Hacker News Reader

Comment by VectorLock | Hacker News Reader

I wonder when ransomware will get smart enough to detect backups and insinuate themselves into them to foil the "just restore from backups" strategy.

View on HN

Yes. They are often targeting IT providers of SMBs by phishing/otherwise compromising their credentials, and deleting backups before encrypting. It works sometimes, 2FA hygiene and secondary site redundancy are usually good enough to protect you.

2FA is so overrated. You can so easily do a sim swap to get access to a particular phone number and bypass 2FA.

The problem isn't with 2FA, the problem is with SMS-based 2FA.

True, and that's why you shouldn't use SMS 2FA. The unfortunate part is when that's the only method offered.

TOTP and HOTP 2FA are unbreakable and supported by literally everyone. Who still does SMS 2FA anymore?

Lots, unfortunately. With no way to opt out

If you inject the ransomware into a system that is subsequently backed up and wait a significant period of time, you could potentially lock all backups as they are restored. Then people have to decide between paying up or restoring to a time before the ransomware was injected.

I'm not sure if it's feasible to have ransomware lock backups as they're restored, however.

They already do, I worked a case last week where that happened.

Trickbot for example will be on a machine for 2-5 months so that it's in your backups, and is commonly followed by Ryuk ransomware.

So if you get hit with Ryuk and just restore from backups without re-mediating anything you will likely be hit with Ryuk again.

Most likely they already do that if its on the same computer. Details aren't out yet, but I would guess the backups came from other computers.

There are many known cases of ransomware attacks that have deleted backup repositories.

Reply on news.ycombinator.com