Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #3743 > unrolled thread

Gameover Zeus and Cryptolocker - odd warning

Back to article view | Back to comp.misc

Contents

  Gameover Zeus and Cryptolocker - odd warning "James Harris" <james.harris.1@gmail.com> - 2014-06-18 17:24 +0100
    Re: Gameover Zeus and Cryptolocker - odd warning Andy Burns <usenet.feb2014@adslpipe.co.uk> - 2014-06-18 18:06 +0100
    Re: Gameover Zeus and Cryptolocker - odd warning polygonum <rmoudndgers@vrod.co.uk> - 2014-06-18 21:48 +0100
    Re: Gameover Zeus and Cryptolocker - odd warning David Harmon <source@netcom.com> - 2014-06-18 16:12 -0700

#3743 — Gameover Zeus and Cryptolocker - odd warning

According to 
http://news.sky.com/story/1274201/cyber-attack-to-hit-in-next-two-weeks

British investigators have been working with the FBI to trace the hackers 
behind ongoing attacks, and the botnet system used by the targets has been 
temporarily disrupted.

But the UK's National Crime Agency says people have just two weeks before 
the system could be functioning again, and urged people to protect their 
computers from an expected "powerful computer attack".

-- end of quote

Does that sound credible to you? Is it credible that disruption to a botnet 
system could be expected to last a projected period such as two weeks?

Too, the news article says: "The NCA is urging people to back up important 
files." If Crptolocker has encrypted them what's the point of advising 
people to back them up? Wouldn't the backed-up copies also be encrypted?

The whole story seems implausible. Is it a hoax?

James

[toc] | [next] | [standalone]

#3744

James Harris wrote:

> Is it credible that disruption to a botnet
> system could be expected to last a projected period such as two weeks?

Maybe they know how it calculates which domains it'll contact for C&C on 
a given day and had pre-registered a few weeks worth of the ones it 
would try, thereby buying some breathing space?

[toc] | [prev] | [next] | [standalone]

#3747

On 18/06/2014 17:24, James Harris wrote:
> If Crptolocker has encrypted them what's the point of advising
> people to back them up? Wouldn't the backed-up copies also be encrypted?

It would be a waste of time backing them up after they have been 
encrypted, I agree. Though it might be a good idea to do so before they 
are encrypted.

I was involved in a relatively minor infection some time ago. A single 
computer on a network had become infected and started to encrypt some 
files on a server. However the various blocking mechanisms in place 
prevented the full fury being unleashed so no demand appeared. Initially 
it looked as if the server had suffered a storage malfunction - and the 
files were simply restored from backup. Next day, when the same files 
were trashed again, it became clear what had caused it. Re-restore the 
files and clean the affected PC - all was well.

The way in which Crytolocker works requires a mechanism for passing the 
encryption key to a secure location and then delivering it back when the 
ransom has been paid. Strikes me that disruption to that process could 
easily be the thing that could only be achieved for a brief period. Once 
the owners realise what has happened, they will move the servers.

-- 
Rod

[toc] | [prev] | [next] | [standalone]

#3751

On Wed, 18 Jun 2014 17:24:48 +0100 in comp.misc, "James Harris"
<james.harris.1@gmail.com> wrote,
>Too, the news article says: "The NCA is urging people to back up important 
>files." If Crptolocker has encrypted them what's the point of advising 
>people to back them up?

Dude, do your backups *before* you have a problem.

>

[toc] | [prev] | [standalone]

Back to top | Article view | comp.misc

csiph-web