Ramblings of an old Doc
And threaten blackmail if personally damaging documents found.
Published on February 6, 2017 By DrJBHL In Personal Computing

 

Things seem to get worse, not better. Ransomware is now the most common form of malware.

Now ransomware will lock your OS, as well as hold your data for ransom, bricking your computer unless you pay.

"In the space of a year, ransomware appears to have evolved on from the simple but effective strategy of locking down the files of infected targets until they pay a ransom, to incorporating additional malicious elements, such as stealing personal or financial data from the victim's system...Now cybersecurity researchers warn that new ransomware features could make life even worse for victims. Rather than just encrypting key files, ransomware could soon infect a computer to such an extent that the only two options available to the user would be to pay, or to lose access to the entire system.

According to the Malwarebytes Stateof Malware Report 2017, we're likely to see more variants of this type of ransomware, which is designed to modify the infected computer's Master Boot Record, the part of the system which controls the ability to boot into the operating system.

Once modified in this way using malicious code, the system will boot into a lock screen set up by the malware, demanding payment not only to decrypt files but also to restore access to the main operating system. The inability to do anything with the system aside from viewing the ransomware note will only give victims two options: pay up, or have their system wiped completely. It's likely to make ransomware an even more appealing avenue of attack for cybercriminals." - ZDNet

This is noteworthy, as well:

"The attacks against Western targets might not surprise. They are the countries with the most access to technology, and there's also the potential that these states are being targeted for political reasons. The researchers points out that many cybercriminal syndicates work out of Eastern Europe.

"A country that seems to be missing from this list is Russia. This isn't because Russian citizens have a firm grasp on computer security. Rather, it's an indicator that Russian ransomware developers might shy away from targeting their own," the report says." - ibid

I recommend reading the linked article.

I do not recommend paying these criminals because nothing assures you that they won't leave the malware on your computer for subsequent activation. Certainly, never pay by credit card, if you decide to pay despite this warning. After all, are these the people to trust with such info? In the end, it might just be cheaper to buy a new computer.

I also recommend taking the steps necessary to foil or recover from ransomware attacks outlined in my prior articles.

 

Source:

http://www.zdnet.com/article/ransomware-is-about-to-get-a-lot-worse-by-holding-your-operating-system-hostage/#ftag=CAD-04-10aag0g&bhid=22934121128163694730898056497463

 


Comments (Page 2)
2 Pages1 2 
on Feb 07, 2017

This won't solve the encrypted file issue but what if you boot to a flash drive and install a new boot record?  At least if you have a backup oif your files you can reimage the OPC after that.  Or why not simply reimage from the flash drive and a backup disk?

on Feb 07, 2017

gevansmd

This won't solve the encrypted file issue but what if you boot to a flash drive and install a new boot record?  At least if you have a backup oif your files you can reimage the OPC after that.  Or why not simply reimage from the flash drive and a backup disk?

Best horse-has-bolted solution is True Image [or equivalent] and a daily incremental backup of your OS.

When you're 'hit' just restore image back to day prior...

Otherwise just listen to the_Monk for best advice for avoidance...

on Feb 07, 2017


Otherwise just listen to the_Monk for best advice for avoidance.

Yes, I created a non-priveleged account to surf the net and check emails.  It wasn't as straight forward in Win 10 as previous Windows editions, but I got there.  There's new and different steps to add another account in Win 10 and you need to record an email address for it.  I didn't want to be bothered with all that so just created a local account instead.

on Feb 08, 2017

I think that only full system backup (OFFLINE) is the best passive protection against ransomware that can save your data/time/money/health.

http://manual-removal.com/hakunamatata/

on Feb 08, 2017

HellPrice

I think that only full system backup (OFFLINE) is the best passive protection against ransomware that can save your data/time/money/health.

 

How many revisions do you keep?  Because if it's less than a week you may want to reconsider.  Here's why.

If I'm a ransomware creator, I know that people are employing tactics to prevent infection by me including everything listed in this thread.  I simply create the 'infection' in stages.  The first program circumvents your security by piggy-backing on the elevated credentials too many people still USE their systems with.  I immediately use those elevated privileges to effectively modify system properties allowing my infection to reside in your system undetected.  Then I wait......maybe a week.......maybe two.  Why?  Because I know by then your backups will have overwritten themselves with new ones including my 'modified version' of your OS.  Then, maybe a week later I progress to stage two, and actually deploy the parts of the malware that will cause damage (ie. encrypt files etc.).  Sure you can go back to an OFFLINE backup.  So what?  I still possess the 'keys to your kingdom' and can re-infect at will.

I am not saying that backups are useless.  Backups are VERY useful.  Just don't over-think what they provide to the end user.  Backups provide a certain level of 'peace of mind'.  Privilege reduction/restriction is the only way to afford real protection especially from ourselves. 

 

on Feb 08, 2017

If you get infected with one of these, does it affect separate drives used for files? For example my SSD has windows and my games on it. I have a HDD internal for most pictures and porn. Then i have another external HDD that has the bulk of my pictures, movies and such. 

 

My solution for viruses has always been to simply drop in my windows disc and reinstall. Will that work in this case and would the virus destroy the other HDD drives or would  you still have them and the data on them?

on Feb 08, 2017

 

In my experience I have seen it corrupt/encrypt data on any/all connected devices (ie. drives connected via USB as well as including networked resources).

on Feb 08, 2017

It really depends on the virus. The worst I've probably seen bypassed the surge protector, and fried the computer. 

on Feb 08, 2017

By now, I was looking forward to flying cars...

Regression is so prevalent I wonder if publishing "Recipes for Bar-B_Q squirrel" wouldn't be more practical...

on Feb 09, 2017

Here's my 'routine'.

I have the usual - Cybereason Ransomfree, Malwarebytes Pro, Kaspersky.

In addition, I prepare for the worst.

I have Acronis doing daily backups. I also have another set of daily backups going to an Acronis Securezone, which, I'm assured, can only be accessed by Acronis.

I have my programs on an SSD, documents on another drive and several backup drives. I also have another backup drive which is always disconnected.

Once a month I connect the backup drive to copy my files across. The only really 'mobile' files I have are my camera RAW files. Should I have to wipe the drives in between backups, the RAW files are still on the camera (it can store 1100 files).

So, worst case scenario, I get hit and all my drives and data are locked. I can format all the drives and start again. I can load the latest image from the secure zone so my C:/ is back up and running (I could even do a clean install if need be). I can then connect the offline backup drive and copy back my documents.

A bit excessive, but better safe than sorry.

on Feb 09, 2017

It is whatever works. Erring on the side of caution is a good thing.

on Feb 12, 2017

I fell for a fake Microsoft Tech Support scam the other day. I haven't found any lingering effects so far, but I am going to dispute transactions when my bank will let me. With stuff like this happening, it doesn't surprise me that the world is headed in such a negative direction.

on Feb 13, 2017

Zeta1127

the world is headed in such a negative direction.

 It sure is, when everywhere you look seems to be on a irreversible downhill trend, whether it be criminals, corporations and/or government.  Sadly, the days are gone when CEOs and politicians were gentlemen and statesmen... and modern-day thieves no longer have a code of conduct. 

Nowadays just about everyone wants to steal/take your money, rightfully so or not.  And just because it's a politician or corporate person, don't mean it ain't stealing.  It's just been legitimised is all.

At the end of the day, there's just one word for it all... GREED!!!

 

Worst of all, the people with the most seem to be the greediest of them all... and I won't mention Trump in case some think it's political.

2 Pages1 2