18 Sep
2015
18 Sep
'15
10:55 a.m.
On Fri, 18 Sep 2015, John Foust wrote:
As to why your antivirus didn't see it...
there's always a few days
before the latest infection mechanisms are documented and added to
the AV updates.
CryptoLocker has been around for a year. I don't think that McAfee nor
AVG see it. "Well, it's not a VIRUS, . . ."
When I first heard about Cryptolocker, I wanted to
give up consulting
and find a different career.
Is there a way to crowdfund a hit?
18 Sep
18 Sep
12:16 p.m.
On 18 September 2015 at 16:55, Fred Cisin <cisin at xenosoft.com> wrote:
CryptoLocker has been around for a year. I don't
think that McAfee nor AVG
see it. "Well, it's not a VIRUS, . . ."
Former AVG employee here. I quit; this is not an official statement.
CryptoLocker/CryptoWall/etc are *not* a single program. It's a whole
family of them. The programs are constantly modified so that the
anti-malware doesn't pick them up until it's too late. Antimalware
mostly still uses signature databases for identification, plus hooks
for suspicious activity. Cryptolocker is not infectious, so it doesn't
perform canonical suspicious activities. It opens lots of user data
files but so do indexing tools from Windows Search to Google Desktop
to Copernic.
However, Cryptolocker et al spread by fooling users into running
something they shouldn't run. I'm sorry, but you got suckered.
Me, I only use Windows if someone pays me to. Life is too short
otherwise. My desktop is a Mac (and before that was a Hackintosh); my
laptops run Ubuntu. Both are much *much* less work and I don't need to
run antimalware.
--
Liam Proven ? Profile: http://lproven.livejournal.com/profile
Email: lproven at cix.co.uk ? GMail/G+/Twitter/Flickr/Facebook: lproven
MSN: lproven at hotmail.com ? Skype/AIM/Yahoo/LinkedIn: liamproven
Cell/Mobiles: +44 7939-087884 (UK) ? +420 702 829 053 (?R)
12:25 p.m.
Are you 100 % sure you don't need anti-malware...
http://appleinsider.com/articles/15/08/05/apple-to-patch-actively-exploited…
from what I have seen the fix from Apple isn't a
fix...
http://www.theregister.co.uk/2015/07/22/os_x_root_hole/
but to run SUID. Of course as you know from Facebook I am not a MAC expert, but I do know
that if a product has as many lines of code in it as OS X it will have bugs and security
holes...
Dave
-----Original Message-----
From: cctalk [mailto:cctalk-bounces at classiccmp.org] On Behalf Of Liam
Proven
Sent: 18 September 2015 17:17
To: General Discussion: On-Topic and Off-Topic Posts
<cctalk at classiccmp.org>
Subject: Re: Backups [was Re: Is tape dead?]
On 18 September 2015 at 16:55, Fred Cisin <cisin at xenosoft.com> wrote:
CryptoLocker has been around for a year. I
don't think that McAfee
nor AVG see it. "Well, it's not a VIRUS, . . ."
Former AVG employee here. I quit; this is not an official statement.
CryptoLocker/CryptoWall/etc are *not* a single program. It's a whole family
of them. The programs are constantly modified so that the anti-malware
doesn't pick them up until it's too late. Antimalware mostly still uses
signature databases for identification, plus hooks for suspicious activity.
Cryptolocker is not infectious, so it doesn't perform canonical suspicious
activities. It opens lots of user data files but so do indexing tools from
Windows Search to Google Desktop to Copernic.
However, Cryptolocker et al spread by fooling users into running something
they shouldn't run. I'm sorry, but you got suckered.
Me, I only use Windows if someone pays me to. Life is too short otherwise.
My desktop is a Mac (and before that was a Hackintosh); my laptops run
Ubuntu. Both are much *much* less work and I don't need to run
antimalware.
--
Liam Proven ? Profile: http://lproven.livejournal.com/profile
Email: lproven at cix.co.uk ? GMail/G+/Twitter/Flickr/Facebook: lproven
MSN: lproven at hotmail.com ? Skype/AIM/Yahoo/LinkedIn: liamproven
Cell/Mobiles: +44 7939-087884 (UK) ? +420 702 829 053 (?R)
12:46 p.m.
On 18 September 2015 at 18:25, Dave G4UGM <dave.g4ugm at gmail.com> wrote:
Are you 100 % sure you don't need anti-malware...
http://appleinsider.com/articles/15/08/05/apple-to-patch-actively-exploited…
from what I have seen the fix from Apple isn't a fix...
http://www.theregister.co.uk/2015/07/22/os_x_root_hole/
but to run SUID. Of course as you know from Facebook I am not a MAC expert, but I do know
that if a product has as many lines of code in it as OS X it will have bugs and security
holes...
Well, overall, yes.
It's a Unix box. If it was a web server or something, it would be
remotely exploitable, like any other Unix box.
But it's not. It has no outwardly-accessible services at all -- it's
behind a firewall and all it does is share a single folder with my
laptops. It doesn't even have ssh. It isn't a mail server, web server
or anything.
There are a few Trojans on OS X, but I think I am smart enough to avoid them.
There's no adware, no spyware (except what Apple might have built in),
no self-infecting viruses, nothing. I don't use most of Apple's apps
-- I don't use their browser, email client, chat client, or
productivity tools; I very occasionally use their media player and
their text editor, and that's about it. The Apple text editor isn't
the default, incidentally.
--
Liam Proven ? Profile: http://lproven.livejournal.com/profile
Email: lproven at cix.co.uk ? GMail/G+/Twitter/Flickr/Facebook: lproven
MSN: lproven at hotmail.com ? Skype/AIM/Yahoo/LinkedIn: liamproven
Cell/Mobiles: +44 7939-087884 (UK) ? +420 702 829 053 (?R)
1:10 p.m.
-----Original Message-----
From: cctalk [mailto:cctalk-bounces at classiccmp.org] On Behalf Of Liam
Proven
Sent: 18 September 2015 17:47
To: General Discussion: On-Topic and Off-Topic Posts
<cctalk at classiccmp.org>
Subject: Re: Backups [was Re: Is tape dead?]
On 18 September 2015 at 18:25, Dave G4UGM <dave.g4ugm at gmail.com>
wrote:
But you do use a browser.... and all of those have holes...
Are you 100 % sure you don't need
anti-malware...
http://appleinsider.com/articles/15/08/05/apple-to-patch-actively-expl
oited-privilege-escalation-bug-in-os-x-10105---report
from what I have seen the fix from Apple isn't a fix...
http://www.theregister.co.uk/2015/07/22/os_x_root_hole/
but to run SUID. Of course as you know from Facebook I am not a MAC
expert, but I
do know that if a product has as many lines of code in it as OS X
it will have bugs and security holes...
Well, overall, yes.
It's a Unix box. If it was a web server or something, it would be remotely
exploitable, like any other Unix box.
But it's not. It has no outwardly-accessible services at all -- it's behind a
firewall and all it does is share a single folder with my laptops. It doesn't even
have ssh. It isn't a mail server, web server or anything.
There are a few Trojans on OS X, but I think I am smart enough to avoid
them.
There's no adware, no spyware (except what Apple might have built in), no
self-infecting viruses, nothing. I don't use most of Apple's apps
-- I don't use their browser, email client, chat client, or productivity tools; I
very occasionally use their media player and their text editor, and that's
about it. The Apple text editor isn't the default, incidentally.
--
Liam Proven ? Profile: http://lproven.livejournal.com/profile
Email: lproven at cix.co.uk ? GMail/G+/Twitter/Flickr/Facebook: lproven
MSN: lproven at hotmail.com ? Skype/AIM/Yahoo/LinkedIn: liamproven
Cell/Mobiles: +44 7939-087884 (UK) ? +420 702 829 053 (?R)
3:10 p.m.
On 18 September 2015 at 19:10, Dave G4UGM <dave.g4ugm at gmail.com> wrote:
But you do use a browser.... and all of those have
holes...
True, but they do on any OS. There are far fewer 'sploits for OS X or
for Linux than for Windows (e.g. the famed WMF decoder one) -- andf by
avoiding IE or anything that embeds or wraps IE, that reduces the
chances still further.
--
Liam Proven ? Profile: http://lproven.livejournal.com/profile
Email: lproven at cix.co.uk ? GMail/G+/Twitter/Flickr/Facebook: lproven
MSN: lproven at hotmail.com ? Skype/AIM/Yahoo/LinkedIn: liamproven
Cell/Mobiles: +44 7939-087884 (UK) ? +420 702 829 053 (?R)
12:49 p.m.
On Fri, 18 Sep 2015, Liam Proven wrote:
However, Cryptolocker et al spread by fooling users
into running
something they shouldn't run. I'm sorry, but you got suckered.
Absolutely.
I now think that it was a "We're Adobe, click here to update Flash Player"
or maybe "Java update"
But, I never got my winnings from the Elbonian Lottery.
It got everything in that computer, and started on the backup drive that
was currently connected. I now realize the importance of diconnecting the
backup drive promptly. D'uh!
But, it got bogged down in the first directory of the backup drive, and
hadn't moved on to the other directories by the time it started extortion
of the computer! Tht directory was full of zillions of files, mostly
photos copied from my friend's computer after he died. He saved me from
beyond the grave! And, I still have his machine to make another copy of
those.
Hmmm. 30 years ago, I stepped on the DIRectory of a floppy, and created a
subdirectory that had a subdirectory that was its parent directory. It
actually worked well enough to prevent CHKDSK /V from being able to walk
the DIRectory tree (kept trying to follow subdirectories back onto
themselves). I wonder if that would work on this? (until they notice,
and change their sequence). Also created files named "*.*" and
"????????.???", multiple entries for same file in DIRectory, etc.
--
Grumpy Ol' Fred cisin at xenosoft.com
12:57 p.m.
On 18 September 2015 at 18:49, Fred Cisin <cisin at xenosoft.com> wrote:
Absolutely.
I now think that it was a "We're Adobe, click here to update Flash Player"
or maybe "Java update"
I can see how one of those, done well, might fool most of us. I am not
one of those daredevil ascetics who runs Windows without anti-malware
but with no Flash, Java, etc. -- crap like that is the reason I run
Windows. I won't let MS clients connect to the Internet on my own
machines though -- no MS chat client, email, browser, music player,
video player, _anything_. All disabled or removed and replaced with
FOSS alternatives.
Sadly, this isn't really practical in business.
But, I never got my winnings from the Elbonian
Lottery.
It would have been all muddy anyway.
It got everything in that computer, and started on the
backup drive that was
currently connected. I now realize the importance of diconnecting the
backup drive promptly. D'uh!
Yes, and thank you for the salutory lesson!
But, it got bogged down in the first directory of the
backup drive, and
hadn't moved on to the other directories by the time it started extortion of
the computer! Tht directory was full of zillions of files, mostly photos
copied from my friend's computer after he died. He saved me from beyond the
grave! And, I still have his machine to make another copy of those.
Small blessings, I guess.
Hmmm. 30 years ago, I stepped on the DIRectory of a
floppy, and created a
subdirectory that had a subdirectory that was its parent directory. It
actually worked well enough to prevent CHKDSK /V from being able to walk the
DIRectory tree (kept trying to follow subdirectories back onto themselves).
I wonder if that would work on this? (until they notice, and change their
sequence). Also created files named "*.*" and "????????.???",
multiple
entries for same file in DIRectory, etc.
Niiiiiiiice...
--
Liam Proven ? Profile: http://lproven.livejournal.com/profile
Email: lproven at cix.co.uk ? GMail/G+/Twitter/Flickr/Facebook: lproven
MSN: lproven at hotmail.com ? Skype/AIM/Yahoo/LinkedIn: liamproven
Cell/Mobiles: +44 7939-087884 (UK) ? +420 702 829 053 (?R)
1:19 p.m.
On 09/18/2015 09:49 AM, Fred Cisin wrote:
On Fri, 18 Sep 2015, Liam Proven wrote:
I think it's more complicated than that. Here's a sample of what
happened to me in the last few days.
I received an email for a lost password reset in Twitter. This was odd,
as I've never ever been tempted to sign up for that pile of steaming
gossip and sociopathy called Twitter. But there it was, my email and a
link coming (verified by headers) from twitter.com. Internally, it used
a name, but it wasn't mine.
I sent a complaint to Twitter along with the complete forwarded message
demanding to know what was going on. I got the automated response, but
then utter silence. I'd be surprised if I got much more than that.
I've often stated that the problem with the malware protection business
is that it's reactive, not pro-active. So there's got to be hours or
days for the nastyware to propagate before someone writes a detector for it.
There's been apparently a virus active for months that spies on online
poker players:
http://www.bbc.com/news/technology-34289003
Where were Norton, AVG, etc. for those months? I don't blame them;
they're trying to make up for the fact that most operating systems are
failing at their basic task of protecting the user. FWIW, the small
server I use here runs OpenBSD. The level of paranoia of the code base
maintainers impresses me--but I don't trust it entirely.
One can but wonder how many backups are infected with the same virus.
--Chuck
However, Cryptolocker et al spread by fooling
users into running
something they shouldn't run. I'm sorry, but you got suckered.
Absolutely. I now think that it was a "We're Adobe, click here to
update Flash Player" or maybe "Java update" But, I never got my
winnings from the Elbonian Lottery. 
19 Sep
19 Sep
11:58 p.m.
At 09:55 AM 9/18/2015, Fred Cisin wrote:
CryptoLocker has been around for a year. I don't
think that McAfee nor AVG see it. "Well, it's not a VIRUS, . . ."
Yes and no. The bad guys work very hard to evade detection.
They're always developing new wrappers to deliver the old payloads.
The other recent development that makes me want to quit?
Someone's demonstrated you can hide in the firmware of hard drives.
https://blog.kaspersky.com/equation-hdd-malware/7623/
- John
3229
days inactive
3231
days old
9 comments
5 participants
participants (5)
-
cclist＠sydex.com -
cisin＠xenosoft.com -
dave.g4ugm＠gmail.com -
jfoust＠threedee.com -
lproven＠gmail.com