* [dm-crypt] Fwd: Encryption info [not found] <7FD87F5D-AD43-4CC1-8FBA-724919533835@it-inc.co.za> @ 2015-01-05 9:51 ` Gary Evetts 2015-01-05 12:54 ` Arno Wagner 2015-01-06 6:47 ` Heinz Diehl 0 siblings, 2 replies; 4+ messages in thread From: Gary Evetts @ 2015-01-05 9:51 UTC (permalink / raw) To: dm-crypt [-- Attachment #1.1: Type: text/plain, Size: 1161 bytes --] Good Day, Please see attached the following pics of the screen I came to see when looking at our 2003 server after the holiday season interval. I am presuming the invidual/s who have done this have used your software to encrypt the data files on the server. Only through google search of the email address they are using to correspond their demands with, did I find a link to your website. I believe I have traced the infiltration source app with the server logs - that being Terminal services. They then used the built in Administrator account ton the 24 December to log onto the server which was not logged in at the time but only on the log-on screen. What that password is - is unknown to me as it is the default build account. Are you able to help me with the un-encrypting of the data files that have been encrypted or are the offenders the only source of a resolution? Many thanks, Regards, Gary ---------- Forwarded message ---------- From: Gary Evetts <gary@it-inc.co.za> Date: 5 January 2015 at 10:08 Subject: Encryption info To: "gcevetts@gmail.com" <gcevetts@gmail.com> Regards, Gary Evetts IT-Inc 072 211 1613 www.it-inc.co.za [-- Attachment #1.2: Type: text/html, Size: 1729 bytes --] [-- Attachment #2: photo 1.JPG --] [-- Type: image/jpeg, Size: 138327 bytes --] [-- Attachment #3: photo 2.JPG --] [-- Type: image/jpeg, Size: 109490 bytes --] ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dm-crypt] Fwd: Encryption info 2015-01-05 9:51 ` [dm-crypt] Fwd: Encryption info Gary Evetts @ 2015-01-05 12:54 ` Arno Wagner 2015-01-06 6:47 ` Heinz Diehl 1 sibling, 0 replies; 4+ messages in thread From: Arno Wagner @ 2015-01-05 12:54 UTC (permalink / raw) To: dm-crypt Yes, you got owned by some criminals. But cryptsetup is exceedingly unlikely to have anything to do with this, as it runs only on Linux and you seem to be on Windows. Sorry, we cannot help you. The common wisdom with these types of people are though that most seem to be taking the money but will not provide any decryption key. Side note to others here: This seems genuine if rather clueless. At least virustotal did not find anything in the jpegs. Arno On Mon, Jan 05, 2015 at 10:51:28 CET, Gary Evetts wrote: > Good Day, > > Please see attached the following pics of the screen I came to see when > looking at our 2003 server after the holiday season interval. I am > presuming the invidual/s who have done this have used your software to > encrypt the data files on the server. Only through google search of the > email address they are using to correspond their demands with, did I find a > link to your website. I believe I have traced the infiltration source app > with the server logs - that being Terminal services. They then used the > built in Administrator account ton the 24 December to log onto the server > which was not logged in at the time but only on the log-on screen. What > that password is - is unknown to me as it is the default build account. > > Are you able to help me with the un-encrypting of the data files that have > been encrypted or are the offenders the only source of a resolution? > > Many thanks, > > Regards, > > Gary > > > ---------- Forwarded message ---------- > From: Gary Evetts <gary@it-inc.co.za> > Date: 5 January 2015 at 10:08 > Subject: Encryption info > To: "gcevetts@gmail.com" <gcevetts@gmail.com> > > > > > > > > > > > > > Regards, > > Gary Evetts > > IT-Inc > 072 211 1613 > www.it-inc.co.za > _______________________________________________ > dm-crypt mailing list > dm-crypt@saout.de > http://www.saout.de/mailman/listinfo/dm-crypt -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- A good decision is based on knowledge and not on numbers. -- Plato If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dm-crypt] Fwd: Encryption info 2015-01-05 9:51 ` [dm-crypt] Fwd: Encryption info Gary Evetts 2015-01-05 12:54 ` Arno Wagner @ 2015-01-06 6:47 ` Heinz Diehl 2015-01-06 8:33 ` Arno Wagner 1 sibling, 1 reply; 4+ messages in thread From: Heinz Diehl @ 2015-01-06 6:47 UTC (permalink / raw) To: dm-crypt On 05.01.2015, Gary Evetts wrote: > Are you able to help me with the un-encrypting of the data files that have > been encrypted or are the offenders the only source of a resolution? LUKS/cryptsetup is not used here, since you are on Windows. However, you should check if your files are actually encrypted or not. For me, there's a possibility that they only want you to click on the .EXE, with all the nasty consequences this could have. Btw: You have a backup of your data? ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dm-crypt] Fwd: Encryption info 2015-01-06 6:47 ` Heinz Diehl @ 2015-01-06 8:33 ` Arno Wagner 0 siblings, 0 replies; 4+ messages in thread From: Arno Wagner @ 2015-01-06 8:33 UTC (permalink / raw) To: dm-crypt On Tue, Jan 06, 2015 at 07:47:37 CET, Heinz Diehl wrote: > On 05.01.2015, Gary Evetts wrote: > > > Are you able to help me with the un-encrypting of the data files that have > > been encrypted or are the offenders the only source of a resolution? > > LUKS/cryptsetup is not used here, since you are on Windows. > However, you should check if your files are actually encrypted or > not. For me, there's a possibility that they only want you to click on > the .EXE, with all the nasty consequences this could have. Good idea. I think this is a definite possibility. Privilege escalation with user action is far easier than without, especially if the click then asks for escalation. > Btw: You have a backup of your data? If the data is encrypted, your best bet is likely reconstruction from backup and then patching it before connecting it to the net again. Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- A good decision is based on knowledge and not on numbers. -- Plato If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-01-06 8:33 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <7FD87F5D-AD43-4CC1-8FBA-724919533835@it-inc.co.za>
2015-01-05 9:51 ` [dm-crypt] Fwd: Encryption info Gary Evetts
2015-01-05 12:54 ` Arno Wagner
2015-01-06 6:47 ` Heinz Diehl
2015-01-06 8:33 ` Arno Wagner
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.