12 Days competition: Day 7 – Was it Gameover for CryptoLocker?

The Twelve Days of Christmas - melody

Here’s the melody – click to sing along!

Gameover and Cryptolocker formed one of the most notorious, sophisticated and lucrative parings in malware history.

Gameover was the botnet that grabbed control of innocent users’ computers and then used them to carry out cybercrime on a giant scale.

Cryptolocker was the counter-crack-resistant ransomware, often distributed by Gameover, that encrypted your files and demanded a $300 ransom if you wanted to see them again.

In May 2014 law enforcement agencies from around the world joined forces and struck back. Read our article to discover what happened and how you can help:

Has CryptoLocker been cracked?

Is Gameover over?

And for your chance to win an exclusive, limited edition, Naked Security T-shirt, work out the answer to Paul Ducklin’s brain teaser below…

This December we’re celebrating Christmas by giving away five of our much-coveted, limited edition Naked Security T-shirts every day for 12 days!

We’ve selected twelve of the most interesting stories from 2014 and we’ll be writing about one of them each day.

All you have to do to win a T-shirt is read the story and answer the question.

We’ll pick 5 lucky winners out of a hat (OK, /dev/urandom) each day and those who answer the most questions correctly over the 12 days will be entered into our grand prize draw for a goody bag of geeky gifts valued at up to $500!

We need to know your email address so that we can contact you if you’ve won. When we contact you, we’ll need your T-shirt size, a delivery address and a contact number so we can ship your prize. We won’t use any of your personal details for anything other than this competition.

Entries close at 23:59 Pacific Standard Time (UTC-8) each day. Sophos staff, those pro­fessionally connected to the company, and their families, are welcome to submit answers for fun, but can’t win. T-shirt styles may vary from those depicted. Sophos’s decision is final, and so on. Please read our official competition terms and conditions.

What was Day 6’s answer?

On Day 6, we asked what message the “Cabir” virus for Nokia phones would pop up when you restarted your device.

The answer we wanted was Caribe (see above) or Caribe-VZ/29a.

There are two possible answers because there were two major variants of the virus; one added the “tag” VZ/29a to the word Caribe.

In the old days of virus writing, virus writers would often add their moniker, which here is VZ, and the name of their virus-making gang, which here is 29a.

In case you are wondering, 29a is hexadecimal for 666, which is the Number of the Name of the Beast.