New Ransomware 'Jaff' Spotted; Malware Groups Pushing 5M Emails Per Hour To Circulate It (theregister.co.uk) 58
An anonymous reader writes: The Necurs botnet has been harnessed to fling a new strain of ransomware dubbed "Jaff". Jaff spreads in a similar way to the infamous file-encrypting malware Locky and even uses the same payment site template, but is nonetheless a different monster. Attached to dangerous emails is an infectious PDF containing an embedded DOCM file with a malicious macro script. This script will then download and execute the Jaff ransomware. Locky -- like Jaff -- also used the Necurs botnet and a booby-trapped PDF, security firm Malwarebytes notes. "This is where the comparison ends, since the code base is different as well as the ransom itself," said Jerome Segura, a security researcher at Malwarebytes. "Jaff asks for an astounding 2 BTC, which is about $3,700 at the time of writing." Proofpoint reckons Jaff may be the work of the same cybercriminals behind Locky, Dridex and Bart (other nasty malware) but this remains unconfirmed. And Forcepoint Security Labs reports that malicious emails carrying Jaff are being cranked out at a rate of 5 million an hour on Thursday, or 13 million in total at the time it wrote up a blog post about the new threat.
Re: (Score:2)
And you think that would make it better?.. I mean your logic is they should ban all untraceable forms of currency including cash because they COULD be used to do nefarious things.
Of course, governments do stupid things.. and people are easy to goad through fear. (aka: terrorisim)
Re:Another horrific idea from Microsoft (Score:4, Interesting)
It's for enhanced user experience. But yes, the stupidest idea from Microsoft ever was to allow scripting in documents, and not just basic scripting but scripts with tons of control over your computer. They should just go ask a 10 year old, "would this be a good idea?" and they'd be better off.
Having problems running this in Linux (Score:5, Funny)
Does anyone know what settings I need in WINE to make this work in Linux? Getting sick of all these Windows-specific programs!
Re:Having problems running this in Linux (Score:4, Funny)
And that's the problem with Linux. You spend more time fiddling with settings to get something to work than you do getting work done
Re: (Score:1)
Well, I tried it on BSD and it wouldn't work there either. So much for portability - write once, debug everywhere...
Re:Having problems running this in Linux (Score:4, Interesting)
Yeah, but only once. Unlike in Windows, the settings don't tend to magically flip themselves back with "updates"
Re: (Score:2)
It keeps some of it's settings (eg. allowing or disallowing read/write access to network drives) in a script that gets replaced with every update instead of somewhere sensible.
Re: (Score:2)
And that's the problem with Linux. You spend more time fiddling with settings to get something to work than you do getting work done
Only if you consider consider "not getting work done" a problem.
Re: (Score:3)
The perfect ransom ware for a linux machine would be one that keeps all the files but changes the OS to windows XP then locks the boot firmware till you pay.
Re: (Score:2)
...as long as it isn't Windows 10 (or worse, Vista...)
And, This is Why... (Score:5, Insightful)
...I have 100% backups of every computer on my LAN, every night, stored to an external drive, one of three that I rotate among. The backups are automatic, concluded by shutting down the computer from which the backup was just copies to disk, every night. I have about a weeks' worth of backups on each disk, for each computer on the LAN, so I have about three weeks' worth of backups on hand. Rolling back is easy, and takes less than an hour.
I'll never understand how technologists--who claim they are professionals--can leave their own or others' computers unprotected by backups, automatically made ('cause if they're not automatic, they'll never get made).
Sure, anti-virus and malware detection is important, but my backups are the final defense against miscreants like those who create these malicious invasion methodologies.
Re: (Score:2)
So if you physically rotate the drives...how is that "automatic"?
More importantly, keep in mind some of the ransomware running around is sneaky, running transparently for weeks or months to ensure that whatever backups are being made have rolled passed their maximum retention and all the new backups are actually encrypted. After a common retention period like 3 months, the malware pulls the plug...deleting the local encryption keep and throwing up a ransom note. "Oh, but I have week's worth of backups, I'
Re: (Score:2)
s/encryption keep/encryption key *sigh*/
Re: (Score:2)
So if you physically rotate the drives...how is that "automatic"?
More importantly, keep in mind some of the ransomware running around is sneaky, running transparently for weeks or months to ensure that whatever backups are being made have rolled passed their maximum retention and all the new backups are actually encrypted. After a common retention period like 3 months, the malware pulls the plug...deleting the local encryption keep and throwing up a ransom note. "Oh, but I have week's worth of backups, I'm fine!"...until you realize all those backups are also encrypted...
Which is why I have URbackup [urbackup.org] running on my LAN backing up all the family computers. It shares no NFS or SMB folders to be infected or tampered with. I have a years worth of quarterly full backups and six months worth of daily incrementals which it stores very efficiently using hard links. It has Windows, Mac and Linux clients. I check it weekly to make sure I don't see a huge spike in incremental data saved which would indicate a ransomware event. The chronically lazy can get reports emailed.
It won'
Re: (Score:1)
Re: (Score:2)
These m
Re:And, This is Why... (Score:4, Insightful)
Ok, but why? Backing up individual PCs is a waste of time and resources in the high-speed network era.
Train your users that it's 2017, workstations are disposable and may disappear at any given moment. If their shit isn't saved on the network NAS or in $CloudDriveProvider, it doesn't exist. Restoring should be just re-imaging a computer and signing back into relevant accounts.
Windows has had seamless server file storage redirection for years, so you don't even really have to train them, just redirect My Documents and Desktop to the fileserver.
Ditch MS office already. It's 2017 and there is absolutely no excuse for these types of vulnerabilities anymore. It doesn't do anything useful that Google Docs does, unless you consider spreading malware useful.
Re: (Score:2)
It uses a wonderful feature of Windows called docm which allows scripts.
If you go to TFA, you'll see this brilliant Windows software in action.
Re:And, This is Why... (Score:5, Insightful)
1) A LOT of workstations include not just data, but a lot of specific configuration. That's especially true of those used in the medical field where they're used to control equipment, but it's also very true for any user more advanced than an office drone. Simply re-imaging them won't get them anywhere remotely close to a functional state.
2) Simply saving to network/cloud drive won't save you from ransomware; They'll simply encrypt every NAS/cloud storage the user has access to. Often it can greatly exacerbate the problem because if/when a server attached to that NAS gets infected...it can encrypt the entire company's data at a much, much faster rate than local PCs and doesn't need to infect all those individual machines or wait for them to be powered on. Cloud storage is even worse in this regard, because access keys can be jacked and the storage reached externally by bot clusters.
Also, NAS is dead...long live hybrid solutions. Panzura, StorSimple, etc. Still, it requires massively upgraded networks, both LAN and WAN connectivity, to adequately replace local storage with remote for hundreds or thousands of users.
A much more legitimate response would be something like AWS WorkSpaces, but again local machine controllers often won't be able to use those solutions.
3) Who the hell uses My Documents? Despite MS pushing it for ages, real world usage shows almost everyone (especially non-power users) saving everything to their desktop.
4) Ditch MS Office, haha that's funny. Clearly, you don't work in any company larger than a few dozen employees.
Re: (Score:2)
It allows an economy of scale approach to dealing with the problem.
More capable systems with different features now have access to the files, so now you can have snapshotting and access to external storage, such as tape, which is not going to all be online at once if the whole thing gets compromised. Doing that on a PC level is a bit of messing about, but on a shared
Re: (Score:2)
Does Google Docs allow you to manage your files and use Office-like features and interfaces offline, and without absolute reliance upon the cloud to perform the simplest of tasks within your company?
Short answer: YES
Re: (Score:2)
Ditch MS Office
Use Google Docs
Workstations are disposable... just re-image and sign back in
Sounds like a good prescription for Chromebooks
Re: And, This is Why... (Score:1)
Yeah great if you work for a tiny company, try the same with 100/1000/10000/100000 desktops...
Re: (Score:2)
Throw out the desktops. Give everyone Chromebooks. No management issues.
Just sign in and you're good to go.
Re: (Score:2)
Serious question: Why do so many computer geeks actually believe every computer user 'lessor' than them doesn't use applications more specialized than a web browser?
I'm sure that Chromebook will be great for updating your resume...after you're fired for crippling the company as practically no enterprise applications will run on those toys. Alternative applications are either non-existent, not nearly functional enough, too expensive, require costly retraining, or most often some combination of those faults.
Re: (Score:2)
If an enterprise has locked themselves into applications that run only on Windows, they are stupid and deserve to pay Bitcoin ransom for their stupidity. The writing has been on the wall for many years and most app vendors who are not luddites have (at a minimum) a web version of their software.
Chromebooks have no need for desktop management. It's much easier to manage the network that a bunch of malware infested Windows boxen.
Re: (Score:2)
Maybe, but it happens A LOT.
Also due to the moving target nature of MS Windows that means you get some of these applications that only work on specific versions as these vital applications. I have two users still on MS Windows XP - one to run an electronic testing application and another for a label printing program. They can still run MS Office 201*, firefox, thunderbird etc and don't need a lot of memory so
Re: And, This is Why... (Score:2)
Unfortunately true.
Lazy admins let this slide.
Really? A label printer? WTF You can't find a label printer program?
State of the art 20 years ago is a threat to the Enterprise today.
Re: (Score:2)
Then again you should have known better than the advice to pay bitcoin to criminals and continue to encourage them.
It's MS Windows. The only bit where it looks like an "Enterprise" is software falling over like disposable redshirts.
Re: (Score:2)
Yes, sorry, I used the term "admins" but they are not really responsible... they just admin what they are given. They can make recommendations to the CTO managers who are the real culprits. The C level people are fat and lazy and not doing their job. It would take work and thinking and planning and money to fix their enterprise but they are lazy and cheap. They are just sliding by and hoping that nothing bad happens to the house of cards they have built on dodgy Windows software.
Unfortunately, Windows IS en
Re: And, This is Why... (Score:2)
"Yeah great if you work for a tiny company, try the same with 100/1000/10000/100000 desktops..."
Economies of scale makes it cheaper per desktop the more you have ...
Re: (Score:3)
I am waiting for the generation of ransomware which installs a shim driver that transparantly encrypts documents, but allows the user to access them for a certain period time (so all backups in 30-90 days are useless), then at a date/time, purges the keys, and springs the trap.
I would say that these days, I'd consider a much longer backup rotation with snapshots kept for years just in case.
I also would look at a "pull" backup mechanism, a client that the server contacts. That way, unlike backing up to a sh
Re: (Score:2)
So, a business is going to survive the loss of 30-90 days of work?
Re: (Score:2)
You are waiting for criminals who will wait around for a long time, risking discovery by various traces and backtracking, instead of demanding money now. I think you'll be waiting for a while.
It sounds like a really cool plot but I think we are still in "take the money and run" territory here i
Re: (Score:2)
I am waiting for the generation of ransomware which installs a shim driver that transparantly encrypts documents, but allows the user to access them for a certain period time (so all backups in 30-90 days are useless), then at a date/time, purges the keys, and springs the trap.
Back when dinosaurs ruled the Earth, there was Ashton Tate's dBASE running under MS-DOS.
.DB file I/O. When it saw write activity, it occasionally changed some data in the outgoing buffer but also remembered the exact position and bytes changed into a hidden file. When reading damaged blocks, it would revert those changes.
Who cares? Because there was a TSR (Terminate and Stay Resident) virus you could get that intercepted
So the user effect was absolutely nothing. And the more you (unsuspectingly) us
Re: (Score:1)
backing up workstations? what the fuck for?
you sound like a blow hard, and the whole comment is probably bullshit.
Joke's on them (Score:1)
I don't use a fancy-pants PDF reader that gives a crap, and I don't have Office installed, either.
Even on Windows this is a non-scary problem for anyone who knows anything.
Roll on job security.
Interesting Omission (Score:1)
Re: (Score:2)
It's normally a fairly safe assumption since the rare mac or *nix security problems get a label applied.
Are we ready to kill them yet (Score:2)