Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

Filter by
Sorted by
Tagged with
246
votes
10answers
81k views

How is the “WannaCry” Malware spreading and how should users defend themselves from it?

There's a new strain of attacks which is affecting a lot of systems around the world (including the NHS in the UK and Telefonica in Spain) which is being called "WannaCry" amongst other names. It ...
66
votes
3answers
13k views

How does ransomware get the permissions to encrypt your disk?

Recently, my employer blocked access to Gmail, Yahoo Mail, etc., because an employee downloaded an email attachment which contained ransomware and got their disk encrypted. QUESTION : How does ...
125
votes
4answers
13k views

How does ransomware get on people's computers?

I've noticed increased frequency of ransomware questions around Stack Exchange. Some of the people I remotely know had their devices recently infected as well. I'm starting to be concerned. When ...
8
votes
2answers
1k views

How to avoid ransomware

Malware files execute themselves after downloading them. Let's look at it from the point of view of a piece of ransomware like CryptoLocker, from Wikipedia: Crypyowall 3.0, uses a payload ...
-9
votes
2answers
394 views

WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now? [closed]

WannaCrypt-like SMB spreading technique was widely used in Stuxnet, as docummented by Symantec and Kaspersky. Read this: W32.Stuxnet Dossier (2010,Symantec PDF) Now we have the name of the exploit: ...
4
votes
3answers
1k views

What is a good backup strategy against ransomware? [duplicate]

From my understanding, most ransomware works in the background until they are finished with encrypting all their chosen files. I assume that while the ransomware work in the background, if I plug in ...
198
votes
10answers
24k views

What should you do if you catch encryption ransomware mid-operation?

You boot up your computer one day and while using it you notice that your drive is unusually busy. You check the System Monitor and notice that an unknown process is using the CPU and both reading and ...
80
votes
6answers
13k views

Getting files back by paying Ransomware

A company I support/do work for has been hit with ransomware. I've gone down all the data recovery paths etc ... and the business has decided that paying the ransom is cheaper then rebuilding and ...
48
votes
8answers
9k views

How does malicious software encrypt victims' files so quickly?

Encrypting a file to me is akin to dealing with a very long string, feeding it into the hashing or encryption function to get another long encrypted string (or a hash in the case of hashing). This ...
20
votes
2answers
3k views

Do the most common ransomware programs delete the original files as they go, or in a big bulk delete at the very end?

I'm talking about the most common varieties like Cryptolocker, Cryptowall, Torrentlocker, KeRanger, RSA4096, etc. (There is not necessarily a need to answer for all of these, one or two may do.) If ...
10
votes
2answers
1k views

Techniques to detect & mitigate Crypto-ransomware?

Crypto ransomware attacks are the latest concerns for our organization, we need to verify if we are adequately protected from them & if affected, what are the generic mitigation measure? How do ...
19
votes
1answer
7k views

Ransomware encryption keys

Where does ransomware such as the recent wannacry variant store the key it uses to encrypt the files on the victim's disk? Is this hard coded in the program itself? Or does it call into a server to ...
6
votes
1answer
1k views

CryptoLocker master key

I am struggling to understand how it is possible to decrypt files encrypted by the TeslaCrypt ransomware using the master key their creators provided. As far as I know, ransomware encrypts files ...
15
votes
4answers
5k views

Has anybody successfully decrypted their files after paying the WannaCrypt ransom?

WannaCrypt is a shot heard 'round the world, for sure. I have seen news articles saying that people have paid more than $20,000 in ransoms. Here's one from Krebs: Global ‘Wana’ Ransomware Outbreak ...
7
votes
1answer
1k views

How does this javascript attack work?

There is a closed question on StackOverflow with a similar code excerpt but it is closed due to not being a programming related question so I thought I would ask here instead. It was emailed in a Zip ...
3
votes
4answers
2k views

Is it possible to crack ransomware encryption if I have the original file?

Is it possible to crack ransomware encryption if I have 2 versions of a file: before and after the encryption? Are there any tools for such a thing?
2
votes
3answers
631 views

Is there now an increased risk of ransomware in pirated software?

Ransomware is on the rise, much due to new ransom-paying opportunities via Bitcoin. Has there been a reported increased risk of ransomware in pirated software (i.e. so called “warez”) – outside of ...
1
vote
1answer
2k views

Dharma ransomeware files decryption [closed]

One of my clients send me some picture that shows they infected by some ransomware. As i analysed i found that ransomware is probably Dharma ransomware, child of Crysis. so i tried to decrypt files ...
-1
votes
1answer
89 views

Online traffic monitoring by ISP for safety purposes [closed]

I have a question regarding approach to online security and protection against viruses, malware and phishing by one of the biggest European ISP. Below you will find my understanding of the topic. Is ...
-2
votes
2answers
372 views

Cryptowall encryption files

This is a question concerning the way the Cryptowall ransomware encrypts files on the victim's computer. Someone knows if it is possible to recover the encryption key comparing the encrypted file and ...
164
votes
4answers
39k views

GitLab account hacked and repo wiped

I was working on a project, a private repo, and suddenly all the commits disappeared and were replaced with a single text file saying To recover your lost code and avoid leaking it: Send us 0.1 ...
71
votes
15answers
28k views

Are cloud storage services a good strategy to protect against ransomware attacks?

I have been reading a lot here about Ransomware attacks and I am wondering if my strategy for protecting myself is valid or not. I have 10Gb of personal data and 90Gb of photos and videos. I have ...
17
votes
4answers
13k views

Do Linux systems need antivirus against ransomware? [closed]

I use Linux to store private data and backups for my team because it is said that Linux is itself very secure from malware and doesn't need antivirus. But now as ransomware is spreading and has ...
26
votes
3answers
33k views

Does WannaCry infect Linux? [duplicate]

After reading this question, now, I am wondering if WannaCry malware can infect Linux OS especially Ubuntu. One of the answers talked about SMB2 and windows. Does it mean a Linux based computer is ...
21
votes
5answers
8k views

How can ransomware know file types?

When ransomware searches the victim's files in scanning step, how can ransomware know the types of files? It can check the file name (e.g. book.pdf) or file signatures. What I'm wondering is when ...
21
votes
3answers
3k views

Would it be plausible to write your own anti-crypto-ransomware tool? [closed]

Question After reading about how basic ransomware targets and encrypts your files. I was wondering if it would be plausible to write your own script to try and detect such activities? Initial ...
30
votes
8answers
9k views

Is Windows 10 backup safe from ransomware?

Windows 10 stores its backups in a protected folder, e.g. E:\System Volume Information, and only the SYSTEM account has full access to it. Does this make it safe from ransomware that encrypts files? ...
3
votes
1answer
543 views

Is there a ransomware variant that checks for file's magic numbers to encrypt?

Is there a known ransomware-variant (Cryptolocker, Cryptowall etc.) that before encrypting the files checks for their magic numbers? Lets say that there's a Word file, that had its file extension ...
6
votes
1answer
338 views

How to spare file server data from being held hostage by client ransomware?

Suppose in a network there is a file server which's storage is shared between all workstations and all users require full read/write access to this storage for their cooperation workflow. (Over samba, ...
4
votes
2answers
514 views

Would limiting write access to a backup directory help protect it from ransomware?

I know that this is similar to this question, but I don't believe it's a duplicate. You have a program that automatically makes regular backups of all your files to a folder or mounted drive. Let's ...
3
votes
3answers
636 views

How can I protect myself from “ransomware” attacks like the one that affected Transmission users?

The downloader for version 2.90 of the Transmission BitTorrent client was infected by a piece of malware called KeRanger, which encrypts files on your computer and demands a one-Bitcoin ransom to ...
1
vote
2answers
4k views

Protection from ransomware using virtual machine

I have been recently reading about rise in ransomware attacks such as CryptXXX and I was curious about I can protect myself from such attacks. I have a Windows 10 x64 system. Some measures I took are ...
1
vote
3answers
945 views

What do emails have to do with the spread of WannaCrypt?

After the recent spread of WannaCrypt, there has been a lot of warnings about the dangers of emails and clicking on links in them. But the malware is spreading as a worm using SMB to infect other ...
0
votes
1answer
593 views

How to decrypt file that was attacked by ransomware? [closed]

there are a ransomware attacking on of my computer and most of the file has been renamed to something like id-2832SGndfDcbv.supportfriend@india.com.xtbl The file isn't corrupted as the file still ...
0
votes
2answers
569 views

How can I get notified about the publishing of ransomware decryption keys

My computer had been hijacked by "Cryptolocker" a ransomware you might be well aware of. The nasty ransomware has encrypted most of my documents and video files. I used an anti-malware and removed the ...