Gen's Blog

No one likes malware, but a particularly malicious type is called Ransomware, and it specifically preys on people’s data.

Ransomware essentially encrypts the entire user’s computer or specific files until a sum of money is paid to the attacker. While there is no guarantee the attacker will make the files or computer available again, it seems to be in their best interest to return access to the computer, otherwise no one else would pay once word got around.

A particularly nasty type of new ransomware has just been discovered, and it utilizes a surprising attack vector: virtual machines.

In a new report by Sophos, the operators of the Ragnar Locker are using another novel method to avoid being detected when encrypting files.

They are now deploying VirtualBox Windows XP virtual machines to execute the ransomware and encrypt files so that they are not detected by security software running on the host.

This attack is started by first creating a tool folder that includes VirtualBox, a mini Windows XP virtual disk called micro.vdi, and various executables and scripts to prep the system.

https://www.bleepingcomputer.com/news/security/ransomware-encrypts-from-virtual-machines-to-evade-antivirus

As the security software running on the victim’s host will not detect the ransomware executable or activity on the virtual machine, it will happily keep running without detecting that the victim’s files are now being encrypted.

Interestingly, Windows 10’s “Controlled Folder Access” may prevent this attack, as it prevents any unauthorized changes by applications without a password.

This is especially problematic for government organizations, business, and hospitals. In fact, one of their more recent attacks was on an energy company EDP (https://www.edp.com/en), where the attackers stole more than 10 TB of files and received a ransom of over 10 million dollars.

This attack illustrates how security software with behavioral monitoring is becoming more important to stem the tide of ransomware infections.

It’s more important than ever to implement safe browsing habits, and common sense when executing unknown files, as once the attacker is in your system, it’s game over.

Recently I wanted to make a simple multiplayer game in Unity, but I didn’t want to use their terribly made UNET, as even though it’s barely a few years old, it’s already deprecated. I also didn’t want to go with a third party like Photon Networking, because I don’t want to pay for CCU (Concurrent User) usage, server costs, and other misc fees.

No, what I wanted was a solution such as Minecraft implements, where you directly connect to a server and it’s served through peer-to-peer networking, with one player being a server. The solution? A small library called LiteNetLib. This library allows you to build multiplayer games in .NET (C#), including Unity, with no limitations on usage, including player count. It was exactly what I needed.

The documentation is slightly sparse but it wasn’t rocket science to get a small example up and running, and the developer seems pretty open to questions. There’s also a small sample included so you can see what it entails.

Cheers!