Linux Ransomware targeting Servers and Threatening Webmasters to Pay

Since past few years, Ransomware has emerged as one of the catastrophic malware programs that lets hacker encrypts all the contents of a victim's hard drive or/and server and demands ransom (typically to be paid in Bitcoin) in exchange for a key to decrypt it.

Until now cyber criminals were targeting computers, smartphones and tablets, but now it appears they are creating ransomware that makes the same impact but for Web Sites – specifically holding files, pages and images of the target website for Ransom.

Dubbed Linux.Encoder.1 by Russian antivirus firm Dr.Web, the new strain of ransomware targets Linux-powered websites and servers by encrypting MySQL, Apache, and home/root folders associated with the target site and asking for 1 Bitcoin (~ $300) to decrypt the files.

The ransomware threat is delivered to the target website through known vulnerabilities in website plugins or third-party software.

Once infected, the Linux.Encoder.1 malware encrypts all files in the Home directories on the system as well as Backup directories and the System Folders associated with Web site files, pages, images, code libraries and scripts.

Ransomware Uses AES Encryption

According to the security researchers, the ransomware in question needs root privileges to work. Additionally, when it launches, the malware starts downloading:

• The Ransom Message containing the demands of fraudsters
• A file containing the public RSA key

After that, the Ransomware starts as a daemon and deletes all of the original files. The RSA key is then used to store AES keys that are used by the ransomware to encrypt the local files on the infected computer.
The ransomware also adds the .encrypt extension to each file it encrypts and writes a ransom text message in every folder.

Targeting Linux-Powered Websites and Servers

The malware specifically encrypts files in folders that are typically found in Linux Web server setups, including directories like home, root, MySQL, Apache, and any directory that includes terms such as git, svn, webapp, www, public_html, or backup.

Moreover, the ransomware looks for files that have extensions specific to Web development environments including .js, .css, .properties, .xml, .ruby, .php, .html, .gz, and .asp, as well as other file extensions like .rar, .7z, .xls, .pdf, .doc, .avi, .mov, .png, and .jpg.

Once the victim pays the ransom amount, the system receives a signal to pass over the directories again to decrypt the files.

Until security researchers create a decryption program, they recommend webmasters to backup all important data and keep all their files in place in case they are targeted.


Want to know more visit : www.arinesolutions.com

Russian Hackers Release 5 Million Gmail Usernames and Passwords Online

It’s good news/bad news time. The bad news is that someone got his or her hands on nearly 5 million Gmail addresses and corresponding passwords and made them all public. The good news is that even if your Gmail address is on the list, the password may be too old to merit much concern.

The Russian tech blog Habrahabr theorizes that the leaked Gmail addresses and passwords were most likely compiled through phishing scams, use of weak passwords and other common compromises, not as a result of a hacked Google server. Similar databases of email addresses and passwords from Yandex and Mail.ru, two popular Russian-language services, were made public earlier this week.
You can use a site called, appropriately enough, “Is my email leaked?” if you’d like to check the status of your Gmail, Yandex, or Mail.ru account. The site itself is safe, and you can even give a shortened version of your email address with asterisks if you’re concerned.

Earlier today (Sept. 10), Australian security researcher Troy Hunt tweeted that he’d soon be adding the Gmail addresses to his own haveibeenpwned.com compromised-email checking website, which aggregates the results of large password dumps.

Based on an informal poll of the Tom’s Guide New York office, not that many people seem to be affected by this data dump. This makes sense when you consider that Gmail has more than 500 million users and the password breach affects fewer than 1 percent of them.

Even if you’re one of the 5 million affected, you may not have to worry. Many of the passwords on the list are outdated, tweeted Peter Kruse of Danish security firm CSIS — some by as long as three years. If you change your password on even a semi-regular basis (as Gmail recommends), cybercriminals most likely have no way to access your account or personal information.

If your account has been compromised (or even if it hasn’t, and you want to be safe), change your Gmail password to something totally different, and consider adding two-step verification to your account. Otherwise, just remember that password breaches are relatively common but also tend to get overblown in mainstream-media coverage.

Article by Arine Solutions