Skip to main content

Ryuk Ransomware spares Windows Linux installs

A new variant of the Ryuk ransomware now blacklists Linux folders used on Windows 10, so as to avoid encrypting them.

The change avoids affecting the folders for the Windows Subsystem for Linux (WSL), which allows Linux to be installed as a virtual machine on Windows 10.

However, the change isn't about trying to show kindness to Linux installs, but instead is a purely practical measure - if the ransomware encrypts WSL folders it effectively destroys the Linux virtual machine, meaning there's no point in paying the attacker for decryption.

Decrypting WSL

There is currently no known variant of Ryuk that specifically targets Linux computers, instead being focused on Windows machines. However, Windows 10 does allow Linux to be directly installed as a virtual machine using the WSL feature.

The feature was introduced by Microsoft in 2016 in order to improve compatibility between Windows and Linux machines. WSL was released in May 2019 and uses a number of Hyper-V features.

One benefit to Microsoft in adding WSL would be to help Windows users who also need a Linux environment to use features in their Azure cloud computing service. 

However, when folders powering WSL are encrypted by ransomware the Linux install is effectively destroyed along with its data. This works against the ransomware attacker's interests, as even with payment for decryption will not recover the data.

Specific folders now blacklisted against encryption by the Ryuk ransomware include:

  • bin
  • boot
  • Boot
  • dev
  • etc
  • lib
  • initrd
  • sbin
  • sys
  • vmlinuz
  • run
  • var

The move shows the degree of sophistication and fine-tuning for ransomware, helping to make it a more effective and lucrative business model.

Individuals and businesses are reminded that the best antivirus often comes with ransomware protection.

Via BleepingComputer.



from TechRadar - All the latest technology news https://ift.tt/39j5iPW
Labels:

Comments

Post a Comment

Popular posts from this blog

The future of Magic Leap's promising AR efforts dim after layoffs

The Magic Leap Two is now further away than ever, unfortunately. Today in a blog post the augmented reality pioneer announced major layoffs and has decided to cut up to half of its workforce, according to some reports. The original Magic Leap One was supposed to be one of the first mainstream augmented reality headsets when it launched in 2018, but a high price point and lack of interest from developers left the headset high and dry after launch. According to the blog post, Magic Leap says it will be focusing its efforts on enterprise solutions (a statement HTC has made recently as well) and shift its focus away from consumer technology… at least for the time being.  The company has been open about creating a second headset that would offer improved specs for some time, but how that work will now have to go forward without half of the team , according to some estimates, remains to be seen. Is the window closing on augmented reality?  Although it’s just one company, Magic...
Post a Comment
Read more

Airship acquires SMS commerce company ReplyBuy

Airship is announcing that it has acquired mobile commerce startup ReplyBuy . The startup (which was a finalist at TechCrunch’s 1st and Future competition in 2016) works with customers like entertainment venues and professional and college sports teams to send messages and sell tickets to fans via SMS. It raised $4 million in funding from Sand Hill Angels, Kosinski Ventures, SEAG Ventures, Enspire Capital, MRTNZ Ventures and others, according to Crunchbase . Airship, meanwhile, has been expanding its platform beyond push notifications to cover customer communication across SMS, email, mobile wallets and more. But CEO Brett Caine said this is the first time the company is moving into commerce. While sports and concerts tickets might not be a booming market right now, Caine suggested that the company is actually seeing increased purchasing activity “in and around the Airship platform” as businesses try to drive more in-app purchases. He also suggested that both the COVID-19 pandem...
Post a Comment
Read more