Ransomware scammers push panic button with bogus claims

[JMH]

Cyber extortionists shilling "ransomware" have upped the ante by pushing users' panic buttons with claims that their malware will wipe hard drives, a security firm said Monday.

The claim is bogus, said Symantec, and is simply a ploy by scammers preying on people's fears.

"This is an attempt to extort money from computer users by taking advantage of human weakness when under panic and pressure," wrote Symantec researcher Jeet Morparia in a Dec. 24 blog post.

Ransomware is a long-standing label for malware that, once on a personal computer, cripples the machine or encrypts its files, then displays a ransom note that demands payment to restore control to the owner. The technique, flatly called "an extortion racket" by Symantec last month, has been in use for at least six years. Until relatively recently, it was rare and ineffective and seen mostly in Eastern Europe.

Ransomware scammers push panic button with bogus claims - Computerworld

 

[AceInfinity]

Ransomeware therefore very successful... I feel sorry for everyone that this fools, but I really do have to shake my head at things like this, because even time and time again, it only proves that the average computer user really has no clue. The people that come up with these things just laugh. "Ha.. I got them again.."

That's the reason, statistically, for why socially engineered malware today is so successful though. If more people were able to read the tell tale signs, or do some investigation into what they were experiencing online, we could reduce this. For how common it is to find someone that knows nothing about computers, I wish it wasn't so common. However, understanding that perhaps most people don't have the time to fool around with computers as much as most of us on this forum though, there has to be some kind of other solution that doesn't affect people like me who get tired of things like all of the "Be aware", "Are you sure?", etc; Messages and notifications you get while using a computer, all because some people really do need these extra "helpers" when they use a computer. For lots of the technical computer users, it's kind of a slap in the face, like someone having to hold your hand so you can go to the bathroom lol.

I've always hoped to have an advanced option someplace where the more technical computer users could turn these things off because sometimes it just gets too annoying.

Ransomware is just too too successful to be even somewhat comical though, and that's my belief.

I did some investigative work a year or so ago, on a specific ransomeware that would hold your Windows files ransom, because your Windows was "locked":

More information on this one is in this video:

~Ace

 

[Shintaro]

Does any know what attack vector was used to infect the PC with the Ransomware?

 

[AceInfinity]

Does any know what attack vector was used to infect the PC with the Ransomware?

What do you mean? I actually thought this one was a fake Firefox update.

 

[Shintaro]

What exploit was used to get the Ransomware on to the PC? For example was there a MS patch missing? And was it an old exploit that should have been patched?

 

[AceInfinity]

What exploit was used to get the Ransomware on to the PC? For example was there a MS patch missing? And was it an old exploit that should have been patched?

No exploit, just no detection from the AV's, and since the file was an update appearing to be from Mozilla Firefox, it seemed less suspicious, and people ran it on their systems. The original story I'd got for how it first was released was a fake Firefox update file. I don't know anything before that in terms of the history of this trojan.

If you are talking about the Ransomeware in the first post of JMH's... Then I don't know anything about that one. Only the one I posted.

 

[Shintaro]

I thought it might have been a bit more sophisticated than that.
Cheers.

 

[AceInfinity]

I thought it might have been a bit more sophisticated than that.
Cheers.

The usual virus really doesn't do much other than bypass an AV really, and the user's awareness for that matter. Once it's on a system all it has to do (depending on what the virus was created for) is do it's damage, or stay anonymous if it's an information collector.