App Review Should You Be Worried About Ransomware?

[XxX Legolas XxX]

 

[Neno]

If you are worried about Ransomeware, install WinAntiRansome (best soft. for them) Or, don't run every single file, like maniac.

 

[cruelsister]

As we know ransomware (especially Cerber and Locky, the two most common ransomware types currently) are more commonly spread by maladvertising via exploit kits (the most common vectors being Java and Shockwave/Flash) which means that a person does not have to click on anything to get infected by the malware- the script politely will run the malware executable for you (isn't that nice!). Point being that stating not to click an executable and you are safe isn't very true currently.

And, Oh Yeah- it's not user error if an Ad network sells infected advertising to unsuspecting websites; maybe it is time to cast blame in other directions than an innocent user.

 

[Lucent Warrior]

IMO his number 2 "Create external back ups often" is not only common sense, but a failsafe that should be part of everyone's Preventive maintenance they should be employing. If it is backed up, you lose nothing but time repairing the machine "in most cases".

I keep nothing personal on my system, except for when im using it at that moment. For example, if i took my camera out for a shoot, and come home with 200 pictures, they will get uploaded to my computer, and immediately after doing so, i weed out what photos i do not want to keep, and then make copies to place on one of my many flashdrives. Now i will use the originals on the system to edit and upload ect, and then delete them from the system.

Basically, i keep nothing on my system i can lose if something were to happen like Ransomware, or even hardware failure.

 

[JakeXPMan]

As we know ransomware (especially Cerber and Locky, the two most common ransomware types currently) are more commonly spread by maladvertising via exploit kits (the most common vectors being Java and Shockwave/Flash) which means that a person does not have to click on anything to get infected by the malware- the script politely will run the malware executable for you (isn't that nice!). Point being that stating not to click an executable and you are safe isn't very true currently.

And, Oh Yeah- it's not user error if an Ad network sells infected advertising to unsuspecting websites; maybe it is time to cast blame in other directions than an innocent user.

Yes good input sister. I was wondering about how it can infect without clicking anything.

I do think my brother got his from the flash player a few years ago, freaked him out, but I had a feeling something was fake, so I did research and boom, it was a ransomware. I didn't know they existed to be honest until it was on the laptop, but got it working normal again soon, thanks to Malware1. (My first weeks at MT came in handy)

 

[XxX Legolas XxX]

i don't agree what softwares Britec09 recommend. I will recommend : SecureAPlus free,Voodoo Shield free and Comodo firewall free.

 

[hjlbx]

I would be remiss if I did not point out that leaving an external drive connected to system and get hit by an external drives encrypting ransomware - you're beat !

Disconnect all external drives while not in active use or use a utility to deny read\write access (have to disconnect\reconnect drive to enforce policy changes - so people won't use it because it is "inconvenient"... LOL I guess you like your valuable data scrambled).

 

[Lucent Warrior]

I would be remiss if I did not point out that leaving an external drive connected to system and get hit by an external drives encrypting ransomware - you're beat !

Disconnect all external drives while not in active use or use a utility to deny read\write access (have to disconnect\reconnect drive to enforce policy changes - so people won't use it because it is "inconvenient"... LOL I guess you like your valuable data scrambled).

Thats it, im going to take my computer into tha backyard right now and fill it with 45 hollow points and be done with it, then no one is going to mess with my stuff

Seriously though, you are correct and users should not leave their external drives plugged in all the time, i mean really, who does that

 

[hjlbx]

i don't agree what softwares Britec09 recommend. I will recommend : SecureAPlus free,Voodoo Shield free and Comodo firewall free.

VS won't protect against a browser exploit that abuses whitelisted Windows processes to bypass application whitelisting. A ransomware *.tmp will inherit whitelist status from the trusted Windows process run sequence and run unrestricted...

 

[hjlbx]

Seriously though, you are correct and users should not leave their external drives plugged in all the time, i mean really, who does that

I do... but use BiniSoft USB Flash Drives Control.

Save, switch policy, un-\re-connect drive - all (read\write\execute) denied.

Need to allow access, switch policy, un-\re-connect drive - access allowed.

 

[DardiM]

Should You Be Worried About Ransomware?
I am worried when I don't receive e-mail waves

 

[XxX Legolas XxX]

VS won't protect against a browser exploit that abuses whitelisted Windows processes to bypass application whitelisting. A ransomware *.tmp will inherit whitelist status from the trusted Windows process run sequence and run unrestricted...

i don't know about that.This is only for Voodoo or for all softwares I recommend?

 

[jamescv7]

Definitely you should worried on ransomware especially when you do not have any backup.

Number one thing is provide backup software no matter what circumstances; this will build practicality solution rather reformat all the time, at least your data can be accessible.

When we say common sense, people must have proper knowledge against those intrusive scenarios.

 

[shmu26]

VS won't protect against a browser exploit that abuses whitelisted Windows processes to bypass application whitelisting. A ransomware *.tmp will inherit whitelist status from the trusted Windows process run sequence and run unrestricted...

will NVT ERP protect against it? Let's assume for the sake of argument that you haven't whitelisted any parent processes.

 

[hjlbx]

will NVT ERP protect against it? Let's assume for the sake of argument that you haven't whitelisted any parent processes.

You have to have processes whitelisted, otherwise every time the process executes you will get an alert. That will amount to hundreds of alerts during a user session.

It was reported to Andreas, but he has been busy with other projects so I don't know what he decided to do.

 

[shmu26]

You have to have processes whitelisted, otherwise every time the process executes you will get an alert. That will amount to hundreds of alerts during a user session.

It was reported to Andreas, but he has been busy with other projects so I don't know what he decided to do.

in most known browser exploits, the abused process is on the default vulnerable processes list, in which case you should get a prompt from ERP in any case. Is this not true?

 

[hjlbx]

in most known browser exploits, the abused process is on the default vulnerable processes list, in which case you should get a prompt from ERP in any case. Is this not true?

The default vulnerable process list is kinda small - but you are correct. There are other processes that I would add to that list. There is a Vulnerable Process thread here at MT with a downloadable *.xls.

 

[shmu26]

The default vulnerable process list is kinda small - but you are correct. There are other processes that I would add to that list. There is a Vulnerable Process thread here at MT with a downloadable *.xls.

VS prompts for powershell and cscript and wscript, when browser is active. So VS should protect from the most widespread browser exploits.