this post was submitted on 08 Oct 2023
778 points (98.6% liked)
Programmer Humor
31812 readers
288 users here now
Post funny things about programming here! (Or just rant about your favourite programming language.)
Rules:
- Posts must be relevant to programming, programmers, or computer science.
- No NSFW content.
- Jokes must be in good taste. No hate speech, bigotry, etc.
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The advice I've always heard is disconnect network but leave powered for forensics/recovery. Some ransomware store the decryption key soley in memory, so it is lost upon power loss
That actually makes sense. We had a ransomware attack once. We also disconnected the device but I cant remember if we powered it off. At the time it stopped encrypting due to that since our network drives were not reachable anymore.
Is there actually a way to spread the encryption process to a server?
Im not a it expert at alll. But reallly ?
Best I understand the encryption key is needed to encrypt and decrypt, so if the malware isn't written well enough it may well continue to store the encryption key in memory.
There's some old malware on archive.org that just pulls the FAT off the filesystem into memory and offers a dice roll to restore it