Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

Filter by
Sorted by
Tagged with
246
votes
10answers
81k views

How is the “WannaCry” Malware spreading and how should users defend themselves from it?

There's a new strain of attacks which is affecting a lot of systems around the world (including the NHS in the UK and Telefonica in Spain) which is being called "WannaCry" amongst other names. It ...
198
votes
10answers
24k views

What should you do if you catch encryption ransomware mid-operation?

You boot up your computer one day and while using it you notice that your drive is unusually busy. You check the System Monitor and notice that an unknown process is using the CPU and both reading and ...
164
votes
4answers
39k views

GitLab account hacked and repo wiped

I was working on a project, a private repo, and suddenly all the commits disappeared and were replaced with a single text file saying To recover your lost code and avoid leaking it: Send us 0.1 ...
126
votes
4answers
13k views

How does ransomware get on people's computers?

I've noticed increased frequency of ransomware questions around Stack Exchange. Some of the people I remotely know had their devices recently infected as well. I'm starting to be concerned. When ...
80
votes
6answers
13k views

Getting files back by paying Ransomware

A company I support/do work for has been hit with ransomware. I've gone down all the data recovery paths etc ... and the business has decided that paying the ransom is cheaper then rebuilding and ...
79
votes
5answers
13k views

Why are ransomware attackers not tracked down via bitcoin transactions?

A bitcoin transaction has details of the incoming address as well as the outgoing address (where the bitcoins are being transferred), so my question is why that outgoing address has not done anything ...
71
votes
15answers
28k views

Are cloud storage services a good strategy to protect against ransomware attacks?

I have been reading a lot here about Ransomware attacks and I am wondering if my strategy for protecting myself is valid or not. I have 10Gb of personal data and 90Gb of photos and videos. I have ...
67
votes
4answers
15k views

Why is so much ransomware breakable?

The site: https://www.nomoreransom.org/ offers many decrypter tools for ransomware. But why? It shouldn't be so hard to use the Windows Crypto API (e.g. just google "create AES Key in Windows") to ...
66
votes
3answers
13k views

How does ransomware get the permissions to encrypt your disk?

Recently, my employer blocked access to Gmail, Yahoo Mail, etc., because an employee downloaded an email attachment which contained ransomware and got their disk encrypted. QUESTION : How does ...
65
votes
3answers
16k views

What happens if you run WannaCry after installing the necessary patches?

I understand that WannaCry spreads itself by exploiting the SMBv1 vulnerability, which is fixed by patch MS17-010. Does this mean that even with the patch installed, WannaCry can still infect the ...
48
votes
11answers
8k views

Why are ransom attacks successful?

I just read that "ransom" attacks are on the rise - where the attacker uses a vulnerability to enable them to encrypt files and demand money for the key. Why is this any different to a disk failure, ...
48
votes
8answers
9k views

How does malicious software encrypt victims' files so quickly?

Encrypting a file to me is akin to dealing with a very long string, feeding it into the hashing or encryption function to get another long encrypted string (or a hash in the case of hashing). This ...
45
votes
4answers
8k views

Can the ransomware encryption key be derived from comparing encrypted and unencrypted files?

A firm has 10 million files, all ransomware encrypted, but the firm has all of those 10 million files backed up, and almost all of them have not changed. Would comparing all of those files against ...
39
votes
2answers
9k views

How can ransomware be so prevalent when there is such a clear money trail to the attackers?

If there's one thing the Internet is good at, it's keeping track money and knowing where it has moved. Ransomware attacks typically request payment for a decryption key. How is it with such an easily ...
30
votes
8answers
9k views

Is Windows 10 backup safe from ransomware?

Windows 10 stores its backups in a protected folder, e.g. E:\System Volume Information, and only the SYSTEM account has full access to it. Does this make it safe from ransomware that encrypts files? ...
26
votes
4answers
9k views

How to decrypt .lock files from ransomeware on Windows [closed]

I am helping a friend which is an accountant and got all of her books locked due to this. Here are some details: BTC address of the attacker: 1MBwkTssJkqRvXmAFcSEZ3xTD39A9rkyYA Email: helptoyou1@...
26
votes
3answers
33k views

Does WannaCry infect Linux? [duplicate]

After reading this question, now, I am wondering if WannaCry malware can infect Linux OS especially Ubuntu. One of the answers talked about SMB2 and windows. Does it mean a Linux based computer is ...
21
votes
5answers
8k views

How can ransomware know file types?

When ransomware searches the victim's files in scanning step, how can ransomware know the types of files? It can check the file name (e.g. book.pdf) or file signatures. What I'm wondering is when ...
21
votes
3answers
3k views

Would it be plausible to write your own anti-crypto-ransomware tool? [closed]

Question After reading about how basic ransomware targets and encrypts your files. I was wondering if it would be plausible to write your own script to try and detect such activities? Initial ...
20
votes
5answers
5k views

Is there any open source ransomware? [closed]

I'm working on malware analysis at my university and I'm trying to develop ransomware. I'm planning to publish the source code after it's finished. Is there any open source ransomware sample so I can ...
20
votes
2answers
3k views

Do the most common ransomware programs delete the original files as they go, or in a big bulk delete at the very end?

I'm talking about the most common varieties like Cryptolocker, Cryptowall, Torrentlocker, KeRanger, RSA4096, etc. (There is not necessarily a need to answer for all of these, one or two may do.) If ...
19
votes
4answers
3k views

What lessons can be learned from the latest spate of Ransomware attacks? [closed]

I'm not sure this is the right place, but figured people would find it useful if they aren't too familiar with security policies and general best practices. There is a lot of information out there, ...
19
votes
1answer
7k views

Ransomware encryption keys

Where does ransomware such as the recent wannacry variant store the key it uses to encrypt the files on the victim's disk? Is this hard coded in the program itself? Or does it call into a server to ...
18
votes
3answers
20k views

Are there ransomware infections of Ubuntu Linux in the wild?

Due to the recent media coverage of ransomware attacks several people for whom I've provided personal computer support in the past have expressed concerned. The majority of these people are running ...
17
votes
4answers
13k views

Do Linux systems need antivirus against ransomware? [closed]

I use Linux to store private data and backups for my team because it is said that Linux is itself very secure from malware and doesn't need antivirus. But now as ransomware is spreading and has ...
15
votes
4answers
5k views

Has anybody successfully decrypted their files after paying the WannaCrypt ransom?

WannaCrypt is a shot heard 'round the world, for sure. I have seen news articles saying that people have paid more than $20,000 in ransoms. Here's one from Krebs: Global ‘Wana’ Ransomware Outbreak ...
14
votes
3answers
3k views

Why does Sage Ransomeware blacklist League of Legends, steamapps, etc.? [closed]

I was recently reading the Malwarebytes Labs threat analysis for Sage Ransomware. I found it interesting to learn that, apparently, in addition to system directories, which makes sense, paths to games ...
12
votes
1answer
2k views

Will resize of an image execute the file?

Our server was exploited by a ransomware. We allow admins to upload PDF, docx, excel etc. But also images and SVG. And we use dragonfly to generate thumbnails on those files that are supported. Let'...
11
votes
3answers
2k views

How does genuine ransomware exist?

Typically, ransomware will encrypt the victim's files and ask for money in exchange for the decryption key. If you do pay the ransom, does it actually deliver on this promise? It seems to me that ...
10
votes
2answers
1k views

Techniques to detect & mitigate Crypto-ransomware?

Crypto ransomware attacks are the latest concerns for our organization, we need to verify if we are adequately protected from them & if affected, what are the generic mitigation measure? How do ...
9
votes
4answers
4k views

Will password protected files like zip and rar also get affected by Odin ransomware?

If I protect my files with password and use rar or zip files to store these files. Can ransomware encrypt password protected files?
9
votes
5answers
337 views

Could ransomware be stalled while encrypting?

I have been reading about ransomware, and I was wondering if it could be defended against by having certain "trap" files on a drive. Sometimes I look through Code Golf and am thoroughly impressed by ...
9
votes
2answers
1k views

Are machines patched against WannaCry protected against the ongoing Petya attacks?

Our environment has a few Windows 2012 R2 servers which is already patched against the WannaCry ransomware. The update installed was KB4012213. Is this good enough to protect against the ongoing ...
8
votes
9answers
13k views

Is there a file system that doesn't support encryption?

I would prefer that no one, even me, could encrypt my files. I have no use for it, and don't want it. Is there a way to permanently disable any sort of encryption at the OS level? If not, is this a ...
8
votes
2answers
4k views

How to recover from ransomware using Restore Points?

While reading about ways to recover from a ransomware on a Windows machine it's often recommended to use the System Restore functionality, e.g. to restore from a Restore Point. I know that the ...
8
votes
2answers
1k views

How to avoid ransomware

Malware files execute themselves after downloading them. Let's look at it from the point of view of a piece of ransomware like CryptoLocker, from Wikipedia: Crypyowall 3.0, uses a payload ...
8
votes
1answer
1k views

Is Apple's AirPort Time Capsule vulnerable to ransomware?

I have a Macbook Air laptop and use Apple's Time Machine program and an AirPort Time Capsule (physically connected to my router via ethernet cable) to periodically back up my data. If my laptop were ...
7
votes
3answers
4k views

Why aren't ransomware deployers arrested? [closed]

Why aren't people who use ransomware to extort money from people arrested? Using ransomware is illegal, presumably. The idea that Bitcoin is anonymous is a myth. Given this, it seems like they ...
7
votes
1answer
1k views

How does this javascript attack work?

There is a closed question on StackOverflow with a similar code excerpt but it is closed due to not being a programming related question so I thought I would ask here instead. It was emailed in a Zip ...
7
votes
8answers
14k views

MacOS Ransomware with EFI Lock

Problem Description Yesterday my mother called me that she got a message on her iPhone, that it was stolen (iCloud Find My Phone). She then had to enter security codes (two-factor authentication) ...
7
votes
2answers
1k views

How to protect Time Machine backups from Ransomware?

According to Heise (German) Time Machine backups can be encrypted by Ransomware. Sorry I didn't find an English source, please use Google translate. KeRanger had an inactive module ...
6
votes
2answers
3k views

How does the attacker to ransomware get the password?

I have been thinking about ransomware and as I see it the password seems like it should be a problem for the attacker. I can see it going down one of two ways. Either the password is included in the ...
6
votes
1answer
2k views

What happens if a Dropbox folder is encrypted by WannaCrypt / WannaCry?

Does one's Dropbox "data in the cloud" also get encrypted?
6
votes
4answers
849 views

Why is there no easy heuristic protection against ransomware?

After the recent spread of the WannaCry ransomware - which proved one more time that this kind of attack is capable of causing serius damage and dangerous disruptions to critical services - I asked ...
6
votes
2answers
1k views

Why isn’t Secure Boot protecting against ransomware like PETYA

Some ransomwares, like PETYA, are encrypting the MBR and asking for a ransom. I don’t understand why Secure Boot isn’t preventing that of happening.
6
votes
1answer
1k views

CryptoLocker master key

I am struggling to understand how it is possible to decrypt files encrypted by the TeslaCrypt ransomware using the master key their creators provided. As far as I know, ransomware encrypts files ...
6
votes
1answer
338 views

How to spare file server data from being held hostage by client ransomware?

Suppose in a network there is a file server which's storage is shared between all workstations and all users require full read/write access to this storage for their cooperation workflow. (Over samba, ...
6
votes
1answer
611 views

Why does WannaCry use different AES keys to encrypt different files on host?

I have a question after reading the discussion here: Ransomware encryption keys So I understand the process of WannaCry encryption now, thanks to the accepted answer given by the community on the ...
6
votes
3answers
2k views

Ransomware-resilient Linux Samba file server

Imagine the following scenario: Files are kept on a Linux server and clients access them via Samba. One of the client machines gets infected with ransomware, which encrypts everything within the ...
5
votes
1answer
2k views

How to reverse engineer WannaCry? [closed]

I was reading an article today about a Google researcher linking the WannaCry malware to the earlier malware Cantopee. I had two primary questions based on the contents of the article. What do the ...