Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Programming IT Technology

RansomWare Disassembly Reveals Evolutionary Path 64

Posted by CowboyNeal from the trojan-family-trees dept.
flaws writes "The guys at Secure Science Corporation have written a revealing article demonstrating the relationship with the most recent Ransom-based Trojan (known as Glamour) and some previous data stealing trojans. They include an open source decrypting utility for unlocking your files if infected, and some stats that are a bit disturbing. According to their report, in the past 8 months, 152,000 victims have been infected, and over 14.5 million records were discovered to be logged by the trojan."
This discussion has been archived. No new comments can be posted.

RansomWare Disassembly Reveals Evolutionary Path More

RansomWare Disassembly Reveals Evolutionary Path

Comments Filter:

  • My poor pornography :( (Score:5, Funny)

    by Token_Internet_Girl ( 1131287 ) on Thursday July 26, 2007 @08:30PM (#20004787)
    "Dear User: We are currently holding your pornography hostage. Unless you send us $300, you will never see Jenna Jameson and that beer can again."

    • Re: (Score:2, Funny)

      by Drew McKinney ( 1075313 )
      It was a beer bottle.

      I never did get that picture back...
    • "Dear Sheeple,

      Remember that night you and your wife got drunk and took all those nasty photos? $500 to sugarinyourgastankwhilstanallyrapingyourmom@quicky lube.com or your neighborhood gets to critique them, too...

      ...and have a nice day.

      Kudos,
      Howie Feltersnatch"

      I'd bet 10-to-1 odds some unscrupulous f**k will try/has tried it, too...

  • From the report: "...it was quickly apparent that the files were not really encrypted with 4096-bit RSA....This is a bit bewildering...implementing real 4096-bit RSA is simple and would have made it extremely difficult, if not impossible, to produce a working decryptor without paying $300." Silly script kiddies.

    • Why bother? (Score:3, Insightful)

      by bill_mcgonigle ( 4333 ) *
      This is a bit bewildering...implementing real 4096-bit RSA is simple and would have made it extremely difficult, if not impossible, to produce a working decryptor without paying $300." Silly script kiddies.

      If you just XOR the data and tell people it's RSA-4096 99.44% of them are going to just accept that it's true (after googling to find out what RSA means) and send you the $300. How many are going to find out about this open source decryptor? I betcha 80% of IT consultants won't even know about it, and h

      • Because of who the targets are. Re:Why bother? (Score:5, Interesting)

        by twitter ( 104583 ) on Thursday July 26, 2007 @09:39PM (#20005279) Homepage Journal

        If you just XOR the data and tell people it's RSA-4096 99.44% of them are going to just accept that it's true (after googling to find out what RSA means) and send you the $300.

        No, they are going to look for a "free decoder program," ha ha ha. Oh, the joys of non free software.

        Jokes aside, this trojan is aimed at corporate users. If it's easy to fix, big dumb companies will tell their sheep to bring forth their problems and fix them. If the creeps had been bright enough to use real encryption, there would be no solution and embarrassed users will try to fix the problem themselves. Of course, paying $300 to an extortionist will get you nothing more than another request for money unless they want to sell you back each file. For more evidence of this, see Vista pricing.

      • Most virus and trogen work because no matter how much awareness you put out there, in the end you can not increase the intelligence of people. People are still going to click on those links, still going to download their 'free' porn and still utilize p2p networks where these people can just fish with shotguns in. And lets say a corporate employee does some of this at work, gets this virus then half their companies documents are held hostage more then likely they are going to pay up $300 to hurry and get t
        • I hope this was comprehensible it's pretty late here and very sleepy.

          Yes, you illustrate the corporate ethos adeptly.
      • Vs lbh jnag gb ernq vg V fryy n qrpelcgbe sbe $300 abj fraq zr zl zbarl!

  • In a related story (Score:5, Funny)

    by Anonymous Coward on Thursday July 26, 2007 @08:47PM (#20004935)
    . . .Trojan brand shown to BLOCK Evolutionary Path!
  • Do people still really open attachments from people that do not know or were not expecting? Are people really executing unknown .exe files?

    What is the infection vector for these things? Is it email, P2P networks fooling people into believing that mp3 really is an EXE file?

    although I cant believe that people are stupid enough to fall for a nigerian scam wanting to deposit 30 billion dollars in their accounts overnight either.

    • Re:I keep reading about these. (Score:5, Informative)

      by necro2607 ( 771790 ) on Thursday July 26, 2007 @09:03PM (#20005055)
      Well, considering that Windows by default doesn't show the file extension for known filetypes, as far as all the noobs can tell, the file they just double-clicked was "Artist - song.mp3", since they wouldn't even see the .exe at the end. Sweet deal eh?

      If you've used any common p2p apps like eDonkey or the like, you'll notice that when you search for something, even if you type some arbitrary crap like "huoshgahgauoiwhrgoaghnaj" you'll also get "huoshgahgauoiwhrgoaghnaj.mp3.exe" and "huoshgahgauoiwhrgoaghnaj pics xxx mpeg avi.exe" or similar shit. So someone searching for a keygen is going to get "exactly the keygen they wanted.exe" .... and so on and so forth. You can imagine how quickly someone will eagerly download and run a keygen they've been looking for for ages that they couldn't find anywhere else.... ;)

      • Re: (Score:1)

        by k3vlar ( 979024 )
        What bothers me is people believe naming something "Artist - Track.mp3.exe" will make it look like an mp3. If windows hides the file extensions, then a file called "Artist - Track.mp3.exe" will look like "Artist - Track.mp3" and a file legitimately called "Artist - Track.mp3" will show without any extension at all, and therefore "Artist - Track". You'd think that one song out of 24 that actually has .mp3 at the end might seem a little suspicious. Especially when that .exe has an icon for a Windows Media Pl

        • Re: (Score:2)

          by fbjon ( 692006 )
          You're assuming the existence of rational thought...


          Besides, even if you do think before acting, you could still get fooled. Exe's can have their own icons embedded, so a trojan might look like an mp3 after all. I usually look at the icon first, myself, so I might get fooled by it... except I scan suspicious wares before opening.

      • Helpful tip (Score:3, Informative)

        by Fish (David Trout) ( 923462 )

        "Well, considering that Windows by default doesn't show the file extension for known filetypes, as far as all the noobs can tell, the file they just double-clicked was "Artist - song.mp3", since they wouldn't even see the .exe at the end. Sweet deal eh?

        Which is why I've been telling people for years the first thing they should do after installing Windows (immediately after selecting the "Show hidden files and folders" option and unchecking (clearing) the "Hide extensions for known file types" and "Hide protected operating system files" options in Control Panel -> Folder Options, View tab) is to run REGEDIT and do a 'Find' for all occurrences of "NeverShowExt" and delete every single one found. All of them (spare none).

        Yes, it is admittedly unappe

        • Re: (Score:1)

          by kat_skan ( 5219 )

          "Well, considering that Windows by default doesn't show the file extension for known filetypes, as far as all the noobs can tell, the file they just double-clicked was "Artist - song.mp3", since they wouldn't even see the .exe at the end. Sweet deal eh?

          Which is why I've been telling people for years the first thing they should do after installing Windows (immediately after selecting the "Show hidden files and folders" option and unchecking (clearing) th

          • This doesn't really solve anything, though, since people can't reasonably be expected to know a safe file extension from a dangerous one. ...

            ...

            Obviously the little bit of metadata provided by displaying the file extension is better than none at all, but it's not going to make email attachments all that much safer.

            I beg to differ. In my experience does help -- quite a bit.

            Even though most people (myself included, and I consider myself to be one of the more sophisticated/experienced Windows users) wouldn't necessary know all of (or even most of) those other file extensions you mentioned were "executable" type file extensions, they would at least know some of them were.

            Most malware writers use extensions such as ".exe", ".scr", ".vbs", etc, and not the more arcane ones.

            And I hope you'll agree that all but the

    • Re: (Score:1)

      by conlaw ( 983784 )
      If you RTFA all the way through, you'll find reference to a Kaspersky discussion of the beginning of this Trojan from June 2006. According to that discussion (http://www.viruslist.com/en/analysis?pubid=18967 8 219), the original emails were sent to people who had applied for jobs on a Russian job site and the attachment supposedly discussed the compensation plan. The email, as translated from the original Russian was:

      Hello !

      We are writing to you regarding the resume you have posted on the job.ru websit

      • Re: (Score:2)

        by bahwi ( 43111 )
        Why use a virus? That sounds official enough to get them to fill out the attached form with their social and just sell that info for identity theft purposes. Damn russians, not even a little capitalistic! Or heck, they could be doing both!

        Yes, I know it doesn't sound official, have you ever seen a person desperate for work? They'll take any response and run with it.

    • Re: (Score:2)

      by DrSkwid ( 118965 )
      That "only from people you know" is bollocks. Your bozo friends are likely to get infected and the result of the infection is sending you infected files.

      Who's going to suspect a PDF from their friend contains an unscanned virus payload.

      Javascript in PDF, great idea!

      • Um, well, me. I learned early on that few of my friends had my level of understanding with computers. Frankly, when it comes to files I subscribe to the Paranoia mind set 'Trust no one. Stay alert. Keep your anti-virus handy'. I also keep my laser handy, but have found it to be less effective against attachments. I still do this, even though I have dumped windows and use Linux. Figure I'd rather not be one of the first folks to get infected with a Linux capable virus when spammers and script kiddies start

    • Re: (Score:2, Interesting)

      by Aellus ( 949929 )
      I'm living at my parents house for the next month while I'm in transition between two places. Conveniently, my fathers machine has gone haywire and I'm still trying to figure out what happened to it (OS install crashes every time, and _yes_ that includes various forms of linux). Anyway, I've come back to my computer from time to time and discovered he has been checking his email on it. Twice I've noticed that the firefox download window still had random .pdf and .exe files. He once left an email page open t

    • Re: (Score:2, Interesting)

      by Lavene ( 1025400 )

      Do people still really open attachments from people that do not know or were not expecting? Are people really executing unknown .exe files?

      A fun experiment: Write a small, harmless program that when executed send a single ping to your home machine/ server and an equally simple program to count the incoming pings on said system.

      Write a short message saying something like "The well known virus 'YouAreTooStupid' is again spreading across the Internet. Please run the attached program to clean and/ or immunize your PC", attach your little program and send it to twenty people. Then sit back and watch your counter...

      It will keep counting for da

    • There are quite a few well working vectors. One is the still popular invoice.pdf.exe file with an Adobe logo. And as long as people have file extensions disabled by default, this will continue to fly.

      Then there's MPack. Quite hard to track down and near impossible to avoid, unless you happen to have a browser that's not affected and/or a system that can't run Windows executables natively.

      P2P works too, if you manage to make people think your executable is just what they want, be it a crack for a recent game
  • Can anyone explain what "Beware of geeks bearing graft" means? (QOTD)

  • You can prevent encryption by creating a reg key (Score:5, Funny)

    by jpetts ( 208163 ) on Thursday July 26, 2007 @10:47PM (#20005723)
    The entry should be a REG_DWORD named WinCode in the HKLM\SOFTWARE\Microsft\Windows NT\CurrentVersion location, and should have the value 31337
  • Microsoft has been doing this for years now. They call it an "operating system" and also "office suite". Those are just code names though, don't let it fool you!
  • Evolution is nonsense. Surely this trojan was intelligently designed.
    • This should be modded as intelligent LOL! But seriously this is scary stuff for the average user such as myself. :(
  • does it run on Linux?

Slashdot Top Deals

Get hold of portable property. -- Charles Dickens, "Great Expectations"

Close