NEVER EVER PAY RANSOM MONEY.
Please. Even if your business will suffer it will suffer a lot more if you do pay since now it is known you'll cave. Also: you are making the problem larger for others.
Please. Even if your business will suffer it will suffer a lot more if you do pay since now it is known you'll cave. Also: you are making the problem larger for others.
At around 2PM, the attackers began directly attacking the infrastructure of our upstream providers and the datacenter itself. The coordinated assault on our ISP exceeded 100Gbps and attacked not only the datacenter, but also routers in Zurich, Frankfurt, and other locations where our ISP has nodes. This coordinated assault on key infrastructure eventually managed to bring down both the datacenter and the ISP, which impacted hundreds of other companies, not just ProtonMail.
At this point, we were placed under a lot of pressure by third parties to just pay the ransom, which we grudgingly agreed to do at 3:30PM Geneva time to the bitcoin address 1FxHcZzW3z9NRSUnQ9Pcp58ddYaSuN1T2y. This was a collective decision taken by all impacted companies, and while we disagree with it, we nevertheless respected it taking into the consideration the hundreds of thousands of Swiss Francs in damages suffered by other companies caught up in the attack against us. We hoped that by paying, we could spare the other companies impacted by the attack against us, but the attacks continued nevertheless. This was clearly a wrong decision so let us be clear to all future attackers – ProtonMail will NEVER pay another ransom.
That would give their customers time to batten the hatches and/or migrate off the system for the time being while sending a clear signal that they would not pay anyway.
This is a tough situation to be in but putting your customers in control of the company (and in a democratic way no less) is not the solution. What about those customers that decided (rightly imo) against paying?
Companies such as these should have an up-front item in their terms of service indicating that they would never pay a ransom, that way they would be clear to both their customers and their potential attackers.
I think they were put under pressure by other companies using the same IPS, not their customers.
Great in theory, but surely nobody "elsewhere" will host you securely if hosting you means all their other customers get hosed.
"the attack against ProtonMail can be divided into two stages. The first stage is the volumetric attack which was targeting just our IP addresses. The second stage is the more complex attack which targeted weak points in the infrastructure of our ISPs. This second phase has not been observed in any other recent attacks on Swiss companies and was technically much more sophisticated. This means that ProtonMail is likely under attack by two separate groups, with the second attackers exhibiting capabilities more commonly possessed by state-sponsored actors. It also shows that the second attackers were not afraid of causing massive collateral damage in order to get at us."
Protonmail could just be talking this up, but if your ISP's (or AWS's) fancy countermeasures don't deal with this, why would they keep you? And why would any other ISP want or accept your business?
There are very good clean pipe services available; the major limitation is that the clean pipe provider must have enough capacity to absorb any attack... something that can be quite difficult unless you are someone like L3.
However, the good clean pipe services are all very expensive. (I don't mean the "http only" service like cloudflare; that is a very different sort of thing.) - this is because of that aforementioned limitation; you need a lot of headroom in your bandwidth to run a clean pipe service.
But yeah, amazon charges a lot more for bandwidth than you'd expect to pay direct from a transit provider at small-ISP scale, so I would hope that they have enough capacity and technology to filter fairly large attacks.
I'm interested in whether the ISPs have any form of protection against the disruption caused by a customer of a shared service coming under a criminal attack of this kind.
Yes. And what does a provider do when a customer is getting hit so hard by a ddos that it is pushing their other customers offline? they blackhole the target at their upstream (usually starting on a per-IP basis, but that will widen as the attacker shifts the target)
So... most likely, the isp said "if this continues, we will need to finish the job and shut you off" - which is what every other ISP is going to do in the case of an attack that is large enough to knock the ISP in question offline.
Check out the legalese on your hosting contract; everyone reserves the right to dump you as a customer in these sorts of cases.
Actually, it makes no sense to not follow through because that is their business model.
So you just simply do not pay extortion fees unless you want to become part of the problem.
In the case of an encrypted filesystem that means you will have to restore from a back-up (which I assume (naively maybe) that you have). And you chalk the whole thing up to your education fund. Paying up is simply wrong.
Right, which is why "never pay extortion fees" doesn't make much more sense for combatting this stuff than "never click on spam links" makes for combating spam. It's unrealistic to think we will convince enough businesses to altruistically not pay extortionists, just like it's unrealistic to think you'll get your grandmother to stop clicking on spam links. You need another solution.
But once you as a business pay an extortionist you have just taken on another partner in your business, who will do none of the work and who will take almost all of your profits. So paying out of pragmatism will actually have the exact opposite effect of what you intend to achieve (to make the problem go away).
A good parasite does not kill the host, merely takes all the resources they can get and it certainly won't stop with one attempt at extortion. And judging from the blog post linked they learned their lesson.
edited for clarity, thanks ghotifish.
>> The only way spam will go away is if everybody will finally stop responding to spam.
> Right, which is why "never pay extortion fees" doesn't make much more sense for combatting this stuff ... It's unrealistic to think we will convince enough businesses to altruistically not pay extortionists,
jessriedel is not saying it's altruistic to pay, it's altruistic not to pay.
http://www.amazon.com/gp/product/1492603236 http://krebsonsecurity.com
Anything less than that is not a backup but a mirror and mirrors while useful are not at the same level of security that a backup is.
Some copies are backups, but not all of them and most copies on spinning or re-writeable media especially when they are networked are not actually backups. Somebody tell backblaze ;).
That's true but for the individual payee it can make sense. Trying to get the ransomers back can work. They'll keep at it till they figure they can get harmed.
There wouldn't be any point in paying a $1m ransom for a $50m boat if it was going to get caught by 49 other pirate groups on its way to safety. So when a ransom has been paid, pirates escort a boat to safety.
DDOSers can't offer any such guarantee; it's not like one DDOSer can stop another going after the same victim. And to my knowledge there aren't any websites where victims can post reviews saying whether the same DDOSer targeted them again later on.
There is a chance they could be 'honorable' thieves and desist, but it's likely having had someone cave in once, they'd cave in again, and again... So, it only makes sense as a delaying tactic, in the long run it's mostly a losing proposition, unless you're setting them up for a sting or something.
I've been in that position (twice) and in both cases was able to reverse tables on my opponent. It could be that I'm lucky but I think that these operations only work because there are a lot of people that cave in when they see a letter on a lawyers letterhead regardless of the merit.
-Winston Churchill
This goes for any 'in the cloud' data that you might have. In the end it's your data and your company that is at stake. Not all data wipe-outs are malicious, sometimes accidents do happen.
http://www.theregister.co.uk/2014/06/18/code_spaces_destroye...
http://www.dwheeler.com/essays/scm-security.html
Orange Book systems' (1980's to early 90's) used air gaps and/or paper backups in safes. OpenCM, a robust SCM by Shapiro et al, mentions that among other things:
https://web.archive.org/web/20060315100242/http://opencm.org...
SoD alone would go a very long way to close some of the larger holes (dd question: who has access to your backups?) but even that is something that a lot more people seem to be aware of than is put into practice.
The amount of trust placed in the hands of a very few people is scary, and to do all that without real backups is something that would keep me awake at night if my bread and butter depended on it.
you would be shocked at the number of people who get upset when you advise them to make their own backups, and interpret this as an indictment of the reliability of your own backup procedures.
e.g. "isn't that what we pay you for???"
nevertheless, do it anyway and let them fume. there are no prerequisites for running a business and you'll find that many absolute morons are at the helm of some nominally successful businesses.
A company of any size can continue on even if severely crippled with nobody left who understands how anything works. I've seen it time and again - also even where I've felt I was important.
Minimal viable product and vendor lock ins are powerful real world things.