The Journal of Joe The Peacock. Yay.: A *NEW* for-real ransom virus

6.07.2008:

A NEW for-real ransom virus - please read

3:01 PM

I'm not a tech blogger (on purpose, because god knows we have enough of them out there), but I'd be remiss if I didn't do my part to call attention to this new virus that encrypts your precious data with a 1024-bit encryption key, and demands a ransom be paid to get the decryption key.

Now, this isn't the weaksauce 128-bit version from '06, or the mediumsauce 660-bit key from last year. This one is ALL NEW for 2008, and even though the older versions could be decrypted, this one ain't quite there yet... And might not be there for a while.

Why do I say that? Well... It took Distributed.net 1,757 days across 331,252 individual computers working together to crack a 64-bit RC5 key. This is 1024-bit key on the same algorithm... So yeah. You pony up the dough, or your data's fucked.

The virus apparently infects PCs through unpatched browser exploits. The bottom line... PLEASE update your browser if you're on a PC. My suggestion, of course, is to start using FIREFOX if you're not, and keep it up to date with every new release. Trust me, if you're not using it and see changing as a big pain... It is, but within a week, you'll NEVER go back.

Please, at the very least, move from IE6 to IE7 and set up Windows Update to automatically update your machine. No matter how "evil" you see WGA as being, it's nowhere near as evil as having your sensitive data locked down with some 1024-bit encryption key and having to either a) wait or b) pay a ransom to get at it.

Just checking the stuff on my machine, if I were hit with this thing, This Is Not Art! Productions would be in a WORLD of hurt. Thankfully, with Jeremy's help, I've created a fairly fail-proof backup schema that incorporates Apple Time Machine on a remote drive, rsynch backup between the laptop and desktop, and off-site storage of all data nightly at Mozy.com. Also, thankfully, I don't use PCs anymore. But that's a whole other topic.

Seriously, update your stuff. Don't get jacked.

Labels: technology

* * *

(Permalink)

5 Comments:

Jeremy said...: nice, virus' don't affect me! I use a mac! :P

I'm going to fund this virus maker. I will pay him some money to make it only affect ie6, to get people to stop using that hunk of shit!

So use a browser released in the past 1.5-2 years so we can all stop breaking our fucking websites so they look the same in your browser! Or just go use firefox.; 6/07/2008 7:20 PM
CallieMo said...: Since I do all my browser based stuff in Firefox on Linux now, I feel pretty good about my level of safety. Plus I've got Avast running in my VM that is running Win XP, so I'd hope that they have that covered through that as well. Plus we do backups of the important stuff to the RAID5 Linux box on our network too.

I've coverted my family to the goodness that is FireFox too. It boggles my mind that there are still people who voluntarily use IE for anything now. What rock are they under?; 6/07/2008 7:58 PM
Jeremy said...: i do understand how people stick with ie, especially older people, they've just always used it, it's already built in, and it takes 1/6th the time to actually open up and they're good to go.

i know my father get's sick of waiting for the browser or page to load 1/2 way through typing the domain name. (though thankfully I've finally gotten him out of typing the domain name into the msn search box that pops up :P; 6/07/2008 9:30 PM
Kyle said...: I'm one of the people that sticks with IE (though I do use IE7 now). I understand FF's better overall, and I do have NoScript on it for some extra protection, but still...

What Jeremy said is true. I'm not old (21, heh), but IE's what I've always used (with the exception of a few classes where we used Macs and FF was the only option there). I try to switch over to FF, but...I dunno, I have this mental block over it.

Still, with this news, I may use it a bit more. And get around to backing up at least my important stuff.; 6/07/2008 10:17 PM
CallieMo said...: I guess I'm lucky that we got my parents online almost 12 years ago. They're pretty much old pros now and it's easy to get them to try new stuff. It's so cute that my 70 and 74 year old parents are now teaching their friends (people in the 65-85 year old range) what to do.

I guess I do underestimate how little information about internet safety gets through to the unwashed masses without a geek in their lives. Wouldn't it be lovely if people had to take a short course or something before getting online so that there wouldn't be millions of infected machines on the net being used for nefarious shit?; 6/07/2008 10:18 PM