CryptoLock - wow they really are making some money

[phillipsjk]

If it is not offline, it is not a back-up.

I think this virus would be vulnerable to the Cold Boot Attack. To encrypt the files, the key has to be in memory. To force the key to be in memory, you may even want to plug in an enticing-looking external drive for it to encrypt.

Edit: forgot about the DMA attack: figure IEEE 1394 connectors are a security risk

[justusranvier]

Even though this should should be more properly thought of as Microsoft's problem, not Bitcoin's problem, there are people gearing up to use it as an excuse to introduce blacklisting.

[Lauda]

If it is not offline, it is not a back-up.

I think this virus would be vulnerable to the Cold Boot Attack. To encrypt the files, the key has to be in memory. To force the key to be in memory, you may even want to plug in an enticing-looking external drive for it to encrypt.

Edit: forgot about the DMA attack: figure IEEE 1394 connectors are a security risk

and how would you make 12hr back-ups on a offline(possibly remote) HDD?

[phillipsjk]

If it is not offline, it is not a back-up.

and how would you make 12hr back-ups on a offline(possibly remote) HDD?

The remote hard-drive can be in a system that stays offline until receiving a WOL packet.

I haven't got my routine backups working yet, so can't really tell you what I do.

Was planing to do both DVD-R HDD based backups.

Remote is important too. I suspect if your are using sneakernet, you would want to keep the off-site, off-line backups to weekly frequency.

Do your really have $600 worth of data every 12 hours? If that is the case, I may suggest some kind of version control system out of reach of the compromised Windows Machine.

[Lauda]

The remote hard-drive can be in a system that stays offline until receiving a WOL packet.

I haven't got my routine backups working yet, so can't really tell you what I do.

Was planing to do both DVD-R HDD based backups.

Remote is important too. I suspect if your are using sneakernet, you would want to keep the off-site, off-line backups to weekly frequency.

Do your really have $600 worth of data every 12 hours? If that is the case, I may suggest some kind of version control system out of reach of the compromised Windows Machine.

I'm just asking in theory. No, I currently don't have that much. I like the idea of the WOL packet though.

[inform]

Yesterday we had a client call up in hysterics - only 24 hours left before CryptoLock is going to throw away the encryption keys - all data gone!

If interested, here are the screens she sent us http://imgur.com/a/EHBRb


Last night, we had a poke around the blockchain to see where the ransom monies flow.  Here is the ransom address we were provided: https://blockchain.info/address/1M83NXYuPpjEjYt8baXYxriQNCDyfWU8i3

Ransom address is cleared out with this transaction:
https://blockchain.info/tx/c20079ca4a978a8b6eea1ba7fc2e3603b91dd73e34b7d381fa527d05ab3be375

The address where ransom is cleared to is interesting, to say the least...
https://blockchain.info/address/1AEoiHY23fbBn8QiJ5y6oAjrhRY1Fb85uc

Total Received   4,691.06798731 BTC  and that is from 15-Oct-2013 to now.  It's probably just one of a number of clearing/consolidation addresses.

These guys are probably making USD50,000,000 a year or more!


BTW - we calmed her down, eventually solved her problem.  As a side note: the CryptoLock people need to dumb down the bitcoin thing - there must be hundreds of victims out there, like this lady, who've never even heard of bitcoin.

Even if you pay, you're only financing the next version.
P.S But if some guys need informations

must pay 100%

[C. Bergmann]

Today our system admin sendet out a mail through my companies network: serious warning. Trojan comes through attached fax. This virus doesn't aim on private users, it aims on business networks.

[Lauda]

Today our system admin sendet out a mail through my companies network: serious warning. Trojan comes through attached fax. This virus doesn't aim on private users, it aims on business networks.

It aims at everyone.
How does one even code such a thing?

[AndrewWilliams]

Today our system admin sendet out a mail through my companies network: serious warning. Trojan comes through attached fax. This virus doesn't aim on private users, it aims on business networks.

It aims at everyone.
How does one even code such a thing?

C++