[mhogomchungu]

I am in Tanzania(East Africa) and my father's computer is infected.

All he did to get infected was plugging his laptop on the network at work(University of Dar Es Salaam).

The laptop is next to me and my task this night is to try to remove this thing.

[devrandomguy]

This malware is well written, and uses strong encryption.

I would suggest that you and your father spend the evening reading up on backup practices, and reconsider the value proposition of open source software.

I hope I am not coming off as a smug jerk. My hope is that rather than becoming frustrated and demoralized after an evening of fruitless hacking, you and your uni will recover, and become resilient against future attacks.

[mhogomchungu]

He has backups of his data.

I personally use linux and my github repo is here[1] where i have a bunch of encryption related projects(zuluCrypt,SiriKali and lxqt_wallet). The last windows computer i used was windows xp.

I dont want to move him to linux because i am not always around and he can ask other people for help when he is on windows.

[1] https://github.com/mhogomchungu

[devrandomguy]

Thank God for backups! And thank you for making sure people make backups.

My mother is in a similar situation. She is an elementary school teacher, and has little time for unrelated endeavors like this. What time she does have, is spent in the garden, as it should be.

Nevertheless, we are now seeing that the time-cost of closed source software, is greater than that of open-source software. My solution has been to prepare a KDE based distro for her, to work with her, side by side, whenever she needs to learn new tools. It is a good bonding experience, when both people can maintain a positive attitude about it.

The solution to the problem of malware, is education.

[AdeptusAquinas]

How quickly some forget heartbleed.

The solution to malware is obscurity. Have an OS that no one wants to break into, and you won't be broken into.

[devrandomguy]

I think you are referring to diversity, not obscurity. Diversity does indeed increase the resilience of the network, but there will always be enough common factors across the board, that diversity alone will not suffice.

In the end, the software that we depend on, must be reviewable by anyone who is concerned about it. A prerequisite for that, is that software should be as small, clean, and simple as possible, to encourage such scrutiny. IIRC, the real problem with heartbleed, is that the OpenSSL codebase was a mess, and no-one wanted to work on it.

[hackuser]

> The solution to malware is obscurity. Have an OS that no one wants to break into ...

... and you'll have an OS for which neither malware authors nor legitimate software developers want to write applications.

There's a trade-off involved. We could all use pen an paper and be invulnerable to malware, but then how would we post on HN?

[AdeptusAquinas]

That's my point, as I type this on fully patched Win 10 Pro.

Certainly Windows has its issues, but it's biggest 'flaw' when it comes to malware isn't that it's closed-source, but that it's ubiquitous and therefore a highly attractive target.

[dpwm]

Heartbleed is a very different class of vulnerability -- it allows sensitive information to leak but does not provide root access.

[edkennedy]

Quick, migrate to TempleOS!

[qb45]

That's rather extreme, I think but Haiku or Windows 98 with IE4 could possibly be quite safe from viruses nowadays, even if not exactly "secure".

[r00fus]

Are macOS or ChromeOS options?

Heck, some of my relatives are good with an iPad for 90% of their online activities.

[tehlike]

Chromeos and everything in browser sandbox with always up to date software sounds pretty solid.

[azernik]

So reinstall the OS from orbit. It's the only way to be sure.

[kevindqc]

I understand that people love open source, but how is that relevant here? For example OpenSSL is open source, yet it didn't prevent Heartbleed and other exploits from happening?

[devrandomguy]

OpenSSL was an example of open source done badly; neither of our communities can claim to be universally perfect. The solution, was to fork and replace OpenSSL with a superior project: LibreSSL. That part of the story, is a success for open source. It shows us recovering quickly and permanently from the worst catastrophe imaginable.

[hackuser]

How widely is LibreSSL used, compared to OpenSSL?

[Kali909]

Working fine on FreeBSD 10 for me, but it's not default yet as far as I know.

My thoughts on the matter are, this is all a pointless waste of time/effort, or otherwise said, an arms race of exploits/bugs that will go on and on and produce nothing of value, except justifying a military budget in various govs.

If they truly were doing their jobs and being of benefit, we wouldn't have the corruption we do, the paedo rings, the drug cartels etc.

To be secure, you have to beat the smartest people on the planet I would have thought, and unless you have a nation's resources, that's tricky. Tightening laws I'm not sure is the answer either, it feels like human nature expressed in Internet terms.

[devrandomguy]

There is no way to know for sure, because we have not embedded telemetry / spyware in open source operating systems.

One of the problems here, is that large organizations are reluctant to update software across a large population of computers. If those updates were smaller, more transparent, and could be separated based on whether they are a security fix, a new feature, or a new tool that allows a 3rd party to monitor user activity, then the sysadmins would be empowered to close security issues quickly, while introducing minimal risk.

[microtonal]

macOS uses LibreSSL:

  % ssh -V
  OpenSSH_7.4p1, LibreSSL 2.5.0

On Linux, at least Alpine is using LibreSSL.

[Retr0spectrum]

From what I've seen, it isn't particularly well written. However, you're probably correct about the encryption being strong.

One of the reasons the infection rates are dropping off is that the malware had some kind of poorly implemented sandbox detection, where it would attempt to resolve a non-existent domain. However, now the domain has actually been registered by a researcher, so now every new infection thinks it's running in a sandbox.

This is the work of someone who doesn't really know what they're doing, and they probably copied a large chunk of the code from somewhere else.

[linkregister]

There is at least one cryptolocker variant that supports Linux.

[dpwm]

Out of curiosity, how does that spread?

I'm intrigued because I've seen people claim that "linux is just as vulnerable as windows to user stupidity," but I have a hard time understanding how. The vast majority of windows infections occur because somebody got tricked into running an executable file.

On every Linux distro I've used, scripts and binaries need the executable bit set or be explicitly run through the desired shell. As far as I know, no browser sets the executable bit on downloads. To run scripts, you need to know what you're doing.

Now,

  curl http://... | sudo sh

is an entirely different problem. As are remote execution vulnerabilities in the kernel. As are adding random package manager repositories found on internet forums. But all seem a bit more technically involved than opening an executable file with a .pdf extension.

[hackuser]

Tip: Don't spend time trying to remove malware and undo its effects. You'll never know if you succeeded; most malware is designed to hide itself, and likely this particular malware is well-written.

Wipe the laptop and reinstall. It's more certain, and probably won't take much longer than trying to remove the malware. If the malware infects firmware or other subsystems below the OS, and thus won't be removed by a reinstall, buy a new laptop if that's an option.

[iagovar]

Just that? No click somehwhere?

[raesene6]

If someone connects to a network which has been infected and they've not applied the appropriate patch (MS17-010) it looks like they're in trouble if they're running Windows and don't have a firewall blocking incoming connections.

So first person in a network has to have fallen for the phishing attack, but once it's in the network it can spread via the ETERNALBLUE exploit.

[crocal]

I confirm that. Once inside network it's a carnage.

[smelendez]

It can copy itself across a network through a vulnerability in SMB, Windows' file-sharing protocol. That's the bug that was disclosed in the NSA leaks. Microsoft released a patch in March, but of course not all computers are patched.

[rhizome]

Clicks are for phishing and trojans, i.e. human vulnerabilities. This is due to an operating system bug, which is a technical vulnerability.

If you can get the right network packets to an unpatched machine, you can infect that machine.