183

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have the appropriate hardware for that readily available. Dumping just the right process should also work, but finding out which one may not be trivial (eg. the ...


135

WannaCry attacks are initiated using an SMBv1 remote code execution vulnerability in Microsoft Windows OS. The EternalBlue exploit has been patched by Microsoft on March 14 and made publicly available through the "Shadowbrokers dump" on April 14th, 2017. However, many companies and public organizations have not yet installed the patch to their systems. The ...


113

Ransomware doesn't get root/admin permissions, because it does not need to. It does not encrypt the disk or files protected by the operating system (executables, configuration, credentials), it encrypts files created and stored by the users (data); and all it requires to do so, is the same level of access as the users themselves. Just like a user would ...


103

No, that's impossible, unless you change the definition of a file. A file is arbitrary data. Arbitrary data can be encrypted data. Even if we only allow structured data, structured data can - if we assume no space constraints - be abused to store all arbitrary data* (citation needed). Which brings us to the starting point. You can have partial success, ...


101

Disclosure: I work for one of vendors participating in NoMoreRansom. Most modern ransomware indeed implements proper cryptography. Earlier versions were using rand() for key generation, seeding the random generators with variants of time() - this is why it was important for successful decryption to know when exactly the infection happened; ideally down to ...


95

Read-only file systems can by definition not be written to (At least not digitally. What you do with a hole puncher and a neodymium magnet is your own business). Examples: Live CDs, from which you can boot into an operating system which will look the same on every boot. WORM (Write Once Read Many) devices, used for example by financial institutions which ...


95

If you download and execute WannaCry, it will still lock your files and attempt to infect other unpatched computers in the network. WannaCry only needs the SMB exploit to get into a system, not to get out. Once it has control of your system, it does not need the exploit to execute arbitrary code, including the worm. The MS17-010 patch protects your computer ...


85

There is a chance that once the bitcoins have been converted into ‘real money’ or ‘real assets’ the ledger could leak information on the owners of those bit coins. But even then tracking and attribution can be very complex, but in answer to your question the reason in this case is probably that the attacker(s) haven’t ‘cashed’ them in yet. Depending on who ...


78

I don't think you will see those files again, unless you have a back up. You can view the transaction history of the Bitcoin address you were asked to pay to here. As you can see, there are 303 transactions in total and many of them are for 1 BTC. That implies that the same Bitcoin address have been given to multiple victims. This in turn means that it is ...


77

First, determine which variant of ransomeware you've been hit by. Depending on which one, you may have more options. As @Ohnana has said generally ransomware operators are true to their word, it's in their interest after all. If it became known that certain groups never allowed data to be decrypted, they'd stop getting money from their victims. That being ...


77

First off, not all ransomware are created equal: just like any software, some ransomware is well-written, while some are poorly-written. You can get an overview of major ransomware variants on wikipedia/ransomware. Some ransomware - notably CryptoLocker - do use lists of file extensions to decide which files to encrypt, and why not? Users knowledgeable ...


76

What I would do: Suspend the process. Don't kill it, just pause it. Look in the process tree if there are any parents that might need suspending as well. Pull the network cable and/or turn off WiFi (and if you're paranoid, Bluetooth too). Check open files by those processes to see which one it is currently encrypting. If it's a particularly important one, ...


76

You can use git reflog in a clone and checkout the last commit before this happened. It happened because .git/config on your webserver (in the directory of the cloned repo) includes the remote URLs and people added username:password in it which should never be the case - people should use SSH, deploy keys or authenticate on each pull. Never store your ...


73

According to the IBM X-Force Threat Intelligence Quarterly Report, fourth quarter 2015, the primary sources of ransomware attack are unpatched vulnerabilities, drive-by infections, and spear-phishing emails: Source: IBM X-Force How to prevent ransomware attacks User education Educate your users not to download files from unknown contacts. Usually ...


71

Most people don't have backups. Most people who do have backups, haven't tested them to make sure they work. The real difference between disk failure and ransomware is that paying the ransom is cheaper than paying a data-recovery company, and is more likely to get your data back.


64

The ransomware is using a known, publicly disclosed exploit in SMBv1 (Server Message Block Version 1). It is an application level protocol used for sharing files and printers in a networked environment. The SMBv1 protocol is commonly found in networked Windows environments, and includes operating systems such as Windows XP, Windows 7, 8, 8.1, and 10. ...


61

As a respectable IT consultant, you should never recommend paying ransomware. If it fails, you will be blamed. If it works, you won't be blamed for recommending against it because the business knows that they are gambling and they were sloppy for letting it happen. And recommending to pay blackmail to a criminal tarnishes your image. I would never use a ...


56

Ransom-ware (or any encryption software for that matter) will not encrypt the file in-place, because the encrypted filesize will not match the unencrypted filesize bit-for-bit (unless it's just an xor shuffle, in which case it's not really encryption). More importantly, a spontaneous abortion of the encryption process (due to a shutdown, running out of ...


53

WannaCry exploits a set of flaws in Microsoft's implementation of the SMB1 protocol. Since these are implementation flaws rather than structural flaws in the protocol itself, Linux systems cannot be automatically infected, but can be if manually installed. This is true regardless of if the systems are running Samba, Wine, or any other Windows-emulation ...


50

What you are suggesting is a Known Plaintext Attack, and yes if the encryption algorithm is bad enough, it could be used to discover the key or keys used to encrypt the data, depending on the cipher used. I say keys because some ransomware uses individual keys per file, so cracking one key would only give you the key to that file. Practically this is ...


49

I doubt that the hackers pushed a "delete all" commit, or else you could simply revert the last commit. Rather, they force-pushed a different commit with the note to the HEAD of the master branch, making it look like your entire commit history is gone. As others have pointed out, you can easily use a local repo to force push the correct code to the server. ...


49

It is just a cost/gain question. Ransomware developers generally do not want to build a security tool with all the involved reviewing. They just want the less expensive tool that will allow them to get more money than it cost. Of course, they are probably breakable, but who cares? Provided some of the first victims have paid what they were asked, the ...


45

I was at an OWASP talk where the speaker decompiled and analyzed a ransomware executable (for Windows) in front of us. There are many flavours of ransomware out there, so I can't speak to ransomware in general, but I can certainly talk about the one I saw. The general idea is that the ransomware executable contains the encryption public key needed to encrypt ...


45

While the measures you describe in your question are not wrong, they are not correct either: Documents are not safe to open either. Often times, exploits come in the form of interestingFile.txt.exe. Windows hiding the .exe by default leads users to think that's just a text file when indeed they execute code. There are other ways to keep executable code ...


43

I'm not sure about Google Drive, but Dropbox provides a way to recover previous file versions, a feature that wouldn't be impacted by the ransomware, since it relies on a file copies on the Dropbox servers. So it'd certainly be a way of protecting your data. However, recovering everything over your internet connection is a relatively slow process. ...


41

A few people are mentioning back-ups as a fix for ransomware. Ransomware works because the target is not prepared for the outcome. While a failed hard drive and a ransomware encryption can both be "recovered" via restoring a backup to a new drive, the ransomware is sometimes a malware that runs on the machine itself. In any event, restoring from an external ...


38

For classic Cryptowall, the virus itself will typically reach out to the C2C and grab the private key and begin the decryption process. There's also a standalone tool that is preloaded with a decryption key that again, automatically starts decrypting. Most ransomware schemes will make the ransom process as painless as possible. The FBI has noted that many ...


38

If the ransomware gains administrator access to your computer then it can damage any backups that the Windows machine may have created on that computer. If the ransomware only acquires non-administrator access (i.e. you use a non-admin account for web-browsing) then those backups will be safe. The best thing is to back up to a removable storage device. (...


Only top voted, non community-wiki answers of a minimum length are eligible