Subway SF Hit par Cryptom HDDCryptor Ransomware - Les passagers voyagent gratuitement - Comment, Forum sur la sécurité PC et la technologie | SensorsTechForum.com
Suppression des menaces

Subway SF Hit par Cryptom HDDCryptor Ransomware - Les passagers voyagent gratuitement

1 Star2 Stars3 Stars4 Stars5 Stars (Pas encore d'évaluation)
Loading ...

san-francisco-métro-frappé par ransomware-sensorstechforumCe que les chercheurs croient être une variante de la famille HDDCryptor malware notoire a frappé le système de métro Muni de San Francisco. Le hack a donné lieu à plus de 2,000 systèmes deviennent compromis et leurs disques durs à chiffrer. The ransomware displayed a short message on boot screen, linking to the e-mail cryptom73@yandex.com. Puis, the cyber-criminals demanded over 73 thousand dollars to be paid as a ransom to restore access to the systems on the subway. This is yet another case of how IoT (Internet des objets) can impact our daily lives.

Menace Résumé

Nom

Cryptom

TypeRansomware
brève descriptionLe malware crypte le disque dur de l'utilisateur avec un mot de passe personnalisé, refusant tout accès à ce. Il demande 100 le paiement de la rançon BTC pour envoyer un mot de passe pour le chiffrement.
SymptômesLe démarrage du système affiche la note de rançon suivante – You Hacked, ALL Data Encrypted, Contact For Key (cryptom27@yandex.com) ID:”
Méthode de distributionVia un kit Exploit, attaque de fichier Dll, JavaScript malveillant ou un lecteur par téléchargement du malware lui-même d'une manière obscurcie. Malicious executables may be the initial infection but is reported to further spread using worm-spreading features (automatique)..
Detection Tool See If Your System Has Been Affected by Cryptom

Télécharger

Malware Removal Tool

Expérience utilisateurInscrivez-vous à notre forum Discuss Cryptom Ransomware.
Outil de récupération de donnéesWindows Data Recovery Stellar Phoenix Avis! Ce produit numérise vos secteurs d'entraînement pour récupérer des fichiers perdus et il ne peut pas récupérer 100% des fichiers cryptés, mais seulement quelques-uns d'entre eux, en fonction de la situation et si oui ou non vous avez reformaté votre lecteur.

The Cryptom Ransomware Attacked Different Systems

Not only systems within the Municipal Transport Agency of San Francisco’s subway were infected. The ransomware managed to impact many other related systems as well, tels que les ordinateurs administratifs, systems for payment, ordinateurs de base de données SQL, terminaux et kiosques. The malware has most likely been coded by someone with experience because it had a worm-like capability to spread across different types of devices, suggesting the sophistication behind it. Not only this but other computers, even including Macs and other PC’s were also hit, augmentation du nombre d'appareils infectés à environ 8,500.

What Does Cryptom Ransowmare Do

The goal of Cryptom is to generate profit at the user’s expense. The attack by the virus may portray a worm-like behavior, which means it spreads from an infected device to an infected device, raising some serious security issues in various IoT devices.

After infecting a given machine, the ransomware does not just encrypt the files on the compromised device. Plutôt, it focuses on performing various tasks oriented with attacking the MBR (Master Boot Record) which if overridden, allows it to directly encrypt the SSD or HDD on the compromised device.

After this encryption process is complete, the ransomware generates a unique unlock key via it’s encryption mechanism which will allow for the successful deciphering of the encrypted data. And Cryptom finally generates a boot message saying the drive is encrypted:

ransom-note-cryptom-ransomware-sensorstechforum

The Origins of HDDCryptor

Similar to other HDDCryptor variant, Mamba Ransomware, Cryptom may exhibit the same behavior. The sole idea for this specific file encryption malware is using coding skills to generate a sophisticated ransomware virus by taking the source code from open source program, connu comme DiskCryptor which is originally used for protection of hard drives.

It is believed that not only the ransomware creates multiple files on the main logical drive of the infected computer, but it also uses those files to obtain administrative privileges. This is used most likely for Cryptom to create a new user on the compromised device and then most likely use the following ciphers to encrypt the hard drive:

  • AES-512 encryption algorithm
  • XTS encryption mode

What is The Impact

Thousands of devices in the SF subway and bus network were rebooted with the ransom message on them. Upon contacting the e-mail address the cyber-criminals responded that their software infects automatically and they did not expect any ransom to be paid. But either way they demanded the insane ransom amount of approximately 100 BTC for the payoff.

The impact of this infection is that the SF public transport organization was pushed into opening the gates for access to the subway, allowing everyone to ride for free.

Cryptom Ransomware – Predictions, Protection et retrait

Given in consideration that cities, like San Francisco’s transport system is interconnected, this is what allowed for the Cryptom virus to spread so quickly. Even the cyber-criminals have admitted that this was not their initial target. Cependant, we could be seeing more and more ransomware attacks on interconnected devices impacting our daily life, like ATM’s, des caméras de sécurité, parking meters and every other device with an OS and a screen belonging to the same network.

Dans le cas où vous avez été infecté par ce virus ransomware, we urge you to be extremely careful in what you are doing. HDD encryptors have been around for quite some time and viruses, like “Petya” and “Mischa” have proven that they work. As soon as you see the ransom note, the first step we advise you to take is to unplug your HDD from the device immediately. To learn how to do this, you can follow our instructions (étape 1 avancer d'un pas 3 in the “Decryption Phase”) in the article below:

After extracting the hard drive, it is recommended to not tamper with it in any way and wait until malware researchers come up with a solution, immediately after which we will update this article with a web link to the solution itself.

In the mean-time the best thing you can do to increase protection is to make a system consisting of protection tools and a security oriented behavior. Here is what we suggest you to do:

1. Read our ransomware protection tips.
2. Lis our research on how to safely store your files to protect them from ransomware viruses in general.
3. Télécharger un outil anti-malware avancée that will help increase general malware and exploit protection:


See If Your System Has Been Affected by Cryptom

Télécharger

Outil de numérisation Malware


4. Télécharger le Talos’s tool which aims to protect the MBR from ransomwareand other viruses.

avatar

Ventsislav Krastev

Ventsislav a couvert les derniers logiciels malveillants, développements logiciels et plus récent technologie à SensorsTechForum pour 3 années. Il a commencé comme un administrateur réseau. Ayant obtenu leur diplôme et marketing, Ventsislav a aussi la passion pour la découverte de nouveaux changements et les innovations en matière de cybersécurité qui deviennent changeurs de jeu. Après avoir étudié la gestion de la chaîne de valeur et d'administration réseau, il a trouvé sa passion dans les cybersecrurity et croit fermement à l'éducation de base de chaque utilisateur vers la sécurité en ligne.

Plus de messages - Site Internet

Suivez-moi:
Gazouillement

Laisser un commentaire

Votre adresse de messagerie ne sera pas publiée. Les champs obligatoires sont marqués *

Délai est épuisé. S'il vous plaît recharger CAPTCHA.

Partager sur Facebook Partager
Loading ...
Partager sur Twitter Tweet
Loading ...
Partager sur Google Plus Partager
Loading ...
Partager sur Linkedin Partager
Loading ...
Partager sur Digg Partager
Partager sur Reddit Partager
Loading ...
Partager sur Stumbleupon Partager
Loading ...