You’re infected—if you want to see your data again, pay us $300 in Bitcoins

http://arstechnica.com/security/2013/10/youre-infected-if-you-want-to-see-your-data-again-pay-us-300-in-bitcoins/

by elux • 13 years ago

380 288 13 years ago

Fuzzwah• 13 years ago

Victims don't even get the enjoyment of having to make their payments in some far flung corner of an MMO, like the plot of Reamde.

https://www.goodreads.com/book/show/10552338-reamde

Uhhrrr• 13 years ago

That's the first thing I thought of, too. This is just about exactly the model of the Reamde crew.

warfangle• 13 years ago

da G shou

officemonkey• 13 years ago

Which means the Islamic terrorists coincidentally live upstairs (which I believe is one of the stupidest coincidences of any book I have read and enjoyed.)

eli• 13 years ago

The story was no doubt based on earlier real-life examples of "Ransomware" like this one: http://www.infoworld.com/t/malware/ransomware-returns-if-you...

daveid• 13 years ago

The article didn't mention, what systems does this ransomware primarily target? Is it cross-platform?

nvk2• 13 years ago

That i know, only MS

jerf• 13 years ago

But note that's only due to popularity. Socially engineering your way into a user running an executable means that executable will simply run with user privs. No trickery or hacking required, no OS holes. And that will mean that the executable will have full access to do everything a user could do, which will effectively certainly include sending a new encryption key over the network, and encrypting every file that user can get a hold of.

(One of the little problems with the UNIX-style user permissions is that it is designed to defend the OS, not the user. Sure, that little executable may not be able to corrupt "the system", which may amount to 5 or 10 GBs of easily-replaced code, but it will have its way with the 2TB of the single user's media files.)

The only faint defense Linux/UNIX can claim is the slightly higher probability that you'll be on a checkpointing file system and can roll back, and I say only "slightly" because they still aren't very popular yet compared to conventional file systems.

mariuolo2• 13 years ago

I'm sorry, but if a firm doesn't compartimentalise access and a single infected workstation can bring down everything, then they deserve what they get.

Hadn't been ransomware it could have very well been a disgruntled employee, to the same effect.

sillysaurus23• 13 years ago

I want to upvote you for truth, but HN currently has a meanness problem of which this comment is a specimen.

GhotiFish2• 13 years ago

It's not truth, it hits residential users all the same. As much as we nerds might wish it, you don't deserve to be extorted because you don't understand computers.

pavel_lishin4• 13 years ago

While you're technically right - we are responsible for our security, and we should lock down our networks just like we lock our front doors - this is basically blaming the victim.

mariuolo2• 13 years ago

In a nice neighbourhood one could probably leave the door unlocked, but unfortunately internet is more like Gangland than Wonderland.

This said, I'm not blaming home users, but IT folks who failed to secure corporate data and should have known better.

emillerm• 13 years ago

I think the article mentions that it's small businesses that are at risk. Most mom and pop shops don't have the greatest IT infrastructure.

abstractConcept3• 13 years ago

What sort of IT infrastructure do they usually have? - My gut reaction was that they wouldn't have a need for a server in the first place, but I guess that depends on how small it is. A simple file-share though, would be rather vulnerable to this.

rwallace• 13 years ago

Have you fully secured your home and office against arson attacks? No? Don't even know how to do so? Didn't think so. Does that mean you deserve what you get if you end up bankrupt in the event of such an attack?

amalag2• 13 years ago

A company I work with was hit when the employee opened a phishing email supposedly from another employee in the same company. It hit about 50 gb of data on the shared drive. We had Crashplan and restored from a few days previous. I then turned on DKIM and enabled quarantining non DKIM emails via DMARC.

sillysaurus23• 13 years ago

I then turned on DKIM and enabled quarantining non DKIM emails via DMARC.

Translation for techies who aren't familiar with email's many acronyms?

swombat2• 13 years ago

All those acronyms are easily googleable. Not being a techie does not mean you get to be lazy about looking things up.

3pt14159• 13 years ago

DomainKeys Identified Mail (DKIM) lets an organization take responsibility for a message that is in transit. Domain-based Message Authentication, Reporting and Conformance (DMARC) is a technical specification created by a group of organizations to help reduce the potential for email-based abuse, such as email spoofing and phishing e-mails, by solving some long-standing operational, deployment, and reporting issues related to email authentication protocols

blhack2• 13 years ago

DKIM means: http://en.wikipedia.org/wiki/DomainKeys_Identified_Mail

DMARC means: http://en.wikipedia.org/wiki/DMARC

And the person below you doesn't understand how search engines work.

driverdan3• 13 years ago

That doesn't cause problems? I've seen a lot of email that isn't signed.

nvk2• 13 years ago

Stop using Windows, is a good start.

GhotiFish2• 13 years ago

I primary use linux, but even I feel threatened by this. This is Sony's rootkit all over again.

edit: never mind, I thought this was novel. Never heard of ransomware before.

PilateDeGuerre• 13 years ago

This scenario - minus the Bitcoins - was a plot device in Neal Stephenson's "Reamde".

coryfklein• 13 years ago

Ah, I guess it is time to send the annual email to mom, dad, and the in-laws to be very wary of downloading anything or clicking on links in suspicious emails.

I find this is good insurance against the inevitable phone calls I receive as the only computer-literate member of the family: "Hey Cory, all my documents disappeared and I can't get them back. Do I have a virus?"

susi22• 13 years ago

In a corporate environment I'd expect crucial data to be on the network drive and snapshotted every few hours. We run ZFS on our network and all the secretaries have to do their doc/excel work on the drive. Nowadays that everybody has a Gigabit Ethernet connection read/writes are extremely quick.

Use ZFS and make read only snapshots that are only accessible to the sysadmins. You'll solve many problems that way. We do snapshots at 6am,noon and 6pm and then keep the 6pm one for 7, 14 and 30 days.

ballard4• 13 years ago

Yup. That's been the standard practice for the past 10 years, to avoid having to request media from an offsite vendor. Used to use VSS on SANs.

(Tested backups are the first three rules of IT.)

masklinn2• 13 years ago

Use ZFS and make read only snapshots

IIRC ZFS snapshots are read-only by definition. Clones are the writable ones.

mrb• 13 years ago

Agreed. At a previous job, I set up a multi-terabyte SMB/NFS file server (Solaris, ZFS) with snapshots taken every 5 minutes. This was incredibly useful. The snapshots (in .zfs directories) were even accessible to end-users so that they could recover from their own mistakes without the help of sysadmins.

With such a setup, the only situation in which sysadmins are required are when end-users accidentally copy sensitive data to the file server, remove it, and need sysadmins to also remove the snapshots to permanently remove the sensitive data.

vertis• 13 years ago

This is a great solution if you have a good technical staff helping to run a business. The reality is though that this is more likely to affect businesses without technical knowledge, or home users.

marcosdumay5• 13 years ago

In about any corporation you look, crucial data will be in a Windows server (no ZFS available, sorry), and backed up on intervals that are some integer multiple of 24 hours.

Or, better, the above is the best case scenario that IT dreams of achieving some day. In practice, a huge share of the crucial data sits on people's machine, with no backups, and go on vacation every year.

j00lz• 13 years ago

Most corporate windows file servers (since 2003) use shadow copy, which saves previous versions of files every couple of hours. Any decent IT dept will use folder redirection, which redirects deskop, my documents to the local file server.

gwern• 13 years ago

The only new thing about this ransomware is that the payment method is through Bitcoin, right?

smtddr3• 13 years ago

yup. But the fact they're using bitcoin shows a clever way for ransomware to collect payment with virtually zero-risk; since it's not possible(that I know of) to really trace exactly who, in real life, got those bitcoins. Which means, ransomware might make a strong comeback since the risk is now basically zero, this program isn't that difficult to write and there's real money to be made. Even if you only charged 50 USD, this idea would make hundreds, if not thousands, a month. Change the binary every once in awhile so its signature doesn't match popular anti-virus databases and you got free money coming in for... well ...forever[1]

1. Educating users to stop running random programs in zip files attached to emails, is apparently impossible. Maybe email-clients should scan the contents of any zipfile it receives and if it finds any kind of executable, put up all kinds of warning dialogs saying "You really don't want to run this. There's no reason to get a program in zipped email attachment nowadays. Please go consult your IT-admin or somebody who knows about computers for a 2nd-opinion"

donpdonp• 13 years ago

the bitcoin pseudo-anonymity is a plus, but i feel the real value in this new round of ransomware is that the unlocking actually works. Its possible for the ransomware app to verify payment and unlock itself, with no contact or control from the ransomware author, greatly reducing the author's risk. Actually, its easier for the victim too - rather than wiring funds to some bank account in far off lands, a quick anonymous digital payment instead. Im speculating but its possible for the app to query blockchain.info for a deposit for a given address, or (less likely) for the app to download the blockchain itself, and then unlock after a certain balance. If there is high confidence that the data will actually get unlocked, that swings the balance of fight the app or pay the app towards the pay the app side. The author sits back and waits for those wallets to fill up.

pavel_lishin4• 13 years ago

Educating users to stop running random programs in zip files attached to emails, is apparently impossible.

Imagine something just like the malware we're discussing, but instead of a 72 hour timer, it's a 4 hour timer - and at the end, it pops up a "gotcha! just kidding. but if this were real malware, you would have either lost hundreds of dollars, or all your documents. Don't open attachments like me."

greglindahl• 13 years ago

Lower risk, but it probably reduces income: how many people can figure out how to make a bitcoin payment? How long does it take to make a bitcoin payment? The harder it is, the more likely the target is to give up and do without.

arca_vorago• 13 years ago

Actually bitcoin has many strengths, but anonymity is not one of them. There have been multiple papers that go into how easy it is to trace, and even laundering style services like SRO used aren't very good.

http://fc13.ifca.ai/proc/1-3.pdf http://cseweb.ucsd.edu/~smeiklejohn/files/imc13.pdf

untog• 13 years ago

Yes, but that alone is important. A lot more difficult to shut down.

nsxwolf• 13 years ago

Get a Mac.

bickfordb• 13 years ago

Running Windows just became a lot more expensive

tbarbugli• 13 years ago

And than the police shut down the ransomware servers and dooms data from many infected victims to garbage, brilliant!

tempestn5• 13 years ago

Unfortunate for those folks, but if it can prevent many more people from being infected, then still worthwhile.

pavel_lishin4• 13 years ago

Would it actually help? Does the ransomware contact the servers prior to encrypting everything?

blhack2• 13 years ago

You can work to prevent this by creating a group policy that disallows

     %AppData%\*.exe

and

     %AppData%\*\*.exe

A good discussion of this happened here: http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care...

sidenote: this virus actually scares me, and it sounds like it actually scares most people who work in IT. This is the shittiest thing anybody has ever seen, it sounds like.

mcphilip2• 13 years ago

It actually made my skin crawl reading about it. Never had that reaction to such a story before. Interesting...

Edit: It's the BTC aspect that's worrisome. Ransomeware is nothing new -- AIDS Information Trojan did it in 1989, but the (potentially) safe method of payments in crypto currency seem to be a new factor that will attract much more innovation in these type of attacks.

marcosdumay5• 13 years ago

I just though the exact opposite. When I read "Ransomware comes of age with ... anonymous payments." I just thought "Somebody is going for a surprise once he finds out how anonymous Bitcoin really is".

Anyway, what really makes me nervous is Microsoft's insistence of executing any data that a their programs touch.

conductor• 13 years ago

This type of viruses are nothing new [0]. The only new thing in this case is that it demands BitCoins instead of an SMS to a premium number or something else.

[0] https://www.securelist.com/en/descriptions/old313444

dmix• 13 years ago

aka "Ransomware" https://en.wikipedia.org/wiki/Ransomware_(malware)

The first known ransomware was the 1989 "PC Cyborg" trojan written by Joseph Popp

shiftpgdn• 13 years ago

What makes this special is the fact it uses real encryption instead of just a password protected zip file.

crb• 13 years ago

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? (This is how it's able to silently update itself, even when run as a non-administrator.)

MartinCron• 13 years ago

Yes, I was able to install Google Chrome on a PC which the user didn't have administrative rights just yesterday. It delighted me to no end.

lstamour• 13 years ago

My understanding is they changed that and by default it wants admin rights. Then if that fails, it asks if you want to continue without. (At least, this was my experience the last time I had to install Chrome on a machine without admin rights.)

jrabone• 13 years ago

And that's just as good an idea as executable data segments in a binary format (ie. not a very good idea). It's taken MS literally YEARS to get to half-decent default filesystem permissions in Windows 7 and this kind of thing just undermines it totally.

jussij2• 13 years ago

Google Chrome Updater certainly does have a few virus like characteristics.

Every time my interent connection slows (WiFi) I know it's Chrome Updater so I kill it via Task Manager and everthing is good again.

There doesn't apear to be away to turn it off inside Chrome itself and turning off updates via the registry does not seem to stop it.

Silhouette8• 13 years ago

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install?

Yes, and from a security point of view it should be treated as hostile accordingly.

There is no need to actively circumvent Windows security like this. Firefox, among many other examples, is quite capable of automatically updating itself using a proper Windows service mechanism.

It's long past time that Google were called out on this one. Not only is it a potential security risk, it also interferes with backups of %AppData%, which is generally an area of Windows PCs that you do want to save regularly in case of disasters.

missing_cipher• 13 years ago

I'm also seeing Dropbox, uTorrent and PunkbusterB in %appdata% according to fekberg's command.

fekberg3• 13 years ago

Here's a command you can run to find out what executables exist in AppData:

    dir /S /P "%userprofile%\AppData\*.exe" > %userprofile%\Desktop\FoundFiles.txt

m_myers• 13 years ago

Or for PowerShell:

    dir -Path "$env:userprofile\AppData" -Filter *.exe -Recurse > "$env:userprofile\Desktop\FoundFiles.txt"

Useful if your corporate security policy, like mine, has disabled the command prompt but left PowerShell intact.

Silhouette8• 13 years ago

It's helpful to add /A (shows .exe files even if they have hidden/system attributes set) and maybe /B (bare format, just the path/filenames without all the header/footer information).

sfont2• 13 years ago

I tried implementing this solution and it has a lot of difficult side effects. Shortcuts on the task bar could not run (with the exception of Chrome oddly enough). If you select run in IE it fails because it saves to temp and some installers failed as well, again because of the use of temp. Unless the end user is very saavy or has an onsite IT this seems that the better solution is rotating backups. Alternating days to external hard drives that are then disconnected is the best mitigation. And having already had one client effected by this is does scare me. Interesting enough he paid and had his files decrypted in about 48 hours.

shanselman• 13 years ago

Unfortunately lots of stuff runs under there including, but not limited to:

GitHub for Windows and dozens of apps it installs in there F.lux Anything installed with ClickOnce Chrome GMVault Xamarin's Android Support Markdownpad SkyDrive Join.me

Assuming that everything in there is a virus is too much, I think.

tracker1• 13 years ago

I would think that .Net portable apps are likely also per user executables.. not to mention that there are usually at least one scripting environment even on windows cscript/jscript/vbscript/powershell for example, not to mention Java, Python, Ruby and/or node may be installed.

sfont2• 13 years ago

bcoates• 13 years ago

Don't do that, that's crazy. If you don't want your users running random binaries turn on applocker: http://technet.microsoft.com/en-us/library/dd723683(v=ws.10)...

If the "1002.exe" sample on Reddit is accurate the installer is unsigned, so forbidding unsigned binaries should be sufficient. The number of legitimate unsigned Windows binaries is small enough that you should be able to whitelist them by hand.

ary• 13 years ago

AppLocker can't be enforced on Windows 7 Professional (or lower). In my case that was a deal breaker.

http://technet.microsoft.com/en-us/library/ee424382.aspx

That being said a very restrictive Software Restriction Policy as linked below would mitigate CryptoLocker as it exists today. It has worked well for me so far.

http://www.mechbgon.com/srp/

dutchbrit• 13 years ago

Our company was hit by this yesterday, caused a lot of issues. Thank god we had backups, but they were 2 days old (frustratingly enough, the backup failed the previous day - first time in months...)

phogster• 13 years ago

Never heard of ransomware before, but the trend is alarming: http://www.google.com/trends/explore?q=ransomware#q=ransomwa...

mcphilip2• 13 years ago

While I'd like to think I'm sophisticated enough about security to avoid this, it makes me concerned about the vast majority of people (e.g. my parents, my girlfriend) that are clueless about such dangers.

Are there any recommendations of a simple way to at least enable automated backups of local documents to the cloud on a windows box?

mistercow4• 13 years ago

I think that you could use Box for this pretty effectively. With their $15/month business plan, you get 1TB of storage and can apparently set any directory as a "workspace", which presumably includes the home directory. For most users, that would be more sufficient to keep everything backed up and the syncing process is supposed to be the same kind of transparent deal as Dropbox (which would also be a good solution, except that you can't set an arbitrary directory as your Dropbox folder).

synthos• 13 years ago

until it encrypts the workspace and that gets synced. Although, I suppose you might have a previous revision as I know dropbox supports versioning for some (all?) kinds of files.

thenomad2• 13 years ago

Not technically a true backup system, I think, but Dropbox is pretty easy to use and is a lot better than nothing.

misterbwong• 13 years ago

Look into one of the many cloud based backup providers. I don't have any specific recommendations but here's a list off the top of my head:

1. http://www.carbonite.com/ 2. http://www.crashplan.com/ 3. http://www.backblaze.com/

rosser• 13 years ago

From the Reddit article linked above [1]:

"Backup solutions like Carbonite are no good against this as they will commit the encrypted files to the cloud."

You need "cold" backups to get around this without paying.

[1] http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care...

ballard4• 13 years ago

Tarsnap is the only sensible backup provider given the recent history of warantless secret searches in America. SpiderOak is also a contender for file sharing. Both use end-to-end encryption knowable only to the end-user.

dasil003• 13 years ago

I can't afford to have my family photos backed up to tarsnap. Let the NSA have 'em.

renata• 13 years ago

CrashPlan supports this, although it is not the default.

icebraining• 13 years ago

I like and have used Tarsnap in the past, but it's not like other providers prevent you from uploading encrypted archives, they just don't encrypt them themselves.

pbhjpbhj4• 13 years ago

There's list of a some backup solutions relevant to personal backup (as opposed to enterprise level solutions) here, costs for most providers given too and a brief overview of differentiating features - http://alicious.com/cloud-backup-solutions/.

I quite like duplicati. Slightly opaque to set-up but I'm using it with SkyDrive for some files as at the time of set-up SkyDrive gave me the most free storage with the lowest level of pain [for me] setting up.

ingenium• 13 years ago

I really like SpiderOak https://spideroak.com

I have mine set to backup every 4 hours. It versions the files as well so you can restore to a previous backup.

ryan-c2• 13 years ago

I've gotten a few copies of this, all to an email address that was only ever given out to AT&T, and is not guessable.

gknoy• 13 years ago

Would you consider posting a screenshot of what the initial (infection) e-mail looks like?

ryan-c2• 13 years ago

Wouldn't be particularly meaningful since I use mutt.

antihero4• 13 years ago

I think the interesting thing here is the shift from the target - the "best" target used to be compromising the OS, so OS's made moves to protect themselves from programs running as unprivileged users. Now, it's trivial to wipe an OS and restore from a backup. The real value is the things people store on a computer, which are usually going to be accessible via a user account.

One trivial solution would be OS level automatic versioning of files (ala Dropbox or Sparkleshare) - the original files would be written to location that is read only to the user and only accessible via the OS, hence, backups could always be restored from it, but never destroyed without admin rights.

Of course, with people having great internet and whatnot, an automatic cloud based solution would be much more likely and useful.

I think with Windows 8.1 and onwards, Microsoft are automatically doing this by setting up the "Documents" type folders in SkyDrive - a great think moving forward.

Backups are, obviously, a much better solution but require extra storage and usually cost money.

So there might be a niche for a freeware product that runs as an admin that automatically versions files - perhaps even as simple as having an admin-owned .git repo for the Documents folder.

The worrying thing about this attack is that targeting user data is trivial on all OSs, because of the way we think about privileges - it could be done to us Linux users through something nasty in our shell rc using GPG or whatever. There is no need to compromise anything.

masklinn2• 13 years ago

Backups are, obviously, a much better solution but require extra storage and usually cost money.

And the virus will encrypt anything writable, so the backup needs to be "pull", if the infected machine is the one doing backups and has write access to a non-cold-storage backup location it will may encrypt the backup itself.

rgbrenner• 13 years ago

Solved this problem at my startup Nuevo Cloud.. the filesystem is copy-on-write, including deletions.. In the settings you can control how long to keep the copy-on-write log, and then you can jump to any second within the log.

So even if this virus encrypted your backup on Nuevo Cloud, you can just pull up the snapshot from a second before the infection, and restore your files.

mistercow4• 13 years ago

The only virus I ever got was the SevenDust 666 virus on Mac OS 8. An infected machine would have a "666" extension that couldn't be deleted (it would instantly replace itself) and then start losing files. So losing files as a target has been around for many years.

The interesting change to me is that now viruses have been effectively monetized.

waqf• 13 years ago

Not such a new change, for it's been known since at least 1989: https://en.wikipedia.org/wiki/AIDS_(trojan_horse)

jafaku• 13 years ago

This opened my eyes, thanks. I'll see how to set up backups that I can create but not delete.

jve• 13 years ago

BackupPC[1] does this by using pull technique to backup your data.

[1] http://backuppc.sourceforge.net/

Silhouette8• 13 years ago

You make an excellent point, but there is a second and perhaps even more sinister side to it. Encrypting your data and holding it hostage is one thing, but even if you have indestructible backups, there are probably still many sensitive pieces of information that can be acquired by a blackmailer with only user-level privileges: bank details, company trade secrets, personal mail/photos/videos, etc.

Having a back-up of these is important, but probably so is ensuring that they aren't distributed to people they shouldn't be. This requires a very different model of access control and user/application privileges, and unfortunately I don't think any mainstream OS is even close to solving this one yet.

AnIrishDuck• 13 years ago

This requires a very different model of access control and user/application privileges, and unfortunately I don't think any mainstream OS is even close to solving this one yet.

I'm not sure it does require a different model of access control. It just requires people to actually use the access control mechanisms that exist already.

You should not access banking details or any other sensitive information in the same user-level context as you use to generally browse the internet. The privileges needed for each task ("browse the internet" vs. "check bank statements") should be different. I personally have a separate user account on my machine set up specifically for "sensitive" tasks.

Separation of data access via privileges is nothing revolutionary, nor is it something that can't be done on any modern OS. Unfortunately, online services are still behind. For example, I would probably switch to an online banking provider that let me create one account for viewing balances and another for transferring cash. But these services will get there in time.

User education is a different story.

andreyvit• 13 years ago

Well actually, looks like we're getting there.

The problem is seemingly solved by OS X app sandbox and Mac App Store review process (the sandbox alone is not enough, because it allows to declare 'exceptions' like full disk access, so human reviewers are needed to watch out for those).

The sandbox may occasionally be causing some pain (in fact, would be very painful if I had to support OS X 10.7), but at the same time my app can no longer access any user data that the user hasn't explicitly whitelisted, which is a good thing.

Windows Metro apps also live in a sandbox, but they are sort of a different platform (no access to the file system at all, as far as I know). Over time, I can see them gaining some access to a subset of the file system, perhaps via SkyDrive.

marcosdumay5• 13 years ago

the original files would be written to location that is read only to the user and only accessible via the OS

A versioning filesystem looks much cleaner than a different location. Maybe we should start using those again. (Is there any candidate for ext5 already?)

And yes, partitioning the data permissions for the same user is a much needed change. Nobody got a solution for that yet, and there are lots of people trying. Apple, for example, is just giving up on iOS; Google has a subpar solution on Android that does not actually work on practice (the cyanomod people did improved it a bit) but is the closest we have from something viable.

antihero4• 13 years ago

Yep, if this could exist at file-system level it would be wonderful. What candidates actually exist for this and are in a usable state? BTRFS? ZFS?

sergiotapia• 13 years ago

Who are the creators? Are the FBI going to take them to federal-pound-me-in-the-ass prison?

zalzane• 13 years ago

It looks like the patent trolls have finally found their true calling.

ChuckMcM• 13 years ago

Central to the plot in the book Reamde but these guys don't offer a 'pay in WoW gold' choice.

Given the cost of computers these days, at least in business a separate 'browsing' machine and 'business' machine seems to be the best solution. I wonder if you could provide wireless for employees to bring their own laptops which had no 'office' connectivity (but internet connectivity) and machines that were hard wired and MAC filtered to the 'business' network.

Pxtl6• 13 years ago

Well that's moderately horrifying. I've dealt with ransomware before, but mostly it just used scary messages, not literally encrypting all your data.

mrtksn• 13 years ago

but this one seems to do what it claims to do. it's pretty scary for people who don't have decent backup system. but these same people live with the risk of losing their data due to a drive failure, so...

Pxtl6• 13 years ago

A lot of "decent backup systems" would be vulnerable to this too. Say you back up all your local stuff to a RAID that you've mapped as a drive, as well as a mapped Google Drive?

It's still all toast.

That level of backup would handle any kind of physical failure - a dead drive, the destruction of your house, the failure of Google... but still, this thing would kill it.

There's only so much you can expect from a person when it comes to keeping their personal documents and family photos.

I mean obviously, if you're running a company you need a real backup solution, but for family files or a one-man-show business? There is no reasonable precaution.

scotty79• 13 years ago

I wonder if amount of $300 was determined via A/B testing as optimal for bringing maximum profit.

c23gooey• 13 years ago

The article mentions that there is a $100 variant floating around.

Makes me wonder whether they use the $100 variant in markets that $300 would be too much to pay.

If, is as reported, this virus is pulling in around ~$5million / annum, then that is a great basis for setting up a professional organisation to run the virus and extract maximum value from it.

jasonlfunk• 13 years ago

"you need to pay 300 USD / 300 EUR / similar amount in another currency"

How about 300 VND? Seems similar to me. :)

alec• 13 years ago

Since the Bitcoin blockchain is public, couldn't you follow the money? Make a list of all wallets that accepted these funds initially, and then do graph analysis, either to see where the money went or provide others with a tool to avoid transactions with those wallets?

Phlarp• 13 years ago

Theoretically yes, but in practice mixing services make this much much more complex.

sltkr• 13 years ago

Yes, but this is somewhat like saying you could mark the banknotes used to pay off a person that's blackmailing you. If you catch someone with a marked note that doesn't prove they are the perpetrator; it just means that they received your money somehow.

Karunamon• 13 years ago

Problem is that doesn't really help you identify the perpetrators. Both mixing services, and the fact that a user can generate unlimited wallets (if someone sends money to a wallet, you can't prove they own the second wallet or if they transferred money to someone else) makes this very difficult.

gngeal• 13 years ago

This is what Venti (of the Plan 9 fame) is for!

bfell• 13 years ago

This happened to someone I know (really, it wasn't me). Not only did it encrypt the local drives it also hit all of their network drives. As reprehensible as it is to pay the ransom they really had no choice since the encryption happened the prior night before the last backup.

haberman• 13 years ago

You could imagine the Bitcoin community deciding to blacklist any wallets to which funds like this were demanded and disbursed. That seems like a great idea until you then realize that this would be a way of denying anyone access to their own funds, by specifying their wallet as the recipient even though the attacker doesn't control it. There really doesn't seem to be any good countermeasure to this.

dragonwriter• 13 years ago

You could imagine the Bitcoin community deciding to blacklist any wallets to which funds like this were demanded and disbursed.

I can imagine lots of things, but I don't see any reason to believe that that's likely.

kodr• 13 years ago

and then the thief stops sending the key to unlock the data.

seriously the only to stop this is to:

- not get infected by opening random exe

- arrest the thief

FootballMuse• 13 years ago

What's to say that the bitcoin address remains the same? It can be randomly generated for each infection and as such a blacklist would be impossible.

egypturnash2• 13 years ago

That sentence works until you start thinking about the likelihood of herding those cats into any action as a community.

marcosdumay5• 13 years ago

Or the police could just investigate the wallet, because it there is a feature that Bitcoin does not have, it's anonymity.

kbart2• 13 years ago

Which police? The guys behind this virus may as well be somewhere deep in China or Russia, good luck reaching them. It's not a terrorism or child pornography to get serious international attention.

roasty• 13 years ago

Disabling or limiting your use of JavaScript and Java in the browser will go a long way towards protecting against delivery of this as it is likely delivered by an exploit kit. If you do hit an exploit kit, Microsoft EMET (free) will probably mitigate the exploit/s.

AsakiIssa• 13 years ago

I know a customer that got hit by this Tuesday morning. Unsurprisingly, Avast did nothing. I just told her the bad news and clean-installed Windows.

I have tried to find the private key with sample files, using known file byte headers, the public key and brute force on the private key. Sadly, no luck yet.

duskwuff• 13 years ago

That's assuming the private key is even reused. If they're generating a new key for each user (which they very well could be), you're boned.

ggchappell• 13 years ago

I get annoyed when people are warned not to open some attachment. The real problem here is that in 2013 we're still using the flawed language of "opening attachments" -- as if running a native executable with full permissions is an action that belongs in the same category as viewing an image, reading a text file, or listening to music.

Well, it doesn't. This is a problem that should have been solved at the level of OS permissions/UI long ago. Why does a modern OS include UI functionality allowing a standard user to run an uninstalled executable in a non-sandboxed environment? There's no good reason for it.

In some cases the problem been solved (e.g., restrictions that allow only signed apps to be executed). But I guess none of those cases include Windows, its standard UI, and popular e-mail programs. :-(

kuschku• 13 years ago

The best solution would be the one used by Linux: Separate Data and Software.

On Linux there is a specific flag that has to be set and is not set per default to make a file executable.

So if you run something, you know that you are running it as a program and not opening it as data.

Windows on the other hand marks everything as executable which begins with MZ and whichs filename ends in .exe or .com

timv• 13 years ago

Except in this case (original article) it was an executable inside a zip file.

In the normal case, unzipping a file on linux will result in the executable bit being restored if it was included on the original file.

This is normally what you want - imagine an app that was distributed (over https) as a zip file where you then had to go and manually add the executable bit to each relevant file.

But a zip file that was opened as an email attachment is largely indistinguishable from one that was opened from an HTTPS download (it need not be that way, but it is), so the OS has no reliable way to allow you to run executables you download in a zip, but not ones you received as an email in a zip file.

There are certainly ways around it, but the executable bit isn't really the solution here.

dsuth• 13 years ago

While that is useful, in Windows-land the result would only be another message box to click-through, asking if you wanted to make the file executable, which no average user would understand, and therefore just click OK. If they even took the time to read it before clicking through.

Better to sandbox any executables received from external sources.

olliesaunders• 13 years ago

The absence of that executable flag does nothing to protect you from using an existing executable and some data such as an interpreter and source code.

wfunction• 13 years ago

On Linux there is a specific flag that has to be set and is not set per default to make a file executable.

Windows does too. It's called FILE_EXECUTE permission.

It just happens to grant them to everything by default, but the problem isn't the lack of the feature.

Wingman4l74• 13 years ago

We only use that language because it's an order of magnitude easier to explain to novice computer users, and because as you stated, the problem still hasn't been fixed at the OS permissions / UI level.

A modern OS lets us do that because lots of users are the sole user of their PC and do not understand the idea of permissions.

im3w1l2• 13 years ago

People understand that webapps are safe, because they have less permissions.

mbesto• 13 years ago

I believe this is what Bromium is doing with their "micro-VMs" - http://www.bromium.com/use-cases/overview.html

pkinnaird• 13 years ago

Called it in July. Read more...

http://blog.kinnaird.us/the-coming-age-of-ransomware-cloud-s...

revelation• 13 years ago

This is why a RAID setup is not a backup.

abstractConcept3• 13 years ago

Has anyone attempted to run this using Wine?

As long as you keep all drives (/ or ~/) unmounted, I assume it would be `safe' to test it.

Might be a simpler environment to analyze CryptoLocker in, as apposed to a full Windows install.

marcosdumay5• 13 years ago

I'd try it in a virtual machine just in case.

jpalioto• 13 years ago

Nasty stuff. Fortunately for me, this would set off the "why the heck are my fans running so loud right now" alarm that I have in my head (that honestly, I wish I could turn off sometimes ... curse you trustedinstaller.exe!!).

wentkenko• 13 years ago

People on here are talking about attachments and being smart enough not to fall for sham downloads, but this isn't how most of ransomeware is spread to its victims. They use exploit packs and 0 days. Visiting a website that's been hijacked with an Iframe or a proxy that embeds an Iframe or any other data to the HTML that is returned could get you infected. There is no full proof way around this unfortunately.

fekberg3• 13 years ago

I've been trying to raise awareness in my social medias, since my family, friends and co-workers might not spend time on HackerNews.

If you want, copy my message and share with your family, friends and co-workers:

"Hi folks,

There's a new virus out there that I want to raise awareness of, it's called CryptoLocker. Basically what this virus does is that it tracks all your files - hard drives, flash drives, usb sticks, network drives/shares - then it encrypts the files it finds.

The only way to unlock the files again is to pay $300 to get the key used for the encryption. The encryption used is RSA with a 2048 bit key which makes it extremely hard to crack, I'd say impossible with the time span and todays computers.

You have 72 hours before they trash the key making it impossible for you to get your data back.

This can be extremely devastating if you are running a business and all your files are gone. If you sync your files to the cloud, you're still not safe, it syncs the encrypted files as well. If you are able to restore to previous versions of your files in the cloud - great.

Let your friends, family and co-workers know about this.

Here are some simple ways to avoid getting a virus in general:

1. Don't open e-mails from people you don't know

2. Don't open attachments in e-mails unless you were waiting for the attachment

3. Don't go to websites/click links that you don't fully trust

4. Don't download and execute files that you don't fully trust

It might seem obvious to the most of us to don't do the above, but to a lot of friends, family and co-workers it might not be.

Imagine waking up and having to pay $300 to get your data back. However, the police tracked down one of the servers that serves the keys and shut them down which means the keys were not delivered and the data was lost, this means even if you do pay the $300, there is no guarantee that you will get the data back.

Raise awareness of this and avoid having your files lost."

jonhohle• 13 years ago

5. Consider alternatives to Windows so you won't have to deal with these silly things that have largely only been affecting Windows users for the last decade+.

fekberg3• 13 years ago

Sure, I'll ask my 70+ year old relatives that have been using PC with Windows since they first got their computer to download an Ubuntu ISO, burn that and re-install their system.

Joking aside. I'd love for everyone to just jump on a virus free OS, but as soon as that OS is mainstream there will be viruses.

The problem isn't the OS, the problem is that people trust everything that is for instance sent to them via e-mail. Users need to be educated on security, no matter the OS.

hnha• 13 years ago

0. Have a working and secure backup strategy.

coin• 13 years ago

"When the receiver clicked on it, he saw a white box flash briefly on his screen but didn't notice anything else out of the ordinary"

What email client automatically unzips AND executes any containing .exe files?

doubt_me2• 13 years ago

How long will it take until the FBI gets rid of these guys?

xdd• 13 years ago

just run it at NSA once. 24hours I bet.

doubt_me2• 13 years ago

Naw. One of their assets built it

foundlogin• 13 years ago

Finally viruses are doing what they're supposed to - wreck your computer instead of staying under the radar as long as possible. If people are motivated to protect themselves from this they'll also be preventing botnets and doing good to the rest of the internet.

readme• 13 years ago

I got a similar virus once but it was before bitcoin was popular. It just asked for money via credit card. The virus hid my files, and I needed them for work too.

Fortunately the virus did that by some filesystem driver level hack, because after I booted into Linux I was able to mount the partition and get my files back.

computerhead• 13 years ago

or dont use windows...

DigitalSea• 13 years ago

This is one of the scariest forms of attack on computing since viruses became prevalent in the nineties. The fact they were up until recently relatively undetectable adds another eerie dynamic to the situation. It highlights the aged old problem of people not pro-actively backing up their data offline until it's too late. Go out and buy a couple of cheap 1tb external drives and back your data up now and keep doing it, there are even tools and drives that handle this automatically for you.

While ransomware isn't anything new, the fact that the authors of such software are using currencies like Bitcoin make it that extra bit harder to track and stop these people from extorting data. I sense a new wave of ransomware is about to hit the scene now that Ars have revealed specifics about potentially making millions a year from such a racket. It's hard informing people about these things without encouraging others to go and try writing their own ransomware and expect Bitcoin as payment.

This really worries me.

crazypyro• 13 years ago

The first thing I thought when I read the $5 million dollar figure was "Oh shit, imitators are coming..."

grecy2• 13 years ago

When I first saw the title, I thought it went like this:

1. Your machine is infected, and it encrypts everything it can.

2. The 72 hour countdown begins, and during that time your machine has been re-purposed to crunch BitCoins.

3. All you have to do is wait 72 hours, and everything will un-encrypt and uninstall, leaving you perfectly fine.

Creators profit by having millions of machines crunching BitCoins in their name.

pbhjpbhj4• 13 years ago

These machines were probably already crunching BitCoins for years but now that's not profitable ...

grecy2• 13 years ago

Even if you had millions of infected machines crunching on your behalf it wouldn't be profitable?

MiguelHudnandez6• 13 years ago

I was hit by this, or a variant, at my place of business. Hundreds of thousands of files on our shared drive were overwritten, about 2 TB worth of files. Office documents, PDFs, and Adobe documents like PSD and INDD were encrypted. JPEGs were altered but still viewable. All files increased in size by a few hundred bytes.

Pull-only backups were the savior here, although because we didn't notice until the next day, the pulled backups on that system were also overwritten with encrypted/corrupt files. Luckily we had VSS versioning on the pull-only backup location. There was a close call in that the 2 TB or so of "new" data ended up pushing VSS over quota and we almost lost our good versions of the files that way. If not for the VSS versions, we would've had to resort to cold backups which would've been a bit older. As it stood, no file recovered was more than a few hours old.

Auditing on the file share indicates which workstation was infected. Pertaining to that: it surprises me that in 2013, a default install of Windows will not log any useful information about shared folders by default. You must enable object auditing in Group Policy and specifically declare which users or groups are subject to said auditing on a share-by-share basis. In a world without logrotate, I suppose a sensible default is to just let a bunch of shit happen without recording it.

What gets me wound up most of all is the amount of engineering involved for an average home user to protect themselves. I thought a Mac with Time Machine was enough, but a similar virus would easily corrupt those backups if they were available to it over a mapped drive.

It is the goddamn 21st century, and users are still losing work by overwriting documents by accident, or opening a document as an e-mail attachment and not being able to find the actual file they edited. Should people really need an IT guy with ten years of experience to be protected from simple mistakes? Google has made progress on that front with the Chromebook, I suppose.

tempestn5• 13 years ago

Something like CrashPlan provides good protection against this sort of thing for home users. It includes versioned, off-site backups -- either on their servers for around $6 a month, or on a "friend's computer" for free. Either way, the backups are saved via crashplan, not with direct drive access, so it should be safe against this kind of thing.

No affiliation, just a user.

iloverobots• 13 years ago

Crashplan restores are also relatively easy, with a few nice options.

MiguelHudnandez6• 13 years ago

Thanks! I am looking at BackBlaze, Arq + Glacier, and now CrashPlan as relatively cheap additions for extra peace of mind.

keyme2• 13 years ago

"JPEGs were altered but still viewable". Could be a problem with their encryption. Care to share a before and after JPEG of something? For science?

pbhjpbhj4• 13 years ago

Presumably it's doing something like encrypting just the file headers or a part of the file, that way it can "lock" more files in a shorter time. JPEGs seem to be quite robust in being partly recoverable even when parts of a deleted file have been over-written - sorry I don't know the details.

MiguelHudnandez6• 13 years ago

For science, I will try to find one that is acceptable to share and post a before/after, or just the results of the comparison.

What I recall from my initial investigation was that the binary was completely different, but opening the image did not indicate any changes. Almost like it was converted from RGB to CMYK or something.

Wingman4l74• 13 years ago

opening a document as an e-mail attachment and not being able to find the actual file they edited

I'm so sick of this. The "open/save" dialog is in sore need of being revamped. There's really no such thing as "open" anyway -- it's really "save to some obscure profile temp directory and then open". Try explaining "you can't open a file that's not first saved to disk" to a user, though.

gizmo6862• 13 years ago

But sometimes you want to just "open" a file. The fact that your computer may choose to save it is an implementation detail. In fact, most systems don't actually 'save' it in many senses of the word. Instead they write it to the file system in a way that indicates that it may be removed at any time without notifying the user. In fact, on Linux (I can't speak to any other OS), it is common for these temporary files never to actually be saved to the disk. Instead they are loaded into a RAM based file-system (tmpfs), usually found at "/dev/shm"

driverdan3• 13 years ago

So you had 2TB of crucial business files and only had a single backup point? No remote / online backup? Scary.

MiguelHudnandez6• 13 years ago

I mentioned cold backups -- those just would've been a little older.

The pull-only archive w/ VSS versions really is massively convenient. It is the first line of defense against the scenario that comes up almost all of the time: "Help, I messed up this important file!"

anExcitedBeast• 13 years ago

I really don't think we should try to dumb down UX for the benefit of less experienced users. You run the risk of creating a false understanding of how a computer works which can cause harm down the line, as well as frustrating and confusing more advanced users who do know what happens when you save a word document. Besides, as the user population ages it's becoming less of a problem.

MiguelHudnandez6• 13 years ago

Besides, as the user population ages it's becoming less of a problem.

I want to believe. I really do. But I'm not so sure based on personal experience.

This article made the rounds recently, and I think it is apt: http://www.coding2learn.org/blog/2013/07/29/kids-cant-use-co...

fmax30• 13 years ago

Huh , that is pretty scary add a physical packet snooper on all the traffic sent from my computer , it might be possible to mitm the private key as it is sent to the server. That way i might have a fighting chance against this.(if the traffic was unencrypted that is )

spajus• 13 years ago

It's a pity to see that Windows haven't died off yet and things like this are still happening. Using Linux / Mac for years, never looked back.

And for those who say "my mother can't use Linux", don't be a cheapskate, get your loved ones a Mac - they will definitely know how to use it.

wbkang• 13 years ago

Keep in mind this is not a virus in a traditional sense. The user has to explicitly run the executable to run this malware.

joeblau• 13 years ago

Wow what a scheme. I mean it's almost the perfect situation for whoever wrote the system. It creates an extortion mechanism with a sense of urgency. Normally, users just carry malware around on their machine for weeks or months. The most frustrating part of this whole thing is that if you don't get the private key back and you're not backing up; you're toast.

kbart2• 13 years ago

I imagine that this combined with virus capabilities (so it can spread itself via network) would be an overkill. Strange that they didn't do it, once you have an access to the local network (as soon as the initial victim runs .exe received by email) it shouldn't be too hard.

anonymous2• 13 years ago

Wouldn't it be possible to attach a debugger to a running instance of the virus and extract the key while encryption is taking place?

Wicher2• 13 years ago

Yes, but if they have their crypto stuff together, it might not gain you much.

Someone here mentioned the encrypted versions of the files are the original size + a little extra. To me that indicates that they use a public key (of which the private component does not reside on your computer, and never has, but which you can buy). The public key is used to encrypt a key for a symmetric algorithm (AES, DES, ...), which encrypts the data, and the RSA-encrypted version of that symmetric key is then prepended as a header of some sorts.

So using a debugger you'd be able to see the public key, which I suppose is infected-useraccount-specific. It's not useful for decryption, you'll need its private counterpart.

You'll also see the symmetric key, of which a new (random) one should be instantiated for each file that is being encrypted. Should, but might not... if they slipped up, the latter might be reused (for your user account). In which case you can win, if you can observe it encrypting a new file — you'd be able to decrypt the other files too.

They'd have to be quite stupid to slip up like this, but it happens.

Update: Reading a reverse engineering report¹ it appears that it indeed works as described above. And yes, they didn't slip up; a new symmetric key is generated for each individual file.

¹ http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2945

devcpp• 13 years ago

Problem is, the prompt doesn't appear until the encryption has ended, the key has been sent to the servers (it's kind of complicated, it apparently tries to find servers on its own, I wonder if it can be fooled) and that key has been locally destroyed.

So, by the time the user is notified that there is malware on their PC, it's too late. People who know to detect viruses while they're running don't run attachments in the first place.

Wicher2• 13 years ago

According to the KernelMode thread¹ the keypair is generated on the server. The public key is retrieved from it, but its private counterpart will never be on your machine. No key is sent to the server.

¹http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2945

forgottenpaswrd• 13 years ago

No, because you encrypt with a public key, not with the private key.

So the encryption process does not know how to decrypt it.

Imagine a combustion engine, you know how to burn gas to extract energy and CO2. But this engine does not know how to make gas from CO2 and energy.

andybak• 13 years ago

Everyone is talking about post-infection. However - this passage from http://www.bleepingcomputer.com/virus-removal/cryptolocker-r... seems fairly key also:

"This infection is typically spread through emails sent to company email addresses that pretend to be customer support related issues from Fedex, UPS, DHS, etc. These emails would contain a zip attachment that when opened would infect the computer. These zip files contain executables that are disguised as PDF files as they have a PDF icon and are typically named something like FORM_101513.exe or FORM_101513.pdf.exe. Since Microsoft does not show extensions by default, they look like normal PDF files and people open them."

I haven't got a Windows box handy to try this on but I assume there is at the very least an extra warning dialog when opening an exe - even a zipped exe?

Not that that mitigates this at all. The inability to distinguish executables from data files - and although that doesn't apply in this case - the ability of data files to hide executable payloads either via design or error - is a major and currently uncorrected flaw in the system.

pbhjpbhj4• 13 years ago

Why doesn't MS Windows use magic numbers to establish file types, or does it now?

gbl08ma• 13 years ago

It does (I think), but even if it doesn't, it uses the file extension to determine it. However, EXE files are free to set their own icon. In this case, the icon of the EXE was a "PDF" icon.

The silly bit is the fact that the file extensions are hidden by default, and users can only use the icon to check the file type.

verytrivial• 13 years ago

This is the difference between crime and organised crime. People would not hand over the money to the burly visitors each month if their shop was burnt down anyway.

Evidence that paying the ransom actually results in the files coming back is the most troubling aspect here - these people are looking to establish a longer term criminal enterprise.

simonw• 13 years ago

I talked to a small shop owner just the other day that had been hit by this. They said they spent the $300 on a new PC instead - but I'm pretty sure they lost a bunch of irreplaceable data (mailing lists, supplier details etc). Pretty heart breaking.

amalag2• 13 years ago

Crashplan is really easy to setup. Won't save their data in hindsight, but they should have it or something like it.

headShrinker• 13 years ago

Is it the case that Mac OS default security setting would prevent an unsigned app like this from running?

__abc• 13 years ago

REAMDE

swat535• 13 years ago

I have a question regarding this, does anyone know what happens if your data is already encrypted ? will it encrypt the encrypted files?

fantnn• 13 years ago

Yes.

GillesB67• 13 years ago

For hacker having both an original file and the encrypted version that file should be relatively easy to retrieve the key? Especially if the virus XOR all or a part of the file. Otherwise a hacker may look at the random function that generate the key in the source code of the virus it may be weak and take values from the computer and time of infection.

howlett• 13 years ago

How is this any different from a virus that wipes (not just deletes) your data? It takes the same amount of time (actually wiping data would be faster) and the result is the same: No data.

Maybe the psychological part of "Oh God the file is there but I can't use it" or the fact it's ransomware?

kalesoup11• 13 years ago

The wave of the future. Why break computers when you can just have the user pay you to avoid breaking it.

tete• 13 years ago

What I find funny is that this piece of software actually tells you more about what it does than software you pay money for and even uninstalls itself, after it is not needed anymore. It's kinda weird how malware is better quality than most other software.

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

Related Stories