We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

Filter by
Sorted by
Tagged with
5
votes
2answers
515 views

Does EMET prevent WannaCry exploit execution?

Based on answers to the question How is the “WannaCry” Malware spreading (...), I understand it leverages vulnerabilities present in the SMB implementation. Assuming an unpatched and otherwise ...
5
votes
1answer
3k views

Ransomware in virtual machines. Running Locky for testing security measures

We have several binaries of the ransomware Locky. We tried to run it in a virtual machine, which has several storages like Samba, etc. attached, in order to see how the files are going to be encrypted....
5
votes
3answers
572 views

Mitigating the risk for a successful ransomware infection

The company I work for has been getting hit with loads and loads of frightfully sophisticated ransomware spam lately, people masking as consultants, customers, very specific company requests, etc. ...
5
votes
2answers
534 views

What's the attitude of anti-virus vendors toward ransomware?

I was recently asked to look at a Windows computer behaving strangely, and I found a "Your files have been encrypted" ransom note that had been left in several directories. I wasn't able to identify ...
5
votes
2answers
636 views

Are we safe from infection of Bad Rabbit?

I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say ...
5
votes
5answers
261 views

In the era of cryptolockers, is it possible to prevent Windows from modifying your Linux partition?

I could imagine that in few years, cryptolockers could become so advanced that instead of just encrypting some files on the partition of the current OS, they could also touch all other partitions on ...
5
votes
0answers
377 views

How to deal with Sage Ransomware 2.2 infection?

My PC got stuck like this: It's a Sage 2.2 Ransomware. How do I fix this? Does restoring the system help me?
4
votes
1answer
1k views

How does MalwareTech make the WannaCry ransomware live map?

The media keeps updating us on the number of WannaCry infected PCs. Are they all using the information from MalwareTech? How does MalwareTech get this information?
4
votes
3answers
2k views

How does “Ransomware” Work?

So I am wondering how Ransomware files work. I know Ransomware encrypts all files with AES-256 for speed but where does RSA come in? Apparently RSA is slow to encrypt files so it uses AES-256 first ...
4
votes
1answer
537 views

Received an email from a Bulgarian address trying to extort money

As the title says, I received an email from some Bulgarian email address saying that the sender has compromised my browser and thereby obtained control over my camera as well as gathering data on all ...
4
votes
1answer
684 views

How to check if Windows computer has SMB accessible over the internet?

The currently spreading ransomware WannaCry exploits SMB vulnerabilities to infect new computer. Is this exploitation possible over the internet? How to check if my computer has SMB accessible ...
4
votes
2answers
2k views

Ransomware - Full disk wipe versus formatting

Typically when I encounter ransomware/cryptoware on a device I will fully wipe the drive(s) with at least one pass using a utility such as DBAN. I sometimes wonder if I am overestimating the potential ...
4
votes
2answers
1k views

Is there any known encrypting ransomware that attacks Macs?

Just about every article I read about Cryptowall, Cryptolocker, and its ilk seems to assume that the reader is running some flavor of Windows. When I Google "ransomware OSX", I get a long list of ...
4
votes
3answers
2k views

Does Ransomware on one computer put entire network at risk?

I was visiting an office recently where one computer had become infected with a ransomware variant and turned off until the 'network guy' could come take a look (I don't know which one as no one took ...
4
votes
2answers
589 views

Ransom32: How does it work?

Ransom32 seems to be a new ransomware written (partly) in JavaScript. As I understand it, it doesn't affect a user through a browser / by visiting a website, but by downloading some .rar file which ...
4
votes
2answers
146 views

Will enabling SMB protocol authentication prevent Ransomware attack like WannaCry spreading in network?

We have a requirement of using SMB protocol due to a system limitation. will enabling SMB authentication among the nodes will prevent the ransomware threat spreading in network? Reference: https://...
4
votes
1answer
143 views

How to combat Doxware?

There is seemingly very little information available about the emergence of ransomware; doxware. I could only find a couple of news articles suggesting that doxware encrypts your files, but also ...
4
votes
3answers
1k views

What is a good backup strategy against ransomware? [duplicate]

From my understanding, most ransomware works in the background until they are finished with encrypting all their chosen files. I assume that while the ransomware work in the background, if I plug in ...
4
votes
3answers
947 views

Does typical Ransomware only 'attack' certain folders/filetypes

I expect this is very much on a per malware and OS basis so could potentially be very broad hence the typical. A user's computer has been infected by a piece of malware which aims to encrypt all ...
4
votes
1answer
300 views

Can ransomware hide in cloud storage/backup environments?

I currently use Dropbox as an online backup to protect my important files (work related, save files, some hobby projects) against data loss, including ransomware, hardware loss, theft,... However, I'...
4
votes
1answer
306 views

Reality Check: Create chaos at an office

An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
4
votes
1answer
255 views

How do I use google drive local folder with auto sync while protecting myself from ransomware?

Background So I have my Google Drive 1TB account. Obviously, I'm using Drive to have a backup for all my precious files. I used to have a local Drive folder with auto sync on my PC. It was very ...
4
votes
1answer
668 views

Is malware known to mount volumes?

I have several Windows machines that do automatic backups to external or internal backup drives. This happens automatically during off hours, and it needs to stay that way with no manual intervention ...
4
votes
2answers
518 views

Would limiting write access to a backup directory help protect it from ransomware?

I know that this is similar to this question, but I don't believe it's a duplicate. You have a program that automatically makes regular backups of all your files to a folder or mounted drive. Let's ...
4
votes
3answers
3k views

Does DNS-based blocking protect against ransomware?

I have been looking into OpenDNS as something to possibly use at my company, and they claim that Cryptolocker-style ransomware almost always uses DNS to "phone home" and that OpenDNS blocks this, ...
4
votes
1answer
203 views

Simple, malware-resilient, automatic Windows backup (or: How should the average small company protect their Windows server?)

I am trying to devise a backup strategy for a Windows server, and I'd like it to satisfy the following criteria: It should be resilient to malware: If ransomware takes over the server, it should not ...
4
votes
1answer
334 views

What are the actions of Locky on the source files which lead to encrypting?

During discussions about possible actions to mitigate the risk of the ransomware Locky, someone pointed at the possibility of preventing at OS level the creation of .locky files via the File Server ...
4
votes
2answers
2k views

How can I recover files encrypted by Android ransomware?

My Samsung Galaxy Note II was infected by a virus called the "FBI virus." Fortunately, I've managed to remove the malware but my problem now is that all my files have been encrypted. How can I ...
3
votes
3answers
640 views

How can I protect myself from “ransomware” attacks like the one that affected Transmission users?

The downloader for version 2.90 of the Transmission BitTorrent client was infected by a piece of malware called KeRanger, which encrypts files on your computer and demands a one-Bitcoin ransom to ...
3
votes
2answers
1k views

Encryption: Files that can't be encrypted/cryptolocker family doesn't encrypt?

Are there any type of file whatsoever that can -not- be encrypted? Is there any data that can't be encrypted by the regular RSA encryption methods? Also, does anyone know what files the cryptolocker ...
3
votes
4answers
2k views

Is it possible to crack ransomware encryption if I have the original file?

Is it possible to crack ransomware encryption if I have 2 versions of a file: before and after the encryption? Are there any tools for such a thing?
3
votes
4answers
1k views

Where to find ransomware samples to make demonstrations?

I'm looking for some ransomware samples that work on Linux so that I can show a proof of concept with Qubes OS on how one's other virtual machines can be safe from a ransom attack if a single virtual ...
3
votes
2answers
327 views

Will ransomware reach an air-gapped computer?

I'm doing some research and wondered since ransomware allows a user a decryption key- how that would be possible if it is not on a network? 12/23 Edit: After learning how ransomware works I'm now ...
3
votes
2answers
1k views

What agency digitally signed Cryptowall 2.0 so that it can run without being detected?

What agency issued a digital signature for the Cryptowall 2.0 ransomware virus? Is it too early to tell? As far as I know this is how Microsoft planned to prevent malware, by adding a digital ...
3
votes
2answers
2k views

Can ransomware encrypt files in a drive locked by BitLocker?

I have a general understanding of how ransomware works. I want to know if ransomware will target a locked Bitlocker drive, however. I very rarely unlock that drive, and it will only be unlocked for ...
3
votes
1answer
294 views

Android ransomware difficulties [closed]

My phone is a Samsung Galaxy S2. I have somehow gotten some ransomware that is displaying device information, including my name and recent contacts' data. The ransomware starts basically right away, ...
3
votes
2answers
235 views

Ransomware left some files not encrypted

A ransomware attack happened to my server, I've backups and all and I tracked down the reason to two elements (either unupdated Bitnami LAMP stack or unupdated Flask server) but I noticed some files ...
3
votes
2answers
256 views

Being anonymous with bitcoin

In the recent ransomware attacks, attackers have asked the targeted organizations to pay them in bitcoins. How can they be anonymous if they deal in bitcoins? Can they convert bitcoins to any other ...
3
votes
3answers
513 views

How to prove a false positive

I was notified by my university's infosec team that one of my lab's computers had been infected by ransomware. They shut down the computer's network connections using Crowdstrike and are insisting ...
3
votes
1answer
854 views

Can you find the ransomware key if you already have decrypted files?

Disclaimer: I have very very little experience with ransomware/encryption, so I'm sorry if I ask something stupid. Ransomware attacks are all over the news, especially this year. And this got me ...
3
votes
2answers
707 views

DGA (Domain Generation Algorithm) - malwares

Some malwares use DGA (Domain Generation Algorithm) to randomly generate domains in order for the zombies to be able to communicate in a resilient manner with the C&C. As far as I know, there is ...
3
votes
1answer
4k views

WannaCry Source Code

Maybe this is a stupid question: Is the WannaCry source code public? https ://github.com/svenvdz/wannacry https: //github.com/Hackstar7/WanaCry https: //github.com/fadyosman/WannaCrySample I didn'...
3
votes
1answer
156 views

Is CryptoLocker part of the TeslaCrypt ransomware family?

I'm reading a Microsoft report examining the most prevalent ransomware families as of recent. On the news, I've heard of CryptoLocker, CryptoWall and TeslaCrypt, but I don't see any of them ...
3
votes
1answer
245 views

Has my server been compromised? (Ransomware related)

I just received an email that corresponds to the description here, which was posted just a couple of hours ago: https://myonlinesecurity.co.uk/pdfpart2-pdf-sent-from-my-samsung-galaxy-note-4-powered-...
3
votes
1answer
1k views

How does Cryptolocker propagate?

One of the computers in my office has been compromised by Cryptolocker. Once informed, my immediate response was to disconnect the computer from the network - though there was a period of a few hours ...
3
votes
1answer
547 views

Is there a ransomware variant that checks for file's magic numbers to encrypt?

Is there a known ransomware-variant (Cryptolocker, Cryptowall etc.) that before encrypting the files checks for their magic numbers? Lets say that there's a Word file, that had its file extension ...
3
votes
2answers
705 views

Security vulnerabilities when sharing files between virtual machine and host

According to this link, when running a windows OS virtual machine on a windows host OS, one can share files like one would share files between two computers on a network by ensuring that file sharing ...
3
votes
1answer
312 views

Is overwriting the entire hard disk (e.g. with `dd`) sufficient to ensure that ransomware has been removed?

Appologies if this is the wrong place to ask this question. I have/had a computer infected with ransomware. I have just used a linux live cd and used the command dd if=/dev/zero of=/dev/sda bs=1MB ...
3
votes
0answers
53 views

Possible EternalBlue Infection, Next Step? [duplicate]

Sorry if I messed up in any manner, e.g. title, details, tags, layout, venue, response plan, etc. I know a little of the stacks and security in general. Short Version: I found material on my other ...
2
votes
2answers
390 views

How is possible that ransomware decrypters work?

Today I found that there is a website that offers tools for ransomware decryption, but with my current knowledge about encryptions, it makes no sense for me, because a file encrypted with a strong key ...