188 votes
Accepted

What should you do if you catch encryption ransomware mid-operation?

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have ...
Ángel's user avatar
  • 18.8k
136 votes
Accepted

How is the "WannaCry" Malware spreading and how should users defend themselves from it?

WannaCry attacks are initiated using an SMBv1 remote code execution vulnerability in Microsoft Windows OS. The EternalBlue exploit has been patched by Microsoft on March 14 and made publicly available ...
Nik Nik's user avatar
  • 1,292
115 votes
Accepted

How does ransomware get the permissions to encrypt your disk?

Ransomware doesn't get root/admin permissions, because it does not need to. It does not encrypt the disk or files protected by the operating system (executables, configuration, credentials), it ...
techraf's user avatar
  • 9,159
108 votes
Accepted

How can a company ensure cybercriminals destroy hacked data after payment?

How can the company be certain that the data is destroyed, It cannot be certain. The only hope that it is part of the criminals business model to maintain a good reputation in that one gets what is ...
Steffen Ullrich's user avatar
103 votes

Is there a file system that doesn't support encryption?

No, that's impossible, unless you change the definition of a file. A file is arbitrary data. Arbitrary data can be encrypted data. Even if we only allow structured data, structured data can - if we ...
Peter's user avatar
  • 3,630
100 votes
Accepted

Why is so much ransomware breakable?

Disclosure: I work for one of vendors participating in NoMoreRansom. Most modern ransomware indeed implements proper cryptography. Earlier versions were using rand() for key generation, seeding the ...
George Y.'s user avatar
  • 3,534
94 votes
Accepted

Is there a file system that doesn't support encryption?

Read-only file systems can by definition not be written to (At least not digitally. What you do with a hole puncher and a neodymium magnet is your own business). Examples: Live CDs, from which you ...
l0b0's user avatar
  • 3,011
93 votes

What happens if you run WannaCry after installing the necessary patches?

If you download and execute WannaCry, it will still lock your files and attempt to infect other unpatched computers in the network. WannaCry only needs the SMB exploit to get into a system, not to ...
knbk's user avatar
  • 751
86 votes

Why are ransomware attackers not tracked down via bitcoin transactions?

There is a chance that once the bitcoins have been converted into ‘real money’ or ‘real assets’ the ledger could leak information on the owners of those bit coins. But even then tracking and ...
TheJulyPlot's user avatar
  • 7,819
78 votes

What should you do if you catch encryption ransomware mid-operation?

What I would do: Suspend the process. Don't kill it, just pause it. Look in the process tree if there are any parents that might need suspending as well. Pull the network cable and/or turn off WiFi (...
Luc's user avatar
  • 32.9k
78 votes
Accepted

How to decrypt .lock files from ransomeware on Windows

I don't think you will see those files again, unless you have a back up. You can view the transaction history of the Bitcoin address you were asked to pay to here. As you can see, there are 303 ...
Anders's user avatar
  • 65.6k
77 votes

How can ransomware know file types?

First off, not all ransomware are created equal: just like any software, some ransomware is well-written, while some are poorly-written. You can get an overview of major ransomware variants on ...
Mike Ounsworth's user avatar
74 votes
Accepted

How does ransomware get on people's computers?

According to the IBM X-Force Threat Intelligence Quarterly Report, fourth quarter 2015, the primary sources of ransomware attack are unpatched vulnerabilities, drive-by infections, and spear-phishing ...
brcsp's user avatar
  • 818
63 votes

How is the "WannaCry" Malware spreading and how should users defend themselves from it?

The ransomware is using a known, publicly disclosed exploit in SMBv1 (Server Message Block Version 1). It is an application level protocol used for sharing files and printers in a networked ...
dark_st3alth's user avatar
  • 3,032
58 votes

What should you do if you catch encryption ransomware mid-operation?

Ransom-ware (or any encryption software for that matter) will not encrypt the file in-place, because the encrypted filesize will not match the unencrypted filesize bit-for-bit (unless it's just an xor ...
J.J's user avatar
  • 785
53 votes

Does WannaCry infect Linux?

WannaCry exploits a set of flaws in Microsoft's implementation of the SMB1 protocol. Since these are implementation flaws rather than structural flaws in the protocol itself, Linux systems cannot be ...
Mark's user avatar
  • 34.6k
50 votes

Can the ransomware encryption key be derived from comparing encrypted and unencrypted files?

What you are suggesting is a Known Plaintext Attack, and yes if the encryption algorithm is bad enough, it could be used to discover the key or keys used to encrypt the data, depending on the cipher ...
GdD's user avatar
  • 17.4k
50 votes

GitLab account hacked and repo wiped

I doubt that the hackers pushed a "delete all" commit, or else you could simply revert the last commit. Rather, they force-pushed a different commit with the note to the HEAD of the master ...
Matt's user avatar
  • 521
49 votes

Why is so much ransomware breakable?

It is just a cost/gain question. Ransomware developers generally do not want to build a security tool with all the involved reviewing. They just want the less expensive tool that will allow them to ...
Serge Ballesta's user avatar
47 votes
Accepted

Help! Ransomware encrypted my files. What do I do now?

Can I get my files back? How? Maybe. If you have backups, you can restore your files from there. Just make sure to completely reinstall your operating system first, i.e. "nuke from orbit", to remove ...
Anders's user avatar
  • 65.6k
44 votes

How does ransomware get on people's computers?

While the measures you describe in your question are not wrong, they are not correct either: Documents are not safe to open either. Often times, exploits come in the form of interestingFile.txt.exe. ...
Tobi Nary's user avatar
  • 14.4k
43 votes
Accepted

Are cloud storage services a good strategy to protect against ransomware attacks?

I'm not sure about Google Drive, but Dropbox provides a way to recover previous file versions, a feature that wouldn't be impacted by the ransomware, since it relies on a file copies on the Dropbox ...
Jakub's user avatar
  • 830
38 votes
Accepted

Is Windows 10 backup safe from ransomware?

If the ransomware gains administrator access to your computer then it can damage any backups that the Windows machine may have created on that computer. If the ransomware only acquires non-...
700 Software's user avatar
33 votes
Accepted

Ransomware encryption keys

All ransomware implementations are different, but for the most part, the particularly stupid variants that did things like use a hard-coded key, or used easily guessable or reproducible key generation ...
Xander's user avatar
  • 35.8k
31 votes

How is the "WannaCry" Malware spreading and how should users defend themselves from it?

Cisco has posted an article on this that goes into more detail than any of the others I've seen. Their basic steps for prevention are as follows: Ensure all Windows-based systems are fully ...
AndyO's user avatar
  • 411
29 votes
Accepted

Do Linux systems need antivirus against ransomware?

There are actually multiple parts of the question: Is Linux affected by malware and especially ransomware? Do antivirus products exist for Linux? Do these products help against this threat? To ...
Steffen Ullrich's user avatar
28 votes
Accepted

What lessons can be learned from the latest spate of Ransomware attacks?

I think one of the main lessons learned is that the security services shouldn’t be hoarding zero days and tools to exploit them, (especially) if they can’t properly secure them. The thing to remember,...
TheJulyPlot's user avatar
  • 7,819
28 votes

Does phishing include ransomware?

The term you're looking for here is social engineering. This is an umbrella term that describes any attempt to get a person to perform a particular action - particularly one that benefits the social ...
Polynomial's user avatar
  • 135k
27 votes

Is there a file system that doesn't support encryption?

Loads of file systems don't have native file system level encryption support. Software-encrypted files can be stored on any file system though, just like any other file. The file system cannot tell ...
Alexander O'Mara's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible