Teslacrypt releases master key

[Solaris17]

IDK if any of the rest of you guys are system/network secop but take a look at this. Thankfully my infrastructure was never hit /hasn't yet with ransomware but take a look at this.

http://www.bleepingcomputer.com/new...al&utm_source=twitter.com&utm_campaign=buffer

holyshit.

 

[Frick]

That sure is interesting and nice, but as noted they're moving to other encyptions anyway. Don't know how big TeslaCrypt was thogh.

Edit: Google says CryptXXX sucks and can be decrypted. Goooooood, because cryptoware is something I genuinly fear. Not that my browser/security habits are bad, but still.

 

[Solaris17]

That sure is interesting and nice, but as noted they're moving to other encyptions anyway. Don't know how big TeslaCrypt was thogh.

Edit: Google says CryptXXX sucks and can be decrypted. Goooooood, because cryptoware is something I genuinly fear. Not that my browser/security habits are bad, but still.

Tesla was one of the bigger ones. I fear it as well. It is very prevalent and we deal with clients all the time that get hit. Though you are also correct in that there are obviously others. The magnitude is a bit bigger than you might think. The article is just now mentioning other variants being explored. But the ecosystem for this kind of infection is already pretty vast. Take a look.

https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml#

They even have variations that are fileless and attack via WMI remotely.

 

[Sasqui]

Wow truth is stranger than fiction!

 

[MrGenius]

My questions are does MBAR work, and should I install it?
http://www.bleepingcomputer.com/download/malwarebytes-anti-ransomware/

Seems like the only real/100% working solution to any of it is to make frequent backups on an external drive/storage system.

 

[Solaris17]

My questions are does MBAR work, and should I install it?
http://www.bleepingcomputer.com/download/malwarebytes-anti-ransomware/

Seems like the only real/100% working solution to any of it is to make frequent backups on an external drive/storage system.

Thats a tough question, MBAR and MBAM do pickup some of the variants, but they really are pumping them out. Definitely cases of being missed. The biggest issue we and Users are facing is that the bread and butter of the crypto malware is that they have the ability and are programmed to search connected drives and UNC paths so they also hit network shares. Unfortunately having something on a separate drive isn't 100% safe any more. Unless of course you disconnect it after you backup.

 

[MrGenius]

Unless of course you disconnect it after you backup.

Yeah, that's what I meant by that really. I'm mean that's what I do. As soon as the backup completes I unplug the drive and put it in safe keeping. I realize they can get at your other stuff too, if you don't do it like that.