The ransomware surge
bbc.com
bbc.com
I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup.
You might get a call from one of your application engineers shortly before bed on a Friday night that the web front-ends are acting weird, and they can't get in to troubleshoot, and then 10 minutes later come to discover that the latest strain of Ryuk has laid waste to 2/3s of the servers and workstations across the company. And then all of a sudden, those VM snapshots you'd been copying off to another file share with a shell script have become your salvation. Yeah, containing Ryuk and the rest of incident response mode are going to suck, but at least now you don't have to write an apology to your customers that the data they entrusted to you has been irrevocably lost.
In case you're wondering, no, that did not literally happen to me. But it is a mild fictionalization of someone I know.
Keep backups, and test your restores regularly, people.
Ransomware gangs often destroy your backup infrastructure. So it's important to create pull-only backups or backups that cannot be deleted / overwritten.
That gets complex if your database contains PII. If a user asks for their account to be deleted...
Someone will always have permissions to remove or change the entries, just not easily and not in an automated daily process way.
In the past, this was achieved by having a set of tapes offsite. Today, one might configure Veeam to lie when issued a delete command, and instead send the data off to an Amazon glacier instance that requires different credentials to read, write, and delete.
Every rsync.net customer has ZFS snapshots available in their account that are immutable. They are read-only.
So, even if Mallory trashes your primary site and then gains access to your rsync.net credentials, the daily/weekly/monthly snapshots cannot be destroyed.
We may move to reject destructive commands from append-only repos in the future, but this will break existing workflows. Discussion on this here: https://feedback.borgbase.com/posts/28/reject-delete-and-pru...
GDPR requires that good data-stewards keep backups:
the controller and the processor shall implement... the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
https://gdpr-info.eu/art-32-gdpr/
For more details on GDPR and backups, see https://www.backup-systems.co.uk/blog/6-gdpr-implications-on...
It would be inappropriate, for instance, to store user data on the blockchain.
One of the first questions I ask is if they have at least one fully independent, full/incremental off-site backup that can't be corrupted from the main infrastructure, and if they have ever checked if they actually work and are restorable.
I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run IT.
No, the automatic 7 day RDS snapshots or turning on S3 versioning is not a sufficient backup. Neither is mirroring to a S3 Glacier bucket in the same org, or rsyncing to a a backup server in the same datacenter.
Backups are annoying and unglamorous. Nobody wants to do them, or do the tedious work of validating them or setting up something like an automated restore test.
Until the day you lose your data.
Why?
If you lose control of an aws root account it can take weeks to get it back. That’s probably enough time for the hackers to clean out the backups.
Billing issues can lead to aws wiping out an account.
For $work the backups are in AWS but using a different payment method, account owner etc to prevent cross contamination. Honestly, they should be outside aws entirely, but separate accounts is a good start.
> Billing issues can lead to aws wiping out an account.
These are small-scale related issues though. When you're at the level where it's hard to have a reasonable backup outside of AWS, you can also resolve the root account issues fairly quickly by calling your TAM directly.
Like you said, backups are annoying and unglamorous. Yet, the data on my laptop is the only thing I could not replace. It's more important to me than my passport or my birth certificate. Its preservation is certainly worth a bit of thought.
It’s called having a network attached storage (NAS) device. I have a Synology NAS, which I backup to, continuously at 5 minute intervals.
Warning: Microsoft image and file backups sometimes do not work.
I recommend Acronis True Image instead, which comes with antivirus. It pretty much always works, never falter never fail. Get the version that allows you to back up to the cloud with blockchain features. You will be happy you did.
But, this is a basic overview of how to prevent NAS ransomware attacks: https://www.howtogeek.com/435452/how-to-secure-your-synology...
There is better advice elsewhere but this is a good start.
This may be a good comment to look at: https://news.ycombinator.com/item?id=25618346
This may be another good comment to take a look at: https://news.ycombinator.com/item?id=24860863
Acronis is Swiss-based and has to comply with the GDPR, due to its direct ties with the European Union. I am a dual US|EU (Croatian) citizen, with legal rights to work/live/retire in Switzerland, so I do not have to worry about storing my information "abroad".
The EU has strict regulations, and they are only going to get stricter. There have even been talks about the EU being allowed to legally break encryption recently. If you are a third-country national (not an EU/EEA/Swiss citizen), then I do not recommend Acronis cloud backup or any other EU/EEA/Swiss service for storing your personal data. America may have its problems, and privacy may be a joke, but at least you have rights and sovereignty there.
It's actually managed by a side project of mine: https://github.com/nicbou/timeline
Three years ago, after doing YC Startup School, I built https://www.borgbase.com to offer the simple, but secure backup service I wanted myself. Today it’s a viable business and my customers are all great and value backups as essential part of their own business. Wouldn’t want to be in any other “more glamorous” corner of the industry. Also kudos to anyone - partner or competitor - working in this “unglamorous” space. You’re all doing great work.
Additional offline backups aren't really feasible past a certain data volume and daily change/velocity. I'd still encourage everyone to have them for their own essential data in addition to a cloud backup. E.g. by burning it to BluRay or tape (3-2-1 rule). You can see find my own, more philosophical discussion, of the topic here: https://docs.borgbase.com/strategy/. There I also distinguish between operational backups and archives. BorgBase is focused on the former. Offline backups are more suited for the latter.
It's not hard to create a cloud backup service where delete requires separate credentials which are not used in day-to-day operations (and so can be kept secure). And without these credentials a backup is kept N days and cannot be deleted or overwritten. Don't know if anyone do this, though.
It gets better (as in worse) someone can easily cut down back-up expenses, and become a hero by "balancing the budget with no disruptions to operations", get a fat bonus, and then after a year or so, leave.
Their successors won't get any bonuses by increasing the budget for something that has no ROI.
And randsomware is booming!
Unless you do not open for any sort of business without having all backup system set up then you run the risk, and with thousands of companies running the risk so as to not be out-competed by faster, riskier companies someone will suffer a bad outcome of their risk-taking.
Possibly, but not if the business has a culture of recognising downside risk. Single events that are not extremely unlikely and that could cripple the business are things that every company should be looking out for.
I am not even remotely surprised, because most companies are not IT oriented companies, and most of those either have managers that can't be made to understand the importance of DR, or (sadly) IT people who can't.
I myself am currently in a multi-year long political battle to justify a mere $600mo to get our DR env (built with old equipment that is on the verge of irrevocable failure) moved from a closet at a branch location to an actual co-lo that won't lose power and internet 3 times a week.
At least we finally got that backup generator approved for the corporate office after the third time a goose committed suicide on our power lines. Ugh...
I have been heads down on my own side hustle as a one man show. Do you have any suggestions on how to properly approach backups for smaller groups like myself working with limited funds?
For context, some of the tech on my plate includes a few DO ubuntu droplets (hosting docker containerized services), Postgres DB (prod DO managed w/ auto-snaps, pretty much same scenario you mentioned), S3 storage for user-created assets (DO spaces w/ no backup strategy yet; no, not launched, yet), GitHub for source code, and physical MacBooks (iCloud + manual backups to a single physical external SSD).
Realistically speaking I’m bootstrapped. More importantly, I’m interested in learning the right ways in doing backups.
His is from the early 90s, the RAID card on the backup server was bad so it was just randomly flipping bits on the files being stored... nothing was ever tested until they needed one of those backups.
Mine was about a tape setup that followed the correct 3-2-1 setup... one of the CLI tools had an update and the agreement was waiting for user input so it would just drop and the rest of the script continued... no one had ever tested a backup so the tapes being shuffled around were empty.
Obviously EC2 for AWS, but what about managed services?
A bad ransomware attack on a large cloud provider could cripple a significant portion of the internet.
They want restores.
Source: I’m a cybersecurity lawyer.
And they do not mitigate against the threat of the data being published online which seems to be the new(ish) threat these days with ransomeware.
IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP).
Users will always open attachments from people they don't know, click links, or even pick up random USB sticks.
The perpetrators know this. They don't need to be more sophisticated than the InfoSec people at a given organisation, they just need to trick one user in that organisation in to letting them on to the network.
You can prevent ransomware fairly simply by following best practice, and taking some steps that most companies will feel are excessive (but effective), such as whitelisting binaries, preventing running of any binaries not on that whitelist, and keeping that whitelist up to date on a regular real-time basis. Nobody wants to spend the time doing this, so they leave it a "free-for-all".
Exploiting user-level access is just the natural escalation now that getting good exploits is more costly and difficult. Now attackers will "make do" wiht what they have. IT can win the battle, but with inconvenience, friction, and increased costs in IT.
There's important businesses that are "critical infrastructure" still using Windows 7 on their corporate day-to-day let-me-check-my-emails-and-browse-the-web laptops, without extended support. Organisational inertia and a lack of recognition that they need to pay for the technology that enablers their business leads them to this position.
Eg. an application is only allowed to touch 100 files per second or 1000 files per hour.
When it reaches those limits, it gets paused and a popup asks the user if this application really should be doing X.
Then at least ransomware can't run through stuff too quickly.
A rate limit, with group-policy controllable "automatic response" would perhaps help - you need the GPO integration though so that an IT admin can say "never allow file system rate limit to be exceeded".
If you enforce a rate limit locally, and on the network, and move to copy-on-write filesystems, it would be a whole lot harder to cause straightforward harm (at least while migrating to a newer, safer OS architecture paradigm, where code doesn't run as the user).
In the post-Covid world, I think MS and others have a whole host of these kinds of issues to think about - Windows in an AD environment is still (as far as I know) not something really geared for working off-prem. It still relies heavily on LDAP and CIFS etc. A re-write to get a desktop OS ready for the "web first" world (where everything is sent to the AD domain TCP/443, using HTTPS, with client certificates rather than passwords, stored locally via hardware-backed secure storage, and trusted CAs used by the DC) would be a big first step towards this. Yes, I know you could use Direct Access or whatever MS has butchered into the system, but in a world moving to zero trust, MS needs to move to zero trust.
Rate limits would be a great starting point, as would some proper platform-level protections around preserving shadow copies, using copy-on-write, and locally preserving versioned user files as a priority. As soon as a ransomware attack touches the network, IT should be able to handle it, as their backup regime should take effect. At that point, if you don't have backups sufficiently separate from user-writable files (or you never validate them, and thus don't realise you're backing up transparently encrypted ransomware'd files for months), you're on your own!
Cost cutting is probably the biggest threat to most businesses. The mythos of the hyper-converged infrastructure, with the datastores and repositories for backups being hosted on the same physical device, are some sort of infection that just cannot be wrenched from people's heads.
IT Professionals (not managers, not hapless non-techies, actual persons with a cornucopia of certs and accolades on their linkedin) are in denial as to how to design a proper infrastructure to respond to ransomware. At this stage and for the foreseeable future, Ransomware is an inevitability; not "if" you get attacked, "when". But the countless number of conversations I've had where basically a group of people from the IT department theorycrafted a perfect defense only to get attacked because one of them clicked on a random excel document from a spoofed email is too high.
When clients ask me "what do we need to do to protect against ransomware" and I explain what airgapping means (tape, removable drive arrays), we're either ignored, or they say they accept and the clients just don't have the discipline to follow the required practices.
Modern IT prefers cargo-cult security, and IT professionals love their checklists from some organization, regardless of the fact that most of the checkboxes are useless to protect against ransomware. But the professional can eschew responsibility because "hey, I checked all the boxes."
Until technical professionals as a whole start to take security seriously and exhibit the discipline that is required for such security right now, Ransomware is going to continue to be prevalent. No amount of rate limiting from vendors will help, because users will simply just not use such versions, will disable such limits, will work around such limits, or any of dozens of workarounds to avoid it because such limits would be inconvenient (neverminding such limiting tooling probably will just be exploited)
We need discipline first, not tooling to try to correct for lack of discipline.
“The thing” would not work as an unprivileged user account and would only work as a right click run as administrator situation :-)
As weird as it sounds, this is both correct and incorrect at the same time.
It is correct, because ransomware is not particularly sophisticated by today's standards. Couple of decades of R&D has made the building blocks robust and uninteresting.
It is also correct in the sense that the attacks used to breach systems are unsophisticated. A vulnerability is published for an internet-facing system, and in just couple of days the underground toolkits are already (ab)using it.
It is incorrect in the sense that the crews who breached the systems are not the crews who deploy ransomware. Computer crime has evolved to a fully functioning economy, with high specialisation among its participants. Crew A reverse-engineers patches, updates their vulnerability exploitation engines and goes on to breach systems. (In a race against time, because there are other crews doing the same.) They then sell access to crews B, C and D.
Crew B are after financial information and will exfiltrate anything that can be sold to morally ambivalent hedge funds. They may also grab R&D material, because corporate espionage is a thing. Crew C will grab all the personally identifiable data and have intimate knowledge how to best monetise it for various types of fraud.
Crew D will deploy the ransomware, because they have all the sophistication you need to run their extortion operations at scale. These days this includes the ability to handle massive volumes of off-site backups, because why not. "Pay up or we leak it" is a perfectly valid extension to their business model.
The gangs I referred to as "Crew A" are known in the industry as Access Brokers. There are of course other operators too who work in a more asynchronous fashion, such as money launderers.
The economy powering the criminal enterprise markets is certainly sophisticated. And while most of the technology in use doesn't qualify for using that word, the internal operations these gangs run certainly do.
If it gets in through an access broker, you're definitely looking at a sophisticated outfit of attackers.
I guess I'm approaching this as the defender - if the malicious code isn't exploiting anything needing patched (other than decades-outdated assumptions of a threat model where any binary has the ability to act inseparably "as" the user), the actual ransomware is harder to prevent for most organisations, as all the friendly hand-holding type advice they receive from police and governments doesn't save them (patching desktop systems won't prevent the file encryptor payload from running on the first host, after a user runs the bogus docx.exe file and ignores warnings through alert fatigue).
It would be interesting if companies were more willing to (or required to) share details of ingress vectors, to understand the extent to which they're being breached through really advanced attacks involving reversing of recent patches, versus someone popping a pulsesecure VPN that's been warned about for years. Or on-prem Exchange that they've continued to ignore all the warnings about as nothing is on fire. Or just a user clicking a link to a shared file mistakenly emailed to them, called CONFIDENTIAL - PAY SCALE 2022, which phishes their SSO credentials for 365...
I'm not saying it'd be easy to do, but rather that it'd be a nice thing for the world if they did.
> IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP).
Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group?
Modern security is based primarily on security through obscurity. As long as you stay up to date, all of the bugs you have are sufficiently obscure that knowledge about them is probably too expensive for the type of hacker that would target you.
> Users will always open attachments from people they don't know, click links, or even pick up random USB sticks.
Why is any of that a problem? A user should not be able to threaten an organization's IT system even if they were outright hostile (unless they were put in a specific position of trust within IT; but even then the amount of damage they should be able to do from their personal work computer should be limited).
because software is tremendously complex with a large surface area to attack. And many OS features were designed when wide-scale hacking was not a problem.
You can better believe software running an aircraft carrier has been hardened 12 ways til sunday. Prosumer operating systems - not so much.
Because there's not enough money in making things bug-free from the start. It is possible (see seL4 and They Write the Right Stuff), but the incentives aren't there.
Some kind of liability or minimum standard (similar to building code) would help, but I'm not sure just how it would be best implemented.
You're not wrong about why it doesn't exist, but I'm not convinced the market conditions exist to rectify that.
Slightly old here means 13 years after the latest release in case of Windows XP.
That's a very long time for anyone to upgrade.
"My puppy just got hit by a car! Can I come in and use your phone to call for help?"
IT is a cost to their business, not a revenue source. They don't consider the counter-factual of "well, what if we didn't use IT and computers and the internet" when valuing what IT is bringing to their business. If they did, they'd perhaps be willing to spend more.
MBAs don't like spending money on something that doesn't yield them more sales though...
Since there's no visible problem (nothing catches fire) the day, week or month after cutting spend on IT, it's an unnecessary expense in the eyes of beancounters.
One bank I interned at sent people an email about the weather or something to that extent and each link had a unique identifier. Shaming each individual user is the best way for them to learn.
It's the best way for them to stop trusting the security team and never come in with any issue, even if it could be used as an early signal preventing bigger attack. Many people's jobs rely on them receiving emails from unknown sources and receiving files from them. Shaming them for "you should've known this specific link is bad" is counterproductive. That's even before we get to whether they would actually put in any credentials.
Phishing tests have value. Running them to shame people into compliance is a waste of time.
For better takes, there's a good thread https://twitter.com/hacks4pancakes/status/133487573995560550...
These are facts of life and need to be expected. Not saying that security training is wasted money, but it is in no way a solution to for example phishing. Accept that you will have compromised clients and internet facing servers and start making a strategy with that scenario in mind.
The cause is definitely technical, it is a huge gaping hole in the design of modern operating systems that you could sail the Ever Given through sideways without incident.
Your operating system does not confer to the user the ability to delegate only X resources to the opening of a file, email, etc. They (the users) have no ability to limit side effects. Blaming them for your bad system isn't ever going to help fix things.
The missing system of limiting side effects is known as Capability Based Security. We all have a practical example of it in our wallet or purse. We can remove a unit of currency, hand it to someone else for a purchase, and that is the maximum we can lose, unless something extraordinary happens.
We all have outlets, which limit the amount of power they will supply, and some even check to make sure it isn't supplied through us, or into a system that has arcing issues. We never have to worry that turning on a lamp will take down the power grid.
Imagine if there were no circuit breakers or fuses, would blaming people for not being careful enough help make the system safer? No, of course not. Neither does blaming the user for your defective Operating System.
Not that you don't have a point, but outlet safety measures only address accidental failures. A malicous device is perfectly capable of storing power in a battery or capacitor to exceed instantaneous power limits, or running at 12 amps (out of 15A fuses) 24/7 to pull much more power than you expect over time, or electrocuting you taser-style even if it doesn't have a high-current ground path. So while the safety features are useful, they're not particularly relevant to security.
The wallet example is pretty good, though, as is your actual point.
Wondering how we're going to remember the times before proper capability based security systems go mainstream...
In fact, there were systems built this way in the 70's.
It's not like Microsoft has an explicit EOL date announced for every OS release...
I run an open data set on data breaches. The vast majority of ransomware incidents start with a phishing email, to beach head, to find domain admin, to game over.
The root problem is domain admin population size. Reduce it to zero with privileged access management to avoid ransomware.
I started the "mnm" open source project to enable a new email network, on a new protocol.
More: https://mnmnotmail.org/
Follow: https://twitter.com/mnmnotmail
However, if an org needs email, why can't they just configure their filters to move everything from outside the org in a special folder, and email server could further filter any link and put it through a warning page before redirecting to the link.
We already have DKIM and SPF to verify if the domains of the sender. Just setting up these can work.
https://mnmnotmail.org/faq.html
https://github.com/networkimprov/mnm/blob/master/Protocol.md
The mnm client app isn't chat-oriented like Slack & Discord, altho it does provide presence status for contacts who've opted into that.
But the main question I have - does a typical mail users actually care about sender domain? I suspect - not at all. And I see two main reasons for this. First notion of domain is de-emphasized everywhere - browsers turned address bar into a search bar and make real URL hard to notice, MUA (e. g. Outlook) don't show full email for senders in an address book. Second problem - legitimate senders often behave in exactly the same way as phishers - use unrelated/unknown domain and give no way to verify that the domain is legitimate. For example Charter/Sirius ISP sends mail from domain customeremailnotifications.com [1] and I found no ways to see for sure that is domain is owned or used by Charter. My memory is fuzzy, but PayPal (or ebay) AFAIR used a phishy domain too, something like managemypaypal.com. A largish ZA utility sends mail from eskomstatements.co.za having the main domain eskom.co.za and of course there is no good way to verify that both domains owned/used by the same company. List can be continued. All this conditions users to trust mail which is coming from a random-domain-registered-by-phishers, because legitimate senders do the same.
[1] https://www.reddit.com/r/Spectrum/comments/dfpres/email_doma... (1 year old, but situation hasn't changed a bit)
I wonder if this could be fixed by email clients marking emails that fail DKIM as spam/attaching a large warning. Most users use email clients and they really don't do a great job of notify users of potential spoofing issues (with Gmail, you have to find "view original" to see that DKIM fails). I'm sure that spam filters would notice after a few hundred/thousand emails, but a successful spear-phishing attempt may not require that many emails. If customers complain about legitimate emails being marked as actually fraudulent, I'm sure adoption rates will increase.
If you are keeping to best practice, including the things you recommend, then you should hopefully never need backups. But I see backups akin to seat belts, motorcycle helmets, fire extinguishers, et. al. They are things you should hopefully never need if you aren't doing anything stupid or dangerous, but if the situation ever goes sideways, can be the difference between surviving or not.
Once this happens, Bitcoin will get rapidly regulated out of existence by governments.
Imagine if it follows the usual stereotypical news coverage. An attractive, photogenic American woman goes to a foreign country and gets kidnapped. Later the kidnappers send ransom demands with a Bitcoin address.
This would be wall-to-wall 24/7 news coverage on all the major channels.
After that, the public would likely support almost any type of regulation on crypto-currency.
Collecting the ransom is probably the point of highest vulnerability and that is something law enforcement agencies like the FBI have used to catch kidnappers.
However, with cryptocurrency, that vulnerability is mitigated a lot, and that completely changes the dynamics.
There is a reason, the ransomware attackers aren't demanding suitcases of cash at pre-ordained meeting sites.
This might not stop the kidnappings, but at least it could stop large organizations from paying ransomware.
One can only hope. Bitcoin is obsolete and if that happens better coins will finally get the chance to replace it.
Unless there is some serious teeth to any response to this, it will keep hapening. The FBI and the UK CCC can put out as many recommendations as they like about backups and updates, but criminals will just keep finding targets, or upping the damage.
It is time to consider these attacks as terrorism, and respond to state sponsored terror attacks accordingly.
Make no mistake: this ransomware surge is 100% enabled / facilitated by Bitcoin and possibly other cryptocurrencies.
This would not have been so bad if cryptocurrencies would actually provide anything of really significant value to our societies, but no.
Aside from a mixture of Ponzi scheme, Pyramid scheme, and MLM + the energy waste, this ransomware is yet another terrible effect on our world.
It is time we effectively ban cryptocurrencies. Let’s end this madness. Please.
I am dead serious. I think cryptocurrencies and blockchain technology is the asbestos of the software world.
It literally doesn't matter how much energy it consumes or how much crime it enables, if it allows us to escape government stupidity it's more than worth it. Actually, crime is proof that cryptocurrencies work and and actually provide the necessary privacy we all need. The harder it is for authorities to trace, the better.
It doesn't and it won't. If governments outlaw crypto currencies you have no way to use them.
I live in a country where my government and the banks are OK, there is no problem to be solved.
Inventing non-existing problems to justify this crypto-madness is dishonest.
They can technically exist?
Do you mean in the specific case of ring signatures? Or at all?
There are already threshold-signature-based schemes for doing this with ECDSA (though they're very gas heavy at the moment). But none has emerged for ring signatures yet beyond the paper stage.
Yes, assuming sufficiently (not very) expressive transaction signing on said chains. Assume Alice wishes to exchange 1 ABC for Dan's 1 DEF. Alice publishes a transaction for 1 ABC with a UTXO that must be signed by both Alice and Dan. She then provides a zero-knowledge proof that her private key for that signature hashes to XXX. Dan then publishes a transaction for 1 DEF with a UTXO that requires a signature from Alice[0] and a hash preimage of XXX. Alice then pulishes a transaction moving that 1 DEF to her own whereever, which (since second-preimage attacks are hard) contains the private key Dan needs to claim the 1 ABC UTXO.
So this requires that chain ABC supports 2-of-2 (or k-of-n) signature requirements, and that chain DEF supports signature-and-hash-preimage requirements.
This simple protocol is vulnerable to losing money entirely if one party abandons it partway though, but that can mitigated by exchanging eg 0.1 ABC/DEF at a time, or by a more sophisticated exchange protocol.
Edit: 0: using a different key than the XXX preimage.
https://ciphertrace.com/twitter-hack-update-blockchain-analy...
https://www.theverge.com/2021/3/16/22334421/twitter-hacker-b...
"(KYC) data associated with the accounts—such as ID, birthday and address—revealing their true identities"
Once the coins entered the mixing services they were gone.
It looks like they got the info from the Texas exchange.
I don't think the TX in that article means an exchange based in Texas. I think TX is abbreviating the word "transaction". Every instance of TX is followed directly by a bitcoin transaction id.
Yeah but the BTC fee problem isn't trivial. When each "small lot" costs $20 to transfer, your Lambo very quickly turns into a Hyundai
When the data is encrypted and locked up, the company itself cries foul (not out of care for people's data) as it can't keep doing whatever mundane things it was doing day-to-day.
If you offered my company our competitors source code for free, we wouldn't take it - we have some ethics. I think most of you are in the same boat - even if you don't have strong company ethics are quick check would discover that you already know how to do everything they are doing, so time looking at their code is time you aren't adding those features to yours. (the one exception would be their file format which are valuable)
Even if the data is valuable, can they use it? I know the database admins in my company are registered with the SEC as not able to trade some things because we have insider information from our customers. Even if someone got that data though, they would have to figure out the database, what it means, AND be lucky enough to do that when there is something non-public that can be traded. Most of the time the expected supply is the same as actual supply, so that fact that we have insider information on the actual supply isn't actually useful. (the above is a different department from mine so I don't know the details very well)
Thus the example of a police department is an outlier as the data is sensitive for a long time.
As an aside does anyone know (with citations) the history and why reputable news publications like the BBC or reuters never cite their sources? It's always seemed odd that even quacks and conspiracy cites (mis)use sources whilst well respected publishers don't.
The solution to ransomware is to daily mirror every system to an append only backup and then just flash everything back if you get hit. You lose a few days...
But I think a lot of businesses really have a problem with the mechanics of just getting their business running again, like the one in the article. This seems fairly straightforward to defend against.
This could be managed with a backup that maintains 'fingerprint' hashes of all the files, tracks the changes and alerts if there are too many, or alternatively, the user/admin litters the system with a set of canary files of the same type that should never change, and the backup system halts and alerts if any of them do.
I'd like to see a utility to just check a set of canary files for changes. Anyone know of one?
I suspect there is whole network of people that will sell crypto for cash to people who want to buy drugs/other things on the darknet.
Maybe there is a handful of corrupt exchanges but the bigger ones already check where your crypto is coming from.
https://www.cynicusrex.com/file/cryptocultscience.html https://www.stephendiehl.com/blog/banbitcoin.html
Pretty soon all you'll be able to legally access as a USian is "Bitcoin!(tm)"[1] (like what PayPal is doing), not the actual uncut blockchain bitcoin that you can send and receive at will.
When that happens they will suddenly remember that its use value is strictly limited to illegal transactions and speculation.
Might be too late by that point tho.
As the system works now, the Federal Reserve prints the money and gets to spend it, and I can't imagine a more unequal income.
1: https://www.clasp.org/blog/how-inflation-reinforces-economic...
2: https://www.theatlantic.com/ideas/archive/2019/11/income-ine...
The fact that there aren't bitcoin loans is proof that it is not a viable store of value.
As for loans, lots of exchanges let you trade with leverage, effectively trading on borrowed money.
Also, there exist institutionally backed Bitcoin options: https://www.cmegroup.com/trading/equity-index/us-index/bitco...
Eventually you get to the point where you see that the information and ultimate large scale control permitted by the collection of that information is itself the end goal, and that it has nothing to do with detecting or preventing crime.
Sent over 20 transactions from US exchange -> US exchange and no problems.
Sent a single transaction from my unhosted software wallet -> US exchange, and got my account locked. Questioned on everything including my employer's information, had do re-do advanced KYC, source of funds etc. (The unhosted wallet was funded from an exchange which makes it stupid, and i didn't use any coinjoins or anything).
Do they have private API's to verify addresses?
Not really. Those things either fund themselves or their divisions get shut down within the criminal organization. Paid ransoms mostly fund luxury sports cars and vacation homes.
Source: I'm a Russian mob boss and ransomware is highly segmented from the rest of my rackets.
When's the last time a civil engineer designed a bridge without accounting for corrosion or the fact that people will be driving over it?
The computer equivalent to "three guys with guns are standing in the middle of [a road] shooting at passing drivers" would be three gunmen gaining physical access to a datacenter - game over. We don't try to protect against that attack vector any more than civil engineers protect against terrorists when designing some intersection, except maybe we encrypt some data at rest and they put up some bollards and CCTV.
You're getting hung up on the agency aspect when the most important thing is the attack by attrition. It doesn't matter whether it is a force of nature like corrosion or all the bad actors in human civilization, the point is that it is a known quantity that will eventually degrade and break every nontrivial system.
We don't know which future zero day exploit will break our systems any more than civil engineers know which wave or car will cause the ultimate collapse, but we know that it is inevitable. That's why we have defense in depth. It is the nature of the beast.
Well if they're exists, why don't we use them for everyone on daily basis, since it'll be safer? Because they're hella expensive and resources are limited.
If any smaller shops or businesses try to implement highest security for their system, their development and operation cost can multifold easily, and the ux can be reduced due to security.
But since it isn't a regular thing I don't bother with that. My car wouldn't survive long in a real battle and I'm okay with that as I don't expect to have to drive my car in a real battle.
The warning is out to everything network connected: it is time to invest in the equivalent of armor and bullet proof glass.
It runs as a user, and just makes do with the access that user has to files.
Before we hold application software to account (and we really do need to), we need to start with the fundamentals - operating systems need to move beyond a "software runs as the current user" model. Otherwise I don't see how we can fix this with assurance/regulation - the root issue seems to be inherent design flaws in modern GUI/desktop operating systems. The tools are there to protect yourself (binary whitelisting, applocker, santa etc.), but they are seen as more inconvenient to use than doing nothing... Hence most companies do nothing, as that's cheaper.
Not to mention a lot of actors getting hit with ransomware aren’t software companies. They’re governments, schools, and hospitals. Never mind taking QA seriously, these institutions don’t even take IT seriously.
Hmmm.
Without them, ransomware would be nowhere near as profitable or easy.
Kill cryptocurrencies, kill ransomware. Plus, kill a massive source of carbon emissions. It's a massive win on multiple fronts.
Plus not all cryptocurrencies waste power the way bitcoin does. And before crypto was big there was malware that asked for money via mailed checks and bank transfers (and there are plenty of scams that just call people and ask for money with no software at all.)
In addition banks make an incredible profit laundering money for drug/human trafficking. I'm sure they could be convinced to put that to use doing other things if crypto wasn't there.
That is no longer the case now that they are actively making climate change worse, and disrupting business through ransomware.