Try This One Weird Trick Russian Hackers Hate (krebsonsecurity.com) 78
Brian Krebs: In a Twitter discussion last week on ransomware attacks, KrebsOnSecurity noted that virtually all ransomware strains have a built-in failsafe designed to cover the backsides of the malware purveyors: They simply will not install on a Microsoft Windows computer that already has one of many types of virtual keyboards installed -- such as Russian or Ukrainian. So many readers had questions in response to the tweet that I thought it was worth a blog post exploring this one weird cyber defense trick. The Twitter thread came up in a discussion on the ransomware attack against Colonial Pipeline, which earlier this month shut down 5,500 miles of fuel pipe for nearly a week, causing fuel station supply shortages throughout the country and driving up prices. The FBI said the attack was the work of DarkSide, a new-ish ransomware-as-a-service offering that says it targets only large corporations.
DarkSide and other Russian-language affiliate moneymaking programs have long barred their criminal associates from installing malicious software on computers in a host of Eastern European countries, including Ukraine and Russia. This prohibition dates back to the earliest days of organized cybercrime, and it is intended to minimize scrutiny and interference from local authorities. In Russia, for example, authorities there generally will not initiate a cybercrime investigation against one of their own unless a company or individual within the country's borders files an official complaint as a victim. Ensuring that no affiliates can produce victims in their own countries is the easiest way for these criminals to stay off the radar of domestic law enforcement agencies. [...] Here's the thing: Digital extortion gangs like DarkSide take great care to make their entire platforms geopolitical, because their malware is engineered to work only in certain parts of the world.
DarkSide and other Russian-language affiliate moneymaking programs have long barred their criminal associates from installing malicious software on computers in a host of Eastern European countries, including Ukraine and Russia. This prohibition dates back to the earliest days of organized cybercrime, and it is intended to minimize scrutiny and interference from local authorities. In Russia, for example, authorities there generally will not initiate a cybercrime investigation against one of their own unless a company or individual within the country's borders files an official complaint as a victim. Ensuring that no affiliates can produce victims in their own countries is the easiest way for these criminals to stay off the radar of domestic law enforcement agencies. [...] Here's the thing: Digital extortion gangs like DarkSide take great care to make their entire platforms geopolitical, because their malware is engineered to work only in certain parts of the world.
Advert? (Score:4, Funny)
"Try This One Weird Trick Russian Hackers Hate"
"Try This One Trick Doctors Hate to Quickly Loose Weight"
Re: (Score:2)
First thing I noticed as well. how that got you a -1 i'll have no idea.
Re: (Score:2)
itiswhatitiwijgalt's karma is such that every post starts at "-1". This post didn't earn them a -1, they started there due to their other posts...
Re:Advert? (Score:5, Insightful)
Why does this sound like one of those spammy adverts you see on CNN's website. It even rhymes. "Try This One Weird Trick Russian Hackers Hate" "Try This One Trick Doctors Hate to Quickly Loose Weight"
Because they were trying to be funny.
I guess you weren't in the mood.
Re: (Score:2)
Re: (Score:2)
Agreed, it could had been, adding a Russian Virtual Keyboard can stop a lot of ransomware.
or Ransomeware will not run on PC with Russian Virtual Keyboards.
Slashdot isn't getting paid for us to clink the link, so just let us know right away, and give more detail in the summary, and for full detail read the article.
Re: (Score:2)
Re: (Score:2)
Re:Advert? (Score:5, Funny)
Apparently there's no Whoosh character on your keyboard.
Comment removed (Score:5, Insightful)
Re: (Score:2)
people have to be told not just that something's intended to be funny, but that they're meant to laugh at it.
There is a name for this disorder. It is called Humor Impairment [chicagotribune.com].
Re: (Score:2)
Also: humour is cultural. Can even change with the times. Or there are situations where some people laugh out of embarrassment, were in another culture one would cry.
Whoosh? (Score:2)
Re: (Score:3)
advertisements?
CNN and practically all other sites across the spectrum have gone to that for what they try to pass as "news" . . .
"This state {verb}{adverb}. . . "
"This state has the most {adjective}{noun} "
"{noun} gets {adjective} with this"
Generally, they're trying to generate a click for a single piece of information that would have fit entirely in the headline.
Or
"{idiot celebrity}'s hack for {dumb action|vain adjective}"
Re: (Score:3)
"Discover The One Word That Causes Nerds To Loose Their Ability To Spell Properly"
Re: Advert? (Score:2)
Re: (Score:3)
Re: (Score:2)
It's almost as if [youtu.be]...
Hmmm... Can you sense the 'keyboard check?' (Score:5, Interesting)
Could the check for Russian/Ukranian/Cyrillic keyboard be used as a signature for malware?
Re: (Score:3)
Could the check for Russian/Ukranian/Cyrillic keyboard be used as a signature for malware?
Not exactly because they are not actually checking for a "Russian/Ukranian/Cyrillic keyboard", they are querying the system keyboard layout. Specifically, they are using querying the keyboard driver (most likely calling GetKeyboardLayout() in User32.dll) either directly or indirectly. However, you could do an end run and check values in HKEY_CURRENT_USER\Keyboard Layout\Preload. They aren't specifically querying, "is this a Russian layout" so programmatically determining what they do with the value is no
Re: (Score:2)
Thanks!
Re:Hmmm... Can you sense the 'keyboard check?' (Score:4, Funny)
Beyond simple signatures, Windows antivirus engines rely on collective behavioral information so that they can find entirely new threats. This means they have "red flags" (e.g. is it a compressed executable?)
These "red flags" can't work too well, because I'm pretty sure "encrypting entire hard drive and deleting backups" is a blazing bright flaming red flag and they're not detecting it.
Re: (Score:2)
One potential legitimate reason would be to automatically select the localization of your program to the user. For most programs though this is something you would do at install time not runtime.
Re:Hmmm... Can you sense the 'keyboard check?' (Score:4, Interesting)
Second, checks for installed languages will not work. Once you add up all students of particular languages, immigrants, researchers, etc you get > 10-15% of the population with Cyrillic support installed. Add to that other "countries to avoid" which play role in the flow of criminal funds - namely several latin alphabet Eastern European countries and the Baltic states and the percentage is probably > 20%.
At the same time, plenty of people in Eastern Europe do not have Cyrillic support installed. Though the people who do not have it installed are probably also those who are least likely to complain.
IMHO, this whole thing is a red herring. There are more than enough geoip services nowadays for malware to determine which country it is in. It does not need to do "those weird tricks Russian hackers hate".
Re: (Score:2)
Firstly I think you are missing the fact that there are so many marks out there for the ransomware gangs that super accurate detection of location is not necessary. A quick screen of has Russian layout, move on is adequate for their purposes.
Second what do you do on an air gaped machine? These are juicy targets for ransomware but geoip is not going to help.
false flag (Score:3)
Re: (Score:2)
Seconded. Can probably piggyback on their own C&C if all you're changing is the language restrictions.
Re: (Score:3)
Re: (Score:2)
I don't think its russian law enforcement .... (Score:5, Insightful)
... they're bothered about. If they accidentaly created a cyberattack on one of the many russian corporations that have more than a passing association with the russian mafia then the hackers future prospects if caught might be rather short and unpleasant.
Re: (Score:2)
The CIA also has the capability to do unpleasant things. I'm just sayin'.
Dont repeat yourself (Score:2)
Re: (Score:3)
You sound alt-left but your comment is so stupid it must be alt-right.
Re: (Score:2)
Re: (Score:2)
In Fascist America, the far right is called "left".
Re: (Score:2)
Re: (Score:2)
Re:I don't think its russian law enforcement .... (Score:5, Interesting)
It's definitely a mafia thing, but the Russian government has ties to the mafia, and gives "guidance" to the ransomware gangs.
In the Italian mafia families, there is a "boss" who controls an "area". If you are a small-time criminal operating in the area, you need to get permission of the boss to work in his area. The boss will demand a "taste" or "piece of the action" or a share of your profits. Also, the boss may place restrictions on your operations, like do not rip off old grandmothers or sell drugs to school kids.
In Russia, Putin is the "Capo die Capi" or "Boss of Bosses". Ransomware gangs are permitted to operate in Russia, as long as they don't attack any Russian institutions . . . or make themselves a public relations liability.
In the case of DarkSide, hitting a few non-critical companies was OK with Putin. Seriously crippling the gasoline supply on the East Coast of the US brought unwanted attention and has forced this issue onto the global scale, which will now need to be addressed at the upcoming Biden / Putin summit. Neither Biden nor Putin wanted to have to deal with this, as they have enough cats to skin together.
Mafiosi hate media attention, because it is bad for their business. They like hiding in their shadows. This is why Putin pulled the plug on DarkSide. It wasn't personal . . . it was strictly business.
This is like those "Cosmo" articles... (Score:3)
So installing a Russian keyboard (Score:4, Funny)
is like biting down hard?
Re: (Score:3, Funny)
Dear Cosmo, I kicked my man in the balls from behind while he was getting dressed like you advised in your March issue, and he turned around and punched me in the face. Am I living with a domestic abuser?
Re:This is like those "Cosmo" articles... (Score:4, Informative)
Dear concerned, Whenever engaging in BDSM activities it is important to discuss boundaries with your partner. The general understanding of limits and the agreement on a safeword will prevent your next ball trampling session turning into a black eye incident.
Re: (Score:1)
Introduce her to Kim Anami's program. Once she's built up those muscles both of you will have sex that you can only dream about. She's really in control and it'll be wonderful.
DarkSide on the S&P500? (Score:2)
There are already plenty of ransomware-as-a-service tech companies leading the market.
Where's their prospectus?
Re: (Score:2)
There are already plenty of ransomware-as-a-service tech companies leading the market.
Where's their prospectus?
Like Google? https://it.slashdot.org/story/... [slashdot.org]
Re: (Score:2)
Crime-as-a-service companies are direct evidence that the crime doesn't pay well enough to be worth the effort.
But, some people will pay a premium to feel that they're criminal masterminds while doing boring, meaningless work for little pay.
No prospectus (Score:2)
Admin Rights....that is the problem (Score:1)
Or maybe...just maybe if people ran their accounts Least Privileged (without Admin credentials)...this whole problem would go away.
Re: Admin Rights....that is the problem (Score:2)
That would vanish the instant people decided to actually install any sort of software or perform any sort of necessary driver update. The constant warning spam becomes just another EULA Accept box to click before your shit installs.
Re: (Score:2)
Odds are you have read/write access to whatever data/documents you use on a daily basis. Not having admin rights may keep the ransomware from locking up system files but those aren't what its after. It wants the stuff you use on a daily basis. Getting to the network share where a team stores all of their day to day stuff is plenty, no need to actually mess with the file server itself or even the OS on the workstations.
Proper backups are the only solution here. But many places don't do them, don't them prope
Re: (Score:2)
Re: (Score:1)
Smart! (Score:5, Funny)
Step 1: Develop malware that will not attack computers with virtual russian keyboards.
Step 2: Let the word spread that installing a russian keyboard is a simple measure for avoiding said malware.
Step 3: Produce virtual keyboard software infested with malware and backdoors.
Step 4: Watch as users willingly download and install your keyboard malware app.
Step 5: Profit!
Re: (Score:2)
Step 3: Produce virtual keyboard software infested with malware and backdoors.
Windows?
Re: (Score:2)
Wanna know how I know you've never typed anything in a different language in your life?
Please don't (Score:5, Insightful)
Summaries are supposed to Summarise (Score:1)
Re: Summaries are supposed to Summarise (Score:2)
Msmash has no time to "summarise" a story, she just posts whatever readers suggest, the more click-baity the better.
Re: Summaries are supposed to Summarise (Score:2)
The first couple of paragraphs of a news article is supposed to include a summary of the story.
So, no one here is into security (Score:3)
Based on the first few dozen comments, no one here pays attention to security.
Otherwise, you'd know who Brian Krebs was. I look at his page every weekday, and have for close to 10 years... but then, until I retired, I was a sr. Linux sysadmin.
Russia, China, Iran, & North Korea thank you (Score:2)
Time to allow western crackers to go after nations like this.
to be safe (Score:1)
Try This One Weird Trick Russian Hackers Hate (Score:1)
Install Linux.
They hate it when everyone is actually running a different OS than what their malware targets.
Colonial Pipeline ATTACK!!!1!! (Score:4, Informative)
Hackers shut down the billing system. Management shut down the pipeline because they were afraid they wouldn't get paid [jalopnik.com].
Re: (Score:2)
Hackers shut down the billing system. Management shut down the pipeline because they were afraid they wouldn't get paid [jalopnik.com].
Your local fast food joint shuts down if it can't get paid, your gas station shuts down if it can't get paid, your bank shuts down if it can't get paid, the super duper mart shuts down if it can't get paid. I don't know what your truck driver does if you can't get them a paycheck, not much I'd guess. Just to point out the obvious, billing systems are a tad important chief.
Also, Colonial wants the image of a secure separate network that was totally safe the whole time, but the reality anyone that's ever wo
Re: (Score:1)
I bet that guy wants to be paid when he works. It's amazing how people think if it's a company it's no big deal. As if there is a money fairy or something.
Insert commie cyber BS (Score:1)