New Ransomware Written Entirely In JavaScript (scmagazine.com) 96
An anonymous reader writes: Security researchers have discovered a new form of ransomware written entirely in JavaScript and using the CryptoJS library to encode a user's files. Researchers say the file is being distributed through email attachments, according to SC Magazine, which reports that "Opening the attachment kicks off a series of steps that not only locks up the victim's files, but also downloads some additional malware onto the target computer. The attachment does not visibly do anything, but appears to the victim as a corrupted file. However, in fact it is busy doing its dirty work in the background. This includes deleting the Windows Volume Shadow Copy so the encrypted files cannot be recovered and the ransomware is set to run every time Windows starts up so it can capture any new information."
"It's a little bit unusual to see an actual piece of ransomware powered by a scripting language," one security executive tells the magazine, which suggests disabling e-mail attachments that contain a JavaScript file.
"It's a little bit unusual to see an actual piece of ransomware powered by a scripting language," one security executive tells the magazine, which suggests disabling e-mail attachments that contain a JavaScript file.
Re:Disabling attachments is not enough (Score:5, Funny)
That will help, but a more effective strategy is to find the breaker box and flip them all off and stuff.
However, be aware that the FBI can, and does, monitor the water flowing up to your house for subtle vibrations caused by voices and footsteps.
They do the same thing with natural gas.
They even put vibration sensors on the cable, telephone, and electrical lines that physically attach to your home from that pole out there.
The only real solution is to move out.
They will know you did, though.
Re: (Score:2)
very OLD to be first (Score:5, Informative)
https://it.slashdot.org/story/... [slashdot.org]
Sand fucking box (Score:5, Interesting)
Why do browsers and email programs have -any- access to anything? Sandbox the fuckers and call it a day. The fact that they aren't is a sign that companies aren't concerned enough about the problem.
Re: (Score:2, Interesting)
What you want is already available. Meet Apparmor. [wikipedia.org]
That people don't use the available tools is a separate problem. There are a range of things from apparmor to lightweight paravirtualizers like lxc [wikipedia.org]. The right place to address this isn't in every single individual tool like an emailer or web browser that can connect to the nextwork, it's in orthogonal tools to solve the problem in one place.
Do one thing, and do it well.
If people don't use the tools they have, that's not the fault of the tools.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
AppArmor is a bit of a pain in the ass since it is mostly a whitelist thing, when it might be better to be able to do something more like IPCHAINS. Currently it creates an allow set and then subtracts the entire deny set from the allow set. What is really needed is an ideny or inline deny type rule for ascending or descending precedence of allow and deny rules. Sometimes you might want to alternate permit and deny permissions in descending or ascending precedence. Believe me, lacking this makes it much hard
Re: (Score:2)
Because at work the client and my coworkers will complain their Cisco secured mail which requires TLS 1.0 turned on! ... will not work without java and javascript with insecure encryption enabled for security apparently.
Re: (Score:2)
Okay but what executes js externally to mail? (Score:2)
Surely Javascript gets sent to the browser. And doesn't the browser prevent it accessing the file system?
Re: (Score:2)
HTML gets sent to the browser. Javascript gets sent to WScript.exe...
Re: (Score:1)
And so we get to the cause of the problem.
Windows and Microsoft.
Why isn't the downloaded file tagged as "downloaded from the internet". This seems to be a capability that Windows has.
Why doesn't wscript.exe look for that and refuse to run the script or run the script in a locked down sandbox. Although I guess Windows would just pop up a "Run this malware as administrator? Yes / Yes" UAC box anyway.
The sooner that operating systems containerise every application the better. Limit the damage - I'd rather eras
Re: (Score:2)
What if I want to attach a file to a piece of email?
Re: (Score:2)
Not sure why you think this applies here.
This isn't automatically running Javascript inside the browser or the email program. This attack is about tricking the user in running an attachment.
Which means in this case it would use Windows Scripting Host to execute the Javascript (could have been VBscript as well). Could have been a Powershell file or whatever, exe-file, it doesn't matter.
Kind of expected they included an encryption library, if it's running in Windows Scripting Host they could probably just hav
Not as complex as you suggest (Score:2)
Outlook not so good.
Clicking on the subject is enough to open the email and "helpfully" run the script via Internet Explorer.
Absolute fucking insanely bad software design is why we are living knee deep in a malware swamp beyond the dreams of bad science fiction.
Re: (Score:3)
Re: (Score:1)
no, it's a sign that they profit from delivering their customers to criminals
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Why do browsers and email programs have -any- access to anything? Sandbox the fuckers and call it a day. The fact that they aren't is a sign that companies aren't concerned enough about the problem.
You missed the point. They *ARE|* concerned about the problem: they need to keep it a problem, so they can sell a solution to corporations.
Believe me, they are deeply concerned about the survival of their business model.
technical literacy is lacking. (Score:4, Insightful)
What has it been, maybe three decades of this kind of thing? At some point, do we expect people to develop enough technical literacy to avoid this kind of problem?
Note that I'm not saying it is the user's fault. It is the fault of the people writing the ransomware, pure and simple. But it's like walking through the bad part of Philly at night flashing bling all over and being visibly drunk. Yes, it's the muggers fault when you get mugged... but it is still worth pointing out that maybe your choices made your risk be higher than it had to be.. That is not "victim blaming". It's victim helping.
Since malware has been around for a long time, it's pure wishful thinking to imagine it's going away any time soon. So, you have to protect yourself.
Running executable and/or scripted email attachments from NigerianPrice204@notmalware.ng or ThisIsBeckyFromAccounting@No.Really is not how you protect yourself. It's been 30+ years of this. The details change, but the problem remains. Maybe it's time for people to start learning.
Re:technical literacy is lacking. (Score:5, Insightful)
things change, things stay the same (Score:1)
Another reason to hate javascript (Score:1, Troll)
Re: (Score:1)
Linux/osx is not dumb enough to make it easy to run an attached javascript file. It can be done, but those who knows how, also knows not to run any sw they get from strangers in the mail.
Seriously, nobody need ability to easily execute stuff that came in the mail. Especially not those who don't understand the implications. So it is not made easy.
Also, even when you succeed in tricking a linux user, the software can't reliably take over the machine. It may still ransom stuff in his account, but the infection
Re: Another reason to hate javascript (Score:2)
Nothing to do with JavaScript. It might as well have been vbscript.
The problem is the MUA allowing you to launch executable Windows script host attachments.
Re: (Score:2)
Hush. He's a nerd with an axe to grind against a certain language. Don't pop his delusional bubble.
Re: (Score:1)
Give it a few days. This is the last place I go to for actual news.
Re: (Score:2)
A Star Trek actor died, and there's no post?
Did you submit a story about it? That's how Slashdot works...
Re: (Score:1)
Walter Koenig is alive and well.
But does it run on Linux? (Score:2)
But does it run on Linux?
Looks like JScript (Windows only).
What is the point... (Score:2)
Re: (Score:3)
Squpid Q (Score:3)
Re: (Score:2)
We need to arrest all JavaScript developers (Score:1)
Faulty software (Score:2)
Either the mail client executes JS with access to full filesystem, or it passes it to the browser that does it.
Clearly there is a sin here: executing non trusted JS with filesystem access. What are the faulty softwares that do this? No names are given here.
FUD - Not Entirely True (Score:1)
This isn't entirely true. The initial dropper uses Javascript. This dropper contains a second-stage in base64-encoded form. The initial dropper than loads the second-stage on the target machine. The second-stage is not in JavaScript, only wrapped in it. This is merely FUD.
Re: (Score:2)
Have these people ever actually written a stable piece of code they would be willing to stake their life or the life of a close relative on?????
If "mother-in-law" counts as a close relative...
Re: (Score:2)
There is a hole in the sandbox. It only requires the user to save the file to disk and agree to run it locally.
Javascript is the new Emacs (Score:2)
A new form of ransomware .. (Score:1)
Revisit synthesis (Score:3)
A long white back, for a PhD project, a guy named Alexia (or previously Henry, the name the thesis was submitted under) Massalin, wrote an OS kernel called Synthesis. The aim there was to improve efficiency by using runtime code synthesis. In the modern world, along with sandboxing using processes and memory protection, given that we now have LLVM, it would be worth someone exploring an OS where binaries are more akin to the LLVM representation (or some high level representation), and importantly, there is no static list of kernel syscalls: rather at install time, a list of required syscalls is compiled, and possibly custom versions synthesised so that the process is restricted, at the binary level, to what it can access. Something like that. If you look at the system calls a process makes, how many of the available ones does it use? And of the calls that modify files, or use network sockets, how much of the potential of those calls actually gets used? What I am suggesting is basically using LLVM to enforce something close to the principle of least authority at the kernel syscall level using code synthesis.
Re: (Score:2)
They already tried that. It was J2ME - and each mobile builder locked the thing the way they could in order to protect their lawn.
On the Desktop, J2SE and J2EE tried something like that, but the outcry from the userbase that suddenly saw they poorly configured servers breaking down, even after years of advices about what would be coming killed the concept.
The security problems we have nowadays are not a technical problem. It's a human problem. "We" *WANT* things as we have nowadays.
Simple solution (Score:1)
A solution that would greatly reduce those kind of problems:
All installable programs should be only available thru a signed repository or store.
The only process able to install programs should be the Store application
No code should be allowed to execute if it hasn't been installed using the Store app.
All app should be sandboxed
That would solve tousand of security problem. But that would also break security software industry. Look at iOS and how many antimalware, antivirus and such exists? None. The process
Re: (Score:1)
One can imagin an open solution. /opt or /usr/local could still be used by developpers for testing their app.
If I take the example of Linux, repositories could be signed by distro vendors, then SELinux could be configured to only allow the package manager to install software in system-tree.
and (for linux at least), the enforcement could be disabled by experienced users.
Why the hell on widown, no software repository exists yet? We had a few attempts in the past like google updater, but all have disapeared si
Why is Ransomware the new thing? (Score:2)
Disposable operating systems - landfills be damned (Score:2)
We need a computer that can easily be discarded when it is too much trouble to clean, like plastic forks.
Good (Score:2)
good, now websites will be forced to present a version of themselves which is still usable without JavaScript.
What did that poll say, a quarter of /. readers surf with JavaScriopt disabled by default. God knows I do.
Sad to say, at some point around 2013 it became less about what the web could do for me and more about what the web could do to me.