Re:Hack-petya mission accomplished – Petya ransomware decryptor
by eugenekolo2 on Monday April 11, 2016 @08:32PM
(#11476326)
Both are already done.
[1] http://www.symantec.com/connect/blogs/russian-ransomware-aut...
Re:Hack-petya mission accomplished – Petya ransomware decryptor
by leni536 on Tuesday April 12, 2016 @02:17AM
(#11477575)
> so that backups are useless too
It can hardly be considered a backup if it's easily compromised from your every day computer. In a good backup configuration your computer only have read and "append only" privilages for the backup so past snapshots are safe.
Having said that not many people have this kind of config (including me).
Re:Hack-petya mission accomplished – Petya ransomware decryptor
by SmellyGeekBoy on Tuesday April 12, 2016 @05:28AM
(#11478190)
Not sure why you're being downvoted, you make a very valid point.
Re:Hack-petya mission accomplished – Petya ransomware decryptor
by leni536 on Tuesday April 12, 2016 @07:13AM
(#11478538)
I guess it's because this kind of backup doesn't mitigate an ongoing compromise of your machine (much like what the GP talked about). I don't think any backup can protect for that. However a good backup limits the damage to the timeframe of the machine being compromised (if your machine is compromised for 1 day you might only lose that day's new data).
I'm afraid of the moment when they get more clever. Or if they include filesystem drivers that silently encrypt every file... if done right, you can even compromise backups transparently for weeks until arming, so that backups are essentially useless too.