Middle Tenn. sheriff pays ransom for files held hostage by malware

AP via Johnson City Press ^ | November 13, 2014

[don-o]

DICKSON, Tenn. — The Dickson County Sheriff's Office in Middle Tennessee ended up paying a ransom after a malicious computer program blocked access to their files.

Detective Jeff McCliss told WTVF-TV that malware on a computer locked the agency's case files, which included autopsy reports, witness statements and crime scene photos. He says the malware, called "Cryptowall," doesn't tamper with files on a computer, but keeps them locked until a ransom is paid.

[HiTech RedNeck]

Is it simply automated copies of what they got on paper or independent media? I guess he could have it all re-scanned. Putting it on a computer that is hackable has just opened up a pandora’s box for all manner of evidence past and future. Cases could get tossed out. Lawyers are grinning.

[Cats Pajamas]

This bastard crypto virus hit my computers Halloween night. Took out all my email. Looks like hieroglyphics. I just got everything back up, spent the last two weeks downloading my backup. Found a demand on my hard drive for $500 bitcoins before wiping the drives. They can pound sand before I pay. I will shut down my business and go on welfare before I would pay extortion. My emails that were scrambled are still gobblygook. I would like to be alone with whoever is responsible. I can’t even say what I really want to say. My daddy raised a good Christian girl.

[billhilly]

I don’t think you missed it. I was just being a smart a—.

[SoConPubbie]

I don’t think you missed it. I was just being a smart a—.

You?? Surely you jest!

[Buckeye McFrog]

I betcha Barney Fife never backed-up his hard drive either.

[billhilly]

The election is over, and as far as I’m concerned, so are you.

[Georgia Girl 2]

That’s what I use also.

[Harold Shea]

Think someone clicked something they shoundn`t have.

My understanding it copies the original then encrypts

it then deletes the original generates a key you must buy.

[BwanaNdege]

"There should be a bounty on the heads of authors of cryptolocker and similar ransom-ware. A lamppost is too good for them."

Heads on a pike staff in front of the COMDEX, DEFCON, etc main venues.

[DUMBGRUNT]

Had that screen come up two weeks back!

Crap! I can install a new system in about 20 minutes with a quick link. Bound to lose some settings and recent work...

With dual monitors one for work and the other to waste time at FR. That may be a bad idea?

Closed all the programs took a look around ran a virus check everything AOK!

THANK YOU LINUS TORVALDS!!!

[conservatism_IS_compassion]

Must have been a Mac; I’m always reading about how there is a virus that will destroy the Apple universe.

They always tell us that Republicans are sleazy and Democrats are pure as the wind-driven snow, too . . .

[Ruy Dias de Bivar]

NEVER OPEN Spy Sheriff! It does the same.

http://en.wikipedia.org/wiki/SpySheriff

[rednesss]

This just happened to a fried of mine. He lost a whole bunch of stuff.

http://www.adlice.com/poweliks-removal-with-roguekiller/

[UCANSEE2]

In Nigeria.

[cqnc]

never. have. an. important. file. on. only. one. spindle. /

[Drew68]

Ahh. Well, Macs are better. There had to be a much better way out of it if it was on a Mac. :)

Yep! It's called "Force Quit".

[rockrr]

Please pardon the ping but I wanted to provide an update to my research on the Cryptolocker thread.

My brother caught the damned thing when trying to install “Dropbox” (he selected a malicious link for the download). Unfortunately he neglected to tell me that he was infected until the grace period had expired. I tried everything I knew (which wasn’t much) to get his files back - all with zero success.

So I replaced his hard drive and marked his old one with a red X and a bold “Cryptolocker!” and then set it on a shelf.

In revisiting the issue I came across some info that may be of interest. From Wackypedia:

“On 2 June 2014, the United States Department of Justice officially announced that over the previous weekend, Operation Tovar—a consortium constituting a group of law enforcement agencies (including the FBI and Interpol), security software vendors, and several universities, had disrupted the Gameover ZeuS botnet which had been used to distribute CryptoLocker and other malware. The Department of Justice also publicly issued an indictment against the Russian hacker Evgeniy Bogachev for his alleged involvement in the botnet.[5][13][14]

As part of the operation, the Dutch security firm Fox-IT was able to procure the database of private keys used by CryptoLocker; in August 2014, Fox-IT and fellow firm FireEye introduced an online service which allows infected users to retrieve their private key by uploading a sample file, and then receive a decryption tool.[15][16]”

I did a websearch for Fox-IT and found a free service for recovering files encrypted with the Cryptolocker virus: https://www.decryptcryptolocker.com/

I submitted a sample file from the infected hard drive and got a recovery key from Fox-IT and downloaded the Decryptolocker application (all on a salvage computer because I didn’t trust them either!). I then ran the key against the infected files and was able to recover about 80-90%!

If you know of someone who got hit by this thing and who still has files (didn’t delete or overwrite) I would encourage you to give it a try.

[don-o]

Thanks! Sounds like good work you did and I added keyword

[BwanaNdege]

WOW!

Thanks for posting!

GREAT PUBLIC SERVICE!

(Nope, I've had no problem with CryptoLocker)

Russian hacker Evgeniy Bogachev awaiting trial

[don-o]

btt