News for hackers. Stuff that matters.
Re:Cisco's Talos team analysis of WannaCry worm by averagewall on Friday May 12, 2017 @09:13PM (#14329101)
Apart from the invididual victims, ransomware seems like it should have a good effect on computer security overall since it actually harms the people who get infected and motivates them to do security better. Most viruses keep quiet so people don't know or care if they're infected and contributing to DDOSs or spreading to others. I sometimes use computers that have obvious viruses on them, and it the people running them just let it happen because it doesn't stop their work.
Re:Cisco's Talos team analysis of WannaCry worm by mtgx on Saturday May 13, 2017 @01:05AM (#14329601)
Yes. I can't wait until self-driving car ransomware appears.

The amount of rage the customers will feel towards the makers of whatever non-secure self-driving or "connected" cars receive the ransomware should give those car makers a nice kick in the behind to get their act together.

Then we'll see how quick the car makers will be about implementing features such as "unlocking your car remotely from the beach."

Re:Cisco's Talos team analysis of WannaCry worm by wungsten on Saturday May 13, 2017 @01:23AM (#14329643)
I wouldn't say I "can't wait" for car viruses, but I do worry about all the stupid remote/automated features being advertised these days. You just know it's going to be exploited, and cars are at the top of my list of things that should be as safe and secure as possible.
Re:Cisco's Talos team analysis of WannaCry worm by problems on Saturday May 13, 2017 @01:38AM (#14329687)
That mostly boils down to lowering the attack surface.

Individual cars doing their own thing, no problem. Cars talking to cloud, big privacy problem, potential security problem. Cars talking to each other locally, smaller privacy problem, but bigger security problem.

Re:Cisco's Talos team analysis of WannaCry worm by voltagex_ on Friday May 12, 2017 @10:57PM (#14329344)
It seems like very few viruses are "obvious" these days - aside from ransomware. How do you know what you're doing on these computers isn't affected or compromised in that case?
Re:Cisco's Talos team analysis of WannaCry worm by averagewall on Saturday May 13, 2017 @01:35AM (#14329679)
Usually just printing. I find the viruses on my USB drive after printing from it on other people's computers. I keep that drive for one-way use and never get files back off it because they're all potentially infected.
Re:Cisco's Talos team analysis of WannaCry worm by qb45 on Saturday May 13, 2017 @02:38AM (#14329793)
Note that that the pendrive itself is potentially "infected" too, sometimes there are OS and file manager bugs resulting in code execution without the user clicking anything.
Re:Cisco's Talos team analysis of WannaCry worm by averagewall on Saturday May 13, 2017 @08:04PM (#14333595)
Those bugs would be zero-days and patched before viruses using them are widespread.
Re:Cisco's Talos team analysis of WannaCry worm by DanBC on Saturday May 13, 2017 @04:58AM (#14330068)
You put files onto the stick.

You put the stick in someone else's machine and print the files. The stick might be infected after this use.

You don't put the stick back in your machine, because it might be infected.

Do you continue to put it in other people's machines to keep printing?

Re:Cisco's Talos team analysis of WannaCry worm by snaily on Saturday May 13, 2017 @06:23AM (#14330244)
Unlike biological contagions, digital ones typically aren't transferred just by physical touch.

Don't run or open anything off the stick on your machine and you'll be fine.

Re:Cisco's Talos team analysis of WannaCry worm by DanBC on Saturday May 13, 2017 @08:19AM (#14330574)
Windows has had exploits where preview features (eg Explorer thumbnails) were running malicious code.
Re:Cisco's Talos team analysis of WannaCry worm by averagewall on Saturday May 13, 2017 @08:05PM (#14333599)
Of course. Windows has also had RCE vulnerabilities just by being connected to the internet. Hence the need to keep it updated.
Re:Cisco's Talos team analysis of WannaCry worm by dogma1138 on Saturday May 13, 2017 @09:06AM (#14330750)
The stick itself is the virus aka Bad USB or any other similar vector.
Re:Cisco's Talos team analysis of WannaCry worm by averagewall on Saturday May 13, 2017 @06:24AM (#14330247)
I don't do step 3. Viruses hardly ever work that way. An infected computer can infect a USB drive, but not the other way around for an up-to-date OS and if you're careful not to run mystery programs you find on it.
Re:Cisco's Talos team analysis of WannaCry worm by bostand on Saturday May 13, 2017 @06:33AM (#14330266)
Not true...
Re:Cisco's Talos team analysis of WannaCry worm by averagewall on Saturday May 13, 2017 @06:44AM (#14330294)
Can you cite any examples or describe the mechanism it would do that?
Re:Cisco's Talos team analysis of WannaCry worm by paulmd on Saturday May 13, 2017 @07:00AM (#14330339)
USB sticks that can use firmware-level filesystem tables and/or multiple host-visible partitions, pretend to be a hub that is hosting multiple devices (HID mouse+keyboard, etc) in addition to an autorun, etc.

Not only can you trivially make such a thing with an arduino but there are also some commercial USB sticks which have a persistent "background" filesystem that cannot be formatted away.

Anything that is run automatically in the background, like the thumbnail services.

Re:Cisco's Talos team analysis of WannaCry worm by tgsovlerkhgsel on Saturday May 13, 2017 @09:54AM (#14330976)
However, this is rather theoretical. All that common malware does is hide/delete all your existing directories, and put EXEs (or LNKs) with folder icons and the names of the original directories in their place. Plus maybe some autorun tricks.
Re:Cisco's Talos team analysis of WannaCry worm by averagewall on Saturday May 13, 2017 @07:39AM (#14330447)
For a fake HID device, you'd see cmd windows or whatever else it uses popping up. Other data hidden on it isn't a problem by itself. It can only passively sit there without some other attack vector.
Re:Cisco's Talos team analysis of WannaCry worm by tokenizerrr on Saturday May 13, 2017 @07:51AM (#14330480)
Right, but the GP described an USB stick that they own. If you know that it's just an USB stick none of that applies.

Autorun hasn't been a thing in ages.

Re:Cisco's Talos team analysis of WannaCry worm by Franciscouzo on Saturday May 13, 2017 @01:13PM (#14331936)
Except that is not true, there's BadUSB (https://github.com/brandonlw/Psychson), which updates the firmware of some common USB drives to make it do whatever your want (such as emulating a mouse/keyboard).
Re:Cisco's Talos team analysis of WannaCry worm by DanBC on Saturday May 13, 2017 @12:21PM (#14331693)
Re:Cisco's Talos team analysis of WannaCry worm by kore on Saturday May 13, 2017 @07:36AM (#14330439)
Stuxnet
Re:Cisco's Talos team analysis of WannaCry worm by averagewall on Saturday May 13, 2017 @08:03PM (#14333593)
Patched
Re:Cisco's Talos team analysis of WannaCry worm by merb on Saturday May 13, 2017 @09:59PM (#14333855)
that's definitly not the case. I know of two incidents, where they basically didn't invest into more security, "since it won't happen again".
Re:Cisco's Talos team analysis of WannaCry worm by louithethrid on Saturday May 13, 2017 @07:04AM (#14330353)
I think ransomware is a very negative thing. It creates a mafia - protection money for continud functionality relationship - in the long run.
Re:Cisco's Talos team analysis of WannaCry worm by rando444 on Sunday May 14, 2017 @07:00AM (#14335100)
Or encourages people to figure out how to backup their files properly.. something they should be doing anyway.