Surely all you have to do is make frequent back-ups of your critical data and the virus becomes pointless.
Hacker - You must pay me $100 or your files will be forever encrypted by my nigh-unbreakable RSA code. User - Meh, I just wiped my system of your virus and restored my important files from back-up. Piss off.
As has been pointed out in the past - the people who are most likely to become infected with a ransomware virus are exactly the same people who are least likely to have backups available.
While I too get frustrated by incompetent users, I think that attitude is a bit harsh. Computers are supposed to have reached the point of being easy to use by laymen, and automatic backup should be part of that.
Time Machine on MacOS seems to be just about there, all they need to do is bundle an external HDD or offer a free online component for personal docs.
Twitter - as someone who helps do backups for (insert huge corp here) there's no other way to say this, but... you're an idiot. For the newer folks among us, I'll happily explain why.
Enterprise-level backup apps are almost always 3rd-party, not "some kind of unreliable M$ thing". Any serious solution also has a means to restore to bare metal, so in effect you need no OS at all to do this.
(and when was the last time anybody kept any current work on a floppy? Cripes - 1992 called and they want their backup devices back).
As has been pointed out in the past - the people who are most
likely to become infected with a ransomware virus are exactly the
same people who are least likely to have backups available.
Back in my youth, I never made regular backups.
Then I got a virus.
Since then, I make regular backups.
As annoying as it seems, sometimes people need to understand
first-hand the need for regular, offline backups.
Until they have the experience of data-loss, they just won't
appreciate what could happen.
Back in my youth, I never made regular backups. Then I got a virus. Since then, I make regular backups.
Back in my childhood I did regular backups of my family's computer. Then we got a virus. Then we realized that the virus was a time bomb that was already present in dormant form even in the oldest several-months old backups.
Sometimes you have parents that are both computer geeks, and they teach you the important of offline backups. Never the less, shit happens anyway.
I'll assume someone paid the ransom at least once. So what key did they use to decrypt? Do us a favor and post it.
As for it being a trick to crack a root signing key, would they not have to have the private key to encrypt with to start?
... huh?
It works like this:
1. Virus generates a random encryption key and encrypts your data with it. Let's call this K. 2. Virus encrypts the random key with a RSA public key and instructs you to email that, R(K), and your money, to the ransomers. 3. The ransomers use their RSA private key to decrypt the encrypted random encryption key, R(K), into K. 4. You use the random encryption key they sold back to you, K, to rescue your data.
Someone else's decryption key, K', is not useful to you because your data was encrypted with a different random key K. You have an RSA-encrypted copy of your own random key, R(K), because that's what the ransomers need you to send them so they can sell you the decryption key K. We're trying to crack the RSA private key so we can generate K from R(K) without having to pay them money, i.e. sidestep step 3.
I use Windows because I'm not brain-dead and can keep my machine secure. For those of us who know what we're doing, it doesn't matter what OS we use. For those of us who don't know what we're doing, similarly, it doesn't matter what OS we use: you're only kidding yourself if you think that widespread Linux adoption would result in there not being many/any pwned machines. The user is, and always will be the biggest computer vulnerability.
Encourage people to make backups of their data on disc, tape, or portable harddrives. I know that's a radical idea, but it just might be crazy enough to work.
Encourage the application writers to make their applications EASY TO BACKUP.
The problem I keep seeing is that TELLING someone to back up their data is easy to do. FINDING ALL of the data is just about impossible.
You'll never know if you got it all until AFTER a problem.
Or even... how about just including a simple script that will look at how it's installed TODAY and back it up to a location chosen by the user? And then that script will generate a script to install that backup should you need it to. Along with license keys and decoding keys and unlocking keys, etc.
Do I just not know some Windows Admin secret magic, or is it true that I really can't back up my applications.
There is a little magic that you can try, but you are pretty much correct. You cannot EASILY backup your Windows apps.
For the Registry, you can "export" the entries for that app to a file and, later, you can import that file into the Registry.
The problem with the Registry is the same as you've noted with the file system. Stuff gets put EVERYWHERE. And there is no way to KNOW that you have EVERYTHING until AFTER you attempt to restore it. AND that doesn't include anything "updated" when you get a patch or point-zero-one release "upgrade".
Now, the installer can put that stuff everywhere... and in theory it can remove that stuff when you un-install it... but it cannot COPY that stuff to a backup directory/device?
And I don't want to hear that that is to prevent "piracy". Just encrypt the stuff with the unlocking key or whatever. That way I can keep a TEXT file of app-name -- key code on my USB drive along with the backups.
Do I just not know some Windows Admin secret magic, or is
it true that I really can't back up my applications. I'd like
to be able to reinstall Windows and then restore all of my
applications.
Not quite a direct answer, but you might want to consider using
mostly "Portable" [portableapps.com] apps (that
site has tons of them, but by no means counts as the only source...
And of course, better-designed programs work portably without
needing a wrapper).
They have nothing to do with Linux or FOSS (though they do tend to
exist as FOSS and have Linux versions available). You copy the
program's directory (and, if you changed it, your data directory)
to a new machine, and bam, it just works. No installation, no
annoying migration tools that fail half the time, no custom
compression schemes that only worked back on version 4.8 but
they stopped supporting in 5.0 and no longer sell version 4.8,
etc.
With most of them, you can run them from USB thumb-drives (the original
meaning in this context of "portable" - Literally, you can take them
with you); With many, you can even run them from read-only media such
as a CD (though obviously you can't save your data in the same place
when doing so).
If we had a backup, wouldn't it be possible to break the encryption using the backed-up data as a crib? Why force the key directly when you know what is in a large chunk of the cyphertext?
Known plaintext attacks are a mainstay of cryptanalysis. They tend to be more powerful than other attacks, but they still don't help much. Factoring is the best known technique for RSA, even given known plaintext or chosen plaintext.
Even further, you *don't* have the known plaintext to break RSA because it's a random symmetric key encrypted with RSA that is used to encrypt the files by the virus. Every modern cipher since DES has been highly resistant to known plaintext attacks. That's a basic requirement for a cipher to be considered non-broken.
I think, personally, that human stupidity is a gold mine, and I'm slowly losing any inhibition and cashing in on it.
Way ahead of you. I went into IT security years ago. It is a gold mine. You can basically sell snakeoil and people will kill each other to buy it from you.
As a result, I am shortly going to be announcing my new "Remain Safely Stupid, (tm)" product line. We harness the power of human stupidity for profit. It will be absolutely nothing more than a box filled with paperwork. After filling out said paperwork, the client is guaranteed paper "rights" to be "free" and "protected" with said freedoms and protections guaranteed by the pieces of paper, and through no action or knowledge of his own. The client thus receives all the benefits without any of the actual ri
I think the bankers, the priests and the politicians have already figured out how to turn stupidity into free energy. Witness, for example, the boundlessly stupid as they sign up to fight politicians wars, religionists jihads, to man priests' inquisitions or run on the endless, profitless treadmill of the serf/employee rat race, and witness this set of examples through history. From tithes, to taxes, to "donations" to traffic tickets and drug enforcement, the boundlessly stupid have always eagerly jumped
So what you're saying is that anyone who lives in any fashion beyond subsistence farming is stupid?
Banking, religion, and politics all have their problems, no doubt. But they're all important and persistent factors in the progress that humanity has made. They've all been involved in bad things, but they've all be involved in lots of good things as well.
A human being is, on their own, capable of many things, both good and bad. Structures, systems, corporations, religions, corporations...they've all allowed us as a civilization to accomplish tasks that no one man could accomplish on his own. Some good and some bad, but all it does is amplify our abilities.
I don't see the allure of backup. This one time I tried backing up my computer, I backed it up all the way, and then it kept shutting off. So I brought it back forward and it runs far cooler now that the fan isn't sealed off by the wall.
Fortunately, we had Interbank Data Recovery Services. And Interbank does more than just acquire the decryption key.
That's because Interbank vows to find out who sent you the ransom and hunt them down like animals. Like filthy, dirty animals. That's the Interbank difference. See, I don't care how Interbank's secret police get things done. I just care that they get things done. For us.
Plus, because we'd enrolled in their Premiere Membership program, Interbank also hunted down friends and relatives of the guy who had encrypted our data, dragged them from their beds in the middle of the night, and set fire to their homes.
How are we going to do that? Everyone knows that things aren't nearly as fun as they used to be... people are even complaining about waterboarding now! what's this world coming to? Shoot, I remember when you could put a man on the rack - no problem.
Simple. Lock them in a cell with a person whose complete pr0n collection is now encrypted. Then go out and come back about an hour later. They talk. They will confess everything, including the assassination of JFK, just as long as they don't have to spend more time with someone whose jackoff material is gone and they're to blame for it.
The people who did that sit in a country ending in -stan. Countries ending in -stan have real problems and don't care for problems their citizens cause abroad.
You can trust me on that one, I've tried. I've even had so much as the name of the person to prosecute. Nothing came out of it. Despite including our federal police and interpol.
You can trust me on that one, I've tried. I've even had so much as the name of the person to prosecute. Nothing came out of it. Despite including our federal police and interpol.
Nothing came of it because you did not sweeten the pot for local law enforcement, politicians, and judges with large bribes. If one wants justice or even just to get something done in a -stan country then one has to grease the wheels of the local economy or in other words its pay (more than your opponent) to play. This is how much of the world outside of the United States, Britain, and Western Europe functions, it is practically impossible to get things done or at least done quickly if bribes are not involved.
15 million CPU years per key? And the attacker can just make up new keys as often as he likes. He could even make a different key for each target if he wanted.
15 million CPU years is a lot to spend when you could just restore from backups.
We should not help people whose data is held at ransom. Finally they will see the folly in using cheapest software, in the cheapest platform with no regard for security. Companies will start taking insurance against data loss. And the insurance premium will be more for insecure closed proprietary crapware like Windows.
As long as security is valued at zero dollars when the IT bean counters are evaluating platforms and vendors crapware will proliferate.
The screenshot at http://news.cnet.com/8301-10784_3-9965381-7.html?tag=nefd.top [cnet.com] says that the victim pays to download a 'decryptor'. Either the decryptor contacts, in real time, the extortionist (at a server location that can be linked to them), or the private key is included in the decryptor program, and should be able to be sussed out...
The explanation I found on the site isn't quite this simple. The data is encrypted with a randomly-generated symmertic key that is protected with RSA.. You send the bad guys the file with the key in it, they decrpyt it and write a program to decrypt everything..
Quite simple and very effective and can be done using standard tools:
1. Encrypt victim's data with random AES key 2. Store key in body of a PGP message for yourself 3. Get victim to send you the PGP message 3. Decrypt PGP message using private PGP key, find AES key 4. Send AES key to victim - for a price...
Seriously, this could probably be hacked together in the matter of a few hours if explained to someone knowledgable. The private key never leaves the bad guys. And if they decide the heat is on and torch the operation and set it up elsewhere you're 100% screwed. Trying to crack this must be the most useless operation ever, they could easily make the keys stronger and thousands of years would pass to crack it. In one word: Nasty.
People are running crappy software that got hacked, or
People did something dumb like running an.exe that someone mailed them.
Either way, this seems like a pretty strong (if harsh) lesson for end users. If #1, use better software, like your geek friends have been telling you this for years. That doesn't have to mean installing Ubuntu; it could just mean upgrading from IE6 to Firefox (or IE7), or from Outlook Express to Thunderbird (or Gmail). If #2, then haven't you been told about 1,000 times not to do that? Now do you see why?
I truly feel bad for people who get nailed for this, in almost exactly the same way I feel bad for my kids when they touch the stove after I've told them it was hot.
So the encryption is sound, but did he just delete the old files after encrypting them or did he scrub the drive too.
Someone try to undelete the files with a disk recovery tool and see what you get. Just because the file is encrypted does not mean that the original was correctly destroyed.
What seems to be missing here, is the realization that if someone has encrypted your files without your permission (supposedly for ransom), there is no reason to trust them to restore the files correctly, and very good reasons not to trust them.
I suppose if the file in question was something like a manuscript for a novel, where the owner can more or less verify it by eye, and (importantly) there isn't that much downside if our opponent sneaks some changes in, that might be worthwhile. But in general...
That would solve it in only 2^511 operations. In actuality, factoring of large numbers is far more efficient than that. The techniques are complex, but they're quite good. That's why a 1024 bit RSA key is considered somewhat small (2048 or 4096 are the norm) but for symmetric key ciphers (where you do have to try all 2^n possible keys) use key sizes of 256 bits or less.
That depends on whether you think it is acceptable to compel someone to reveal something like that.
Oh, I do: as long as it's not the government doing the compelling.
Just once it'd be fun to hear that the local mafia don's PC got infected because his wife wanted cute smileys, and that the local prosecutor is frustrated by the lack of direct evidence linking the don to what they found down by the river.
Seems rather futile.. (Score:5, Insightful)
Re:Seems rather futile.. (Score:5, Insightful)
Hacker - You must pay me $100 or your files will be forever encrypted by my nigh-unbreakable RSA code.
User - Meh, I just wiped my system of your virus and restored my important files from back-up. Piss off.
Layne
Parent
Re:Seems rather futile.. (Score:5, Informative)
Parent
Re:Seems rather futile.. (Score:5, Insightful)
Parent
Re:Seems rather futile.. (Score:4, Insightful)
Time Machine on MacOS seems to be just about there, all they need to do is bundle an external HDD or offer a free online component for personal docs.
Parent
Re:Most Likely to Not Use it and to Pay. (Score:4, Funny)
Enterprise-level backup apps are almost always 3rd-party, not "some kind of unreliable M$ thing". Any serious solution also has a means to restore to bare metal, so in effect you need no OS at all to do this.
(and when was the last time anybody kept any current work on a floppy? Cripes - 1992 called and they want their backup devices back).
Parent
Re: (Score:3, Insightful)
Back in my youth, I never made regular backups.
Then I got a virus.
Since then, I make regular backups.
As annoying as it seems, sometimes people need to understand first-hand the need for regular, offline backups. Until they have the experience of data-loss, they just won't appreciate what could happen.
Other way around (Score:5, Interesting)
Then I got a virus.
Since then, I make regular backups.
Then we got a virus.
Then we realized that the virus was a time bomb that was already present in dormant form even in the oldest several-months old backups.
Sometimes you have parents that are both computer geeks, and they teach you the important of offline backups. Never the less, shit happens anyway.
Parent
Re:Seems rather futile.. (Score:5, Funny)
Parent
Re:Seems rather futile.. (Score:5, Informative)
As for it being a trick to crack a root signing key, would they not have to have the private key to encrypt with to start?
It works like this:
1. Virus generates a random encryption key and encrypts your data with it. Let's call this K.
2. Virus encrypts the random key with a RSA public key and instructs you to email that, R(K), and your money, to the ransomers.
3. The ransomers use their RSA private key to decrypt the encrypted random encryption key, R(K), into K.
4. You use the random encryption key they sold back to you, K, to rescue your data.
Someone else's decryption key, K', is not useful to you because your data was encrypted with a different random key K. You have an RSA-encrypted copy of your own random key, R(K), because that's what the ransomers need you to send them so they can sell you the decryption key K. We're trying to crack the RSA private key so we can generate K from R(K) without having to pay them money, i.e. sidestep step 3.
Parent
Re:Seems rather futile.. (Score:4, Insightful)
Parent
I've got a better idea (Score:5, Insightful)
Don't forget the corollary. (Score:5, Insightful)
Encourage the application writers to make their applications EASY TO BACKUP.
The problem I keep seeing is that TELLING someone to back up their data is easy to do. FINDING ALL of the data is just about impossible.
You'll never know if you got it all until AFTER a problem.
Or even
Parent
There is a LITTLE magic involved. (Score:4, Informative)
For the Registry, you can "export" the entries for that app to a file and, later, you can import that file into the Registry.
The problem with the Registry is the same as you've noted with the file system. Stuff gets put EVERYWHERE. And there is no way to KNOW that you have EVERYTHING until AFTER you attempt to restore it. AND that doesn't include anything "updated" when you get a patch or point-zero-one release "upgrade".
Now, the installer can put that stuff everywhere
And I don't want to hear that that is to prevent "piracy". Just encrypt the stuff with the unlocking key or whatever. That way I can keep a TEXT file of app-name -- key code on my USB drive along with the backups.
Parent
Re:Don't forget the corollary. (Score:4, Insightful)
Not quite a direct answer, but you might want to consider using mostly "Portable" [portableapps.com] apps (that site has tons of them, but by no means counts as the only source... And of course, better-designed programs work portably without needing a wrapper).
They have nothing to do with Linux or FOSS (though they do tend to exist as FOSS and have Linux versions available). You copy the program's directory (and, if you changed it, your data directory) to a new machine, and bam, it just works. No installation, no annoying migration tools that fail half the time, no custom compression schemes that only worked back on version 4.8 but they stopped supporting in 5.0 and no longer sell version 4.8, etc.
With most of them, you can run them from USB thumb-drives (the original meaning in this context of "portable" - Literally, you can take them with you); With many, you can even run them from read-only media such as a CD (though obviously you can't save your data in the same place when doing so).
Parent
Re:I've got a better idea (Score:4, Interesting)
Parent
Re:I've got a better idea (Score:4, Informative)
Parent
Re:I've got a better idea (Score:5, Informative)
Parent
Re:I've got a better idea (Score:5, Funny)
Way ahead of you. I went into IT security years ago. It is a gold mine. You can basically sell snakeoil and people will kill each other to buy it from you.
Parent
Re:I've got a better idea (Score:4, Funny)
Parent
Re: (Score:3, Funny)
It will be absolutely nothing more than a box filled with paperwork. After filling out said paperwork, the client is guaranteed paper "rights" to be "free" and "protected" with said freedoms and protections guaranteed by the pieces of paper, and through no action or knowledge of his own. The client thus receives all the benefits without any of the actual ri
Re: (Score:3, Interesting)
Re:I've got a better idea (Score:5, Insightful)
Banking, religion, and politics all have their problems, no doubt. But they're all important and persistent factors in the progress that humanity has made. They've all been involved in bad things, but they've all be involved in lots of good things as well.
A human being is, on their own, capable of many things, both good and bad. Structures, systems, corporations, religions, corporations...they've all allowed us as a civilization to accomplish tasks that no one man could accomplish on his own. Some good and some bad, but all it does is amplify our abilities.
Parent
Re:I've got a better idea (Score:5, Funny)
Parent
Re:I've got a better idea (Score:4, Funny)
Parent
Re:I've got a better idea (Score:5, Funny)
Parent
Re: (Score:3, Funny)
Re:I've got a better idea (Score:5, Funny)
> Psh... backups? I restore my data from a parallel universe, where I didn't get hit by a virus in the first place.
K dkd that, but kt turns out they use a slkghtly dkfferent alphabet kn that unkverse.
Parent
track down the people who wrote the virus and for (Score:4, Funny)
Interbank Data Recovery Services (Score:5, Funny)
Fortunately, we had Interbank Data Recovery Services. And Interbank does more than just acquire the decryption key.
That's because Interbank vows to find out who sent you the ransom and hunt them down like animals. Like filthy, dirty animals. That's the Interbank difference. See, I don't care how Interbank's secret police get things done. I just care that they get things done. For us.
Plus, because we'd enrolled in their Premiere Membership program, Interbank also hunted down friends and relatives of the guy who had encrypted our data, dragged them from their beds in the middle of the night, and set fire to their homes.
Parent
Damn it (Score:4, Funny)
If only I hadn't erased Jack Bauer's cell from my contact list after the last season...
Re: (Score:3, Funny)
If only I hadn't erased Jack Bauer's cell from my contact list after the last season...
Make them talk? (Score:3, Funny)
Re:Make them talk? (Score:5, Funny)
Talk about motivation!
Parent
Tag: Goodluckwiththat (Score:5, Interesting)
You can trust me on that one, I've tried. I've even had so much as the name of the person to prosecute. Nothing came out of it. Despite including our federal police and interpol.
Re:Tag: Goodluckwiththat (Score:4, Informative)
Parent
15 million modern computers?? (Score:4, Insightful)
15 million CPU years (Score:4, Interesting)
15 million CPU years is a lot to spend when you could just restore from backups.
It is a good devlopment, Don't help them (Score:5, Insightful)
As long as security is valued at zero dollars when the IT bean counters are evaluating platforms and vendors crapware will proliferate.
Got to be a link to the extortionist (Score:4, Interesting)
Re:Got to be a link to the extortionist (Score:4, Informative)
Parent
Re:Got to be a link to the extortionist (Score:4, Insightful)
1. Encrypt victim's data with random AES key
2. Store key in body of a PGP message for yourself
3. Get victim to send you the PGP message
3. Decrypt PGP message using private PGP key, find AES key
4. Send AES key to victim - for a price...
Seriously, this could probably be hacked together in the matter of a few hours if explained to someone knowledgable. The private key never leaves the bad guys. And if they decide the heat is on and torch the operation and set it up elsewhere you're 100% screwed. Trying to crack this must be the most useless operation ever, they could easily make the keys stronger and thousands of years would pass to crack it. In one word: Nasty.
Parent
Leave it be. (Score:3, Insightful)
So, there are two possibilities here:
Either way, this seems like a pretty strong (if harsh) lesson for end users. If #1, use better software, like your geek friends have been telling you this for years. That doesn't have to mean installing Ubuntu; it could just mean upgrading from IE6 to Firefox (or IE7), or from Outlook Express to Thunderbird (or Gmail). If #2, then haven't you been told about 1,000 times not to do that? Now do you see why?
I truly feel bad for people who get nailed for this, in almost exactly the same way I feel bad for my kids when they touch the stove after I've told them it was hot.
Data recovery (Score:5, Insightful)
Someone try to undelete the files with a disk recovery tool and see what you get. Just because the file is encrypted does not mean that the original was correctly destroyed.
No trust, ergo, no reason to decrypt (Score:4, Insightful)
I suppose if the file in question was something like a manuscript for a novel, where the owner can more or less verify it by eye, and (importantly) there isn't that much downside if our opponent sneaks some changes in, that might be worthwhile. But in general...
RC4 is easier... (Score:3, Interesting)
RC4 brute force is far easier. There are several known problems with RC4 which may possibly work to our advantage in cracking the data as well..
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Oh, I do: as long as it's not the government doing the compelling.
Just once it'd be fun to hear that the local mafia don's PC got infected because his wife wanted cute smileys, and that the local prosecutor is frustrated by the lack of direct evidence linking the don to what they found down by the river.