Support NeoGAF

j_k_redtail · Oct 26, 2013

I'm posting this mostly as a Public Service Announcement. Did a search, saw nothing.

CryptoLocker is a ransomware program that was released around the beginning of September 2013. This ransomware will encrypt certain files using a mixture of RSA & AES encryption. When it has finished encrypting your files, it will display a CryptoLocker payment program that prompts you to send a ransom of either $100 or $300 in order to decrypt the files. This screen will also display a timer stating that you have 96 hours, or 4 days, to pay the ransom or it will delete your encryption key and you will not have any way to decrypt your files. This ransom must be paid using MoneyPak vouchers or Bitcoins. Once you send the payment and it is verified, the program will decrypt the files that it encrypted.

Here is a video demonstrating an infection on a test machine.

And here are some user experiences:

Here's my situation: Client has 4 computers connected to a Synology NAS (uses Linux I believe) to share files. One of the clients got the Cryptolocker virus through an email attachment. Files on both the one client computer and the shared files on the NAS were encrypted. Backups were no good, so the $300 ransom was paid. The payment happened just before closing time and the computer was left on overnight.

Returning in the morning, found that all the files on the infected client were decrypted but none on the NAS. Curiously, a file named "PrivatKey.bin" was left on the desktop.

I am seeking information on how to re-start the decryption or maybe to use that PrivatKey.bin file for decryption if anyone has ideas.

....

PS we paid. $300 for 14,400 files returned, 11 years of (then) non-backed up data. It took two hours for the decryption process to begin, and another 3 or so for it to finish. Client and staff grateful and overjoyed. Very Stockholm Syndrome. Not mad at attacker at all, just grateful the beating had stopped.

...

Cryptolocker hit us 2 days ago and we have been fighting it since. Just wanted to run through what we have tried in hopes that it might help others. I know paying these guys is a tough call to make but when you are faced with losing 40,000 files you do what you have to. We ran malwarebytes and removed cryptolocker before we realized we needed it to pay these guys off for the data to be decrypted so we spent all day yesterday trying to reinfect using the original email that was clicked on to infect the PC in the first place....

This thing has been around for a little over a month but it has exploded in the last few days. This is not your average ransomware: it will encrypt files on network shares and external drives, so keep that in mind if that's your backup strategy. Yes, you will lose the files if you don't pay. The family IT guy will not be able to break the encryption and recover them.

These things are only going to get more sophisticated. You can have the best security software in the world, but remember: the user is usually the weakest link. Remind people in your life who use technology to watch what they click.

Edit:

Keyouta said:
http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care_feeding_of_your_cryptolocker/

Yeah, Reddit, but that's a good link to read about the malware. Lots of useful information.

antonz said:
something for the OP

•We have confirmation that both Malwarebytes Antimalware Pro and Avast Free and Pro will stop CryptoLocker from running. My personal choice of the two is MBAM Pro but research on your own, AV Comparatives is a wonderful resource.

Click to expand...

Edit 2: Virus scanners which will detect cryptolocker:

SPDIF said:
I've just uploaded a sample of this malware to Virustotal (it scans the file with a bunch of different AV engines and tells you if they detect the file). The results are here:

https://www.virustotal.com/en/file/...0a3c34fc2008e210ccfe6dae/analysis/1382805599/

Pretty much every AV, provided you have the latest updates, will detect it.

No Love · Oct 26, 2013

God damn, that is brutal.

Always back up your stuff onto disks that aren't connected to a network, and also on the cloud somewhere I suppose. So sad that people are going around screwing others over like this.

Syf · Oct 26, 2013

Yikes. Thanks for the heads-up.

Omni · Oct 26, 2013

I guess it's good that they give you four days...but still. External hard drives that are only used to backup are a necessity these days.

Juice · Oct 26, 2013

Phew @ my all Mac ecosystem of machines

Sympathy for folks affected. Brutal, malevolent software design.

Coreda · Oct 26, 2013

Heard about this on a podcast a few days ago. Seriously people, don't let yourself get taken down by this.

It will encrypt every known document type it can on both your own system, and any network/shared folders. It's a beast.

Keyouta · Oct 26, 2013

http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care_feeding_of_your_cryptolocker/

Yeah, Reddit, but that's a good link to read about the malware. Lots of useful information.

Vox-Pop · Oct 26, 2013

Damn we're all doomed.

daw840 · Oct 26, 2013

Holy shit....this work on Macs or only PCs?

Stet · Oct 26, 2013

How does this proliferate?

antonz · Oct 26, 2013

Blacksafs said:
thats hardcore I didn't even know "ransomware" existed

Much of it tries to present itself as if they are the FBI or another agency who has caught you doing bad things and you must pay or they will come after you. Its all been based on fear stuff until this new encryption stuff

Reversed · Oct 26, 2013

Devilishly genius. Thought it was a pranky spyware program at first.

iammeiam · Oct 26, 2013

This is crazy and scary. BRB checking AV status.

j_k_redtail · Oct 26, 2013

Keyouta said:
http://www.reddit.com/r/sysadmin/comments/1mizfx/proper_care_feeding_of_your_cryptolocker/

Yeah, Reddit, but that's a good link to read about the malware. Lots of useful information.

Added to OP. Also, more info on how it works here:

http://nakedsecurity.sophos.com/2013/10/12/destructive-malware-cryptolocker-on-the-loose/

What CryptoLocker does

When the malware runs, it proceeds as follows:

1. CryptoLocker installs itself into your Documents and Settings folder, using a randomly-generated name, and adds itself to the list of programs in your registry that Windows loads automatically every time you logon.

2. It produces a lengthy list of random-looking server names in the domains .biz, .co.uk, .com, .info, .net, .org and .ru.

3. It tries to make a web connection to each of these server names in turn, trying one each second until it finds one that responds.

4. Once it has found a server that it can reach, it uploads a small file that you can think of as your "CryptoLocker ID."

5. The server then generates a public-private key pair unique to your ID, and sends the public key part back to your computer.

→ Remember that public-key cryptography uses two different keys: a public key that locks files, and a private key that unlocks them. You can share your public key widely so that anyone can encrypt files for you, but only you (or someone to whom you have given a copy of your private key) can decrypt them.

6. The malware on your computer uses this public key to encrypt all the files it can find that match a largish list of extensions, covering file types such as images, documents and spreadhseets.

→ Note that the malware searches for files to encrypt on all drives and in all folders it can access from your computer, including workgroup files shared by your colleagues, resources on your company servers, and possibly more. The more privileged your account, the worse the overall damage will be.

7. The malware then pops up a "pay page," giving you a limited time, typically 72 hours, to buy back the private key for your data, typically for $300. (The price point is suprisingly similar to what it was back in 1989.)

GAF, you are not prepared for this. Watch what you click.

FauX · Oct 26, 2013

virus and malware are mutating...

BronsonLee · Oct 26, 2013

What a cruel idea. This'll work a bit better than the BitDefender stuff, I bet...

Jedi2016 · Oct 26, 2013

Does it make me a bad person if I feel the creators of, and people who profit from, this sort of thing should all be killed?

j_k_redtail · Oct 26, 2013

daw840 said:
Holy shit....this work on Macs or only PCs?

Windows, all the way through 8.

Stet said:
How does this proliferate?

Mostly email attachments. Zombie computers on the Zeus botnet already have it, apparently.

antonz · Oct 26, 2013

something for the OP

We have confirmation that both Malwarebytes Antimalware Pro and Avast Free and Pro will stop CryptoLocker from running. My personal choice of the two is MBAM Pro but research on your own, AV Comparatives is a wonderful resource.

daw840 · Oct 26, 2013

j_k_redtail said:
Windows, all the way through 8.

Mostly email attachments. Zombie computers on the Zeus botnet already have it, apparently.

Good....all of my pics are on my MBP. Though I do need to back them up....not sure really how other than just straight up burning to disc. That would take FOREVER though.

j_k_redtail · Oct 26, 2013

antonz said:
something for the OP

Added.

Stet · Oct 26, 2013

daw840 said:
Good....all of my pics are on my MBP. Though I do need to back them up....not sure really how other than just straight up burning to disc. That would take FOREVER though.

Back up onto an external hard drive, disconnect the external hard drive until the next back up.

Laconic · Oct 26, 2013

daw840 said:
Good....all of my pics are on my MBP. Though I do need to back them up....not sure really how other than just straight up burning to disc. That would take FOREVER though.

Flashdrives are great.

Coreda · Oct 26, 2013

There are many juicy security exploits and news I hear about, but for some reason I never hear anything about them in the general media.

This one will at least get people to pay attention to security advice.

luoapp said:
Where is the Fxxking NSA when you need them!?

IIRC the FBI had tracked down one server containing the private keys (that are used to decrypt victims drives) but upon shutting down the server they inadvertently made it impossible for victims to connect to get the private keys they were paying the ransom for. Remember to backup people...

luoapp · Oct 26, 2013

Where is the Fxxking NSA when you need them!?

Effnine · Oct 26, 2013

I'm sure this may be answered in the Reddit thread, but how is it NOT possible to track where the money goes and take down the people demanding the money? It seems like that would be a fairly easy thing to do ...

Vulcano's assistant · Oct 26, 2013

So I take it only takes one of your employees to make the mistake?

lastplayed · Oct 26, 2013

Surprised more people don't back up on the cloud, especially how cheap it is now.

luoapp · Oct 26, 2013

Effnine said:
I'm sure this may be answered in the Reddit thread, but how is it NOT possible to track where the money goes and take down the people demanding the money?

They can be tracked down, but you need someone with state authority involved, not some AV companies.

Chie Satonaka · Oct 26, 2013

The scum that does this needs to be fired off into the sun in a rocket. I'm always super paranoid about viruses.

Coreda · Oct 26, 2013

Effnine said:
I'm sure this may be answered in the Reddit thread, but how is it NOT possible to track where the money goes and take down the people demanding the money? It seems like that would be a fairly easy thing to do ...

Except they're using Bitcoin for payment. It's completely anonymous.

BlackJace · Oct 26, 2013

The computer equivalent of being robbed at gunpoint. Incredible how much these things have evolved.

Be careful folks.

MThanded · Oct 26, 2013

Effnine said:
I'm sure this may be answered in the Reddit thread, but how is it NOT possible to track where the money goes and take down the people demanding the money? It seems like that would be a fairly easy thing to do ...

bitcoin

MartyStu · Oct 26, 2013

I am impressed.

javac · Oct 26, 2013

Malwarebytes all the way!

Nilaul · Oct 26, 2013

I'm surprised how many people don't back up their important files on a large usb or harddrive (since their so cheap now).

mugurumakensei · Oct 26, 2013

Vulcano's assistant said:
So I take it only takes one of your employees to make the mistake?

if you have shared network drives, it only takes one.

Technosteve · Oct 26, 2013

running two AV software just in case

firehawk12 · Oct 26, 2013

lastplayed said:
Surprised more people don't back up on the cloud, especially how cheap it is now.

I wonder, if this thing gets into your Dropbox folder and Dropbox syncs all those files, are all your files on Dropbox fucked as well?
(Or any other cloud service, for that matter).

Kibbles · Oct 26, 2013

How exactly do you pay them? Can't they be tracked down and get fucked by the law if you have to pay them?

lastplayed said:
Surprised more people don't back up on the cloud, especially how cheap it is now.

Slow ass upload speed and bandwidth limits =\

PotionBleue · Oct 26, 2013

Prevention: As this post has attracted many home users, I'll put at the top that MalwareBytes Pro, Avast! Free and Avast! Pro (defs 131016-0 16.10.2013 or later) will prevent the virus from running.

Not sure if that means non-listed anti-virus programs haven't blocked it yet, but anyway, funny to see the good old free avast still going strong.

CornBurrito · Oct 26, 2013

lastplayed said:
Surprised more people don't back up on the cloud, especially how cheap it is now.

Any recommendations for cloud storage? Which sites offer the best deal?

Also I'd get Avast, but my college forces me to have McAfee antivirus... yeah I know

Effnine · Oct 26, 2013

Coreda said:
Except they're using Bitcoin for payment. It's completely anonymous.

But it still has to go somewhere, right? I mean, is there no end point that can be found?

Amikami · Oct 26, 2013

Damn. Thats terrifying. So what sort of stuff should one look out for? What might be the main sources of such a malware. At this point I'm afraid to google.

Timedog · Oct 26, 2013

This is a pretty smart yet also incredibly stupid idea.

Sophia · Oct 26, 2013

Blacksafs said:
this is probably a stupid question but other than entering info on a shady website, is there a way for a tablet to be comprised by any sort of malware

Depends on what tablet you're using. This specific piece of malware might/would run if you were using a Windows 8 tablet, but if it's Android/iOS/Windows RT then no.

Learn2read · Oct 26, 2013

We had an email at work about this today.

Apparently somebody in the company lost all files for a project. I actually don't quite understand how that would happen, but that's what it said

Nilaul · Oct 26, 2013

mugurumakensei said:
if you have shared network drives, it only takes one.

It only takes one drunken/stupid student to take down the whole university.

Its not like the students will miss the Shiite computers and the out of date software that can't read newer files

j_k_redtail · Oct 26, 2013

BlackJace said:
The computer equivalent of being robbed at gunpoint. Incredible how much these things have evolved.

Be careful folks.

I have anti-theft software installed on my computer which tells the PC to phone home every now and then. The software is actually installed in a special part of motherboard - on the firmware itself. The software can reinstall itself even if the hard drive is removed and replaced. Many major brands have such an ability.

Can you imagine the digital carnage if someone was able to break into that, and put a virus in there? This is out of control.

ThisWreckage · Oct 26, 2013

I don't use e-mail and everything I have worth saving has been backed up in lot of different ways.

Support NeoGAF

Cryptolocker: new malware encrypts your files, demands ransom within 96 hours

Member

Banned

Banned

Member

Member

Member

Junior Member

Contains Sucralose

Member

Banned

Member

Member

Member

Member

Member

Member

Member

Member

Member

Member

Member

Banned

Banned

Member

Member

Member

Banned

Member

Member

Member

Member

Member

I Was There! Official L Receiver 2/12/2016

Member

Member

Member

Member

Banned

Subete no aware

Member

Member

Member

Member

Banned

good credit (by proxy)

Member

Member

Member

Member

Banned

Similar threads