most popular handlers for its file type."
Also: "beware of letting naive users use the same Windows PC's for Internet-based consumption activities net surfing and e-mail, and for production/retention of important content."
If you haven't already read it, SwiftOnSecurity's “A story about Jessica” is rather good for illustrating how badly we've failed as an industry to produce devices which are safe for non-experts to use:
http://swiftonsecurity.tumblr.com/post/98675308034/a-story-a...
On the other hand, WTF is up with that blog?!?
While an obviously viable solution to this is good backups and educating people about computer security, that won't put these people out of business, which is what would really stop this.
Either way though, if anyone here knows of any material delving into hacking ransomware like this let me know, I'd love to read about it.
Furthermore, it's possible to encrypt each file with a different key so one public key would only deceypt one file.
Oh, and a fun fact - with the newest cryptography algorithms it's even possible to modify the files without knowing what they contain. If I'm not mistaken it would even be possoble to create a software that can conpute checksums of files without knowing the file contents.
To my knowledge, this is only true in a purely academic (not practical) sense at present. There do exist homomorphic encryption schemes but current implementations are ridiculously slow.
Why do you say that? The very purpose of public-key crypto is so that you can send only the public key, have the other end encrypt with that, while you hold onto the private key which is the only thing that can decrypt it.
No guarantee this uses public key for the crypto though. From what I know, a symmetric key is more suitable to encrypting huge amounts of data. Could be wrong about that though.
The "decrypt one file for free" feature seems to be specific to CryptoWall which, some have reported, do not use symmetric encryption like CryptoLocker. CryptoLocker stores symmetric keys for each file on the infected machine, encrypt those with a public key and when the payment is received, send the private key from the C&C Server. I would say it's very unlikely CryptoWall would store remotely a private key per file. That could mean a lot of information to be transferred over the wire. Probably because of using only asymmetric (slow) encryption, CryptoWall apparently only encrypt small files completely, and only a piece of the larger ones. One way the "decrypt one file for free" feature might work is by actually uploading the file (or the the encrypted piece of file) to the C&C Server, decrypting it remotely and sending it back. But the feature is definitely worth investigating.
https://blog.fortinet.com/post/cryptowall-another-ransomware...
http://stopmalvertising.com/malware-reports/cryptowall-behin...
Symmetric key encryption is more efficient, but the typical approach when using public key encryption with large files is to use symmetric key encryption, then encrypt the symmetric key with the public key, and then transmit that over the wire.
I imagine that the process used in this software is the following:
1. Generate symmetric key
2. Encrypt symmetric key using (known) public key (the private key remains on the malware owner's servers)
3. Delete the unencrypted symmetric key.
If these three steps are done before the user is told that their files have been held hostage, then by the time that they know they are infected, it's too late to do any analysis of the program, sniff memory, etc. (at best they'll be able to recover the public key and the encrypted symmetric key, which is useless without the corresponding private key). As soon as the ransom is paid, the malware owners will decrypt the symmetric key (using their private key), and send that back to the victim[0].
This could, of course, also use a different symmetric key for each file as well, in addition to the above.
[0] In theory, the malware owners don't even need to store anything per-victim, since the encrypted symmetric key can remain "safely" with the users the entire time. All they need to store is the single master private key.
Each file gets its own key, and those keys are stored on the victim's computer, encrypted with a single key.
DeCryptoLocker can defeat the encryption and restore your files[2].
Symantec says CryptoWall similarly uses public-key encryption with a 2048-byte key[3], but no indication if it can be defeated like CryptoLocker was.
[1] https://news.ycombinator.com/item?id=8834012
[2] https://www.decryptcryptolocker.com/
[3] http://www.symantec.com/security_response/writeup.jsp?docid=...
The program has to encrypt them, unlink the files, and save the encrypted files / archive. If the filesystem needs more space later, it writes over those (discarded) files, right? Everything else would increase disk wear and decrease performance.
Edit: of course excluding SSDs with TRIM/discard enabled.
Also, overwriting discarded files can happen even before the filesystem runs out of space; it depends on the allocation strategy. To maximally preserve the possibility of undeleting files, there would have to be a policy of using the least recently freed blocks for new allocation. That could be pessimistic in other regards, like minimizing fragmentation and seek time.
As it's based on CryptoLocker, all the files would be encrypted with the same key. After CryptoLocker was busted by law enforcement, "Fox-IT and fellow firm FireEye introduced an online service which allows infected users to retrieve their private key by uploading a sample file, and then receive a decryption tool" (https://en.wikipedia.org/wiki/Cryptolocker#Takedown_and_reco...)
edit: technically the files are encrypted with different keys but those keys are stored on the victim's machine and encrypted with a single key -- http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-ne...
If this is the case, I would surprised if they would download the private key for the one free decrypt feature. If they encrypt only small files they might do the decryption on the remote C&C Server?
It's worth investigating anyway.
Cryptolocker is not the problem. The lack of reliable backup is.
15 years into the internet age, and 5 into the cloud you have no excuse.
Data in the cloud /is/ available to everyone that matters.
I'd also like to remind you that it can be impractical to back up some forms of data, especially in the cloud. High definition video (weddings, funerals, holidays) is impractically large.
The problem /is/ Cryptolocker. Anyone with an ounce of practicality will take mitigating steps against it, I have no sympathy for anyone who ignores the risk, but the solution is not massive scale global data duplication, that is treating the symptoms. The solution is to dissuade criminals from this path.
Widescale international cooperation in finding these people would be a start.
Design a simple system that uses amazon as backend to store encrypted data and the keys never leave your control.
There were 4TB drives at 100-sh bucks for big things.
The problem is not Cryptolocker because there will ALWAYS be malware that targets the data itself. And some people will do it just for fun.
I use Duply to schedule incremental backups of my server logs to S3 (write only) and then have S3 expire them after 60 days. Works great.
But how is this related to the internet or the cloud in any way? Putting backups into the cloud is a terrible idea and transferring large data collection over a residential Internet connection makes little sense. Backups for home users became a possibility with the advent of cheap storage, first burners and cheap blank discs and now with large hard drives and flash media.
But the issue at hands here is that with the democratization of the personal computer most users lacks the skills to make their own backups and even among technical people it's not until we got bitten by data loss that we start to take backups seriously.
> Putting backups into the cloud is a terrible idea
> and transferring large data collection over a
> residential Internet connection makes little sense.
I lost a 1TB drive the other day, and the restore worked well after a bit of jiggerypokery.
Previously I used an LTO2 tape system involving Bacula, a VMWare linux instance and a lot of changing tapes. Cloud backup is so much better
Now your home users need to start regular media rotation with scheduled integrity checks with a full copy stored off-site in a geographically diverse location. Are you starting to reconsider your assertion that “putting backups into the cloud is a terrible idea”?
People simply cannot be computer-illiterate in the modern world without eventually being screwed. Nearly every computer ignorant person I know has a virus/spyware/adware ridden PC sitting at home while they're just waiting to find a "computer guy" who can fix it.
I personally think getting into a good backup regimen is a better use for the money than paying some scumbags.
Not really. Their "business model" is extremely restricted. 99.99 of their victims cannot handle the Bitcoin thingy.
(though today they can certainly get ... cheap coins)
Its actually pretty interesting how this developed. Some of guys running variants of cryptolocker realized how much money they were missing out on and established customer support channels to help their victims figure out how to pay.
I also recommend making sure that shadow copies are turned on and allocated plenty of space - including on a separate partition or drive if the user in question regularly comes close to filling the drive. It's not a backup, but it is much faster to restore from a shadow copy than from an offsite backup.
edit: added links
http://stopmalvertising.com/malware-reports/cryptowall-behin...
Sorry, but no, fuck off please. US extraditing people from other countries is an abhorrent practice which should not be happening, ever. Imagine if you got an extradition request from Saudi Arabia, because you broke some of their laws on the Internet. Every single country in the world would tell them to sod off. Yet when US does this it's somehow ok? Absolutely not.
Many legitimate programs will seem to act similarly - opening files and overwriting contents with something else. ID3 tag writers for MP3s, file type converters, batch image processing, etc. This means you can't match easily against the types of actions being taken.
Let's imagine, however, that the antivirus was still able to detect that something odd was happening. If it prompts the user, they will inevitably click 'yes run this file', because that's what they have always done. If it quarantines the file... well, you just add another few lines to the phishing email saying that the attachment is perfectly safe ("scanned by symantec" apparently...) and to go ahead and bring it back out from quarantine
Pre-Bitcoin, the scammer would have her call an expensive foreign premium-rate phone number or mail cash to a foreign address.
I love the elegance of the bitcoin protocol, but I am worred that the civilized world will have to clamp down on it. You just can't have a place where anyone with enough money (a few k EUR/USD) can perform murders without any reasonable risk of being exposed. This will effectively turn us into a bandit country like Russia. I also think it will become harder to effecticely clamp down on cryptocurrencies as time passes, so time is of an essence.
Your 'reasonable risk of being exposed' is when you plan and execute the hit. It's pretty difficult to do. Also, when your target winds up dead, the first investigation is into whether anyone might want that person dead (motive), not the money trail.
Any hitman worth his salt will already today know to get paid in cash or similar liquid assets. As opposed to the ransom situation, the payment of a hit can be arranged long before investigators start looking, so you can easily ship a boxful of cash to a dead drop and avoid ever meeting the hitman in person.
And even if there was a money trail, you couldn't hope to get to a hitman by following it unless you have the other end to start down - ie. you know the "customer", who's the bigger criminal anyway.
> This will effectively turn us into a bandit country like Russia.
No, the availability of anonymous payments is not the defining difference between Russia and 'us'. The rule of law is.
I strongly suspect that we will see a whitelist-endorsed-by-some-reputation-broker approach sometime in the future. The suggestion of this kind of thing usually creates a big backlash among many Bitcoin supporters (for good reasons IMO). But eventually there will be many folks using Bitcoin without any ideological attachment to it, and they'll be lured by the appeal of interacting with agents endorsed by some other party.
A foreign address is still an address, which if used to perpetrate crime on a large scale, would represent a point of vulnerability for the criminals even in a somewhat lawless country. Bitcoin's role in these crimes is analogous to an alternate universe, lawless by design, where criminals can retrieve ransoms anonymously and with impunity.
Isn't this a pretty strong argument against cash?
Isn't this a pretty strong argument against email attachments?
No; totally different arena.
> Isn't this a pretty strong argument against cash?
Cash is a lot more traceable than bitcoin transactions.
> Isn't this a pretty strong argument against email attachments?
? :)
This is extremely false. How did you get this idea?