A New Ransomware Called DeathRansom

A ransomware called DeathRansom began with a rocky start, but has now resolved it's issues and has begun to infect victims and encrypt their data.

When DeathRansom was first being distributed, it pretended to encrypt files, but researchers and users found that they could just remove the appended .wctc extension and the files would become usable again.

Starting around November 20th, though, something changed.

Not only were victim's files actually becoming encrypted, but there was a surge of submissions related to DeathRansom on the ransomware identification site, ID Ransomware.

While the numbers have dwindled since that initial surge, we are still seeing a steady trickle of new victims, which means that there is mostly likely an active distribution campaign underway. Unfortunately, we have not discovered as of yet how this ransomware is being distributed.

What we do know is that like other ransomware, when DeathRansom is launched it will attempt to clear shadow volume copies.

It will then encrypt all files on the victim's computer other than those found whose full pathnames contain the following strings:

programdata
$recycle.bin
program files
windows
all users
appdata
read_me.txt
autoexec.bat
desktop.ini
autorun.inf
ntuser.dat
iconcache.db
bootsect.bak
boot.ini
ntuser.dat.log
thumbs.db

Unlike the previous non-encryption version, the working DeathRansom variants do not append an extension to encrypted files and they just retain their original name.  The data in these files is encrypted.

The only way to identify that the file is encrypted by DeathRansom is by the ABEFCDAB file marker appended to the end of encrypted files.

In every folder that a file is encrypted, the ransomware will create a ransom note named read_me.txt that contains a unique "LOCK-ID" for the victim and an email address to contact the ransomware developer or affiliate.

The ransomware is currently being analyzed and it is not known if it can be decrypted at this time.

One strange thing that was noticed is that numerous victims who have been infected by DeathRansom were also infected by the STOP Ransomware.

This is seen in one Reddit post and numerous submissions to ID-Ransomware where the victim upload a DeathRansom ransom note and a STOP Djvu encrypted file as part of the same submission.

As STOP is only distributed through adware bundles and cracks, it is possible the DeathRansom may be distributed in a similar manner.

Source : Bleepingcomputer.com

Intel’s processors have a security bug and the fix could slow down PCs

       A security flaw in Intel processors has led to a redesign of Linux and Windows kernels. Programmers have been busy for the past two months patching the Linux kernel’s virtual memory system to protect against a hardware bug in Intel CPUs that could let attackers exploit security weaknesses and access security keys, passwords, and files cached from a disk. The Register reports that software updates are required for both Windows and Linux systems, and performance of a machine will be affected.

       Reports suggest information around the specific bug has been kept confidential between software and hardware vendors, and patches for the Linux kernel include comments that have been redacted to prevent attackers discovering the precise weakness. The security bug could be present on Intel processors manufactured over the past 10 years, meaning many systems will require updates.

FLAW IS RELATED TO KERNEL MEMORY ACCESS
       The exact bug is related to the way that regular apps and programs can discover the contents of protect kernel memory areas. Kernels in operating systems have complete control over the entire system, and connect applications to the processor, memory, and other hardware inside a computer. There appears to be a flaw in Intel’s processors that lets attackers bypass kernel access protections so that regular apps can read the contents of kernel memory. To protect against this, Linux programmers have been separating the kernel's memory away from user processes in what’s being called “Kernel Page Table Isolation.”

       The problem with this isolation is that some programmers are reporting performance hits after systems are patched. The Register reports that the slowdowns could be between 5 and 30 percent depending on the exact Intel processor. While Linux patches have been rolling out over the past month, a Windows 10 patch is not yet available. Some are speculating that Microsoft will deliver this in an upcoming Patch Tuesday, as the company started separating the NT kernel memory with Windows 10 beta builds in November. “We have nothing to share at this time,” says a Microsoft spokesperson, in response to a query from The Verge.

       It’s still unclear how these patches will affect regular Windows, Mac, and Linux machines. AppleInsider reports that Apple has already deployed a partial fix for the security bug in macOS 10.13.2, which was released last month. Citing multiple sources at Apple and developer Alex Ionescu, who publicly identified code that points to the fix, the report says Apple has mitigated the flaw by altering existing programming requirements related to the kernel memory data in macOS. More changes are expected to come with 10.13.3 soon, AppleInsider reports.

       Still, one researcher speculates that virtual machines and cloud providers will be most affected by the security problem and resulting performance hits. Microsoft’s Azure cloud will experience maintenance next week, and Amazon Web Services has warned that a big security update is coming on Friday. AMD has confirmed that its own processors are not affected by this security bug. “AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against,” explains Tom Lendacky, an AMD engineer. AMD stocks have soared this morning as a result of Intel’s processor flaw. Intel has not yet publicly commented on the security problem.


Source : theverge.com