Fiendish CryptoLocker ransomware survives hacktivists' takedown An attempt by security researchers to take down command and control nodes associated with the infamous CryptoLocker malware appears to have been unsuccessful in its ultimate aim of putting the Bitcoin-hungry crooks behind the scam out of business. Activists from the group Malware Must Die put together a list of scores of …
Cryptolocker has persuaded me and family members to reconsider our backup and security arrangements - on line and off line backups including versioning, properly set up firewalls, all day to day use by user accounts not administrator, education for the inexpert users, replacement or removal of as much as possible of the avoidable cr@pware (Adobe, Realplayer, Java), in addition to the existing anti-malware solutions). And then system imaging from clean installs in case the worst does happen.
All of which I should have done before. But in the belief that theat was just messing up my system and hijacking the PC for sending spam or DDoS, which can be resolved by a reinstall, it just wasn't a priority. So in some respects thank you Cryptolocker crims, you forced me to do things properly.
Make sure those backups are offline! An online disk backup is just as vulnerable as any other online data.
Also, make sure you can recover, including recovery of the catalogue database (if there is one) which will enable you to recover the rest of the data. An untested backup may as well be just random data.
Quite true - although I'm a Mac user, I keep two separate & offline clones of my boot drive, so in the event of any incursion by the ungodly (there may always be some zero day exploit) I can boot from one of my backups (the most recent) and reformat & re-clone to the boot drive.
It's a bit of a faff, but it has become second nature to me: incremental backups to clones are pretty quick, - and I NEVER let the system remember passwords for any sensitive or financial info, or store card numbers for me.
Better 30 mins/week than letting these arseholes really spoil my day.
"Make sure those backups are offline"
Don't worry, that was a number one consideration. Hitherto it has just been cloud synced, protecting me against sudden hardware failure or loss, but the stealth encryption of CL made me realise the error of my ways.
"Also, make sure you can recover, including recovery of the catalogue database (if there is one)".
No database as this is home machines, without any clever stuff on them, but good advice anyway.
"An untested backup may as well be just random data."
I must 'fess up, checked, but not fully tested. For things like the system image and ripped music there's other recovery paths if they don't restore, it's just more time. The document recovery has been tested variously in full or in part (still susceptible to bit rot I suppose). I might enable checksum comparison on the backup or something like that to provide some verification on backup writes, so thank you for the prompt.
"I'm sorry Mr NSA bloke but these files were encrypted with crytolocker, i haven't deleted them in case the decrytion key is eventually located when cryptolocker is brought down and i can recover all my pics of puppies*. If YOU, Mr NSA, cant decrypt em then please feel free to attempt to prove otherwise".**
Im going (really against my wishes) to the states next year, before i go i am going to restore my laptop to a known clean state, then run truecrypt through it. Then make some folder with corrupt images but a good name, like, ohh, "barely legal numbers 30-40"!. Should cause a laugh and will hopefully cause them to have me refused entry and flown back to blighty.
* puppies with little perky pink noses
** USA, no proof/evidence makes a shit of difference. They do what the fuck they like anyway.
"before i go i am going to restore my laptop to a known clean state, then run truecrypt through it. Then make some folder with corrupt images but a good name, like, ohh, "barely legal numbers 30-40"!. Should cause a laugh and will hopefully cause them to have me refused entry and flown back to blighty."
You're an idiot then. Do you know how many countries will refuse you entry, if you've been refused entry to one of their allies? Do you realise that if you succeed they may well hold you while they attempt decryption? Do you realise that the British consulate isn't going to be entirely impressed when they realise that you've done this deliberately "for a laugh"?
As I commented to a friend about someone I saw in Luxor airport wearing a t-shirt protesting about Egypt's treatment of the Palestinians - Never, ever, make political statements in a port.
"Im going (really against my wishes) to the states next year, before i go i am going to restore my laptop to a known clean state, then run truecrypt through it. Then make some folder with corrupt images but a good name, like, ohh, "barely legal numbers 30-40"!. Should cause a laugh and will hopefully cause them to have me refused entry and flown back to blighty"
You're a total tinfoil-hat-wearing nutter. Been to the States twice with work and my work laptop. On none of those occasions was my laptop ever looked at, EVER. Hell, I don't think they even knew I had a laptop on me.
So calm down.
It's also worth mentioning that the US is a really nice place to visit. I've been to New England, New York and Atlanta, everyone I've met has been lovely, you may not want to engage them in talk about politics, but every single American I have met has been a genuinely nice person.
Statistically, americans are the nicest people on the planet andrated #1 at helping strangers.
This probably has a lot to do with the way their gvernments (local/reagional/national) will happily shaft any/everyone at the slightest opportunity - they're more likely to attack USA citizens over something than the damned furriners.
@ cornz 1:
Riiiiiiiiiiiiiiiiiiiiiiigtht.
If you are that "hard", why aren't you able to just say you aren't going? Surely someone so self assured and aggressive knows how to unvolunteer? In the real world?
(aside) I reckon someone needs to take a break from reading the BOFH archives.
Indeed, it's "safer" for the crooks to delete the keys needed to unlock infected computers, if the keys got out into the wild people could unlock it themselves, possibly, so much easier to lock the PC throw away the key and demand cash for something they can't deliver, and really, if they don't deliver I can't see Trading Standards knocking on their door in whichever country they may be based in.
"Successfully knocking out Cryptolocker will stop new infections."
New infections of Cryptolocker v1. The real threat of CL is that it has been perhaps the most effective piece of ransomware of all time (I speculate so). Which means that other envious cyber crooks are looking at how they can get a piece of the action, either by buying the software and modifying it, or writing their own to copy the business model. That's why I went for the measures noted above, because at the moment I can see which are (probably) the CL emails as they arrive either from ADP Payroll, Fedex, or "I am Natasha from Russia. Look my picture in attachment". But that only protects me when I can see and delte the threat. The Holy Grail for the crims is to be able to infect machines in (for example) a drive by download (or maybe the Grail is getting this to work on the machines of supposedly rich and security unaware Mac users).
Imagine you are a computer crook. If your malware recruits a machine to a botnet for sending spam, or participating in DDoS attacks, how much do you earn? $200 for 10,000 machines per day, say 60c per machine per month max, assuming there's sufficient rental demand to rent them out continuously. If you can install something like CL, you get perhaps 5% of infected users paying up say an average of $20 per machine infected, with no onging need to maintain the bots. So working ransomware gets you double the income of maintaining a botnet for eighteen months, and you get the money up front.
I think the security advisory firms haven't made enough of the aspects of CL that are not individually novel, but collectively are game changing: Effective delivery, stealthy and effective encryption, delivering on the unencryption when users pay up, untraceable payment.
Yes, even though bitlocker doesnot affect myself (Linux user) I am seriously giving thought to backup strategies and using the copy-on-write technology that is becoming mainstream...
Perhaps this is the year Linux becomes the host machine of choice to protect the windows guests of this problem?
P.
If you use copy on write AKA Continuous Data Protection types of backups, the files which the backups are stored in are online, they are therefore just as vulnerable to encryption malware as any other file.
You need to have offline backups at the very least and if you want online, you need offline copies of these files as well..
"If you use copy on write AKA Continuous Data Protection types of backups,"
Backups which are online are merely file copies which haven't been deleted yet.
IN 1997, New Zealand's largest ISP (IHUG) had a young (13yo) script kiddie break into the webserver containing customer websites. He deleted the lot AND the "backups" on mounted drives AND the backups which were on accessable (non-mounted) filesystems. Needless to say a lot of customers didn't have backup copies on their own systems.
He then had the lack of foresight to appear on national TV boasting about it. This was before NZ had laws against such things. His family required police protection for some considerable time afterwards,.
THAT is one of the reasons why I like tape.
> Yes, even though bitlocker doesnot affect myself (Linux user) I am seriously giving thought to backup strategies
As anyone should, and not because of BitLocker.
> using the copy-on-write technology that is becoming mainstream
That's the solution to a completely different problem though.
> Perhaps this is the year Linux becomes the host machine of choice to protect the windows guests of this problem?
Not really, virtual Windows machines on a non-windows host would be just as vulnerable. "not being a hopeless dimwit" is perhaps the best defence in this case. A pdf in a zip file attached to an email from an unknown source, seriously? There's a serious education fail here.
well this is my floating idea. At my lab the netapp box (or whatever it is under the hood) had these hourly snapshot things. It was simply impossible to lose data, but then again that's what we pay our sysadmin for....
So this technology is becoming more mainstream, in that I know that LVM has it, but it is not granular enough.
So along comes ZFS and BTRFS etc.. so copy on write and snapshots.
Am I mistaken in thinking that if the Linux box was managing the copy-on-write with snapshots (say every hour/day etc...) and exposing the filesystem as SAMBA (or whatever) to a windows guest, that cryptlocker would come in and mess up files (I am assuming users home directories), but since copy-on-write , the old version would still be around?
As I declare I am not a raw windows user (only in VM), but it occurred to me this may be a practical and desirable solution, amenable to many.
I am not saying linux is immune to malware, just that apply the strength of one system to another, creates a diverse target to make bad guys try harder...
Any improvements to this strategy?
P.
WRT the NetApp appliance: Snapshots are great, but you should think of them as a copy rather than a backup. They are (or can be) presented out via CIFS, so are just like ordinary file systems. A failure to the array will also take down your snapshots as they're on the same physical hardware. Hence the requirement for offline.
As for zfs/btrfs etc, I don't know as much about these, but if you've got malware on a linux system, which encrypts filesystem data, it's not a great leap of the imagination to suggest that this malware would also kill your zfs/btrfs snaps/copy on write/whatever else, once it had encrypted your files. So, again for normal use great, but you need offline copies.
> So along comes ZFS and BTRFS etc.. so copy on write and snapshots.
> Am I mistaken in thinking that if the Linux box was managing the copy-on-write with
> snapshots (say every hour/day etc...) and exposing the filesystem as SAMBA (or
> whatever) to a windows guest, that cryptlocker would come in and mess up files
>(I am assuming users home directories), but since copy-on-write , the old version
> would still be around?
No expert here, but yes - that would be my understanding. As long as you keep a snapshot from before CL got it's paws into the filesystem then you should be able to roll back. You still need other backups as a filesystem corruption or disk failure can still lose you your data, as will a house fire if you don't have a backup offsite.
> Am I mistaken in thinking that if the Linux box was managing the copy-on-write with snapshots (say every hour/day etc...) and exposing the filesystem as SAMBA (or whatever) to a windows guest, that cryptlocker would come in and mess up files (I am assuming users home directories), but since copy-on-write , the old version would still be around?
You're mixing things. CryptLocker will attempt to encrypt every filesystem that is visible to the machine it's running on. A secure way to do it would be to have the host perform a snapsot of the VM every now and then, without involving the guest at all, and with no access -no write access at least- from the guest to the snapshot. That's usually built in the virtual machine manager, for a very good reason. If the guest OS (Windows) is the one requesting the archiving writes, then it's at least partly vulnerable as the malware will be "aware" of the existence of the "archive" filesystem and will attempt to encrypt it as well. SAMBA especially sounds like a bad idea, FTP is probably easier to lock down.
In short, as long as the system running the malware has write access to the "backup", you're toast.
Linux LVM snapshot will preserve the state of the LVM at the time it was taken. Cryptolocker, or anything else not running on the Linux LVM host, could only affect the snapshot if it were mounted and exported read-write. A common practice is to mount it read-only and export it read-only, so users can perform self-service rescue of files they (or cryptolocker) have messed up. RO mount means that only a root exploit on the Linux host can damage it, but then copying the snapshot to offline and offsite storage is a good second-line, not least should your backup volume fail.
One caveat - make sure that the snapshot LVM is the same size as the source LVM so that should Cryptolocker or everything else write to most of the blocks on the source, the snapshot doesn't run out of space.
They ask for 2 BTC because the value is high. Shoult a BTC be worth a few cents (as it once was) they would ask for thousands of them, that's all. Or for Western Union, like the 419 scammers. Or for anonymous prepaid cards like the "your browser is locked until you pay the fine" nag pages.
I've only heard of someone who's heard of someone who's had problems recovering their data after paying up, but never spoken to anyone directly. It would be pretty stupid of the authors of the virus not to unencrypt the data, as if the word on the street was that they didn't, then people would stop paying up.
Bear in mind that the newer versions of the virus have apparently started asking for only 0.5 bit coins, in response to its sudden rise in value. That's not the move of someone stupid.
I wouldn't want to be these crims when they get caught.
Especially if it's organised crime that is first to catch up with them. It's probable that organised crime has also had its data corrupted, and what can they do? Can't inform the authorities. Can't pay the ransom, in case it were a sting by the authorities. Can do something hideously violent and permanent to the perps if they find them.
The issue with these scumbags is that you cant "follow the money" that's why ultimatally the Bitcoin model, is deemed for failure.
Essentially Bitcoin circumvents the tax man, Accountancy etc. etc. Eventually, governments will have to agree to regulate this sort of venture, or close them down, as it undermines pretty much everything modern economics is built with
As for all of the spamming / scamming scumbags, Im sure Government agencies know enough to close them down. It appears, from a espionage point of view, they have pretty much embedded themselves into all aspects of the internet
No, it doesn't. No more than using paper/plastic money, at any rate. (Value-Added/Sales) Tax laws work because the seller acts as the tax collector. They have to keep records of what they buy, what they sell and the prices they sell the items at. They're then liable for collecting the sales tax or VAT from the customer and paying it back to the taxman (or offsetting it against their tax deductibles to get a balance that they must pay). Bitcoin has absolutely nothing to do with this. Dishonest traders will fiddle the books (putting in false sale value, for example, or just writing off stock) regardless of whether customers are paying in cash or for barter value (like Bitcoin is).
As for following the money: that's what a business's set of accounts are for. Again, it has nothing to do with Bitcoin. Paper money is just as "untraceable", yet you never hear people complaining that it allows for anonymous transactions!
Short of closing down the internet how *can* the authoritoes close Bitcoin down?
Anyway, it's not new. Since the earliest days of the Chinese Empire (and probably earlier, but the records have perished) there have been trustworthy(*) alternative criminal(**) organisations which would move your money across borders and around accountancy barriers for a fee. Typically you hand over some money and receive a token, such as a roughly torn sheet of paper. You later present it to a representative of the same organisation at another location, and they match the other torn piece and then hand over the agreed amount of cash.(***)
(*) for certain values of trustworthy
(**) according to the authorities, who ask more in taxes than the alternative asks in fees.
(***) this practice may even be the origin of paper money instead of gold, brought back from the underworld by the authorities, who could then back several banknotes with the same piece of gold and get away with it for centuries. Behaviour which any self-respecting criminal gang would be ashamed of.
Had my bag of fun with this piece of garbage.
The attack vector was something like this : luser allowed her son (against IT policy) to install and run games on her work laptop. I suspect her son caused the laptop to be infected with CL either by opening an email attachment or the such. It proceeded to encrypt every single .doc, .xls and the such files on said laptop.
Then it displayed its ransomware notice.
Her son tried to uninstall it, but panicked when it changed the desktop background to the infamous CL background bitmap.
He sbould've left it there, but he didn't, and downloaded (and reinfected the laptop) with CL accordingly to the instructions given.
Then mommy came to work with said laptop, plugged it into the network, and did some work.
Then she proceeded to phone me.
Worst day ever. I killed her connection, and had to restore from a backup... Luckily it was only her laptop, her home folder on the server and one directory with lots of .PDF, Word and Excel files affected - and the corruption didn't spread to the automated backups yet....
She was under the impression I could "google for a fix and way to remove it" .... Hopefully the loss of her photos and other (not backed up) documents on her laptop will make her think twice now....
Had to do a fresh windows install on a new HDD as I could not get rid of the CL trojan at all... Will probably format and reinstall that HDD at some later stage.
Going to introduce (and enforce) new, tougher IT policies next year. Lesson learnt.
The attack vector was something like this : luser allowed her son (against IT policy) to install and run games on her work laptop. I suspect her son caused the laptop to be infected with CL either by opening an email attachment or the such.
At WROK PALCE, that would be an Employment Termination Event.
End of discussion.
But, since we don't use WindblowZE, the point is somewhat moot.
"Then mommy came to work with said laptop, plugged it into the network, and did some work."
I hope you pointed out pretty forcefully to her and the CEO how lucky you were that the central fileservers didn't end up encrypted?
In some companies she'd have been escorted to the door by security with the personal content of her desk belongings only following a few days later by courier delivery.
For all out customers with the appropriate linux servers, we've just blocked zip files in incoming emails. The minor inconvenience is outweighed by the safety aspect. For customers with windows servers and an antivirus on the server, we can usually block these attachments too. Most of our customers are perfectly happy with this arrangement.
Surely ISPs could cooperate and just block all affected machines from "phoning home" ?
A simple matter of El Camerono signing the "Internet Security Act" would suffice, empowering ISPs to block known botnetted machines and charge a fair price for either cleaning said machines themselves via a third party or keeping them blocked until the owner fixes them.
Surely, now the Snowden cats are out of the bag, the NSA can identify those responsible for CryptoLocker and send in the SEALS?
My family get two rebuilds for free, the third comes at the price of their admin rights. No matter the OS, having unskilled people using technology will not end well.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
