So the MalwareTech dude that he was talking about, he found the killswitch and then was hailed a hero. He lived in the UK and went to Las Vegas for a vacation and guess what? The FBI arrested him at the airport. It's because in his younger years when he was learning how to hack, he made a malware which he mistakenly sold to someone. The malware was then incorporated with Kronos which led to sensitive bank information to be leaked. He had trials and he wasn't allowed to leave the U.S. nor, was he allowed to legally work there for 18 months. He finally gave up and accepted his charges. On the day of his sentencing, the Judge let him go as he had done the world a huge favor by finding the killswitch and disabling WanaCry ransomware. A very interesting documentary, indeed! {also, when he was arrested, he was left on bail on a bond of $30k, his story got out in his country and the very second day, the community had paid it off completely!}
yes, indeed. I still want to decide when or if I want to update my system.. just a few days ago I got this lovely unnecessary "Windows creator" update, which brought me a few new programms I'll never use and in return my desktop icons are slightly offset to the top (its just a handfull of pixels, but I still notice it, its kinda annoying).
BS, security experts have always been a fan of it. Of course there's stuff attached to it which is less desirable, but the basic premise of forced security updates isn't too controversial.
should? there's lots of things I should and shouldn't do. I love XP inside a container with no online or network access so i can torture it after it's creator screwed with Linux for years. "Linux is a cancer that NEEDS to be eradicated!"
The problem with Microsofts update policy is they don't discern between security, driver and feature updates. Security updates should be installed instantly. Driver updates can break whole system. Nvidia.seems very prone to this. Feature Updates are almost guaranteed to introduce new bugs.
@sonicscrewdriverdw While there is a potential 4th category for bug fixes, the non critical like changed currency symbol of Azerbaijan, generally bug fixes can be categorized in the 3 categories I mentioned.
no not really, they make these ransomewares so that if terrorists find something out like a nuclear weapon they can encript all their files, you don't get that though scince you don't work in the NSA
Spy it got leaked?? the video says that exploit has been up since windows xp, why didn't the NSA inform Microsoft about the said issue, its because they're taking that exploit as an advantage to hack peoples computer to spy..
Dr. Pound is my favorite presenter you feature on this channel. He's very well spoken and clear in his explanations. I also enjoy his drawings that illustrate what he is talking about.
There are different levels of encryption. It could be doing a simpler one. When you perform a full disk encryption, it's also encrypting the free space for future use.
There is a finite list of extensions (around 50) that crytolockers look for .doc .docx .jpg etc.- the important ones to you, not an operating system - so it won't ever take as long as encrypting a full drive, for the reason Dave H said. The reason for this is the malware is there to make money essentially through blackmail. They wouldn't make any money if it encrypted your windows installation.
I think the mac drive encryption does the whole drive including the operating system. Ransom ware usually doesnt encrypt the OS since they couldn't get your money if it did
I love the shadow brokers. I think it's far more ethical to tell everyone about the existence of these exploits and the fact that a so called "Security" agency knew about them and kept them a secret arrogantly thinking that nobody would know. Far more than someone who knows about an exploit and doesn't tell anybody so that everybody is vulnerable. What if some third party found the exploit and used it without telling anybody, far more problems could arise as microsoft wouldn't have put out a patch.
6:52 As a "lone wolf" SysAdmin, this kept me up at night back in 2017...honestly pretty terrifying, the thought of ransomware worm ripping through the corporate LAN you manage! Luckily I was able to react quickly enough and get everything patched.
I had to google what a “sandbox” or “virtual machine” was (to examine how code is being executed in a protected environment) so I really don’t know why I watch some of this stuff but holy hell I learn a lot. Thanks!
it's amusing how the NSA is now whining about how microsoft should have put in a legitimate backdoor for them to use so they wouldn't have to stockpile exploits except microsoft has every right to say "you want us to make you a back door so you can get hacked and lose that too?"
I've switched all my computers to linux. I finished the last one up just a week before this came out. This sort of thing is one of the main motivating factors. Not that viruses don't exist for the platform, or that hackers wont still hack but at least there isn't any major bureaucracy holding up patches.
Organizations with legacy software and legacy OS dependencies should isolate offline computers from machines that can access the web. That's information security 101.
Nicolas W. Wolf Unless that legacy software has an online component. And EternalBlue can attack machines that only talk to the local network in very minimal ways.
12:36 Oh yeah! To minimize this problem, I configured our network so that the Win XP machine can see the scanner, but it cannot connect to the Internet at all. Also, we only turn it on when we need to use the scanner.
Yesterday i was thinking about that ransomware could be a great topic for computerphile and when i woke up today i found this video. I was pleasently surprised.Thanks computerphile
me too, cause government takes its orders from industry lobbyists, else why would 4 out of five big corporations pay no corporate income tax? why would a graph of wealth distribution over time show the richest one percent as owning more wealth than the poorest 90 percent. or is it the poorest 99 percent. in other words, when the rich don't pay and are in charge of tax regulation, they take everything, wall street goes crazy and instead of funding main street, stock values are disconnected from the rest of the economy.
These are the lessons to learn for everybody (any order): - Do your Updates! Always! - Have a backup, do them often, and keep one away from your PC - don't click mail attachments until you are very very very sure them being legit - Forget about antivirus snakeoil rubbish, none of them helps when its critical
To anyone saying "Why not block the Bitcoin address": There is no one "owning" Bitcoin who can define rules for it. No one can stop what Bitcoin has become nor can they change the Bitcoin protocol. It's simply impossible to do such thing, when everything is run P2P and with no owner. Look at it like torrents. "The owners of torrenting" (inventors) cannot simply say "This torrent cannot be downloaded anymore", because they have no authority.
You can turn off Windows 10 updates by stopping the service from running, but there is no "user" option to switch it off. Great video guys, well explained.
I expected to find out about the actual virus. He kinda only summed up the news from this weekend. Does this virus actually encrypt your files? How can you get rid of it? (I am not affected)
Max Maker patch your windows machines, if they aren't. If you get ransomware, you either pay up for the files, or wipe your machine and lose the files, or wipe and restore your files from air-gapped backups. Either way, you should wipe the system because it already has been compromised, and there's no real way of knowing whatever else was put in there.
7 лет назад+13
Does this virus actually encrypt your files? yes it encrypts all the files it can find How can you get rid of it? as far as I know you can't (people who have payed have not received a decryptor or key)
Yes, it actually does encrypt your files. You can get rid of it by removing the files it created, and tweaking some stuff in msconfig and task scheduler (I didn't try this, but that's the usual recipe for removing malware). It won't decrypt your files if you remove it, so consider them lost, but the malware is likely easily removable.
The only interesting thing about this whole situation is the NSA angle. The rest of this is so over-hyped in the media, it's just another day at the office as far as I'm concerned.
if you turn off the wuauserv, you get a companion update application, which demands you to update.I went so far as deleting this server, but it became worse. I got that nag screen once per day.
I'd rather have to remind myself to update it than to have something important to do and little time to do it and be greeted with the message telling me windows is updating upon booting
@Harmit Romey if only decrypting was not IMPOSSIBLE due to the immense amount of computational work needed to be done. So begone, bot. Stop promoting scams and go find a real job.
My girlfriend's dad (not an enthusiast or especially computer savvy) has written down the number of an update which he needs to prevent windows from installing so that he can run Battlefield Vietnam, which he paid for, and a computer that he paid for running an operating system that he paid for. And hence, the case against forced updates.
If you never install the updates, you kind of deserve what comes after them. It's harsh but true. Now, why BF: Vietnam doesn't work is because SECDRV.SYS (the copy protection on the game DVD) had many bugs - one of which allowed for a hackers to remotely control your PC, deploy ransomware, etc. There's loads of news articles if you don't believe me. MS and Macrovision, creator of the DRM, worked together to fix these issues around 2009/2010, but older games that were released before it was fixed are out of luck. MS stopped said versions of Secdrv.sys from working on Windows 10. It can easily be fixed by applying "nocd" patches.
I was actually telling him about nocd cracks last time I was over. If it's a copy protection issue then I will get him set up with one when we go up this weekend, thanks for the tip. However, my point stands that the ability to not install specific updates (and ESPECIALLY feature updates) is relevant to consumers.
In addition to what has been said about manually configuring scheduled tasks or group policies to disable Win10 updates, it's also possible to request a special corporate version of it. There's some fringe cases, where the multi-gigabyte updates over the network are not tenable, or when the computer absolutely cannot suffer unforeseen restarts / performance degradations. There was one case with African wild life reservation posts and their satellite data caps..
For those who got intrested - the best I could identify out of the books on that shelf: Merkow-Breithaupt: Information Security: Principles and Practices, 2nd edition Schneier: Secrets & Lies Antonopoulos: Mastering Bitcoin VA (Springer Books): The Elements of Statistical Learning Schneier: Cryptography Engineering: Design Principles and Practical Applications Anderson: Security Engineering: A Guide to Building Dependable Distributed Systems, 2nd Edition Erickson: Hacking: The Art of Exploitation, 2nd Edition
Hey mike, I know you aren't reading this but thank you so much for being a breath of fresh air when defending Microsoft (the company I do tech support for). We get calls daily from customers who still in 2020 have not upgraded to Windows 10 and blame us for getting a virus on their machine running Windows 7. Thank you Michael Pound!!!
I like how descriptive names in programming are.. WannaCry for a ransomware, RockYou, HashCat, patches etc. Pulling paralels between real life things and digital code bits.
I just don't get these guys that don't want updates ever because of privacy. You are far more likely to get hacked without updates. Your files are more vulnerable to random people online rather than a big organization who is bound to get caught selling information. It is in Microsoft's best interest to keep their users' info safe rather than risk getting a huge shitstorm all over them for the bad practices they might use to make a quick buck.
5:36 but like you said Port 445 should not be open on your WAN interface but it still spread to other networks. This just proves that big router companies had also been exploited by the NSA, don't you think? Also the NSA does not only engage in counter terrorism. They engage in every way to influence world politics to the benefit of their country.
Getting the ransomware out on Friday is a smart move. With people not usually working on the weekends it buys more time for the ransomware to spread before the people can come back to work and fix their systems and such
On the one hand Windows only allowing brief delays in updating is useful for security purposes to keep the system up to date. On the other hand they've made the entire update system a magic black box so that when it breaks it's near impossible to fix. One of my systems keeps just saying "Updates weren't installed, click here to fix" and clicking on the prompt just goes to the setting to configure when to do updates (which aren't working).
The ability to turn off automatic updates (even Windows Updates) is an important ability to have - automatic updates are a potential infection vector. If the upstream side of an connection can be physically intercepted, then IP addresses can be spoofed; packets can be intercepted; even secure connections can be man-in-the-middled, and malware can be sent to the computers downstream when they ask for daily updates. For this reason, many government and business networks purposely re-direct their automatic updates to internal servers; that way updates can be downloaded and scanned or tested on an isolated network before being placed on an internal update server for the rest of the machines to download..
You can turn updates off, one option nowadays is getting the ISO for the updates, a lot of websites have them and it's normally faster and safer than downloading using the Windows function.
Sweyn78, you don't have to pretend, Linux *is* objectively better. Just because security bugs exist doesn't mean they're easy to utilize/exploit, and in the case of MS Windows, some of the security vulnerabilities are even touted as "features" (see Win10's telemetry), so there is no comparison.
Sweyn78, Linux is currently the most popular OS in the world, so I'm not sure how you reached that conclusion. If you're talking about desktop in particular then that's something else, though desktop users benefit from the same security patches that are applied to other forms of Linux, so they are not any less protected. Also, most of Linux's _funding_ comes in the form of man hours contributed by big businesses and organizations that utilize or depend on it (i.e. they'd rather pay their own developers, than donate to unmanaged volunteers), so this is at worst a minor problem for FOSS, and at best, an advantage, because it allows professionals with varying levels of expertise, backgrounds and agendas to contribute to the same projects.
when win10 turns off when I'm 3d printing half way through a print or using CCTV is not very helpful is it I could be using my pc for anything and I can't stop it restarting and sitting on the login screen
Jeff, a lot of times these updates are pre-downloaded days in advance, and the machine is already set to do a restart at the absolutely most inopportune time. Shutting the internet down on that machine won't help.
Mark Williams You can tell Windows when the best time to install updates is. So long g as your computer is on at that time, it will install and restart
The reboot is triggered by a scheduled task called Reboot located in Microsoft\Windows\UpdateOrchestrator. Create a scheduled task that will trigger off of event ID 4702 (scheduled task updated), check if the Reboot task has any triggers and if so, delete them (it's also useful to pop a message box so you're aware updates are ready). This way every time Windows schedules a restart to install updates, the restart will immediately be disabled. EDIT: Scheduled task creation/deletion/update/… logging is disabled by default, so make sure to enable it first or this won't work.
In light of this video, I thought I might share some of my basic knowledge of exploits. While I don't necessarily understand all the code and computer science that goes into making an exploit, I get the gist of them. Either way, allow me to potentially humble most of you all: Some people in the comments section here are saying (or might) say things like "use Linux", "this is why not to use Windows" or "use macOS or iOS", etc. What they've failed to realize is that every piece of software has its bugs, and subsequently has vulnerabilities. If they would have watched the video through, and listened, they would have learned this. macOS, iOS, Linux, FreeBSD, Windows, Android, and the like all have their own histories with malware. Yes, you heard me right, the impenetrable iOS, FreeBSD, and the tech-friendly Linux all have had malware or various exploits that could and or would allow for a potential malware attack. I remember that a while back that there was the "Wirelurker" virus for Apple's iOS platform. Now, while it mostly affected Apple users in China, it may have hit some US users or other users around the world. Put simply, the Apple doesn't fall far from the tree when it comes to malware.Put simply, Apple, as all other major tech companies and their various operating systems, are subject to the laws of computers, code, and programming. In those laws, they are thereby subject to potential exploitation just as all other software and hardware developers are. However, apple has the kind of attitude that its systems are impenetrable, and are the most secure in the world. While the latter may be true, Fort Knox or even the most secure operating system is open to exploitation if the conditions are right. When it comes to Apple, they really need to get straight with their users and fix the potential mess that is iOS. I say this because if your iOS device (assuming you have one) is hacked or gets malware, what are you going to do about it. It's not like there are any antiviruses on the App Store. If Apple's "walled garden's" wall is broken, can become a swampy mess of code and malware. I'm honestly sitting back and waiting to see if a potential Samsung PR nightmare for Apple surfaces in spite of Apple's stubbornness to consider anything other what it thinks it "perfect" in terms of operating systems. Get real, Steve Job's dream of a "virus-free" Apple device is dead. This attitude that this is sill the case should've died with that dream. It simply is not realistic. I could rant on and on for days about Apple and their "security precautions," but I'll save that for another day. Now, for those Linux geeks out there: Your systems are just as vulnerable as Windows and macOS. There may not be as much malware, worms, or trojans for Linux and its "distros" or "distributions", but that doesn't mean that you are all exempt from hacks and exploits. If any of you are into jailbreaks for gaming consoles, you may recall that the PS4 was hacked on its system firmware version 1.76 and below using a FreeBSD exploit. This is due to the fact that Sony based its own 'OrbisOS' off of FreeBSD. This also opens up a completely different discussion that operating systems that are based on other ones are very likely to become vulnerable if its base's code becomes knowingly exploitable. As with anything digital in today's world, if hackers want in, they'll eventually find a way in. That's just how the system works. All in all, it is always wise to have a working and well-respected antivirus and keep your system up to date. If you do this, you are much less likely to be vulnerable and potentially lose your hardware or hard earned money. Then again, ALWAYS keep your eyes pried for potential "gray areas" when using your devices. Sites, emails, etc. that look fishy usually are. In other words, just use common sense (which I swear isn't common anymore) and make sure you're prepared, and you'll likely make it smoothly through modern, seemingly more and more digitized life.
I also love this channel for its crystal clear thinking, strategizing, and common sense that it gives its viewers on RUclips. Kudos to you, computerphile... :)
I feel like this guy likes Microsoft updates too much. I've lost a lot of work and data due to those "we're restarting your computer now while your waiting for you render to finish" popups; and who knows how much data they've collected with windows 10 users.
funnily enough none of these random restarts have happend to me in all my time using windows 10. and yes ive left my computer alone on multiple occasions for several hours to finish a 3d render or something else.
They're right you know, you're able to stop the updates by disabling and shutting down the update service if you're that worried about it shutting down while rendering and only turning it back on when you're done rendering.
Who need ransomware when windows update screws my PC so much it doesn't even know it has windows. Twice... On the bright side, I now have a backup of everything (twice)
Usually companies won't update computers on their network right away after an update is release, because they tend to test the updates first too see if they don't cause any trouble before sending it out to computers on their network. That's also a reason why many companies were affected by this.
No they actually don't, because they can't collect the data on what programs are currently running on your processor or what you currently have loaded in RAM. And they don't have listeners for my I/O throughput so they can't collect individual keystrokes for example, unless I'm currently using the RUclips service. However one of the first things spotted in W10 was that for every keystroke made generated a network package sent out to Microsoft servers, and just a few month ago they showed a report of what programs people used on W10 most, how long they were actively using each program and a bunch of other statistics.
![[#2024MAMA] ROSÉ (로제), Bruno Mars - APT. | Mnet 241122 방송](http://i.ytimg.com/vi/dgGqD28J6aQ/mqdefault.jpg)
Officer: How did the hacker escape?
Me: I don't know he just ransomware
Oh you...!!!
BOI U A GENIUS
ba dum tsssss
Lol
excellent one ^^
I hope this guy will be in many more videos on this channel. I find the stuff he is talking about so fascinating.
He gave the most calm, reasoned and sensible explanation of this whole debacle that I have come across so far.
CounterKitty same here. He does a lot of interesting videos on this channel. More of him please.
Agreed. I sat here and listened to the entire 15 min talk
This is a great channel, but I enjoy watching his stuff the most!
same
So the MalwareTech dude that he was talking about, he found the killswitch and then was hailed a hero. He lived in the UK and went to Las Vegas for a vacation and guess what? The FBI arrested him at the airport. It's because in his younger years when he was learning how to hack, he made a malware which he mistakenly sold to someone. The malware was then incorporated with Kronos which led to sensitive bank information to be leaked. He had trials and he wasn't allowed to leave the U.S. nor, was he allowed to legally work there for 18 months. He finally gave up and accepted his charges. On the day of his sentencing, the Judge let him go as he had done the world a huge favor by finding the killswitch and disabling WanaCry ransomware. A very interesting documentary, indeed! {also, when he was arrested, he was left on bail on a bond of $30k, his story got out in his country and the very second day, the community had paid it off completely!}
"All software have bugs" um rude, my Hello World program is perfect and has no bugs, how dare you.
if it doesn't have any bugs, it doesn't have enough features.
WolfireGaming HAHAHHAAHAHHA. The bug, it doesn't say hello RUclips
```
#!/usr/bin/env python
print("Hello, World!")
```
PROGRAM HELLO
PRINT *, "HELLO WORLD!"
END PROGRAM HELLO
+4lligator FORTRAN! Ayy!
Someone hacked the NSA and stole their backdoor exploits. Damn, those dudes must have a seriously large set of balls.
😂😂
I believe that is the first time someone argued for the forced updates in Windows 10
yes, indeed. I still want to decide when or if I want to update my system.. just a few days ago I got this lovely unnecessary "Windows creator" update, which brought me a few new programms I'll never use and in return my desktop icons are slightly offset to the top (its just a handfull of pixels, but I still notice it, its kinda annoying).
BS, security experts have always been a fan of it. Of course there's stuff attached to it which is less desirable, but the basic premise of forced security updates isn't too controversial.
I think the only problem with automatic Windows updates is that they require system restart.
Patryk Pawleta With an SSD, this is done in no time at all.
rainbowevil That's impossible.
*aggressively installs updates*
LET ME SEE YOUR WAR FACE oДo
*installation* *intensifies*
_passive aggressively installs update_
Secretly turns back on auto update after 2 years
Stallman Was Right
"If you're running XP, the first think you should do is turn off your machine because you have no business running XP" lol
He doesn't know WTF he is talking about. He is only a spokesperson.
Found the Windows XP user.
XP
should? there's lots of things I should and shouldn't do. I love XP inside a container with no online or network access so i can torture it after it's creator screwed with Linux for years. "Linux is a cancer that NEEDS to be eradicated!"
shody ryon linux is for big brain users only
The problem with Microsofts update policy is they don't discern between security, driver and feature updates.
Security updates should be installed instantly.
Driver updates can break whole system. Nvidia.seems very prone to this.
Feature Updates are almost guaranteed to introduce new bugs.
Kyoko Kobayashi I like how you didn't mention bug fixes at all 😂
@sonicscrewdriverdw
While there is a potential 4th category for bug fixes, the non critical like changed currency symbol of Azerbaijan, generally bug fixes can be categorized in the 3 categories I mentioned.
Kyoko Kobayashi
Microsoft is at least trying. Even XP got security updates and it's normally not supported anymore.
Kyoko Kobayashi Yep. Sums up the problems with Windows 10's forced updates.
Also it shouldn't auto update when I am using or could be using my computer. That gets annoying quick
*NSA* ~ _We put surveillance above our countries safety._
no not really, they make these ransomewares so that if terrorists find something out like a nuclear weapon they can encript all their files, you don't get that though scince you don't work in the NSA
@@somethingcool9063 That's not how things work lol...
SomethingCool
Yeah, because someone with your level of control on English worked for the NSA
Country's*
I think failure to report a vulnerability like this should be a crime, but we all know NSA is outside of the law
You can thank the NSA for this hack.
Vercusgames wut
+Vercusgames lol is this a joke?
Not even enough for heir breakfast.
Dr Strangelove noooo it got leaked buddy. not sure where you heard that from
Spy it got leaked?? the video says that exploit has been up since windows xp, why didn't the NSA inform Microsoft about the said issue, its because they're taking that exploit as an advantage to hack peoples computer to spy..
Paid $300 to get my computer decrypted so I could watch this video
(It's a joke)
No. You have not.
You got me
Money well spent.
_"You got me"_
Yes. You got gotten. Now, please pay $300 to the following bitcoin address in order to proceed.
Fortunately for me, my computer already has so many viruses on it theres no room for any more!
I actually laughed, thank you! :D
antipoti why
Worst case it renders all tge other viruses useless by encrypting them
@@R3lay0 why worst.?
Like in the simpsons when mr burns goes for a health checkup and has every disease on earth...indestructible
Dr. Pound is my favorite presenter you feature on this channel. He's very well spoken and clear in his explanations. I also enjoy his drawings that illustrate what he is talking about.
How is it that my mac takes hours to encrypt my drive/files, but this thing does it in seconds?
Great point. Thats what I have been wondering. And for me some preparation before I could encrypt, then as you say, time is needed to encrypt
There are different levels of encryption. It could be doing a simpler one. When you perform a full disk encryption, it's also encrypting the free space for future use.
There is a finite list of extensions (around 50) that crytolockers look for .doc .docx .jpg etc.- the important ones to you, not an operating system - so it won't ever take as long as encrypting a full drive, for the reason Dave H said. The reason for this is the malware is there to make money essentially through blackmail. They wouldn't make any money if it encrypted your windows installation.
I think the mac drive encryption does the whole drive including the operating system. Ransom ware usually doesnt encrypt the OS since they couldn't get your money if it did
Huh easy just modify extensions of important files to protect against ransom-ware or keep backups
it's a vulnerability in SMB1 (Super Mario Brothers)
Gah! SMB has always been my weakness!!
Knuckles the Echidna aha, that makes sense, thanks
Knuckles the Echidna are you going to be in sonic forces?
Ohh I'm hoping Sega make me the main character!
Sonic Forces & Knuckles
That 1940's Ford Analogy was beautiful
HEHE
Yes
14:24 "we're doing this to fu.... counter terrorism"
lol
to fight you imbecile
@@tmcowley Cowley boy
I love the shadow brokers. I think it's far more ethical to tell everyone about the existence of these exploits and the fact that a so called "Security" agency knew about them and kept them a secret arrogantly thinking that nobody would know. Far more than someone who knows about an exploit and doesn't tell anybody so that everybody is vulnerable. What if some third party found the exploit and used it without telling anybody, far more problems could arise as microsoft wouldn't have put out a patch.
If you're smart enough to figure out how to pay the ransom you're probably not running XP
6:52 As a "lone wolf" SysAdmin, this kept me up at night back in 2017...honestly pretty terrifying, the thought of ransomware worm ripping through the corporate LAN you manage! Luckily I was able to react quickly enough and get everything patched.
I had to google what a “sandbox” or “virtual machine” was (to examine how code is being executed in a protected environment) so I really don’t know why I watch some of this stuff but holy hell I learn a lot. Thanks!
A "Do not try this at home" on Computerphile. That's a first... right?
it's amusing how the NSA is now whining about how microsoft should have put in a legitimate backdoor for them to use so they wouldn't have to stockpile exploits
except microsoft has every right to say "you want us to make you a back door so you can get hacked and lose that too?"
I've switched all my computers to linux. I finished the last one up just a week before this came out. This sort of thing is one of the main motivating factors. Not that viruses don't exist for the platform, or that hackers wont still hack but at least there isn't any major bureaucracy holding up patches.
Organizations with legacy software and legacy OS dependencies should isolate offline computers from machines that can access the web. That's information security 101.
Nicolas W. Wolf Unless that legacy software has an online component. And EternalBlue can attack machines that only talk to the local network in very minimal ways.
Stuxnet proved that you can't isolate yourself from malware.
12:36 Oh yeah! To minimize this problem, I configured our network so that the Win XP machine can see the scanner, but it cannot connect to the Internet at all. Also, we only turn it on when we need to use the scanner.
I have always been fascinated by the engineering that goes into crafting these malwares. Just mind blowing details
Yesterday i was thinking about that ransomware could be a great topic for computerphile and when i woke up today i found this video. I was pleasently surprised.Thanks computerphile
no link to the exe in the video description??? wtf, unsubbed
burnzy3210 You can't unsubscribe until you pay 300$
That moment when the reply gets more likes than the comment itself.
Spiky. mey 2
I have the exe. WannaLink? :P
wtf i hate Grumpfh now
I want Dr. Pound to teach me Computer Science. I wish I had him when I was in college
It always scares me when someone says, "I'm from the government. I'm here to help. Trust me."
me too, cause government takes its orders from industry lobbyists, else why would 4 out of five big corporations pay no corporate income tax? why would a graph of wealth distribution over time show the richest one percent as owning more wealth than the poorest 90 percent. or is it the poorest 99 percent. in other words, when the rich don't pay and are in charge of tax regulation, they take everything, wall street goes crazy and instead of funding main street, stock values are disconnected from the rest of the economy.
This guy is such a great host. Videos about very intriguing topics and explains everything very well
These are the lessons to learn for everybody (any order):
- Do your Updates! Always!
- Have a backup, do them often, and keep one away from your PC
- don't click mail attachments until you are very very very sure them being legit
- Forget about antivirus snakeoil rubbish, none of them helps when its critical
To anyone saying "Why not block the Bitcoin address": There is no one "owning" Bitcoin who can define rules for it. No one can stop what Bitcoin has become nor can they change the Bitcoin protocol. It's simply impossible to do such thing, when everything is run P2P and with no owner. Look at it like torrents. "The owners of torrenting" (inventors) cannot simply say "This torrent cannot be downloaded anymore", because they have no authority.
The power of convention
I'm using the Ransomware splash screen as my wallpaper right now.
Zanaris Falador I wanna do that
8:58 "volkswagon emission situation", lol, this is gold.
It is not the first time they say that
Dr. Pound's videos are the highlight of this channel for me. Great work.
You can turn off Windows 10 updates by stopping the service from running, but there is no "user" option to switch it off.
Great video guys, well explained.
I can't wait for someone to exploit a update server, everyone will be so confused.
It's been done, possibly even before your comment was made (Piriform was twice a victim of this).
@@grn1 yep it's SOP for hackers.
exploit "an" update ..you sucker
I expected to find out about the actual virus. He kinda only summed up the news from this weekend. Does this virus actually encrypt your files? How can you get rid of it? (I am not affected)
Max Maker patch your windows machines, if they aren't. If you get ransomware, you either pay up for the files, or wipe your machine and lose the files, or wipe and restore your files from air-gapped backups. Either way, you should wipe the system because it already has been compromised, and there's no real way of knowing whatever else was put in there.
Does this virus actually encrypt your files? yes it encrypts all the files it can find
How can you get rid of it? as far as I know you can't (people who have payed have not received a decryptor or key)
yes it does encrypt your files no you can't remove it or at least not easily
Yes, it actually does encrypt your files. You can get rid of it by removing the files it created, and tweaking some stuff in msconfig and task scheduler (I didn't try this, but that's the usual recipe for removing malware). It won't decrypt your files if you remove it, so consider them lost, but the malware is likely easily removable.
I hope to do a video on the actual encryption soon! We didn't want this one to be too long.
*UPDATES SYSTEM AGRESSIVELY*
*copies comments aggressively*
@@ProgrammerSheep replies agressively
I can't believe I haven't found this channel before. I learnt about all of this type of malware but I never saw one in action.
I love the new content you guys are making, this channel is quickly becoming my favorite! Keep up the good work guys!
The only interesting thing about this whole situation is the NSA angle. The rest of this is so over-hyped in the media, it's just another day at the office as far as I'm concerned.
thing is windows updates tend to break things much more frequently than attacks from the vulnerabilities they patch
>
Yeah, and win 10 is patching non functional drivers over my existing working one ={
you can turn it off by disabling the windows update service.
but is just one rouge update =
if you turn off the wuauserv, you get a companion update application, which demands you to update.I went so far as deleting this server, but it became worse. I got that nag screen once per day.
and it keylogs every keystroke right back to Microsoft/NSA/CIA/Homeland Security
@@SkinnyCow. you mean Mossad...
I only watch Computerphile videos when this guy is doing the videos
"You've got no business running xp" tell that to ATM manufacturers running SP4.
You CAN turn off the updates for windows 10. Juest not the clasic way. Some service tweaks and registry tweaks can do anything on windows.
Yeah, but don't.
updates> windows crashes
doesn't update> people crash windows
I guess I just need to find fixes faster then
all you need to do is disable the update service.
I'd rather have to remind myself to update it than to have something important to do and little time to do it and be greeted with the message telling me windows is updating upon booting
Easy turn off your wifi saved alot of time for you!
I always thought it was called "WanaCry" since it made you wanna cry.
@Harmit Romey if only decrypting was not IMPOSSIBLE due to the immense amount of computational work needed to be done. So begone, bot. Stop promoting scams and go find a real job.
My girlfriend's dad (not an enthusiast or especially computer savvy) has written down the number of an update which he needs to prevent windows from installing so that he can run Battlefield Vietnam, which he paid for, and a computer that he paid for running an operating system that he paid for. And hence, the case against forced updates.
If you never install the updates, you kind of deserve what comes after them. It's harsh but true.
Now, why BF: Vietnam doesn't work is because SECDRV.SYS (the copy protection on the game DVD) had many bugs - one of which allowed for a hackers to remotely control your PC, deploy ransomware, etc. There's loads of news articles if you don't believe me.
MS and Macrovision, creator of the DRM, worked together to fix these issues around 2009/2010, but older games that were released before it was fixed are out of luck. MS stopped said versions of Secdrv.sys from working on Windows 10.
It can easily be fixed by applying "nocd" patches.
I was actually telling him about nocd cracks last time I was over. If it's a copy protection issue then I will get him set up with one when we go up this weekend, thanks for the tip. However, my point stands that the ability to not install specific updates (and ESPECIALLY feature updates) is relevant to consumers.
@@InsaneGamersOfficial You’re totally missing the point; they “got what was coming to them” because they were FORCED to install the updates!
In addition to what has been said about manually configuring scheduled tasks or group policies to disable Win10 updates, it's also possible to request a special corporate version of it. There's some fringe cases, where the multi-gigabyte updates over the network are not tenable, or when the computer absolutely cannot suffer unforeseen restarts / performance degradations. There was one case with African wild life reservation posts and their satellite data caps..
For those who got intrested - the best I could identify out of the books on that shelf:
Merkow-Breithaupt: Information Security: Principles and Practices, 2nd edition
Schneier: Secrets & Lies
Antonopoulos: Mastering Bitcoin
VA (Springer Books): The Elements of Statistical Learning
Schneier: Cryptography Engineering: Design Principles and Practical Applications
Anderson: Security Engineering: A Guide to Building Dependable Distributed Systems, 2nd Edition
Erickson: Hacking: The Art of Exploitation, 2nd Edition
This is why the backdoor should be off limits...unless it's consensual.
My backdoors off limits until at least the 3rd date
My back door is intact.
11:37 Jokes on you! I'm running Windows ME...
One should be able to turn off annoying UI updates and leave only important security ones
you can turn it off by disabling the windows update service.
does it keep the important security updates?
I could listen to this guy talk all day
The volkswagen analogy is quite apropos!
"No one in Nottingham as far as we know has got it" sounds like he's talking about a way too familiar virus
Ad-blocker will keep me safe.
Hey mike, I know you aren't reading this but thank you so much for being a breath of fresh air when defending Microsoft (the company I do tech support for). We get calls daily from customers who still in 2020 have not upgraded to Windows 10 and blame us for getting a virus on their machine running Windows 7. Thank you Michael Pound!!!
With the exception that Windows 10 is the malware.
This gent is doing things for me with his intelligence and simple explanations.
Aside that - this channel is fantastic. Thank you.
I like how descriptive names in programming are.. WannaCry for a ransomware, RockYou, HashCat, patches etc. Pulling paralels between real life things and digital code bits.
I just don't get these guys that don't want updates ever because of privacy. You are far more likely to get hacked without updates. Your files are more vulnerable to random people online rather than a big organization who is bound to get caught selling information. It is in Microsoft's best interest to keep their users' info safe rather than risk getting a huge shitstorm all over them for the bad practices they might use to make a quick buck.
Thanks NSA.
5:36 but like you said Port 445 should not be open on your WAN interface but it still spread to other networks. This just proves that big router companies had also been exploited by the NSA, don't you think?
Also the NSA does not only engage in counter terrorism. They engage in every way to influence world politics to the benefit of their country.
They hate us too dont worry
Getting the ransomware out on Friday is a smart move. With people not usually working on the weekends it buys more time for the ransomware to spread before the people can come back to work and fix their systems and such
On the one hand Windows only allowing brief delays in updating is useful for security purposes to keep the system up to date. On the other hand they've made the entire update system a magic black box so that when it breaks it's near impossible to fix. One of my systems keeps just saying "Updates weren't installed, click here to fix" and clicking on the prompt just goes to the setting to configure when to do updates (which aren't working).
Windows is so insecure that even malware encrypts the data for you.
*trojan virus starts spreading in China*
China 3 years later: “oh yeah check this out”
National Insecurity Agency
The ability to turn off automatic updates (even Windows Updates) is an important ability to have - automatic updates are a potential infection vector. If the upstream side of an connection can be physically intercepted, then IP addresses can be spoofed; packets can be intercepted; even secure connections can be man-in-the-middled, and malware can be sent to the computers downstream when they ask for daily updates. For this reason, many government and business networks purposely re-direct their automatic updates to internal servers; that way updates can be downloaded and scanned or tested on an isolated network before being placed on an internal update server for the rest of the machines to download..
You can turn updates off, one option nowadays is getting the ISO for the updates, a lot of websites have them and it's normally faster and safer than downloading using the Windows function.
Excellent video. :) Describes the problem calmly, without all the media hype. I will link anyone with questions about it to this video.
Y'all need to bring Tom back on for some episodes, his videos are by far the most popular.
*laughs in linux*
Hope you like your non existent game support
Axtronima, Hope you like your non existent privacy and security, while I enjoy my 588 games on Steam. :)
Axtronima, viruses could just as easily look like updates for your currently installed programs, so hope you like living in constant fear. :)
Sweyn78, you don't have to pretend, Linux *is* objectively better. Just because security bugs exist doesn't mean they're easy to utilize/exploit, and in the case of MS Windows, some of the security vulnerabilities are even touted as "features" (see Win10's telemetry), so there is no comparison.
Sweyn78, Linux is currently the most popular OS in the world, so I'm not sure how you reached that conclusion. If you're talking about desktop in particular then that's something else, though desktop users benefit from the same security patches that are applied to other forms of Linux, so they are not any less protected. Also, most of Linux's _funding_ comes in the form of man hours contributed by big businesses and organizations that utilize or depend on it (i.e. they'd rather pay their own developers, than donate to unmanaged volunteers), so this is at worst a minor problem for FOSS, and at best, an advantage, because it allows professionals with varying levels of expertise, backgrounds and agendas to contribute to the same projects.
Have you considered changing your name to Dr. Hashtag?
Dr. Octothorpe would be more dignified... and menacing.
Props for the Volkswagen emissions reference.
I love Dr. Pound's discussions :)
*dons tinfoil hat* Maybe Microsoft, as part of their campaign to make everyone update to Windows 10, they released it.
could my windows 98 be affected wannaCry? or is it indeed 9,8 times as secure as windows 10 by now?
Only one way to find out... what's your email address?
1) Cyber security.
2) Amazing accent
Ok, I'll watch it
I was waiting for your video since Saturday! :)
i could watch this guy all day.very entertaining bloke...
when win10 turns off when I'm 3d printing half way through a print or using CCTV is not very helpful is it I could be using my pc for anything and I can't stop it restarting and sitting on the login screen
You could always unplug your Ethernet cable.
Jeff, a lot of times these updates are pre-downloaded days in advance, and the machine is already set to do a restart at the absolutely most inopportune time. Shutting the internet down on that machine won't help.
Mark Williams You can tell Windows when the best time to install updates is. So long g as your computer is on at that time, it will install and restart
The reboot is triggered by a scheduled task called Reboot located in Microsoft\Windows\UpdateOrchestrator. Create a scheduled task that will trigger off of event ID 4702 (scheduled task updated), check if the Reboot task has any triggers and if so, delete them (it's also useful to pop a message box so you're aware updates are ready). This way every time Windows schedules a restart to install updates, the restart will immediately be disabled.
EDIT: Scheduled task creation/deletion/update/… logging is disabled by default, so make sure to enable it first or this won't work.
If you have win10 pro (which you should have if you are running CCTV on it), you can disable automatic updates via group policy.
In light of this video, I thought I might share some of my basic knowledge of exploits. While I don't necessarily understand all the code and computer science that goes into making an exploit, I get the gist of them. Either way, allow me to potentially humble most of you all:
Some people in the comments section here are saying (or might) say things like "use Linux", "this is why not to use Windows" or "use macOS or iOS", etc. What they've failed to realize is that every piece of software has its bugs, and subsequently has vulnerabilities. If they would have watched the video through, and listened, they would have learned this.
macOS, iOS, Linux, FreeBSD, Windows, Android, and the like all have their own histories with malware. Yes, you heard me right, the impenetrable iOS, FreeBSD, and the tech-friendly Linux all have had malware or various exploits that could and or would allow for a potential malware attack.
I remember that a while back that there was the "Wirelurker" virus for Apple's iOS platform. Now, while it mostly affected Apple users in China, it may have hit some US users or other users around the world. Put simply, the Apple doesn't fall far from the tree when it comes to malware.Put simply, Apple, as all other major tech companies and their various operating systems, are subject to the laws of computers, code, and programming. In those laws, they are thereby subject to potential exploitation just as all other software and hardware developers are.
However, apple has the kind of attitude that its systems are impenetrable, and are the most secure in the world. While the latter may be true, Fort Knox or even the most secure operating system is open to exploitation if the conditions are right. When it comes to Apple, they really need to get straight with their users and fix the potential mess that is iOS. I say this because if your iOS device (assuming you have one) is hacked or gets malware, what are you going to do about it. It's not like there are any antiviruses on the App Store. If Apple's "walled garden's" wall is broken, can become a swampy mess of code and malware. I'm honestly sitting back and waiting to see if a potential Samsung PR nightmare for Apple surfaces in spite of Apple's stubbornness to consider anything other what it thinks it "perfect" in terms of operating systems. Get real, Steve Job's dream of a "virus-free" Apple device is dead. This attitude that this is sill the case should've died with that dream. It simply is not realistic. I could rant on and on for days about Apple and their "security precautions," but I'll save that for another day.
Now, for those Linux geeks out there: Your systems are just as vulnerable as Windows and macOS. There may not be as much malware, worms, or trojans for Linux and its "distros" or "distributions", but that doesn't mean that you are all exempt from hacks and exploits. If any of you are into jailbreaks for gaming consoles, you may recall that the PS4 was hacked on its system firmware version 1.76 and below using a FreeBSD exploit. This is due to the fact that Sony based its own 'OrbisOS' off of FreeBSD. This also opens up a completely different discussion that operating systems that are based on other ones are very likely to become vulnerable if its base's code becomes knowingly exploitable.
As with anything digital in today's world, if hackers want in, they'll eventually find a way in. That's just how the system works. All in all, it is always wise to have a working and well-respected antivirus and keep your system up to date. If you do this, you are much less likely to be vulnerable and potentially lose your hardware or hard earned money. Then again, ALWAYS keep your eyes pried for potential "gray areas" when using your devices. Sites, emails, etc. that look fishy usually are. In other words, just use common sense (which I swear isn't common anymore) and make sure you're prepared, and you'll likely make it smoothly through modern, seemingly more and more digitized life.
I also love this channel for its crystal clear thinking, strategizing, and common sense that it gives its viewers on RUclips. Kudos to you, computerphile... :)
For a channel called Computerphile, there sure is a lot of misinformation in the comments.
I love the cubes in the background
Love the Dr Pound videos, never fails to be interesting!
I feel like this guy likes Microsoft updates too much. I've lost a lot of work and data due to those "we're restarting your computer now while your waiting for you render to finish" popups; and who knows how much data they've collected with windows 10 users.
you can turn updates off by disabling the windows update service.
You haven't dealt with windows 10 all too much have you?
funnily enough none of these random restarts have happend to me in all my time using windows 10. and yes ive left my computer alone on multiple occasions for several hours to finish a 3d render or something else.
ropelli321 me either
They're right you know, you're able to stop the updates by disabling and shutting down the update service if you're that worried about it shutting down while rendering and only turning it back on when you're done rendering.
Who need ransomware when windows update screws my PC so much it doesn't even know it has windows.
Twice...
On the bright side, I now have a backup of everything (twice)
you can turn updates off by disabling the windows update service.
So funny here from my linux desktop...
i would like to see more malware videos from computerphile
Usually companies won't update computers on their network right away after an update is release, because they tend to test the updates first too see if they don't cause any trouble before sending it out to computers on their network. That's also a reason why many companies were affected by this.
win10-: get our spywares to not get ransomwares
Soumik Sarkhel RUclips knows more about you. All companies do this
No they actually don't, because they can't collect the data on what programs are currently running on your processor or what you currently have loaded in RAM. And they don't have listeners for my I/O throughput so they can't collect individual keystrokes for example, unless I'm currently using the RUclips service.
However one of the first things spotted in W10 was that for every keystroke made generated a network package sent out to Microsoft servers, and just a few month ago they showed a report of what programs people used on W10 most, how long they were actively using each program and a bunch of other statistics.
How about just not use Windows?
tylertyler82 then people will make viruses for Linux.
do you even linux bruh
Dr Pound it's always a good information and content =D
I'm italian and I appreciate it!
Thanks Computerphile
I would love for this man to be my professor. So personable and knowledgeable.