Question about CryptoLocker

[alluseridsrejected]

How do you manage to ensure your backup devices do not stay connected to your servers?

For NAS devices, delete mapped drives or just allow read only. Specify specific user credentials within your backup software.

DAS or USB drives that get rotated offsite, no change. I have a couple of customers that have DAS or USB that don't get rotated. I am looking for suggestions and have let the customer know they are currently vulnerable. One bought a NAS. Suggestions anyone?

What backup systems are you using?

Mostly Freenas and ShadowProtect. I just signed up with Datto but have not deployed any boxes yet. They tell me they use ZFS and snapshot in their boxes. For cloud backup, mostly Jungledisk.

 

[RegEdit]

Do we know for sure the most common way it is getting in?

I know that my client who got zapped, opened a .zip file.

Would it make sense to block all .zip files on the clients exchange or hosted spam filter? Or is this getting through another way?

I think that zip files are uncommon enough that any inconvenience would be worth the security.

And was there a .exe file that they double clicked once they unzipped it?

 

[drjones]

And was there a .exe file that they double clicked once they unzipped it?

I guess so but I'm not sure unfortunately.

 

[RegEdit]

Whoever wrote this virus does not speak English very well. They massacred the English language, as is often the case. I'm guessing it's someone from Russia or China.

 

[ComputerRepairTech]

Whoever wrote this virus does not speak English very well. They massacred the English language, as is often the case. I'm guessing it's someone from Russia or China.

Male, russian, Late 20's early 30's

thats my guess.

 

[SAG]

Whoever wrote this virus does not speak English very well. They massacred the English language, as is often the case. I'm guessing it's someone from Russia or China.

Male, Czech Republic, Late 20's early 30's

thats my guess.

Or Kentucky.

 

[SilverLeaf]

Or Kentucky.

Dammit SAG, you done found me out! Guess I better hurry and catch that plane to Belize. I wonder if John MacAfee's old place is still available?

 

[SAG]

Dammit SAG, you done found me out! Guess I better hurry and catch that plane to Belize. I wonder if John MacAfee's old place is still available?

You're from Western Kentucky though, I grew up in Eastern (Breathitt)... I still have trouble trying to figure out what some of my family members are saying.

 

[SilverLeaf]

You're from Western Kentucky though, I grew up in Eastern (Breathitt)... I still have trouble trying to figure out what some of my family members are saying.

Louisville is as far west as I can lay claims to. Currently residing in Rockcastle County. I also spent several years just outside of Corbin....and yeah, there have been times when I almost needed a translator.....occasionally resulting in some somewhat humorous miscommunications.

 

[ITMAN]

I use sophos and by default quarantine all emails with .zip attachments or multiple attachment extensions eg .zip.exe

 

[RegEdit]

Male, russian, Late 20's early 30's

thats my guess.

That means he'll never be caught. Like Pakistan protecting Bin Ladden.

 

[ComputerRepairTech]

hes probably one of the 12 kazakhstan ip addresses seen by the sinkhole: http://www.checkpoint.com/threatcloud-central/articles/index.html

would be hilarious if i guessed right.

 

[JustInspired]

hes probably one of the 12 kazakhstan ip addresses seen by the sinkhole: http://www.checkpoint.com/threatcloud-central/articles/index.html

would be hilarious if i guessed right.

" In order to measure the scope and velocity of Cryptolocker in the wild, the Check Point malware researchers deployed a live Internet server and registered several of the pre-computed domains, expected to be used by the malware. "

Huh? I'm confused. How do you register domains for this purpose? Wouldn't they already be registered by the bad guys?

 

[ComputerRepairTech]

" In order to measure the scope and velocity of Cryptolocker in the wild, the Check Point malware researchers deployed a live Internet server and registered several of the pre-computed domains, expected to be used by the malware. "

Huh? I'm confused. How do you register domains for this purpose? Wouldn't they already be registered by the bad guys?

Im sure they register a few in advance but i doubt they do months in advance.

 

[cyde_ePhex]

Or Kentucky.

Thanks, now I just sprayed Red Bull all over my screen.