Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

Filter by
Sorted by
Tagged with
3
votes
1answer
875 views

Can you find the ransomware key if you already have decrypted files?

Disclaimer: I have very very little experience with ransomware/encryption, so I'm sorry if I ask something stupid. Ransomware attacks are all over the news, especially this year. And this got me ...
5
votes
5answers
264 views

In the era of cryptolockers, is it possible to prevent Windows from modifying your Linux partition?

I could imagine that in few years, cryptolockers could become so advanced that instead of just encrypting some files on the partition of the current OS, they could also touch all other partitions on ...
1
vote
4answers
291 views

How can I defend my mail server against ransomware?

First of all I'm aware that I should use some anti-virus mechanism to prevent as much as possible any ransomware being delivered through my mail server - and yes I'm already using that kind of ...
3
votes
2answers
236 views

Ransomware left some files not encrypted

A ransomware attack happened to my server, I've backups and all and I tracked down the reason to two elements (either unupdated Bitnami LAMP stack or unupdated Flask server) but I noticed some files ...
1
vote
2answers
1k views

How did Wanna Cry get past Antivirus Programs

For those who had windows computers when the WannaCry virus hit, how exactly did the virus bypass antivirus programs. I have tried to read some papers about this, but I don't understand how exactly ...
7
votes
8answers
14k views

MacOS Ransomware with EFI Lock

Problem Description Yesterday my mother called me that she got a message on her iPhone, that it was stolen (iCloud Find My Phone). She then had to enter security codes (two-factor authentication) ...
2
votes
1answer
161 views

Is it possible to “steal” someone else's ransomware bitcoin payment? [closed]

I'm not too sure if this belongs on security.SE, so feel free to close or migrate to a different SE. It seems that many ransomwares use Bitcoin as currency (for good reason), and tell you to send X ...
14
votes
3answers
3k views

Why does Sage Ransomeware blacklist League of Legends, steamapps, etc.? [closed]

I was recently reading the Malwarebytes Labs threat analysis for Sage Ransomware. I found it interesting to learn that, apparently, in addition to system directories, which makes sense, paths to games ...
0
votes
2answers
168 views

How files of ransom attacks were decypted?

In this site is was announced that everybody can decrypt the files victim of a ransom attack. They just don't tell you how it was possible. It's supposed the files were encrypted with an encryption ...
3
votes
0answers
53 views

Possible EternalBlue Infection, Next Step? [duplicate]

Sorry if I messed up in any manner, e.g. title, details, tags, layout, venue, response plan, etc. I know a little of the stacks and security in general. Short Version: I found material on my other ...
0
votes
1answer
308 views

Why does a perfc file cure/kill Petya ransomware (is it a bug or a deliberate decision of the creators)?

Why does a perfc file in the Windows directory prevent the recent Petya ransomware? Is it a bug in the ransomware that halt's it from executing? Or is it a deliberate attempt of the creators to allow ...
2
votes
4answers
219 views

Archival storage for ransomware defense

Thinking about the threat posed by ransomware, the defense that makes the most sense to me is to have a secure copy, and an automated way to restore protected files. Ordinary backups are not really ...
2
votes
2answers
681 views

Can the new WannaCry affect Linux ext4 file system data from Windows?

So every now and then I switch over to my Windows 10 OS from my Linux partition. Whilst I am there, I am fully aware that I can be infected with WannaCry which will encrypt all the files on the system....
19
votes
4answers
3k views

What lessons can be learned from the latest spate of Ransomware attacks? [closed]

I'm not sure this is the right place, but figured people would find it useful if they aren't too familiar with security policies and general best practices. There is a lot of information out there, ...
9
votes
2answers
1k views

Are machines patched against WannaCry protected against the ongoing Petya attacks?

Our environment has a few Windows 2012 R2 servers which is already patched against the WannaCry ransomware. The update installed was KB4012213. Is this good enough to protect against the ongoing ...
1
vote
0answers
827 views

NotPetya Information and Updates [closed]

I was wondering if there were any people here who had any useful links or information on the new NotPetya attacks. Is there any good websites to monitor attacks like this or if there are any good ...
79
votes
5answers
13k views

Why are ransomware attackers not tracked down via bitcoin transactions?

A bitcoin transaction has details of the incoming address as well as the outgoing address (where the bitcoins are being transferred), so my question is why that outgoing address has not done anything ...
2
votes
1answer
915 views

How does erebus infect Linux systems?

Today I read about ransomware called Erebus that supposedly targets Linux servers and encrypts all the data there. What I can't find is any reference to the details of this type of attack, i.e. how ...
2
votes
1answer
1k views

How does ransomware connect to the Tor deep web?

A lot of ransomware and malware uses deep web services to get their key. I was wondering if they carry the Tor browser with them or if they use some other technique, as I don't think everyone has Tor ...
3
votes
2answers
2k views

Can ransomware encrypt files in a drive locked by BitLocker?

I have a general understanding of how ransomware works. I want to know if ransomware will target a locked Bitlocker drive, however. I very rarely unlock that drive, and it will only be unlocked for ...
0
votes
2answers
113 views

limiting automated domain creation by malware

As we know most of the malwares create thousands of domains and subdomains using DBA for setting C&C communications. The domain names are controlled by Internet Corporation for Assigned Names and ...
2
votes
1answer
140 views

How to respond to ransom attack

While the last ransom attack -WannaCry- Shook the world some forensic and malware analysis provided some help to stop the disaster or to slow it down. While reading Matt Suiche blog, he mentioned that ...
1
vote
1answer
249 views

Has anyone actually been hacked by video subtitles?

This morning's news brought this story: Hackers are hiding computer viruses in film subtitles, security experts warn Where they warn that subtitles in videos played on computers could be used to ...
1
vote
2answers
428 views

Is it possible to recover wannacry encrypted files through file system recovery?

As I saw wannacry encrypts files and then removes them, I thought it is possible to recover some of the original files by file system recovery using a bootable OS. Is it possible to use a bootable ...
0
votes
0answers
124 views

DNS hijacking to infect computers with ransomware?

While speaking to a friend regarding protecting personal computers from ransomware, I mentioned that I use a limited user account with application white-listing via SRP (I am running Windows). He ...
2
votes
2answers
3k views

Does Wanna Cry encrypt files on network drives?

I've dealt with ransomware threats in the past, such as LOCKY that not only encrypt data it considers user documents found on the local machine, but also on any network drive to which the user has ...
-2
votes
1answer
462 views

BitLocker versus CryptoLocker

Can BitLocker be an effective protective measure against cryptolockers and ransomware class of attacks? Were there evidences of (un)successful intrusion/encryption attempts on volumes with enabled ...
65
votes
3answers
16k views

What happens if you run WannaCry after installing the necessary patches?

I understand that WannaCry spreads itself by exploiting the SMBv1 vulnerability, which is fixed by patch MS17-010. Does this mean that even with the patch installed, WannaCry can still infect the ...
0
votes
2answers
682 views

Is a insecure VM in a secure host vulnerable to wannacry?

Assume a reasonably secure windows host (latest windows updates/patches, up-to date enterprise antivirus). How vulnerable is in this context a VM with a not up to date windows OS and an old and not ...
1
vote
1answer
105 views

Backup to non-persistent mapped NAS

My backup mechanism until now is a batch file to copy my data folder to my NAS, which is permanently mapped as Drive N:. I have a batch file (BackShut.bat) which mirrors my data directory to the NAS ...
1
vote
2answers
115 views

What happens if your email file on local drive get's encrypted and it then syncs to the cloud? [closed]

Does email syncing using MS Exchange exchange work in a similar way to Dropbox such that a change made on the local drive automatically syncs with the cloud version of that file? Or is it one way only ...
6
votes
1answer
2k views

What happens if a Dropbox folder is encrypted by WannaCrypt / WannaCry?

Does one's Dropbox "data in the cloud" also get encrypted?
2
votes
1answer
305 views

How does WannaCrypt detect when someone pays the ransom?

It seems they are processing it manually, but how can they verify the payment? WannaCry doesn't provide a unique ransom bitcoin adress for each victim.
15
votes
4answers
5k views

Has anybody successfully decrypted their files after paying the WannaCrypt ransom?

WannaCrypt is a shot heard 'round the world, for sure. I have seen news articles saying that people have paid more than $20,000 in ransoms. Here's one from Krebs: Global ‘Wana’ Ransomware Outbreak ...
-9
votes
2answers
396 views

WannaCrypt-style SMB exploits known since Stuxnet, circa 2008, but Microsoft hid fixes from us. So what is new now? [closed]

WannaCrypt-like SMB spreading technique was widely used in Stuxnet, as docummented by Symantec and Kaspersky. Read this: W32.Stuxnet Dossier (2010,Symantec PDF) Now we have the name of the exploit: ...
2
votes
1answer
2k views

WannaCry - block callback IP/domain?

While new variants of Wannacry has sprung up, the old variant is still lurking around corners and I am not sure whether the following callback IPs and domains should be blocked as per typical ...
1
vote
1answer
492 views

How can we beef the security of our Windows Server 2012 R2 against ransomware? [duplicate]

We have a MS Windows Server 2012 installed. After the attacks of last week, I was wondering how we could improve the security of the server against ransomware/cryptoware. We did install the latest ...
5
votes
2answers
518 views

Does EMET prevent WannaCry exploit execution?

Based on answers to the question How is the “WannaCry” Malware spreading (...), I understand it leverages vulnerabilities present in the SMB implementation. Assuming an unpatched and otherwise ...
2
votes
2answers
2k views

Can ransomware affect hidden or “unmounted” drives?

I have an understanding of how ransomware works to a certain extent. But, I would like some input as to what it can do if the volumes/drives that are on a workstation are not visible or are not ...
5
votes
1answer
2k views

How to reverse engineer WannaCry? [closed]

I was reading an article today about a Google researcher linking the WannaCry malware to the earlier malware Cantopee. I had two primary questions based on the contents of the article. What do the ...
1
vote
0answers
114 views

Is there a public malware sample of WannaCry? [duplicate]

Google security researcher Neel Mehta has famously identified code similarities between a sample of WannaCry and code used by North Korean hacker group Lazarus in 2015. Around the same time, another ...
2
votes
2answers
395 views

How is possible that ransomware decrypters work?

Today I found that there is a website that offers tools for ransomware decryption, but with my current knowledge about encryptions, it makes no sense for me, because a file encrypted with a strong key ...
1
vote
3answers
947 views

What do emails have to do with the spread of WannaCrypt?

After the recent spread of WannaCrypt, there has been a lot of warnings about the dangers of emails and clicking on links in them. But the malware is spreading as a worm using SMB to infect other ...
19
votes
1answer
7k views

Ransomware encryption keys

Where does ransomware such as the recent wannacry variant store the key it uses to encrypt the files on the victim's disk? Is this hard coded in the program itself? Or does it call into a server to ...
1
vote
1answer
175 views

Was the 2017 NHS attack targeted?

The news has been alive with the HNS ransomware story this weekend (13th May 2017) and the coverage has been loose guesswork at best generally. So what I'm trying to figure out is: Was this actually ...
4
votes
1answer
687 views

How to check if Windows computer has SMB accessible over the internet?

The currently spreading ransomware WannaCry exploits SMB vulnerabilities to infect new computer. Is this exploitation possible over the internet? How to check if my computer has SMB accessible ...
4
votes
1answer
1k views

How does MalwareTech make the WannaCry ransomware live map?

The media keeps updating us on the number of WannaCry infected PCs. Are they all using the information from MalwareTech? How does MalwareTech get this information?
2
votes
2answers
816 views

Who put the killswitch in the WannaCry ransomware? [closed]

The WannaCry ransomware contains a killswitch, a URL that when registered, caused the malware to shutdown. Question is, who put in the killswitch? Was it the bad guys? Was it the NSA? Could it have ...
8
votes
9answers
13k views

Is there a file system that doesn't support encryption?

I would prefer that no one, even me, could encrypt my files. I have no use for it, and don't want it. Is there a way to permanently disable any sort of encryption at the OS level? If not, is this a ...
2
votes
2answers
162 views

Is ransomware that threatens with publication and verifiably deletes upon payment possible?

Inspired by the article The future of Ransomware and its description of possible ransomware with verifiable key delivery, I wonder if the idea can be taken further into ransomware that credibly ...