ransomware : Différence entre versions

De Vulgum Techus
Aller à : Navigation, rechercher
(→‎Articles externes - Français)
(→‎Articles externes - Anglais)
Ligne 251 : Ligne 251 :
  
 
= Articles externes - Anglais =
 
= Articles externes - Anglais =
−
* [https://motherboard.vice.com/en_us/article/the-worlds-first-ransomware-came-on-a-floppy-disk-in-1989 Vice - 12/04/17] The World's First '''Ransomware''' Came on a '''Floppy Disk''' in '''1989'''
+
* [https://motherboard.vice.com/en_us/article/the-worlds-first-ransomware-came-on-a-floppy-disk-in-1989 Vice - 12/04/17] The World's First Ransomware Came on a Floppy Disk in 1989
−
* [http://www.pcworld.com/article/3126256/security/ransomware-spreads-through-weak-remote-desktop-credentials.html PCWorld - 30/09/16] '''Ransomware''' spreads through weak remote desktop '''[[credentials]]'''
+
* [http://www.pcworld.com/article/3126256/security/ransomware-spreads-through-weak-remote-desktop-credentials.html PCWorld - 30/09/16] Ransomware spreads through weak remote desktop '''[[credentials]]'''
−
* [http://www.geek.com/microsoft/guy-tricks-windows-tech-support-scammers-into-installing-ransomware-1665967/ Geek - 13/08/16] Guy tricks '''[[Windows]]''' tech support scammers into installing '''ransomware'''
+
* [http://www.geek.com/microsoft/guy-tricks-windows-tech-support-scammers-into-installing-ransomware-1665967/ Geek - 13/08/16] Guy tricks '''[[Windows]]''' tech support scammers into installing ransomware
−
* [http://www.neowin.net/news/ransomware-can-now-infect-your-smart-thermostat Neowin - 08/08/16] '''Ransomware''' can now infect your '''[[smart thermostat]]'''
+
* [http://www.neowin.net/news/ransomware-can-now-infect-your-smart-thermostat Neowin - 08/08/16] Ransomware can now infect your '''[[smart thermostat]]'''
−
* [http://www.computerworld.com/article/3103489/security/almost-half-of-us-businesses-hit-by-ransomware-says-study.html ComputerWorld - 03/08/16] Almost half of '''[[US]] [[businesses]]''' hit by '''ransomware''', says study
+
* [http://www.computerworld.com/article/3103489/security/almost-half-of-us-businesses-hit-by-ransomware-says-study.html ComputerWorld - 03/08/16] Almost half of '''[[US]]''' '''[[businesses]]''' hit by ransomware, says study
−
* [http://sputniknews.com/science/20160804/1043930769/ransomware-cybercrime-uk-computers.html Sputnik News - 04/08/16] More Than Half of '''[[UK]] [[Businesses]]''' Suffer From '''Ransomware''' Cyberattacks
+
* [http://sputniknews.com/science/20160804/1043930769/ransomware-cybercrime-uk-computers.html Sputnik News - 04/08/16] More Than Half of '''[[UK]]''' '''[[Businesses]]''' Suffer From Ransomware Cyberattacks
−
* [http://www.pcworld.com/article/3097268/security/why-ransomware-criminals-need-great-customer-service.html PCWorld - 19/07/16] Why '''ransomware''' criminals need great '''customer service'''
+
* [http://www.pcworld.com/article/3097268/security/why-ransomware-criminals-need-great-customer-service.html PCWorld - 19/07/16] Why ransomware criminals need great customer service
−
* [http://www.eteknix.com/cryptodrop-stop-ransomware/ eteknix - 13/07/16] '''CryptoDrop''' Could Stop '''Ransomware '''
+
* [http://www.eteknix.com/cryptodrop-stop-ransomware/ eteknix - 13/07/16] CryptoDrop Could Stop Ransomware  
−
* [http://www.computerworld.com/article/3088094/security/the-number-of-corporate-users-hit-by-crypto-ransomware-is-skyrocketing.html ComputerWorld - 23/06/16] The number of corporate users hit by '''crypto ransomware''' is skyrocketing
+
* [http://www.computerworld.com/article/3088094/security/the-number-of-corporate-users-hit-by-crypto-ransomware-is-skyrocketing.html ComputerWorld - 23/06/16] The number of corporate users hit by crypto ransomware is skyrocketing
−
* [http://www.neowin.net/news/microsoft-warns-of-self-reproducing-ransomware-out-in-the-wild Neowin - 31/05/16] '''[[Microsoft]]''' warns of self-reproducing '''ransomware''' out in the wild
+
* [http://www.neowin.net/news/microsoft-warns-of-self-reproducing-ransomware-out-in-the-wild Neowin - 31/05/16] '''[[Microsoft]]''' warns of self-reproducing ransomware out in the wild
−
* [http://www.computerworld.com/article/3055488/security/cryptoworms-the-future-of-ransomware-hell.html computerworld.com - ] '''Cryptoworms''': The future of '''ransomware''' hell
+
* [http://www.computerworld.com/article/3055488/security/cryptoworms-the-future-of-ransomware-hell.html computerworld.com - ] Cryptoworms: The future of ransomware hell
−
* [http://www.geek.com/news/jigsaw-ransomware-wants-to-play-a-game-with-you-1652249/ Geek - 13/04/16] Jigsaw '''ransomware''' wants to play a '''[[game]]''' with you
+
* [http://www.geek.com/news/jigsaw-ransomware-wants-to-play-a-game-with-you-1652249/ Geek - 13/04/16] Jigsaw ransomware wants to play a '''[[game]]''' with you
−
* [http://www.pcworld.com/article/3054220/security/experts-crack-petya-ransomware-enable-hard-drive-decryption-for-free.html PCWorld - 11/04/16] Experts crack '''Petya ransomware''', enable '''[[hard drive]]''' decryption for '''[[free]]'''
+
* [http://www.pcworld.com/article/3054220/security/experts-crack-petya-ransomware-enable-hard-drive-decryption-for-free.html PCWorld - 11/04/16] Experts crack Petya ransomware, enable '''[[hard drive]]''' decryption for '''[[free]]'''
−
* [http://www.neowin.net/news/petya-ransomware-reportedly-encrypts-hard-drives-manipulates-operating-system-boot-process Neowin - 26/03/16] '''Petya ransomware''' reportedly encrypts '''[[hard drives]]''', manipulates '''[[operating system]] boot''' process
+
* [http://www.neowin.net/news/petya-ransomware-reportedly-encrypts-hard-drives-manipulates-operating-system-boot-process Neowin - 26/03/16] Petya ransomware reportedly encrypts '''[[hard drives]]''', manipulates '''[[operating system]]''' boot process
−
* [http://www.pcworld.com/article/3045206/security/teslacrypt-ransomware-now-impossible-to-crack-researchers-say.html PCWorld - 17/03/16] '''TeslaCrypt ransomware''' now impossible to crack, researchers say
+
* [http://www.pcworld.com/article/3045206/security/teslacrypt-ransomware-now-impossible-to-crack-researchers-say.html PCWorld - 17/03/16] TeslaCrypt ransomware now impossible to crack, researchers say
−
* [http://www.engadget.com/2016/03/06/first-known-mac-ransomware/ engadget - 06/02/16] First known '''[[Mac]] ransomware''' reaches the wild
+
* [http://www.engadget.com/2016/03/06/first-known-mac-ransomware/ engadget - 06/02/16] First known '''[[Mac]]''' ransomware reaches the wild
−
* [http://www.computerworld.com/article/3040976/security/cerber-ransomware-sold-as-a-service-speaks-to-victims.html ComputerWorld - 04/03/16] '''Cerber ransomware''' sold as a service, speaks to victims
+
* [http://www.computerworld.com/article/3040976/security/cerber-ransomware-sold-as-a-service-speaks-to-victims.html ComputerWorld - 04/03/16] Cerber ransomware sold as a service, speaks to victims
−
* [http://www.pcworld.com/article/3035106/security/a-new-android-banking-trojan-is-also-ransomware.html PCWorld - 19/02/16] A new '''[[Android]] trojan''' steals your banking info and holds your files '''ransom'''
+
* [http://www.pcworld.com/article/3035106/security/a-new-android-banking-trojan-is-also-ransomware.html PCWorld - 19/02/16] A new '''[[Android]]''' trojan steals your banking info and holds your files ransom
 
* [http://arstechnica.com/security/2016/02/mysterious-spike-in-wordpress-hacks-silently-delivers-ransomware-to-visitors/ arstechnica - 04/02/16] Mysterious spike in '''[[WordPress]]''' hacks silently delivers ransomware to visitors
 
* [http://arstechnica.com/security/2016/02/mysterious-spike-in-wordpress-hacks-silently-delivers-ransomware-to-visitors/ arstechnica - 04/02/16] Mysterious spike in '''[[WordPress]]''' hacks silently delivers ransomware to visitors
−
* [http://www.computerworld.com/article/3026997/security/new-android-ransomware-uses-clickjacking-to-gain-admin-privileges.html ComputerWorld - 27/01/16] New '''[[Android]] ransomware''' uses clickjacking to gain '''admin''' privileges
+
* [http://www.computerworld.com/article/3026997/security/new-android-ransomware-uses-clickjacking-to-gain-admin-privileges.html ComputerWorld - 27/01/16] New '''[[Android]]''' ransomware uses clickjacking to gain admin privileges
−
* [https://blog.malwarebytes.org/malvertising-2/2016/01/malvertising-campaign-via-pop-under-ads-sends-cryptowall-4/ Malwarebytes - 07/01/16] '''Malvertising''' Campaign via Pop-under Ads Sends '''CryptoWall 4'''
+
* [https://blog.malwarebytes.org/malvertising-2/2016/01/malvertising-campaign-via-pop-under-ads-sends-cryptowall-4/ Malwarebytes - 07/01/16] Malvertising Campaign via Pop-under Ads Sends CryptoWall 4
 
* [http://www.neowin.net/news/these-hackers-prefer-a-different-approach-asking-the-victims-to-further-spread-their-malware Neowin - 05/12/15] These hackers prefer a different approach: asking the victims to further spread their '''[[malware]]'''
 
* [http://www.neowin.net/news/these-hackers-prefer-a-different-approach-asking-the-victims-to-further-spread-their-malware Neowin - 05/12/15] These hackers prefer a different approach: asking the victims to further spread their '''[[malware]]'''
−
* [http://www.eteknix.com/taking-money-wasnt-enough-new-ransomware-steals-passwords-first/ eteknix - 04/12/15] Taking Your Money Wasn't Enough – New '''Ransomware''' Steals '''[[Passwords]]''' First
+
* [http://www.eteknix.com/taking-money-wasnt-enough-new-ransomware-steals-passwords-first/ eteknix - 04/12/15] Taking Your Money Wasn't Enough – New Ransomware Steals '''[[Passwords]]''' First
−
* [http://www.eteknix.com/linux-systems-targeted-new-ransomware/ eteknix - 11/11/15] '''[[Linux]] Systems''' Targeted by New '''Ransomware'''
+
* [http://www.eteknix.com/linux-systems-targeted-new-ransomware/ eteknix - 11/11/15] '''[[Linux]]''' Systems Targeted by New Ransomware
−
* [http://www.computerworld.com/article/3003461/security/first-linux-ransomware-program-cracked-for-now.html ComputerWorld - 10/11/15] First '''[[Linux]] ransomware [[program]]''' cracked, for now
+
* [http://www.computerworld.com/article/3003461/security/first-linux-ransomware-program-cracked-for-now.html ComputerWorld - 10/11/15] First '''[[Linux]]''' ransomware '''[[program]]''' cracked, for now
−
* [http://www.pcworld.com/article/3002119/encryption/new-ransomware-program-chimera-threatens-to-leak-user-files.html PCWorld - 05/11/15] Nasty new '''ransomware [[program]]''' threatens to leak your files online
+
* [http://www.pcworld.com/article/3002119/encryption/new-ransomware-program-chimera-threatens-to-leak-user-files.html PCWorld - 05/11/15] Nasty new ransomware '''[[program]]''' threatens to leak your files online
−
* [http://www.pcworld.com/article/2999824/all-coinvault-and-bitcryptor-ransomware-victims-can-now-recover-their-files-for-free.html PCWorld - 30/10/15] All '''CoinVault''' and '''Bitcryptor ransomware''' victims can now recover their files for '''free''' -> http://vt.cx/5g
+
* [http://www.pcworld.com/article/2999824/all-coinvault-and-bitcryptor-ransomware-victims-can-now-recover-their-files-for-free.html PCWorld - 30/10/15] All CoinVault and Bitcryptor ransomware victims can now recover their files for free -> http://vt.cx/5g
−
* [http://www.kitguru.net/gaming/security-software/jon-martindale/20-million-a-year-randsomware-group-disrupted-by-cisco/ KitGuru - 07/10/15] '''£20 million''' a year '''ransomware''' group disrupted by '''[[Cisco]]'''
+
* [http://www.kitguru.net/gaming/security-software/jon-martindale/20-million-a-year-randsomware-group-disrupted-by-cisco/ KitGuru - 07/10/15] £20 million a year ransomware group disrupted by '''[[Cisco]]'''
−
* [http://www.pcworld.com/article/2983138/security/android-ransomware-changes-a-devices-pin-code.html PCWorld - 11/09/15] This nasty '''[[Android]] ransomware''' changes your '''[[phone]]''''s '''[[PIN code]]'''
+
* [http://www.pcworld.com/article/2983138/security/android-ransomware-changes-a-devices-pin-code.html PCWorld - 11/09/15] This nasty '''[[Android]]''' ransomware changes your '''[[phone]]''''s '''[[PIN code]]'''
−
* [http://www.eteknix.com/windows-10-ransomware-discovered/ eTeknix - 03/07/15] '''[[Windows]] 10 Ransomware''' Discovered
+
* [http://www.eteknix.com/windows-10-ransomware-discovered/ eTeknix - 03/07/15] '''[[Windows]]''' 10 Ransomware Discovered
−
* [http://www.neowin.net/news/kasperskys-free-decryption-tool-may-unlock-your-data-from-coinvault-ransomware Neowin - 15/04/15] '''Kaspersky''''s free decryption tool may unlock your data from '''CoinVault ransomware'''
+
* [http://www.neowin.net/news/kasperskys-free-decryption-tool-may-unlock-your-data-from-coinvault-ransomware Neowin - 15/04/15] Kaspersky's free decryption tool may unlock your data from CoinVault ransomware
−
* [http://www.pcworld.com/article/2904016/ransomware-alert-pacman-scheme-uses-dropbox-link-to-gobble-victims.html PC World - 03/04/15] '''Ransomware''' alert: '''Pacman''' scheme uses '''[[Dropbox]]''' link to gobble victims
+
* [http://www.pcworld.com/article/2904016/ransomware-alert-pacman-scheme-uses-dropbox-link-to-gobble-victims.html PC World - 03/04/15] Ransomware alert: Pacman scheme uses '''[[Dropbox]]''' link to gobble victims
−
* [http://www.pcworld.com/article/2901672/how-to-prevent-ransomware-what-one-company-learned-the-hard-way.html PC World - 26/03/15] How to prevent '''ransomware''': What one '''[[company]]''' learned the hard way
+
* [http://www.pcworld.com/article/2901672/how-to-prevent-ransomware-what-one-company-learned-the-hard-way.html PC World - 26/03/15] How to prevent ransomware: What one '''[[company]]''' learned the hard way
−
* [http://arstechnica.com/security/2015/03/cryptolocker-look-alike-searches-for-and-encrypts-pc-game-files/ arstechnica - 12/03/15] '''CryptoLocker''' look-alike searches for and encrypts '''[[PC]] [[game]] files'''
+
* [http://arstechnica.com/security/2015/03/cryptolocker-look-alike-searches-for-and-encrypts-pc-game-files/ arstechnica - 12/03/15] CryptoLocker look-alike searches for and encrypts '''[[PC]]''' '''[[game]]''' files
−
* [http://www.tweaktown.com/news/43439/ransomware-attacks-increasing-cybercriminals-perfect-skills/index.html TweakTown - 13/02/15] '''Ransomware''' attacks increasing, as '''cybercriminals''' perfect their skills
+
* [http://www.tweaktown.com/news/43439/ransomware-attacks-increasing-cybercriminals-perfect-skills/index.html TweakTown - 13/02/15] Ransomware attacks increasing, as cybercriminals perfect their skills
−
* [http://arstechnica.com/information-technology/2015/01/inside-cryptowall-2-0-ransomware-professional-edition/ arstecnica - 09/01/15] Inside '''CryptoWall 2.0: Ransomware, professional edition'''
+
* [http://arstechnica.com/information-technology/2015/01/inside-cryptowall-2-0-ransomware-professional-edition/ arstecnica - 09/01/15] Inside CryptoWall 2.0: Ransomware, professional edition
−
* [http://hothardware.com/news/sony-comes-to-a-screeching-halt-targeted-by-massive-ransomware-hack HotHarware - 24/11/14] '''[[Sony]]''' Comes to a Screeching Halt Targeted by Massive '''Ransomware Hack'''
+
* [http://hothardware.com/news/sony-comes-to-a-screeching-halt-targeted-by-massive-ransomware-hack HotHarware - 24/11/14] '''[[Sony]]''' Comes to a Screeching Halt Targeted by Massive Ransomware Hack
−
* [http://www.tweaktown.com/news/41406/coinvault-ransomware-allows-victims-to-decrypt-one-file-for-free/index.html TweakTown - 25/11/14] '''CoinVault ransomware''' allows victims to decrypt one file for free
+
* [http://www.tweaktown.com/news/41406/coinvault-ransomware-allows-victims-to-decrypt-one-file-for-free/index.html TweakTown - 25/11/14] CoinVault ransomware allows victims to decrypt one file for free
−
* [http://blog.yoocare.com/how-to-remove-cryptowall-ransomware blog.yoocare.com - 10/11/14] How to Remove '''CryptoWall Ransomware'''?
+
* [http://blog.yoocare.com/how-to-remove-cryptowall-ransomware blog.yoocare.com - 10/11/14] How to Remove CryptoWall Ransomware?
−
* [http://www.itproportal.com/2014/08/06/a-cryptolocker-cure-has-finally-landed---and-its-free/ ITProPortal - 07/08/14] A '''cryptolocker''' cure has finally landed - and it’s FREE
+
* [http://www.itproportal.com/2014/08/06/a-cryptolocker-cure-has-finally-landed---and-its-free/ ITProPortal - 07/08/14] A cryptolocker cure has finally landed - and it’s FREE
−
* [http://www.tweaktown.com/news/38243/simplelocker-ransomware-targets-android-encrypts-your-sd-card/index.html TweakTown - 05/06/14] '''Simplelocker ransomware''' targets '''[[Android]]''', encrypts your '''[[SD card]]'''
+
* [http://www.tweaktown.com/news/38243/simplelocker-ransomware-targets-android-encrypts-your-sd-card/index.html TweakTown - 05/06/14] Simplelocker ransomware targets '''[[Android]]''', encrypts your '''[[SD card]]'''
−
* [http://www.tweaktown.com/news/37854/cryptolocker-increases-attack-levels-using-spear-phishing-techniques/index.html TweakTown - 28/05/14] '''CryptoLocker''' increases attack levels, using spear-'''[[phishing]]''' techniques
+
* [http://www.tweaktown.com/news/37854/cryptolocker-increases-attack-levels-using-spear-phishing-techniques/index.html TweakTown - 28/05/14] CryptoLocker increases attack levels, using spear-'''[[phishing]]''' techniques
−
* [http://www.eweek.com/mobile/how-to-recover-from-the-ios-ransom-attack.html eWeek - 27/05/14] How to Recover From the '''[[iOS]] Ransom Attack'''
+
* [http://www.eweek.com/mobile/how-to-recover-from-the-ios-ransom-attack.html eWeek - 27/05/14] How to Recover From the '''[[iOS]]''' Ransom Attack
−
* [http://arstechnica.com/security/2014/05/your-android-phone-viewed-illegal-porn-to-unlock-it-pay-a-300-fine/ arstechnica - 06/05/14] Your '''[[Android]] phone''' viewed illegal porn. To unlock it, pay a '''$300''' fine
+
* [http://arstechnica.com/security/2014/05/your-android-phone-viewed-illegal-porn-to-unlock-it-pay-a-300-fine/ arstechnica - 06/05/14] Your '''[[Android]]''' phone viewed illegal porn. To unlock it, pay a $300 fine
−
* [http://www.tweaktown.com/news/36820/knowbe4-ransomware-threats-goes-beyond-just-cryptolocker/index.html TweakTown - 06/04/14] '''KnowBe4''': '''Ransomware''' threats goes beyond just '''Cryptolocker'''
+
* [http://www.tweaktown.com/news/36820/knowbe4-ransomware-threats-goes-beyond-just-cryptolocker/index.html TweakTown - 06/04/14] KnowBe4: Ransomware threats goes beyond just Cryptolocker
−
* [http://www.tweaktown.com/news/36083/study-forty-percent-of-those-hit-with-cryptolocker-ransomware-pay-up/index.html TweakTown - 07/03/14] Study: '''Forty percent''' of those hit with '''Cryptolocker''' ransomware pay up
+
* [http://www.tweaktown.com/news/36083/study-forty-percent-of-those-hit-with-cryptolocker-ransomware-pay-up/index.html TweakTown - 07/03/14] Study: Forty percent of those hit with Cryptolocker ransomware pay up
−
* [http://www.pcworld.com/article/2084002/how-to-rescue-your-pc-from-ransomware.html PCWorld - 13/01/14] How to rescue your '''[[PC]]''' from '''ransomware'''
+
* [http://www.pcworld.com/article/2084002/how-to-rescue-your-pc-from-ransomware.html PCWorld - 13/01/14] How to rescue your '''[[PC]]''' from ransomware
−
* [http://readwrite.com/2014/01/07/how-to-protect-against-prisonlocker-the-next-major-malware-threat readwrite.com - 07/01/14] It's bigger and meaner than '''Cryptolocker''', but it still needs your permission to ruin your life.
+
* [http://readwrite.com/2014/01/07/how-to-protect-against-prisonlocker-the-next-major-malware-threat readwrite.com - 07/01/14] It's bigger and meaner than Cryptolocker, but it still needs your permission to ruin your life.
−
* [https://blog.kaspersky.com/cryptolocker-is-bad-news/ blog.kaspersky.com - 11/11/13] '''CryptoLocker''' is Bad News
+
* [https://blog.kaspersky.com/cryptolocker-is-bad-news/ blog.kaspersky.com - 11/11/13] CryptoLocker is Bad News
  
 
= Commentaires =  
 
= Commentaires =  

Version du 6 novembre 2017 à 17:48

Lien court vers cette page : http://vt.cx/cq3
QR code vers cette page : http://vt.cx/cq3.qr


Présentation

Les ransomwares sont rapidement devenus les nouvelles terreurs du web du fait d'un fonctionnement particulièrement vicieux qui consiste à crypter les fichiers d'un utilisateur, voire de tous les utilisateurs raccordés sur un même réseau, et à exiger une rançon, payée soit par Bitcoins soit par virements cash, pour permettre une hypothétique suppression du cryptage. Certains ransomware comme Koler.A ciblent les dispositifs Android après qu'ils aient été utilisés pour accéder à des sites pornographiques.

Update ! : Un site proposé par FireEye et Fox IT permet la désinfection des PC contaminés par CryptoLocker en faisant parvenir à ceux qui en font la demande, la clé privée permettant la décryptage des fichiers verrouillés par CryptoLocker. Pour cela envoyer les informations suivantes au lien plus bas :

  • email de contact
  • un exemple de fichier crypté par CryptoLocker (max 16 Mo)

En retour sera envoyée la clé privée permettant la décontamination sans avoir à payer la moindre rançon ! 

https://www.decryptcryptolocker.com

Modes de contamination

  • Majoritairement par email, via des pièces jointes qui sont des exécutables maquillés en autres fichiers généralement de type pdf ou doc.
  • Une fois exécutés, ils s’installent sur le disque dur hôte et peuvent aussi crypter les fichiers sur l'ensemble des disques durs raccordés y compris les disques durs réseaux et les NAS.
  • Certains comme CryptoLocker ne seront opérationnels qu'une fois l'ordinateur rebooté
  • Certains comme CryptoLocker se connectent au réseau sur un ordinateur pirate pour calculer les clés (publique et privée) de codage des fichiers sensibles.
  • La clé publique est celle qui reste sur le PC contaminé. La clé privée est celle qui permet son déblocage et n'est accessible qu'une fois la rançon payée (enfin en théorie)

Fichiers ciblés

Selon Malwarebytes, les extensions de fichiers ciblés par Cryptolocker sont à ce jour : 3fr, accdb, ai, arw, bay, cdr, cer, cr2, crt, crw, dbf, dcr, der, dng, doc, docm, docx, dwg, dxf, dxg, eps, erf, indd, jpe, jpg, kdc, mdb, mdf, mef, mrw, nef, nrw, odb, odm, odp, ods, odt, orf, p12, p7b, p7c, pdd, pef, pem, pfx, ppt, pptm, pptx, psd, pst, ptx, r3d, raf, raw, rtf, rw2, rwl, srf, srw, wb2, wpd, wps, xlk, xls, xlsb, xlsm, xlsx. Ces extensions sont majoritairement celles de fichiers les plus usités par les professionnels à savoir :

De récents ransomwares ne se contentent plus de crypter des fichiers précis avec une clé unique et vont encore plus loin comme :

  • Petya : cryptage de l'intégralité du disque dur
  • CryPy : cryptage de chaque fichier avec une clé différente

Prévention

Ces précautions valent tout aussi bien sur un PC que sur une tablette ou un smartphone

emails

  • Ne pas ouvrir de pdf joints de la part d'expéditeurs inconnus
  • Attention aux faux email d'entreprises de routage (DHL, UPS, etc.) faisant état d'un document joint à ouvrir
  • Faire tester toutes les pièces jointes suspectes par VirusTotal
  • Ne pas cliquer sur des liens suspects dans les emails, y compris ceux de proches dont on a pu pirater le compte (c'est plus courant qu'on ne croit)

Système

  • Faire des sauvegardes des fichiers système et documents, y compris dossiers courriers, sur disque dur externe uniquement
  • Ne pas laisser le disque dur de sauvegarde perpétuellement branché. Le débrancher quand toutes les sauvegardes sont faites
  • Avoir un pare-feu permettra de bloquer tout demande d'accès au net de la part du ransomware ce qui peut interrompre son processus de cryptage
  • Installer un anti-ransomware parmi ceux proposés plus bas (voir Programme utiles plus bas)
  • Avoir un antivirus à jour car beaucoup d'entre eux détectent certains ransomwares
  • Créer une archive cryptée montable comme un disque dur et lui donner une extension exotique peut aussi permettre de sauvegarder provisoirement des fichiers sensibles (voir TrueCrypt) -> Pas efficace avec les ransomwares qui cryptent l'intégralité du disque dur
  • Mettre un mot de passe d'accès au BIOS pour éviter toute tentative d'écriture sur ce dernier
  • Protéger le master boot record (MBR) pour éviter toute tentative d'écriture sur ce dernier (voir Programme utiles plus bas)

Ransomwares connus

Les ransomwares en rouge sont ceux pour lesquels existent des outils de récupération et d'éradication.

Vidéos

Malwarebytes Anti-Ransomware Sneak Peek!

Programmes utiles

Liens utiles

Articles Vulgum Techus

Articles externes - Français

Articles externes - Anglais

Commentaires

blog comments powered by Disqus

Récupérée de « https://www.vulgumtechus.com/index.php?title=ransomware&oldid=36707 »