16 Sep
2015
16 Sep
'15
1:40 p.m.
From: Mouse <mouse at Rodents-Montreal.ORG>
There is a ramsomware variant that encrypts the files but silently decrypts them when they
are accessed. It does this for six months before deactivating the on-demand decryption and
displaying the ransom message, the theory being that by that time all of the backups will
be of the encrypted files, and thus will be useless for restoring good versions.
As to how one can become infected, see
http://www.theregister.co.uk/2015/08/27/malvertising_feature/?page=1. Major sites, such as
The New York Times, Reuters, Yahoo!, and Bloomberg, have been serving malware -- including
ransomeware -- through hijacked advertisements. No need to click on anything, the ad
serves up the malware.
BTW, where I work got hit with ransomeware in December. We were lucky that it first hosed
the accounting/time tracking database, which generated errors when someone tried to enter
her time. When I went to restore a backup of the database, I noticed the ransomware's
html ransom note file and shut down the system before too many more files were encypted.
We were able to restore everything (except the originally infected user's computer,
which we wiped and reinstalled) from an unconnected backup drive.
Bob
I think a more important issue in backing up is
"How many GENERATIONS
to you keep around?"
For many purposes, that's an important consideration, yes. There's
something (small) I back up weekly for which I keep the most recent
seven backups, the oldest backup in each of the most recent twelve
months, and the oldest backup in any year. I'm considering something
of the sort for my house backups - live replication to a backup host,
with a once-a-week freeze of the replica, storing past replica drives
on a scheme somewhat like the above. 
16 Sep
16 Sep
2:01 p.m.
On Wed, 16 Sep 2015, Robert Feldman wrote:
There is a ramsomware variant that encrypts the files
but silently
decrypts them when they are accessed. It does this for six months before
deactivating the on-demand decryption and displaying the ransom message,
the theory being that by that time all of the backups will be of the
encrypted files, and thus will be useless for restoring good versions.
Thereby rendering generations of backups ineffective. When you restore,
you still can not get back any of the file modifications (work) done in
the last 6 months. Thus, the only acceptable solution would be early
detection.
Neither AVG (resident), nor McAfee (manually run weekly) detected my
infection of Cryptowall. What WILL detect it?
As to how one can become infected, see
http://www.theregister.co.uk/2015/08/27/malvertising_feature/?page=1.
Major sites, such as The New York Times, Reuters, Yahoo!, and Bloomberg,
have been serving malware -- including ransomeware -- through hijacked
advertisements. No need to click on anything, the ad serves up the
malware.
But, those still require a gullibility error on the part of the user,
don't they? Do the ads actually load and run the ransomware, or just
present the fraudulent upgrade offer to bring it in?
18 Sep
18 Sep
9:43 a.m.
At 01:01 PM 9/16/2015, Fred Cisin wrote:
But, those still require a gullibility error on the
part of the user, don't they? Do the ads actually load and run the ransomware, or
just present the fraudulent upgrade offer to bring it in?
The bad guys are slipping silent-install vulnerability exploits into
the HTML of ads they place through ad networks. No user error or
trickery involved. You never see it coming. You visit a reputable
site, but can you trust their ad network and all its subcontractors
and all their sub-ad-networks?
As to why your antivirus didn't see it... there's always a few days
before the latest infection mechanisms are documented and added to
the AV updates.
As you say, your backup needs to be effectively off-line, not
on a visible writable filesystem, and you need to detect when
files have changed and keep previous versions within a reasonable
window of detection. Few residential and small-business
networks have anything like that. Most write simple backups
to attached or network storage. Cloud-based backup is nice,
and slow upload speeds throttle the damage, but how many cloud-based
small-business backups can recover N previous versions of changed files?
When I first heard about Cryptolocker, I wanted to give up consulting
and find a different career.
- John
16 Sep
16 Sep
2:41 p.m.
New subject: Ransomware [was Re: Backups [was Re: Is tape dead?]]
There is a ramsomware variant that encrypts the files
but silently decrypts $
This depends on the backup-taking accessing the files in a way that
doesn't trip the decryption.
It also depends on nobody test-restoring from the backups, or at least
not sanity-checking the results if they do.
It also depends on being able to infect the OS and sit there for months
without anyone noticing.
As to how one can become infected, see
http://www.theregister.co.uk/2015/08/$
This depends on the user - perhaps by proxy in the form of something
the user runs - executing content offered by the malvertising-serving
server.
Thus, defense in depth:
(1) Don't run things that execute live content without explicit,
specific approval by the user. Educate users as to the few cases when
giving such approval is sane.
(2) Avoid common OSes and ISAs, so that most malware (ransomware or
otherwise) can't run even if it gets through to the machine.
(3) Test-restore from your backups periodically.
Of course, most people will say they "can't" do one or more of those,
actually meaning they're not willing to pay the prices involved. Such
people need to realize that they will pay one price or the other, and
they'll just have to decide which prices they prefer. Personally, I do
about two and a quarter of the above: (1), 3/4 of (2), and 1/2 of (3).
/~\ The ASCII Mouse
\ / Ribbon Campaign
X Against HTML mouse at rodents-montreal.org
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B
9:41 p.m.
New subject: Ransomware [was Re: Backups [was Re: Is tape dead?]]
Mouse wrote:
There is a
ramsomware variant that encrypts the files but silently decrypts $
This depends on the backup-taking accessing the files in a way that
doesn't trip the decryption.
It also depends on nobody test-restoring from the backups, or at least
not sanity-checking the results if they do.
It also depends on being able to infect the OS and sit there for months
without anyone noticing.
As to how one can become infected, see
http://www.theregister.co.uk/2015/08/$
This depends on the user - perhaps by proxy in the form of something
the user runs - executing content offered by the malvertising-serving
server.
Thus, defense in depth:
(1) Don't run things that execute live content without explicit,
specific approval by the user. Educate users as to the few cases when
giving such approval is sane.
(2) Avoid common OSes and ISAs, so that most malware (ransomware or
otherwise) can't run even if it gets through to the machine.
(3) Test-restore from your backups periodically.
Of course, most people will say they "can't" do one or more of those,
actually meaning they're not willing to pay the prices involved. Such
people need to realize that they will pay one price or the other, and
they'll just have to decide which prices they prefer. Personally, I do
about two and a quarter of the above: (1), 3/4 of (2), and 1/2 of (3).
10:11 p.m.
New subject: Ransomware [was Re: Backups [was Re: Is tape dead?]]
> Thus, defense in depth:
> [...]
> (3) Test-restore from your backups periodically.
As for (3), I don't understand how a test-restore
would help.
The theory is, if the restore restores good contents then the backup
contains good contents.
Even if the files have been encrypted, I don't
understand how a
restore would detect that the files are being encrypted / decrypted
on the fly if a boot every morning does not notice a problem.
It wouldn't. That was to defend against the "the backup contains the
encrypted version" risk - which only some backup mechanisms will suffer
from. If you use something like tar(1) to make your backups, something
that uses the usual file-access mechanisms to read the files, it will
back up the decrypted-on-the-fly version, which is what you want. But
if you use something like dump(1) that goes behind the filesystem's
back to read the files, or something like dd(1) that is
filesystem-blind and just backs up the disk's contents, it easily could
end up backing up the on-disk encrypted version (which is what that
kind of ransomware hopes for, of course).
/~\ The ASCII Mouse
\ / Ribbon Campaign
X Against HTML mouse at rodents-montreal.org
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B
3231
days inactive
3233
days old
6 comments
6 participants
participants (6)
-
cisin＠xenosoft.com -
jfoust＠threedee.com -
jhfinedp3k＠compsys.to -
mouse＠Rodents-Montreal.ORG -
paulkoning＠comcast.net -
r_a_feldman＠hotmail.com