[pmwiki-devel] cryptowall attack on pmwiki

W Randolph Franklin pmwiki at wrfranklin.org
Tue Apr 26 19:29:55 CDT 2016


I discovered 4 files in wiki.d/ :

HELP_DECRYPT.HTML HELP_DECRYPT.PNG HELP_DECRYPT.TXT HELP_DECRYPT.URL

The PNG file said that my files had been encrypted by Cryptowall.

The good news is that there was in fact no damage, perhaps because I'm
running linux.

The bad new is that someone was able to place those files there.

Any ideas where I'd start to look?   Has anyone else seen this?

Also, HELP_DECRYPT.HTML HELP_DECRYPT.TXT HELP_DECRYPT.URL were binary,
in spite of their names. Perhaps listing them in a vulnerable OS is
intended to cause more damage?

Thanks.

-- 
W Randolph Franklin
pmwiki at wrfranklin.org



More information about the pmwiki-devel mailing list