Researchers Find New Version Of WanaDecrypt0r Ransomware Without A Kill Switch (vice.com) 98
Remember that "kill switch" which shut down the WannCry ransomware? An anonymous reader quotes Motherboard:
Over Friday and Saturday, samples of the malware emerged without that debilitating feature, meaning that attackers may be able to resume spreading ransomware even though a security researcher cut off the original wave. "I can confirm we've had versions without the kill switch domain connect since yesterday," Costin Raiu, director of global research and analysis team at Kaspersky Lab told Motherboard on Saturday... Another researcher confirmed they have seen samples of the malware without the killswitch.
What hath thou abandoned me, Microsoft?? (Score:1)
I've got an internet-facing server running Server 2000. Where is our patch!?! My boss is going to freak out if anything bad happens!
Re: (Score:2)
Write up a "told you so" as in a root cause analysis.
Re: What hath thou abandoned me, Microsoft?? (Score:1)
It was only a matter of time... (Score:5, Interesting)
The person who found the previous "kill switch" believes that it was actually an anti-sandboxing feature, not a kill switch.
Re: (Score:2)
can i have a link to where you saw this please?
Re:It was only a matter of time... (Score:5, Informative)
Re: (Score:1)
None, if your ISP hijacks your DNS and serves up advertising when it receives a request for a bad domain name. See Cox Communications for an example. That, however, usually only happens on residential DNS, while the ransomware fliating around now is mainly in corporate environments, due to the nature of SMB.
Re: (Score:2)
Cox and Verizon only hijacked the lookup to protect you from ransomware!
Re: (Score:2)
They are very efficient at it also. Used to get mine within hours. Hard to fight that kind of mitigation unless you use raw ip, which sometimes can become a problem to hide then. unless you have deep pockets for china.
Re: (Score:3)
Re: (Score:2)
OK, note to self: Use a random URL in the next version.
Re: (Score:1)
Even if you use a randomizing URL it can be caught, and algorithm figured out to register the next years worth of domains. it was very bad implantation of a sandbox check.
Re: (Score:2)
That is a possibility however, adding more interaction between sandbox and host leads to more potential ways to break out of the sandbox and truly be malicious. It's almost like a double edged sword. The more you try to prevent by passing to the host the more you possibly weaken your whole secure environment.
Re: (Score:2)
Thank you! Awesome read. Anybody who hasnt should.
We can only hope! (Score:2)
Lets hope that this person is doing this for awareness. and hopefully he makes his point. or else sorry you put a critical on the internet without knowledge of how the internet works.
Re: (Score:2)
I suspect that the perps are doing it for money.
Always follow the money.
Re: (Score:2)
im sure he is. but i can hope that hes not.
This wave... (Score:2)
Is really going to hurt then.. I doubt the world has had time to patch everything...
Re: (Score:2)
Re: (Score:2)
This attack *WILL* really hurt, but it will be good in the long run because it will teach people to back up data.
Re: (Score:1)
God damnit (Score:5, Funny)
I've tried everything to get this to run on my Linux Mint box (including installing WINE) and it just won't do anything.
Re: (Score:3, Funny)
I've tried everything to get this to run on my Linux Mint box (including installing WINE) and it just won't do anything.
Surely you are familiar with stuff not working on a Linux box ?
It's part of the hobby to experience such things, n'est ce pas ?
Re: (Score:2)
Clearly you need a VM to experience the full goodness of Microsoft's SMB implementation..
Re: (Score:2)
Same here but it doesn't work on Win10 either.
Well duh, RTFM (Score:5, Funny)
You need to make sure you have the *correct* version of gettext, libiconv, openssl, gnu-crypto, and gnucash (not the one your distro ships with of course) and you need the correct version of GCC (4.9.4 it will refuse to compile if you use 4.9.3 or 4.9.5). Also if you are on Mint you will need to patch the ransomware.h header file but not Debian. If using CentOS you need to make sure you load the x86 compatibility libraries or it won't work. Make sure to pass the correct flags to ./configure
This is all obvious to everyone who read the manual so stop wasting our time.
Re: (Score:2)
sudo rm -rf
Re: (Score:3)
If you send me two bitcoins within 6 hours I will provide an installer. If you wait longer the price will go up!
Re: (Score:2)
If more than 5 people ran something important on a Linux Mint desktop that is worth holding for ransom then we would consider a port. Until then your target market is just too small and you will need to run a compatible copy of Microsoft Windows to use our software.
Sincerely,
Dev Team.
Re: (Score:2)
If more than 5 people ran something important on a Linux Mint desktop that is worth holding for ransom then we would consider a port. Until then your target market is just too small and you will need to run a compatible copy of Microsoft Windows to use our software.
Thank you! I installed Windows 10 and was able to get it to encrypt my files properly on the first try.
By the way, what does "Error connecting to NSA Data Collection Server" mean? I get that notification whenever my internet goes down.
Re: (Score:2)
Error connecting to NSA Data Collection Server
The error you are experiencing means that the automated email and password database backup systems aren't working as intended. If you intend to work without an internet connection for long periods of time it may be worth while to print hard copies of everything important and mail it directly to the NSA for archiving.
Never Run Windows on Bare Metal (Score:1, Insightful)
1) Get ransomware
2) Read warning about losing data
3) Chuckle with a smirk on your face
4) Revert to this morning's snapshot
5) Carry on
Re: (Score:1)
It works better than dropping all the information you recorded EVER on the floor. Why hospitals are even ON the Internet is beyond me...
Oh right..
Obama.
Thank you very much, asswipe.
Re: (Score:2)
Hospitals moved to computer because it saved space storing data on a server rather than rack and racks of shelves with paper notes with scribbly doctors writing. These would have to be thrown out after three years if the patient never returned. Then when someone is referred to another doctor, clinic, practise, specialist, consultant, those paper notes would have to be transferred across as well. Needless to say, they would end up being lost. Medical notes weren't the right size to store X-ray plates let alo
Re: (Score:2)
Re: (Score:2)
I was not aware Obama had anything to do with the UK's NHS.
Re: (Score:2)
This is assuming that it's a rapidly acting ransomware. Some have acted more slowly, and you could lose a week's worth of data, or a month's worth. And...unnh... how long do you keep your backups before recycling?
I am diabling SMB v1 (Score:4, Informative)
Even though my main machine is mac, and my bootcamp and windows secondary machine are on Win10 and Fully patched, and my synology NAS has SMB v1 disabled, I may as well disable SMBv1 across the whole fleet.
God have mercy on all morons who are still running unpatched machines...
Re: (Score:2)
Because I certainly won't. Either this will be a good object lesson, or they'll get what they deserve for not learning from experience.
Re: (Score:2)
I wonder if you could draw a parallel to the anti-vax movement. There is a sort of herd immunity if all machines are patched as malware has a harder time replicating and spreading with less compromised machines to do so. But there are people who persistently refuse to patch because of some perception that the patch itself or the patching process is more troublesome than the likelihood they will be part of an infection.
Re: (Score:2)
To be fair, that perception is rather well founded in the windows world. I tried going down that road myself back in WGA introduction time frame, but gave up soon enough.
sometimes i think worse must precede better... (Score:5, Insightful)
I've seen security-aware people being widely ignored by technically illiterate managers and decision makers for decades. Sometimes they aren't given the tools they ask for, or their advice is ignored, or sometimes they are both ignored and still blamed when things go wrong. That's not even getting into all the ordinary folks buying low-security or pre-backdoored IoT devices, and the intrusion of the internet into everyday things like cars and televisions.
Sometimes I think something really nasty has to happen before people will wake up. But then when I think about it some more, I don't believe that would help either. The wrong message would be taken. Instead of adopting good security practices, it would instead be a series of laws that managed to be both misguided, harmful, and utterly useless for solving the real problem. It would be "magical thinking" instead of really paying attention to digital security.
Then I go have a couple beers, because fuck it.
It's All About ROI (Score:5, Insightful)
It's not like most IT departments don't know these vulnerabilities exist, and there are many common reasons, some common ones being:
A) Code written under a very tight schedule, where getting working code operational is the number one target, and the team expects to tighten up the security later but never does.
B) Legacy code written before this type of security was much of a concern.
The main problem with preventing this kind of thing is the Bean Counters. Generally, they will do a calculus of the possibility that they specifically will be hack, and what it will cost to tighten up the code to prevent the hack. In other words, they gamble that they will not be hacked, thus saving them the money it will cost to have their inside team or a contractor fix things. It's all about their bonus.
Of course the Bean Counters will not admit this, but it's important to understand that the people who sign off on allocating the funds to accomplish tightening up security simply have no understanding about the actual threat verses cost, nor do they really care because it's all about ROI.
Re: (Score:2)
Re: (Score:2)
The main issue with the bean counters is that they (often intentionally) underestimate the probability of a flaw being exploited.
If exploiting the flaw will give the attacker some kind of financial or otherwise interesting profit, even indirectly (like exploiting a OS flaw to deploy ransomware) then given a sufficient timeframe, the probability that the flaw will be found and exploited is close to 100%.
I know this is a bit of "hire me" since I'm an IS Architect, but IT is going to become a lot more expensiv
Re:It's All About ROI (Score:4, Insightful)
Neither (A) nor (B) apply in this case, but rather:
C) Organizations insist on using an operating system that has been known for decades to have more severe security holes than Swiss cheese, but which the (only!) vendor refuses to fix until its too late (if even then).
Shocking! (Score:2)
It's almost as if someone saw this coming. [slashdot.org]
Why couldn't the NSA find/activate kill switch??? (Score:4, Interesting)
What does it say about the NSA, if lone security researcher finds and activates a kill switch before they do?
So they can snoop on and store an entire nation's web traffic and email, but they can't analyse a small piece of malware, notice it queries some domain name, and then discover (in a test environment) that the existence of the domain stops the malware from propagating? And then activate the domain to give the world a few hours respite?
Sure, now there's a new version without a kill switch, but the brief respite will have given millions of people the opportunity to secure their machines. It seems a pretty pathetic state of affairs when the NSA pours vast sums of money into nefarious snooping, yet can't keep pace with a single security researcher when it comes to *actually* helping keeping the nation secure.
Same goes for other countries' intelligence agencies, e.g. GCHQ.
Re: (Score:1)
What? you want them to violate the DMCA to reverse engineer the code.
Re: (Score:3)
The kill switch is in the malware, not in the underlying Windows code. It's probably not exploitable for intelligence activity. Why would the NSA/CIA/FBI/whatever care about it as long as it doesn't infect their computers? (Which they probably back up regularly and, one suspects, probably don't run on Windows)
Hashes.... (Score:2)
Re: (Score:2)