• We have updated the guidelines regarding posting political content: please see the stickied thread on Website Issues.

Cybercrime: Ransomware

rynner2

rynner2

Gone But Not Forgotten
(ACCOUNT RETIRED)
Joined
Aug 7, 2001
Messages
54,631
Something new to worry about:
NWA-PCUG Newsletter Article, September 2006

Ransom Viruses?
by Jack Matisoff
From August 2006 Boca Bits, The Boca Raton Computer Society, Inc.
jack@[email protected]

Do You Know About "Ransom-Viruses?"

Graham Cluley, senior technology consultant reports a new type of Trojan horse virus was found circulating. It is one of only a few viruses so far that have asked for a ransom in exchange for releasing control of a computer. He has sent a copy to Sophos, a security vendor for investigation.

These schemes had been seen in Russia, but the first one appeared in English just last month.

How this viurs is being spread is not clear, but is being investigated. Viruses, of course, can be spread in several ways, including through spam or a so-called drive-by download that exploits browser vulnerability when a user visits a malicious Web site.

Once run, this Trojan freezes the computer, displaying a message saying files are being deleted every 30 minutes. It then gives instructions on how to send $10.99 via Western Union to free the computer.

Hitting the control, alt, and delete keys will not affect the bug, the virus writer warns. Sophos anti-virus reports provide further details at its Web site.

Some of these virus writers even offer tech support, Cluley said. If the method of unlocking the computer doesn't work after the money is sent, the virus writer promises to research the problem and includes an e-mail address.

Last month, a Trojan emerged that encrypts a user's documents and then leaves a file demanding $300 in exchange for the password to access the information. Victims were instructed to send money to one of 99 accounts run by e-gold, a company that runs a money transfer site.

The password, however, was contained on the infected computer. Sophos cracked it and publicly released it.

IMPORTANT NOTE: Please be SURE that your entire computer, not only your e-mail, is protected against viruses and spy ware. AND, do your computer maintenance on a regular basis.

http://users.nwark.com/~rcmahq/nwapcug/side--96.htm
Click to expand...
 
Very true, but it does leave a very good trail for enforcement folks to track down.
 
Police warn of 'ransom' spam targeting UK users

Tens of millions of UK internet users could be at risk from "ransom" email spam seemingly sent from financial institutions.
The email has an attachment that looks legitimate but is malware that encrypts computer files.
If the attachment is opened, a displayed countdown timer demands a ransom to decrypt the files.

Small to medium businesses seem to be the target and the National Crime Agency says there is significant risk.
Lee Miles, deputy head of the National Cyber Crime Unit, says: "The NCA are actively pursuing organised crime groups committing this type of crime. We are working in co-operation with industry and international partners to identify and bring to justice those responsible and reduce the risk to the public."

The malware installs a piece of "ransomware" called Cryptolocker on computers running the Windows operating system. The ransom demands that the user pay two Bitcoins, a virtual currency, that would be worth £536 to release the decryption key.
Reports suggest that people who have paid the ransom have not had their files decrypted and it has been impossible to restore encrypted files.

The NCA said it would never endorse the payment of a ransom to criminals and warns that there is no guarantee that the people behind the demand would honour the payments.
An NCCU investigation is seeking to identify the source of the email addresses used.

Computer users are being warned not to click on any suspicious attachments, to have updated antivirus software and to regularly back up files. If a computer is infected the advice is to disconnect it from the network and seek professional help to clean the device.

The NCA said that anyone infected with this malware should report it via actionfraud.police.uk.

http://www.bbc.co.uk/news/technology-24964426
 
It probably is teaching my grandmother to suck eggs, but never ever open an attachment sent from someone you don't know and trust.
 
Cochise said:
It probably is teaching my grandmother to suck eggs, but never ever open an attachment sent from someone you don't know and trust.
Click to expand...
I nearly deleted, unread, an email from my brother once, having forgotten he'd changed his email addy! :oops:

(in my defence, I should add that it wasn't perhaps wise of him to choose an addy with the word 'trouble' in it.)
 
More on Cryptolocker:

Cryptolocker ransomware has 'infected about 250,000 PCs'
By Leo Kelion, Technology reporter

A virulent form of ransomware has now infected about quarter of a million Windows computers, according to a report by security researchers.
Cryptolocker scrambles users' data and then demands a fee to unencrypt it alongside a countdown clock.

Dell Secureworks said that the US and UK had been worst affected.
It added that the cyber-criminals responsible were now targeting home internet users after initially focusing on professionals.

The firm has provided a list of net domains that it suspects have been used to spread the code, but warned that more are being generated every day.

Ransomware has existed since at least 1989, but this latest example is particularly problematic because of the way it makes files inaccessible.
"Instead of using a custom cryptographic implementation like many other malware families, Cryptolocker uses strong third-party certified cryptography offered by Microsoft's CryptoAPI," said the report.
"By using a sound implementation and following best practices, the malware authors have created a robust program that is difficult to circumvent."

The first versions of Crytpolocker appear to have been posted to the net on 5 September.
Early examples were spread via spam emails that asked the user to click on a Zip-archived extension identified as being a customer complaint about the recipient's organisation.

Later it was distributed via malware attached to emails claiming there had been a problem clearing a cheque. Clicking the associated link downloaded a Trojan horse called Gameover Zeus, which in turn installed Cryptolocker onto the victim's PC.

By mid-December, Dell Secureworks said between 200,000 to 250,000 computers had been infected.
It said of those affected, "a minimum of 0.4%, and very likely many times that" had agreed to the ransom demand, which can currently only be paid in the virtual currencies Bitcoin and MoneyPak.
"Anecdotal reports from victims who elected to pay the ransom indicate that the Cryptolocker threat actors honour payments by instructing infected computers to decrypt files and uninstall the malware," added the security firm.
"According to reports from victims, payments may be accepted within minutes or may take several weeks to process."

However, Trend Micro, another security firm, has warned that giving into the blackmail request only encouraged the further spread of Cryptolocker and other copycat schemes, and said that there was no guarantee of getting the data back.

Dell suggested PCs be blocked from communicating with the hundreds of domains names it had flagged as being linked to the spread of Cryptolocker, and it suggested five further steps the public and businesses could take to protect themselves:

Install software that blocks executable fields and compressed archives before they reach email inboxes
Check permissions assigned to shared network drives to limit the number of people who can make modifications
Regularly back-up data to offline storage such as Blu-ray and DVD-Rom disks. Network-attached drives and cloud storage does not count as Cryptolocker can access and encrypt files stored there
Set each PC's software management tools to prevent Cryptolocker and other suspect programs from accessing certain critical directories
Set the computer's Group Policy Objects to restrict registry keys - databases containing settings - used by Cryptolocker so that the malware is unable to begin the encryption process.

http://www.bbc.co.uk/news/technology-25506020
 
Some Maine police agencies say they have had no other choice than to pay a ransom to computer hackers to get their police records back.

Computers at the Lincoln County sheriff's office were recently infiltrated by a type of virus called ransomware. It locked up the system and held police records hostage.

Sheriff Todd Brackett told WCSH-TV that after several attempts to retrieve the records, his agency paid a ransom of about $300 to the creator of the virus to get their files back.

Brackett says the FBI helped track the payment to a Swiss bank account but efforts to identify the hackers got no further.

Also in Maine, Houlton Police Department computers were held hostage and the police chief says the department ended up paying a ransom.

http://phys.org/news/2015-04-maine-police-ransom-hackers.html
 
Maybe now they will start to take things like this more seriously
and lock them up for a very long time, even longer if anyone dies.
 
BBC live news on this is now saying it wasn't targetted and has hit a number of other organisations too.

They're not saying which.
 
RaM said:
Maybe now they will start to take things like this more seriously
and lock them up for a very long time, even longer if anyone dies.
Click to expand...

Or even just take adopt basic computer security precautions.
 
Regular punters here may remember my arguments against ID cards and the Surveillance State. Particularly regarding the inefficency of government data storage systems, their security as well as the mission and function creep of interests involved in gaining access to the stored information on systems that are clearly not fit for purpose. How could they close every back door?
I argued then that putting all of our data eggs in one basket would create a golden target for hackers everywhere and now we have this.

If only someone could have seen this coming...
 
39 Hospitals and GP surgeries so far in England ... the hackers are demanding money .. it's thought 74 countries have been affected.

nhshack.jpg
 
Last edited:
It seems very misleading that this is still being called a cyberattack at all, from what they're saying, it seems to be entirely down to out of date security combined with people clicking on links in emails.

Back in 2001 when I worked in Highways, I came back from lunch one day to see around 400 emails in my inbox, all of them with a link to the Mawinela virus... turned out it just took one person logging into their Yahoo mail and clicking the link to give the virus access to their address book and it all cascaded from there.

IT experts are "working round the clock" to restore NHS computer systems hit by Friday's ransomware attack.

Ciaran Martin, head of the UK's cyber security agency, said it was doing "everything in our power" to get "vital services" back up and running.

The BBC understands about 40 NHS organisations and some GP practices were hit in England and Scotland, with operations and appointments cancelled.

Theresa May said the NHS had been caught up in an international attack.

Similar computer infections have been reported in a range of organisations in about 100 countries.

Some British hospitals and GPs were unable to access patient data after their computers were locked by the malicious program.
Click to expand...

The malware used in the attack is called WannaCry and attacks Windows operating systems.

It encrypts files on a user's computer, blocking them from view, before demanding money, via an on-screen message, to access them again.

The demand is for a payment of $300 (£230) in virtual currency Bitcoin to unlock the files.

The virus is usually covertly installed on to computers by hiding within emails containing links, which users are tricked into opening.

Security chiefs and ministers have repeatedly highlighted the threat to Britain's critical infrastructure and economy from cyber-attacks.
Click to expand...

BBC
 
OneWingedBird said:
It seems very misleading that this is still being called a cyberattack at all, from what they're saying, it seems to be entirely down to out of date security combined with people clicking on links in emails.

Back in 2001 when I worked in Highways, I came back from lunch one day to see around 400 emails in my inbox, all of them with a link to the Mawinela virus... turned out it just took one person logging into their Yahoo mail and clicking the link to give the virus access to their address book and it all cascaded from there.





BBC
Click to expand...
Is that $300 in total or per user ? .. if it's in total, we're looking at a hacker or two trying to have a laugh.
 
OneWingedBird said:
It seems very misleading that this is still being called a cyberattack at all, from what they're saying, it seems to be entirely down to out of date security combined with people clicking on links in emails.
Click to expand...
That's pretty much the case. It seems like the NHS was targeted, but really it's because of their lax security that it's snowballed into a much bigger problem.
 
And good news from Devon:
Derriford Hospital back to normal after cyber attack
By Plymouth Herald | Posted: May 13, 2017

Patients are being urged to attend appointments as normal at Derriford Hospital this morning after staff worked tirelessly to overcome a cyber attack.
A number of NHS hospitals across the country reported that their computer systems had been affected by a bug on Friday afternoon.
But this morning the team at Derriford announced disruption has been minimised and most systems were running normally.

A statement on the hospital website reads: "Thanks to a huge team effort from staff - #1bigteam - we have minimised disruption to the hospital and have stepped down the incident we called yesterday evening.
"Most systems are running as normal and no patients have been affected.
"All patients are asked to attend the hospital for their appointments today and tomorrow as normal."

etc...

http://www.plymouthherald.co.uk/der...cyber-attack/story-30330261-detail/story.html
 
rynner2 said:
And good news from Devon:
Derriford Hospital back to normal after cyber attack
By Plymouth Herald | Posted: May 13, 2017

Patients are being urged to attend appointments as normal at Derriford Hospital this morning after staff worked tirelessly to overcome a cyber attack.
A number of NHS hospitals across the country reported that their computer systems had been affected by a bug on Friday afternoon.
But this morning the team at Derriford announced disruption has been minimised and most systems were running normally.

A statement on the hospital website reads: "Thanks to a huge team effort from staff - #1bigteam - we have minimised disruption to the hospital and have stepped down the incident we called yesterday evening.
"Most systems are running as normal and no patients have been affected.
"All patients are asked to attend the hospital for their appointments today and tomorrow as normal."

etc...

http://www.plymouthherald.co.uk/der...cyber-attack/story-30330261-detail/story.html
Click to expand...
Does this mean the NHS is strong and stable again ? ace !

 
Global cyber-attack: Security blogger halts ransomware 'by accident'
By Chris Foxx Technology reporter
13 May 2017
Audio file: 2m 06s

A UK security researcher has told the BBC how he "accidentally" halted the spread of the malicious ransomware that has affected hundreds of organisations, including the UK's NHS.
The 22-year-old man, known by the pseudonym MalwareTech, had taken a week off work, but decided to investigate the ransomware after hearing about the global cyber-attack.

He managed to bring the spread to a halt when he found what appeared to be a "kill switch" in the rogue software's code.
"It was actually partly accidental," he told the BBC, after spending the night investigating. "I have not slept a wink."
Although his discovery did not repair the damage done by the ransomware, it did stop it spreading to new computers, and he has been hailed an "accidental hero".
"I would say that's correct," he told the BBC.
"The attention has been slightly overwhelming. The boss gave me another week off to make up for this train-wreck of a vacation."

The researcher first noticed that the malware was trying to contact a specific web address every time it infected a new computer.
But the web address it was trying to contact - a long jumble of letters - had not been registered.
MalwareTech decided to register it, and bought it for $10.69 (£8). Owning it would let him see where computers were accessing it from, and give him an idea of how widespread the ransomware was.

By doing so, he unexpectedly triggered part of the ransomware's code that told it to stop spreading.
This type of code is known as a "kill switch", which some attackers use to halt the spread of their software if things get out of hand.
He tested his discovery and was delighted when he managed to trigger the ransomware on demand. :D

etc...

http://www.bbc.co.uk/news/technology-39907049
 
NHS 'robust' after cyber-attack
13 May 2017
Video:

A total of 48 of England's NHS trusts were hit by Friday's cyber-attack, but only six are not yet back to normal, Home Secretary Amber Rudd has said.
Speaking after an emergency Cobra meeting, Ms Rudd said "there's always more" that could be done to protect against computer viruses.
She said 97% of NHS trusts were "working as normal" and there was no evidence patient data was affected.

The ransomware attack hit organisations in at least 99 countries.
Europol described it as "unprecedented" and said its cyber-crime team was working with affected countries to "mitigate the threat and assist victims".

Ms Rudd insisted the government had "the right plans" to limit the impact of the attack, which also affected the Nissan car plant in Sunderland.

etc...

http://www.bbc.co.uk/news/uk-39909441
 
rynner2 said:
Global cyber-attack: Security blogger halts ransomware 'by accident'
By Chris Foxx Technology reporter
13 May 2017
Audio file: 2m 06s

A UK security researcher has told the BBC how he "accidentally" halted the spread of the malicious ransomware that has affected hundreds of organisations, including the UK's NHS.
The 22-year-old man, known by the pseudonym MalwareTech, had taken a week off work, but decided to investigate the ransomware after hearing about the global cyber-attack.

He managed to bring the spread to a halt when he found what appeared to be a "kill switch" in the rogue software's code.
"It was actually partly accidental," he told the BBC, after spending the night investigating. "I have not slept a wink."
Although his discovery did not repair the damage done by the ransomware, it did stop it spreading to new computers, and he has been hailed an "accidental hero".
"I would say that's correct," he told the BBC.
"The attention has been slightly overwhelming. The boss gave me another week off to make up for this train-wreck of a vacation."

The researcher first noticed that the malware was trying to contact a specific web address every time it infected a new computer.
But the web address it was trying to contact - a long jumble of letters - had not been registered.
MalwareTech decided to register it, and bought it for $10.69 (£8). Owning it would let him see where computers were accessing it from, and give him an idea of how widespread the ransomware was.

By doing so, he unexpectedly triggered part of the ransomware's code that told it to stop spreading.
This type of code is known as a "kill switch", which some attackers use to halt the spread of their software if things get out of hand.
He tested his discovery and was delighted when he managed to trigger the ransomware on demand. :D

etc...

http://www.bbc.co.uk/news/technology-39907049
Click to expand...
Excellent news ... and the culprit/culprits shouldn't be too hard to find now .. I'm going with it being a teenager due to the farcical ransom demand that was $300 or it doubles ever day !! *dramatic drumroll* .. back in the early days, the government used to catch these kids and give them web security jobs instead of prison terms. I wonder how this will all unfold ?.
 
I don't think this was a targeted attack, or that the NHS is in some way particularly vulnerable. It's very difficult to stop people clicking on links even in a small organisation, and with the variety of users that there must be in the NHS I would think virtually impossible. Nor will anti-malware be able to trap every new threat. The first wave of ransomware last year caught out all sorts of organisations until the counter-measure guys got on to it.

No-one had to 'hack' anything to do this. Computers are not secure, don't irrevocably trust your data to them. Especially if they are connected to the internet, as nowadays they virtually all are.

If you are going to build a secure system for stuff as vital as patient data the first thing you do is build a private network - a real one, not a VPN. Give people a second cheapo device for ad-hoc stuff that can use the internet. And don't give them any ability to plug stuff into the dedicated machinery - no USB ports. This is not the way anything is actually done, but it is the way you'd set about it if you actually took security seriously. No-one does.
 
Last edited:
Newquay surfing computer geek who stopped the NHS cyber attack
By CMJacqui | Posted: May 14, 2017

A self-taught surfing computer geek thought to be living on the Devon coast has been identified as the expert who stopped the huge global cyber attack that brought the NHS and other organisations worldwide to a standstill.

The cyber attack affected 48 hospitals and health trusts in England, including Derriford Hospital in Plymouth, as well as computer equipment in 100 countries across the world.
But it took the 22-year-old Newquay surfer took just a few hours to find a critical weakness in the ransomware to stop it spreading any further after it crippled tens of thousands of computers.
After announcing what he'd done, the young security expert, known only as Malware Tech, has been inundated with messages and praise, but tried to play it down.

He later told the Mail on Sunday: 'Saying I've saved lives is a bit drastic, but I've definitely saved a few people a pretty penny."
The young security expert he security expert started working for a private intel threat firm in Los Angeles a year ago, investigating the latest malicious computer software released by criminals and hackers - but he still lives in the south west.

He has previously tweeted about surfing and living by the sea and says: "I'm not a graduate. I had planned to go to university but ended up getting offered a job in security a year prior, so I took it. I'm completely selftaught so in hindsight university would probably not have been worth the time or money."

etc...

http://www.cornwalllive.com/newquay...cyber-attack/story-30331385-detail/story.html

The main surfing hotspots in north Devon are Croyde and Woolacombe.
 
Unfortunatly this (cybercrime) is an area that the MSM know nothing about - some of the stuff they print is both hilarious and badly misleading. This attack was NOT a 'hack' - it was some general purpose malware, the kind certain people get a kick out of writing basically to show how 'clever' they are.

Yer man Malware Tech was hacking about in the malware trying to analyze it (as I would have done if that kind of thing was still my responsibility) and by a combination of skill and luck he stopped the thing spreading because the author had built in a 'kill switch' - something which in itself suggests that this was a) a generalised attack and b) was not seriously intended to extort money - the author probably just wanted to know how far it would spread - I expect a lot further than he anticipated.

Also the NHS pays Microsoft to keep its XP security up to date until XP can be replaced. As a result anyone still using XP (in the UK, at least) is still getting updates. I have one XP machine (it has some obsolete software on it that won't run on anything newer - viz. the workshop manual for my car) and indeed it still recieves updates. This ransomware by all accounts got in via a browser and so the operating system would have little to do with it.

edited for spelling
 
Last edited:
You must log in or register to reply here.
Back
Top