TeslaCrypt ransomware now impossible to crack, researchers say

[Borg 386]

More reason then ever before to make back ups.

The latest version of the TeslaCrypt ransomware has tidied up a weakness in previous versions that in some cases allowed victims to recover their files without paying a ransom.

Cisco’s Talos research group found that TeslaCrypt 3.0.1 has improved its implementation of a cryptographic algorithm making it impossible now to decrypt files.

“We can not say it loud and often enough, ransomware has become the black plague of the internet,” wrote Andrea Allievi and Holger Unterbrink, both security researchers with Cisco, in a blog post on Wednesday. “The adversaries are modifying and improving it in every version.”

TeslaCrypt ransomware now impossible to crack, researchers say | PCWorld

 

[spencer1]

Will a simple image restore (with an untainted image, of course) wipe out the ransomware?

 

[Brds7t7]

Will a simple image restore (with an untainted image, of course) wipe out the ransomware?

Yes, but depending on how you have your personal files stored it may not be able to retrieve them.
If all your personal data is on C: then a full system image restore will restore your files.
If, like me, you keep your files on D: and you didn't include that in the image, then it wont restore those files to an un-encrypted state. You would need to restore those from a backup/shadow copies.

 

[UsernameIssues]

You would need to be sure that the image file does not get encrypted or deleted. Some users automate the imaging process and have an external drive connected all of the time. NTFS permissions might be enough to stop the ransomware from doing things to images on the external drive... but there is still some risk.

 

[spencer1]

Hopefully, I'm good. I keep the backups on external drives that are only connected to my PC during backups/restores. Could ransomware mess with an image restore performed from a WinPE bootable CD?

 

[Brds7t7]

No, not at all. Only if booted into the main OS. If you're extra cautious, the best thing would be to remove the ransomware infection before connecting up any drives to do the restore.
I don't even keep my WinRE repair tools on the C: drive, I keep them on a separate partition.

 

[mjf]

External bakups/images/clones will get you back in business. But of concern to me would be how the ransomware got onto the PC in the first place and avoid it happening again in the near future.

 

[Brds7t7]

Yep, it's best just to keep those nasty viruses off your PC in the first place. Cryptoprevent has worked well for me so far.

https://www.foolishit.com/cryptoprevent-malware-prevention/

 

[UsernameIssues]

...how the ransomware got onto the PC ....

By visiting "dodgy" websites with compromised Flash based adverts - like BBC, Yahoo, MSN

Major sites including New York Times and BBC hit by 'ransomware' malvertising | Technology | The Guardian

Nothing to click on. No user actions required. Just Flash doing its thing.

 

[Brds7t7]

Ah the wonders of flash. Will there be many people mourning it's eventual demise?
I haven't had flash or java installed on any of my systems for over a year now and can't say I miss either of them.

 

[UsernameIssues]

Ah the wonders of flash. Will there be many people mourning it's eventual demise?
I haven't had flash or java installed on any of my systems for over a year now and can't say I miss either of them.

Then your infection vector might be your PDF reader... but that takes users actions to open a malicious PDF.

I still use Flash to watch streams...

...watching an old movie now

 

[RoasterMen]

I've just had my Java plugin enabled just to check if my codes work. Does YouTUbe still require Flash? They should be using HTML5 right now, Flash makes me uncomfortable.

 

[Brds7t7]

I've just had my Java plugin enabled just to check if my codes work. Does YouTUbe still require Flash? They should be using HTML5 right now, Flash makes me uncomfortable.

YouTube is using HTML5 now.

 

[RoasterMen]

I've just had my Java plugin enabled just to check if my codes work. Does YouTUbe still require Flash? They should be using HTML5 right now, Flash makes me uncomfortable.

YouTube is using HTML5 now.

Weird...I've reinstalled Windows 7 on my friend's PC and has still asked for Flash. I've wondered if it's just finding it but not using it.

 

[HAVOC]

If my files are backed up to D or even E (separate HDD, not a partition on C) will they be encrypted?
What about backups that are on my NAS (always connected to my network)?

I practice safe browsing and never open questionable PDF's or emails. I do have flash and Java installed. Should I uninstall them both?

 

[Brds7t7]

Ransomware can affect any drives that are connected to the network. It can Encrypt files on any drive that are connected to the PC that gets infected.
I see no need to have either flash or java installed anymore, unless you have a specific piece of software which uses it.

 

[Brds7t7]

I've just had my Java plugin enabled just to check if my codes work. Does YouTUbe still require Flash? They should be using HTML5 right now, Flash makes me uncomfortable.

YouTube is using HTML5 now.

Weird...I've reinstalled Windows 7 on my friend's PC and has still asked for Flash. I've wondered if it's just finding it but not using it.

Strange! As far as I know HTML5 has been the default on YouTube since Jan 2015.

I just opened YouTube up in IE (which I never use and doesn't have flash) and all the videos are playing fine.
I usually use Chrome which has it's own Sandboxed Pepper Flash.

 

[UsernameIssues]

Ah the wonders of flash. Will there be many people mourning it's eventual demise?
I haven't had flash or java installed on any of my systems for over a year now and can't say I miss either of them.

Then your infection vector might be your PDF reader... but that takes users actions to open a malicious PDF.

I was thinking about the way I set up computers. I don't allow PDFs to automatically open. By default, some PDF readers (like Adobe's and Chrome's) would open a PDF inside of a browser. The only action required by the user is to visit a website. Depending on ones settings, opening a PDF outside of a browser might only require visiting a website too.

 

[HAVOC]

I uninstalled Adobe flash and Java. I also installed Google Chrome.

 

[HAVOC]

What do these cryptoprevent programs actually do?