Thread by @doctorow

A truism in security is "attribution is hard." It's really hard to know who hacked you, first, because it's easy to deflect suspicion by leaving false clues, and second, because the bar for hacking even big, critical systems is so low.

1/

The ransomware epidemic has been raging for years now, and it's quite a tangle. It includes idiots who download (or pay for) some off-the-shelf malware and turn it loose on whatever systems they can find, who don't even know WHO they've hacked.

2/

It includes sophisticated crime-gangs with high degrees of specialization: tooling, payment processing, even "customer service" for victims who can't figure out how to buy cryptocurrency to pay their ransoms.

3/

It includes state actors, who often pretend to be bungling idiots while infecting the systems of national adversaries - sometimes, they use fake ransomware that irretrievably trashes the target system, then claim to be too incompetent to recover them.

4/

And it includes all kinds of hybrids, like "state-sponsored" hackers (private criminal orgs on governmental payrolls) as well as state-tolerated "cyber-patriot militias" (high-tech mall ninjas who hack out of a sense of patriotic duty).

5/

This combination of adversaries accounts for the more bizarre ransomware turns, like the ransomware gang Darkside, who seized the Colonial Pipeline's billing systems (sparking petrol hoarding in the American south).

6/

The criminals then apologized for their crime, saying that they were just trying to do crime, not create a geopolitical incident. THEN they posted that they, themselves, had been hacked and lost control of their malware and the ransom they'd collected (!).

7/

It's not the first time that bad guys have pulled off a successful attack against a major target, only to react with public shame and horror at who they'd actually targeted - they're like muggers who discover that they just stuck up the Chairman of the Joint Chiefs of Staff.

8/

All this may explain why there is an easy way to protect yourself from many strains of ransomware: install the Russian keyboard option in your Windows system.

9/

As @briankrebs explains in his post, Russian authorities are pretty tolerant of hackers who target foreigners, but are notoriously tetchy if someone in their jurisdiction hits a Russian business (or worse, major government installation) for ransom.

krebsonsecurity.com/2021/05/try-th…

10/

Russian (and regional) malware gangs who want to avoid retaliation from powerful Russian security agencies have programmed their malware to check for the presence of a Russian (or other Cyrillic) keyboard in the system, and, if they find it, to leave the system untouched.

11/

It's like the climax of the Passover story, except for malware and authoritarian security agencies!

Krebs is at pains to point out that there's plenty of malware this won't work on, and there are already strains of Darkside-associated malware that don't perform this check.

12/

But it's a simple step you can take right now, for free, that will not impede your use of your system in any way.

Here's how: "Hit the Windows and X at the same time; select Settings, then 'Time and Language.'...

13/

"Select 'Language,' scroll to the option to install another character set. Pick one, then reboot. If for you need to toggle between languages, tap Windows+space."

14/

Alternatively, here's a two-line batch script that does it, from @lancejssc of @unit221b.

github.com/Unit221B/Russi…

15/

This is a neat, self-contained parable about measures, countermeasures, and counter-countermeasures. Earlier malware refused to infect computers running virtual machines, as their authors sought to avoid analysis by security researchers.

Today, that rarely works.

16/

Installing a keyboard associated with Russia or the Commonwealth of Independent States works for now. It probably won't for long.

Ultimately, we need more security competence in Windows design, to raise that low bar and exclude (at least) the dimmest dimbulbs.

eof/

ETA - If you'd like an unrolled version of this thread to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

pluralistic.net/2021/05/18/unh…