Skip to main content
136 votes
Accepted

How is the "WannaCry" Malware spreading and how should users defend themselves from it?

WannaCry attacks are initiated using an SMBv1 remote code execution vulnerability in Microsoft Windows OS. The EternalBlue exploit has been patched by Microsoft on March 14 and made publicly available ...
Nik Nik's user avatar
  • 1,292
114 votes
Accepted

How does ransomware get the permissions to encrypt your disk?

Ransomware doesn't get root/admin permissions, because it does not need to. It does not encrypt the disk or files protected by the operating system (executables, configuration, credentials), it ...
techraf's user avatar
  • 9,139
107 votes
Accepted

How can a company ensure cybercriminals destroy hacked data after payment?

How can the company be certain that the data is destroyed, It cannot be certain. The only hope that it is part of the criminals business model to maintain a good reputation in that one gets what is ...
Steffen Ullrich's user avatar
102 votes

Is there a file system that doesn't support encryption?

No, that's impossible, unless you change the definition of a file. A file is arbitrary data. Arbitrary data can be encrypted data. Even if we only allow structured data, structured data can - if we ...
Peter's user avatar
  • 3,630
100 votes
Accepted

Why is so much ransomware breakable?

Disclosure: I work for one of vendors participating in NoMoreRansom. Most modern ransomware indeed implements proper cryptography. Earlier versions were using rand() for key generation, seeding the ...
George Y.'s user avatar
  • 3,544
94 votes
Accepted

Is there a file system that doesn't support encryption?

Read-only file systems can by definition not be written to (At least not digitally. What you do with a hole puncher and a neodymium magnet is your own business). Examples: Live CDs, from which you ...
l0b0's user avatar
  • 3,025
93 votes

What happens if you run WannaCry after installing the necessary patches?

If you download and execute WannaCry, it will still lock your files and attempt to infect other unpatched computers in the network. WannaCry only needs the SMB exploit to get into a system, not to ...
knbk's user avatar
  • 751
85 votes

Why are ransomware attackers not tracked down via bitcoin transactions?

There is a chance that once the bitcoins have been converted into ‘real money’ or ‘real assets’ the ledger could leak information on the owners of those bit coins. But even then tracking and ...
TheJulyPlot's user avatar
  • 7,829
78 votes
Accepted

How to decrypt .lock files from ransomeware on Windows

I don't think you will see those files again, unless you have a back up. You can view the transaction history of the Bitcoin address you were asked to pay to here. As you can see, there are 303 ...
Anders's user avatar
  • 65.7k
77 votes

How can ransomware know file types?

First off, not all ransomware are created equal: just like any software, some ransomware is well-written, while some are poorly-written. You can get an overview of major ransomware variants on ...
Mike Ounsworth's user avatar
63 votes

How is the "WannaCry" Malware spreading and how should users defend themselves from it?

The ransomware is using a known, publicly disclosed exploit in SMBv1 (Server Message Block Version 1). It is an application level protocol used for sharing files and printers in a networked ...
dark_st3alth's user avatar
  • 3,022
53 votes

Does WannaCry infect Linux?

WannaCry exploits a set of flaws in Microsoft's implementation of the SMB1 protocol. Since these are implementation flaws rather than structural flaws in the protocol itself, Linux systems cannot be ...
Mark's user avatar
  • 34.7k
50 votes

GitLab account hacked and repo wiped

I doubt that the hackers pushed a "delete all" commit, or else you could simply revert the last commit. Rather, they force-pushed a different commit with the note to the HEAD of the master ...
Matt's user avatar
  • 521
48 votes

Why is so much ransomware breakable?

It is just a cost/gain question. Ransomware developers generally do not want to build a security tool with all the involved reviewing. They just want the less expensive tool that will allow them to ...
Serge Ballesta's user avatar
47 votes
Accepted

Help! Ransomware encrypted my files. What do I do now?

Can I get my files back? How? Maybe. If you have backups, you can restore your files from there. Just make sure to completely reinstall your operating system first, i.e. "nuke from orbit", to remove ...
Anders's user avatar
  • 65.7k
38 votes
Accepted

Is Windows 10 backup safe from ransomware?

If the ransomware gains administrator access to your computer then it can damage any backups that the Windows machine may have created on that computer. If the ransomware only acquires non-...
700 Software's user avatar
33 votes
Accepted

Ransomware encryption keys

All ransomware implementations are different, but for the most part, the particularly stupid variants that did things like use a hard-coded key, or used easily guessable or reproducible key generation ...
Xander's user avatar
  • 35.8k
31 votes

How is the "WannaCry" Malware spreading and how should users defend themselves from it?

Cisco has posted an article on this that goes into more detail than any of the others I've seen. Their basic steps for prevention are as follows: Ensure all Windows-based systems are fully ...
AndyO's user avatar
  • 411
29 votes
Accepted

Do Linux systems need antivirus against ransomware?

There are actually multiple parts of the question: Is Linux affected by malware and especially ransomware? Do antivirus products exist for Linux? Do these products help against this threat? To ...
Steffen Ullrich's user avatar
28 votes
Accepted

What lessons can be learned from the latest spate of Ransomware attacks?

I think one of the main lessons learned is that the security services shouldn’t be hoarding zero days and tools to exploit them, (especially) if they can’t properly secure them. The thing to remember,...
TheJulyPlot's user avatar
  • 7,829
28 votes

Does phishing include ransomware?

The term you're looking for here is social engineering. This is an umbrella term that describes any attempt to get a person to perform a particular action - particularly one that benefits the social ...
Polynomial's user avatar
  • 135k
27 votes

Is there a file system that doesn't support encryption?

Loads of file systems don't have native file system level encryption support. Software-encrypted files can be stored on any file system though, just like any other file. The file system cannot tell ...
Alexander O'Mara's user avatar
22 votes

Will password protected files like zip and rar also get affected by Odin ransomware?

Yes. The zip or rar file will be encrypted like all other files so that they are useless for you. The only protection is making backups to another physical storage. This will help independantly of ...
kaidentity's user avatar
  • 2,654
22 votes

Why does Sage Ransomeware blacklist League of Legends, steamapps, etc.?

I'm guessing these games are fairly large (GTA V is 10s of gigabytes). Therefor, it would take a considerable amount of time to encrypt these which increases the chance of being detected. Often these ...
Silver's user avatar
  • 1,820
21 votes

How to decrypt .lock files from ransomeware on Windows

First line of defense: BACKUPS. Restore the files from there. When available, this has a 100% chance of success. Otherwise: hope that the ransomware did not disable/work around the Windows Shadow ...
LSerni's user avatar
  • 22.9k
20 votes

How is the "WannaCry" Malware spreading and how should users defend themselves from it?

Who is at risk? Anyone running operating systems that are listed in the patch announcement here: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx How? Malware can be delivered in ...
Ed Daniel's user avatar
  • 479
20 votes

Why is so much ransomware breakable?

The obvious answer is that no criminal would want to interact so directly with their victim. "send the encrypted private RSA key to the attackers" requires a consistent point of contact. In the ...
schroeder's user avatar
  • 131k
19 votes
Accepted

Do the most common ransomware programs delete the original files as they go, or in a big bulk delete at the very end?

In addition to Angel's response, As seen in the popular ransomware variations that you mentioned, the encryption is done on a file by file basis where one file is encrypted and then the plain-text ...
Silverfox's user avatar
  • 3,417
19 votes

Help! Ransomware encrypted my files. What do I do now?

Should I pay the ransom? The inclination here is to post an emphatic HELL NO, tell them where they can stick their malware, and bid them a good day. No payouts for you, Mr. Neer-do-well! The company I ...
Machavity's user avatar
  • 3,798

Only top scored, non community-wiki answers of a minimum length are eligible