Question About The Latest Ransomware Attack

Picbuster

Joined Dec 2, 2013
1,047
This all comes back to the way companies work.
They should not connect any company critical computers to internet ( drawings/engineering software design).
Yes that's a problem two PC on your desk one for Internet/mail/ brows but save to the companies hart.
Next thing: we should have two nets one business with all users known and spoofing not possible ( like the old telephone numbers) and every transmitter is detectable (Central office to obtain personal all codes. produce spam or misuse you are or company is removed for ever) .

Next to that net is a hobby anonymous internet with all nasty things ( virus/ ransom ware and more. Be happy play and move around).
Protocols and mechanism should not allow bridging and connecting both together.
But we need the rest of the world to accept that anonymous internet is not acceptable to professional users anymore.

Picbuster
 

joeyd999

Joined Jun 6, 2011
5,287
This all comes back to the way companies work.
They should not connect any company critical computers to internet ( drawings/engineering software design).
Yes that's a problem two PC on your desk one for Internet/mail/ brows but save to the companies hart.
Next thing: we should have two nets one business with all users known and spoofing not possible ( like the old telephone numbers) and every transmitter is detectable (Central office to obtain personal all codes. produce spam or misuse you are or company is removed for ever) .

Next to that net is a hobby anonymous internet with all nasty things ( virus/ ransom ware and more. Be happy play and move around).
Protocols and mechanism should not allow bridging and connecting both together.
But we need the rest of the world to accept that anonymous internet is not acceptable to professional users anymore.

Picbuster
You jump thorough hoops. I'll use Linux.
 

nsaspook

Joined Aug 27, 2009
13,312
Vault 7
https://www.bleepingcomputer.com/ne...-with-malware-when-you-download-them-via-smb/
According to a leaked CIA manual, Pandemic is installed on target machines as a "file system filter driver." This driver's function is to listen to SMB traffic and detect attempts from other users to download shared files from the infected computer.

Pandemic will intercept this SMB request and answer on behalf of the infected computer. Instead of the legitimate file, Pandemic will deliver a malware-infected file instead. According to the CIA manual, Pandemic can replace up to 20 legitimate files at a time, with a maximum size of 800MB per file, and only takes 15 seconds to install. Support is include for replacing both 32-bit and 64-bit files. The tool was specifically developed to replace executable files, especially those hosted on enterprise networks via shared folders.
 

Natakel

Joined Oct 11, 2008
54
Little late to the party . . . but some armor against malware woes for the individual user or a even small business concern are regular backup images of your computer/s.

There are many inexpensive programs that will do that, and many decent free ones as well for the home user (some of the free ones are for any use). I like EaseUS Todo Backup Free Edition (10.5 I think is the most recent version). It will do complete disk/partition backups, or incremental backups. It supports Windows OS from XP to 10.

I've found it won't do much over a LAN via remote log-in, but hey . . . it's free. I back up my computers every two weeks, or more frequently if the situation warrants it. If a computer is mission critical, a daily incremental back up is best. I keep two full backups for each computer, with the most recent one also saved to an external drive. Only needed a back-up once when a hard drive went kaput without warning. Up and running with a replacement drive within an hour.

Having decent anti-virus, a good software firewall, and good computing habits go a long way to thwarting net-nasties . . . but when disaster happens, it's good (and easy) to have a recent back-up image of your mission critical computers.

That brings up additional privacy and security issues -- you must trust a third party.

An alternative is to use an OS that has demonstrated its continued resistance to malware attacks. Why I get so many angry verbal attacks when I say such sacrilege is beyond me.
I think it might be because when someone comes on here or other forums they are looking for information concerning the OS they are using, or how to fix a problem with it. This is what they need. For someone to jump in and suggest they just dump it, all the software based on it, and perhaps many stored records and just go learn to use a whole different OS is just not helpful and thus not well received.

It's no secret what OS you think is superior . . . but what works for you doesn't always make personal and economic sense for others. I like various Linux versions . . . for a long time I had a linux based computer set up as a router. I'm in fact thinking about installing some version of linux on an old quad-core PC I have just to play around with. I'd appreciate any suggestions you might have concerning such a project.
 
Last edited:

nsaspook

Joined Aug 27, 2009
13,312
https://www.reuters.com/article/us-cyber-attack-idUSKBN19I1TD

A ransomware attack hit computers across the world on Tuesday, taking out servers at Russia's biggest oil company, disrupting operations at Ukrainian banks, and shutting down computers at multinational shipping and advertising firms.

Cyber security experts said those behind the attack appeared to have exploited the same type of hacking tool used in the WannaCry ransomware attack that infected hundreds of thousands of computers in May before a British researcher created a kill-switch.
 

nsaspook

Joined Aug 27, 2009
13,312
https://features.propublica.org/ransomware/ransomware-attack-data-recovery-firms-paying-hackers/
Siegel refers to a handful of firms globally, including Proven Data and MonsterCloud, as “ransomware payment mills.” They “demonstrate how easily intermediaries can prey on the emotions of a ransomware victim” by advertising “guaranteed decryption without having to pay the hacker,” he said in a blog post. “Although it might not be illegal to obfuscate how encrypted data is recovered, it is certainly dishonest and predatory.”

MonsterCloud chief executive Zohar Pinhasi said that the company’s data recovery solutions vary from case to case. He declined to discuss them, saying they are a trade secret. MonsterCloud does not mislead clients and never promises them that their data will be recovered by any particular method, he said.

“The reason we have such a high recovery rate is that we know who these attackers are and their typical methods of operation,” he said. “Those victims of attacks should never make contact themselves and pay the ransom because they don’t know who they are dealing with.”
 
Top