Hacker News Reader

Comment by jrochkind1 | Hacker News Reader

The techdirt article author suggest they should have just paid the ransom.

Even knowing that paying the ransom is no _guarantee_ you actually recover, and that you have to then harden your system anyway after that (which you should have been doing all along)... I tend to agree.

I am a Baltimore resident, and I've also had that opinion since the day after the ransomware attack was announced -- just pay the ransom. (In part because from what I experience of Baltimore City government, i was pretty sure the backups and recovery/continuity plans were going to be basically nonexistent).

But on previous HN threads, it was a very unpopular opinion, in the articles right after the attacks were announced, very few in the comments threads seemed to think it was acceptable or a good idea to pay the ransom.

I'm curious if that remains true?

View on HN

I work with a cryto exchange, and fwiw, can tell you that most businesses would agree with you. They pay the ransom. And they use common exchanges like Coinbase, Binance, and Bittrex to do so.

The only way not-paying the ransom is beneficial (aside from having proper backup systems in place obviously) is if there was a large public sentiment shift promoting NOT paying ransoms. If society at large came together and decided the majority of entities are NOT going to pay, then ransomware viruses would be less profitable and thus not as favorable projects for hackers/scammers.

But that would take a lot of effort, organization, and favorable circumstances to have everyone do that simultaneously going forward. And there would be casualties at the beginning before the public sentiment cemented itself in the collective conscious.

But yeah, the only way ransomware will stop is if it stops becoming profitable: which means companies either need to have proper OpSec and backups (so they have no need of paying), or collectively agree that no one will pay ransomware attacks.

Seems like a pipe dream that we'd ever get to that point though. So I imagine companies will continue to fork over the ransoms.

Edit: this got me thinking, say for example, the US government outlawed paying the ransom to hackers. And they could somehow enforce this law effectively. Wouldn't that pretty much stop ransomware attacks in the US? or where ever a law like that could be effectively enforced?

I think society has come together and decided we're all going to pretend we're not paying and talk publicly about how nobody should ever pay, while mostly everyone is paying.

Society also seems to have come together and decided we'd rather save money than spend it on effective backups and security.

Paying ransom makes it profitable. If you make something profitable there will be more of it as there is an incentive for individuals to continue those attacks.

Honestly lack of back ups is unacceptable. I can accept it if its a young start up handling some basic data and passing payments to an established business. However, any SE, DBA, IT director/admin with some experience should know about backups and push management for them. If management fails to pay for cost of backups, that individual should note it(preferably with a paper trail) and bring it up when shit hits the fan.

I will write SQL statements prone to injection, I will hack things together when I have to due to circumstances but I inform management of risks and they make the decision to proceed in a certain way knowing the risk. If they try to light my ass on fire 2 years from now, I will open the email and say "told you so". I have actually done that multiple times already and never got burned.

Welcome to Baltimore. Of COURSE not having backups is unacceptable. Other things that are unacceptable include it taking 3 days to get the city to _turn off the pipe_ in response to a report of a massive leak into a river causing wildlife die-off (https://www.baltimorebrew.com/2019/09/13/water-main-break-ca...), spending money to put in a bike lane then more money to take out a bike lane when nothing in particular has changed (at least TWICE https://baltimore.cbslocal.com/2019/04/29/roland-park-bike-l... https://www.baltimoresun.com/maryland/baltimore-city/bs-md-l...), having a Traffic Director vacancy for 5 years running (https://www.baltimorebrew.com/2019/09/19/a-transportation-de...), and nobody qualified doing anything about traffic light timing (https://www.baltimoresun.com/ask/bs-ask-traffic-lights-20191...), I could keep going.

Baltimore is basically a 'failed state' of municipal government.

While you can "blame the voters", being one myself I literally don't understand what the fuck is going on or what to do about it, even when we elect people who seem like they might do something different, it remains the same.

So... if individual people working in IT protected their own asses by documenting that someone told them to do the wrong thing... that's great for them, what it does for Baltimore is _nothing_. The IT director lost his job (probably? Maybe? So far just on unpaid leave?), which he thoroughly deserves, but that ALSO does nothing for Baltimore, cause people like this keep getting replaced, and it still doesn't get better.

Anyway, this actually doesn't have much to do with ransomware in general, but yeah.

> paying the ransom is no _guarantee_ you actually recover

I’ve only helped recover from ransomware once about 2 years ago. When we ran the decryption program provided after paying it decrypted ~97% of the data. Some files were just permanently corrupted. Windows Server with ECC memory fwiw.

Fun note but the owner wanted to reboot after decryption and I yelled “No!” across the room, wanting to clone the known good data first. Good thing too, a reboot started the encryption all over again… good times.

I heard they were hit again but took my advice and setup Backblaze.

It depends... if the decision makers knew that there weren't solid, tested backups, they should have paid, cut off all external access. and worked to lock things down.

Also, regarding backups... at least 3 physical devices and at least two distinct geographic locations. Have backup systems push to a drop location (temporary), where a pull system can then pull those backups to a separate location. This provides a separation between your internal systems and backup systems. Otherwise, in situations like this, the backups could have been compromised as well.

Aside: this is a perfect example of why government agencies should have policies in place for disclosure of security breaches after 60 days or so. This allows them a window to exploit as needed, while still preventing catastrophe in the case of too many previously unknown exploits going into the wild in a breach. While I'd prefer everything just responsibly disclosed to affected software, I understand that cyber warfare in state actors is a thing.

People have principles when it isn't their money. The best route would be to pay it, then divert the money and fix the issues. Think of the 76k as cheap penetration testing.

The problem with this thinking is:

1/ You have to trust the criminals are "good" people and actually took the time to write code to decrypt the data.

2/ Paying the ransom paints you an easy target for the next exploit.

No, because if it doesn't unlock, you're no worse off than you started.

It might paint you as an easy target, but that's why you increase your defenses. Basically, I'd rather roll the dice and see if the paltry sum gets me a fully working environment why I try to plan next steps.

Just my personal opinion, but I figure the logical response would be to audit 1) the state of their backups, and 2) the source of the malware. After confirming that all necessary data had indeed been backed up and could be restored, and after blocking the vector used to deliver the malware, they could refuse to pay the ransom and restore from backups. Then they could go about further hardening.

If it was discovered that the backups were faulty (as in this case), or if it were not possible to discover how the infection happened prior to the ransom deadline, I would have advised paying the ransom, since 76k is a relatively small amount to the city of Baltimore. (And then of course continuing to investigate and harden to avoid having to do so again.)

>I'm curious if that remains true?

It's complicated, like any scenario where there is individual benefit but social harm (with healthy mixes of fault and incompetence too). It's so obvious sometimes it can get lost, but the people behind the ransomware are criminals. Ransom paid to them is money that is in fact directly going to supporting criminals, the government and in turn taxpayers aiding them. At "best" they're very pure single type cybercriminals and it "merely" supports them in pushing more ransomware. More often criminals are into a diverse set of activities, ranging from other varieties of cybercrime to being part of a real world physical syndicate, in which case some of the ransom is going to an organization that does stuff like murder/assault/human trafficking/drugs/etc. The strong reactions against just paying the ransom, even if it's cheaper and a clear winner from the individual first order perspective of Baltimore City, stem from this and that hasn't changed. Even if it costs $18 million vs $76k, that is still $0 directly going to the criminals themselves. On some real level, if Baltimore just paid the ransom they would be attacking the rest of us for their own benefit following their own fuckup.

Sometimes there might be other mitigating factors in the intensity of people's reactions, but most of them don't apply here. This wasn't an innocent or complex mistake, it was utter, mind blowing incompetence at the most basic level. It wasn't a matter of economics either, or technological sophistication. They'd be immensely better off if they'd merely aimed at any basic network share and cycled a few USB hard drives into a safe deposit box twice a month. That'd still be embarrassingly primitive and ineffective by any remotely modern standard for any significant organizational entity, yet it'd be something. And since it's a democratically elected government entity the complaints about it falling on citizens fall a bit flat too, because citizens have a duty to be checking on their government in a democracy. And this has been a lesson that has helped push things forward elsewhere at long last, so some good came from it that wouldn't have if the ransom had been paid.

So basically yes, it remains true for a lot of us.

AFAIK everyone who has paid the ransom gets their data back. It's a pretty slick operation with decent support after the ransom is paid.

In addition to what other comments said about it making these attacks profitable, 76k is not nearly a big enough stupid tax for Baltimore.

Don't negotiate with terrorists.

Reply on news.ycombinator.com