Cryptolocker

[compman25]

Anyone else have to deal with this yet? http://www.bleepingcomputer.com/forums/t/506924/cryptolocker-hijack-program/

 

[smakme7757]

I havn't personally got it, thankfully, but it went around the media a bit here in Norway as there were a few people that got it here.

If it has indeed encrypted your hard disk then you're pretty much screwed. There is no guarantee that they will unlock your drive if you pay them either.

I wouldn't pay. I'd reformat and cut my losses. Backup is handy here
I'd imagine that they don't even monitor who pays them. They just receive the money.

 

[lxskllr]

There is no guarantee that they will unlock your drive if you pay them either.

I've always been curious about that. I wonder if they do what they say they will. Good business, and smart economics dictates they unlock the files, but some people are dumb as bricks.

If I didn't have backups, I'd consider paying. Data is the most valuable thing many people and businesses have, but having backups is better.

 

[Zardnok]

YIKES! Encountered Cryptolocker this morning in one of the offices I service. NASTY!! Someone sent her a link for a gospel song and one click later, her files are being encrypted and a ransom screen pops up. It was super easy to remove the actual virus from the machine, but the data files are still encrypted. I think I have an Easy Transfer file for her from back in August, so at least she won't lose but two months of work.

Of course she did not have a recent back-up and even if she did, I am not sure it would have helped as this thing encrypted files on the office NAS where the back-ups are stored as well. I am taking this as a lesson learned for all of us and will be much more diligent with off-line back-ups just in case!

 

[compman25]

YIKES! Encountered Cryptolocker this morning in one of the offices I service. NASTY!! Someone sent her a link for a gospel song and one click later, her files are being encrypted and a ransom screen pops up. It was super easy to remove the actual virus from the machine, but the data files are still encrypted. I think I have an Easy Transfer file for her from back in August, so at least she won't lose but two months of work.

Of course she did not have a recent back-up and even if she did, I am not sure it would have helped as this thing encrypted files on the office NAS where the back-ups are stored as well. I am taking this as a lesson learned for all of us and will be much more diligent with off-line back-ups just in case!

This has info on one way to get your data back http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information

 

[SOFTengCOMPelec]

Wow, this thing is scary. I hope I never encounter it

Spoiler

(Please pay $300 to read the rest of this message)

.

Hopefully the Police in the appropriate country(s) can catch these criminal(s).
(But I guess they will be in one of the safe haven countries and/or hidden their won identities).

Another article about CryptoLocker

 

[John Connor]

I wonder if Hitman Pro Kickstart can rid the system with it, but seen as how the drive is encrypted you are FUBARed.

 

[compman25]

You don't need to use anything to remove it, it will remove itself after the 72hrs are up.

 

[KeithP]

I've always been curious about that. I wonder if they do what they say they will. Good business, and smart economics dictates they unlock the files, but some people are dumb as bricks.

I would bet the files get unlocked but I wouldn't be surprised if something is left behind so in 6 months or so they hit you again.

-KeithP

 

[postmortemIA]

This beats all. Worse than BIOS virus, where at least you get to keep your data on the drive.
In theory you can do brute force attack to get your files back, after few yrs of trying.
Can't believe nobody found a flaw in the encryption method yet. Somebody really smart is behind this.

 

[John Connor]

Somebody really smart is behind this.

It's really not that difficult at all to initiate a XSS attemp or rouge scrip on a web page and install the malware and encrypt the drive. I think if you watched the HDD light indicator you would see that something was going on behind the scenes. Encrypting a whole drive would take some time. I think the Blue pill virtual rootkit is a genius malware.

 

[heymrdj]

Dealing with this this morning. Restoring 2.7TB from backups. An administrative user got the virus, and that user basically had mapped every storage drive so he could help any user quickly. We had warned him about such a practice a while back but never was dealt with apparently. So it encrypted 75% of the drives.

 

[Chiefcrowe]

DAMN! after the restore do you just plan to wipe out this user's machine and lock them down more (maybe take away admin rights?)

 

[smakme7757]

Dealing with this this morning. Restoring 2.7TB from backups. An administrative user got the virus, and that user basically had mapped every storage drive so he could help any user quickly. We had warned him about such a practice a while back but never was dealt with apparently. So it encrypted 75% of the drives.

DAMN! after the restore do you just plan to wipe out this user's machine and lock them down more (maybe take away admin rights?)

It's a difficult situation. Seeing as he is employed as an admin, taking away admin rights effectively means he gets the boot. He is obviously trying his best to meet the every increasing needs of the people that need his help.

From the post by heymrdj it seems like he was one of few doing it and that he was given a "heads up", but i don't see it as a massive mistake.

Unfortunately these things happen. I don't think i would call it a mega f*ck on the admins part. Sure he should have been more careful while this virus is loose, but i mean these things happen. Thankfully a cold backup was available for a restore!

 

[Chiefcrowe]

Yeah they do happen unfortunately.

Do you know the attack vector? If it was an email attachment is it possible to block those on the perimeter?
I'm also wondering if AV software should block this by now?

 

[cubby1223]

Wow, just saw this one for the first time today. Been a long time since a virus has been destructive. They've all been annoyances for the last 10 years. This changes everything... because this will be copied and used with every exploit found in the future...

 

[cubby1223]

I'm also wondering if AV software should block this by now?

Microsoft Security Essentials definitely does not block this virus yet.

...reminds me to update to the most current version of kaspersky on my own computer...

 

[heymrdj]

It's a difficult situation. Seeing as he is employed as an admin, taking away admin rights effectively means he gets the boot. He is obviously trying his best to meet the every increasing needs of the people that need his help.

From the post by heymrdj it seems like he was one of few doing it and that he was given a "heads up", but i don't see it as a massive mistake.

Unfortunately these things happen. I don't think i would call it a mega f*ck on the admins part. Sure he should have been more careful while this virus is loose, but i mean these things happen. Thankfully a cold backup was available for a restore!

You got it right. He is an admin, basically the onsite IT coordinator/trainer/front line guy. We are the outside engineering/consulting/IT Management firm. Me and him work as a unit, as dealing with contracts this big I'd be constantly filtering printer calls and phone issues instead of working on server upgrades, system efficiency analyzing ect ect. He's a crucial first contact, and an actual employee of the location, so he's the liaison between his company and my company.

He won't be "punished" in any way (like removing admin privileges or mapped drives). He needs that stuff to do his job. Like you said this is just an unfortunate situation. But I have longed prepared for situations like these, and the plan of action has been followed to a T. Critical users were restored within 2 hours this morning, with them being back up to 100% by end of day tomorrow (which is pretty good from 3TB of deduplicated backups). At this point 0 data was lost. We kept good hot backups and cold backups, and in this case thank god for cold backups.

Yeah they do happen unfortunately.

Do you know the attack vector? If it was an email attachment is it possible to block those on the perimeter?
I'm also wondering if AV software should block this by now?

Came in as a false UPS link. He got trigger happy. He was waiting on a RED overnight hard drive shipment for a SAN that was flaking out.

Wow, just saw this one for the first time today. Been a long time since a virus has been destructive. They've all been annoyances for the last 10 years. This changes everything... because this will be copied and used with every exploit found in the future...

That's my worry. I have my contracts basically at threatcon red. Critical file backups are taken every hour. Full backups are run every night, with verifies happening at noon and at end of the full backup. Virus scans run on the arrays and RDS servers every night. I just wonder if we'll ever leave red....

 

[postmortemIA]

Nice article on somebody's experience with "paying up":
http://robpickering.com/2013/10/cryptolocker-an-executive-infection-1420
also contains valid web address with malware - one of temporary C & C servers - for brave enough people

 

[John Connor]

Where's the web address for cryptolocker? I don't see it.

 

[smakme7757]

Where's the web address for cryptolocker? I don't see it.

You have to find the daily Command and Control server.

The easiest way to do that is to find a copy of the virus (easy enough) and run it. Make sure you have Wireshark running in the background and once the virus stops searching for domains you can be pretty sure that the last domain in the list is the C&C server for the day.

 

[delonm]

You got it right. He is an admin, basically the onsite IT coordinator/trainer/front line guy. We are the outside engineering/consulting/IT Management firm. Me and him work as a unit, as dealing with contracts this big I'd be constantly filtering printer calls and phone issues instead of working on server upgrades, system efficiency analyzing ect ect. He's a crucial first contact, and an actual employee of the location, so he's the liaison between his company and my company.

He won't be "punished" in any way (like removing admin privileges or mapped drives). He needs that stuff to do his job. Like you said this is just an unfortunate situation. But I have longed prepared for situations like these, and the plan of action has been followed to a T. Critical users were restored within 2 hours this morning, with them being back up to 100% by end of day tomorrow (which is pretty good from 3TB of deduplicated backups). At this point 0 data was lost. We kept good hot backups and cold backups, and in this case thank god for cold backups.



Came in as a false UPS link. He got trigger happy. He was waiting on a RED overnight hard drive shipment for a SAN that was flaking out.



That's my worry. I have my contracts basically at threatcon red. Critical file backups are taken every hour. Full backups are run every night, with verifies happening at noon and at end of the full backup. Virus scans run on the arrays and RDS servers every night. I just wonder if we'll ever leave red....

I probably don't fully understand the setup here, but in my opinion, no employee should have local (or god forbid, domain) admin rights on their workstation with their normal domain login account. A separate domain account should be used for any administrative work that needs to be done. In addition, an identity based web proxy should also be in place to prevent a support person using admin credentials from being able to connect to the Internet.

It is definitely less efficient to run this way, but over the long haul I think less time is spent cleaning up malware infections and it is possible to better isolate critical systems and data.

Just my $.02.

 

[smakme7757]

I probably don't fully understand the setup here, but in my opinion, no employee should have local (or god forbid, domain) admin rights on their workstation with their normal domain login account. A separate domain account should be used for any administrative work that needs to be done. In addition, an identity based web proxy should also be in place to prevent a support person using admin credentials from being able to connect to the Internet.

It is definitely less efficient to run this way, but over the long haul I think less time is spent cleaning up malware infections and it is possible to better isolate critical systems and data.

Just my $.02.

it doesn't matter if he is logged in as a non-admin user (presuming CL doesn't need admin rights to run) cryptolocker will encrypt every locally available file on the system. Those mapped shares don't even need to be mapped with admin credentials. They just have to be available.



Cryptolocked doesn't try any saved passwords to break in, it just takes what's already there.



*mobilepost

 

[PrincessFrosty]

Well it'd only be able to encrypt and delete files that user had access to, which is their own work and any shared services they have delete access to.

This is why I have our users stored most of their files on a central file server which only they have access to their own stuff, with central shared locations that limited people can use depending on department.

Then everything is backed up nightly on differential backup to another directory that only the admin and backup service have read/write access to, this means it's always possible to recover file from no less than 24 hours ago. We keep months of rolling backups.

Anyone who has important data they're not backing up has more than just viruses to worry about.

 

[postmortemIA]

Where's the web address for cryptolocker? I don't see it.

There was IP address in article. 50. X.x.x server was still active when I tried to access it