Hacker News Reader

Comment by aazaa | Hacker News Reader

> Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system, one of the people familiar with the company’s efforts said.

I thought the protocol for these attacks was to send the decryption keys, not provide a "decrypting tool."

If some kind of software was provided by the attackers, and Colonial installed it, this could be far from over.

Also, if the company has backups, then why not use them instead? If they're incomplete, then that's the real problem.

View on HN

Probably a reporter/reporting issue. No company that just have been hacked would run a binary received from the hackers in order to restore the systems, they cannot be that stupid. But then again, they did pay the ransom and also seemingly can't restore their systems from backups, so who knows how stupid they really are?

More charitable reading is that the encryption key was sent over, and they started restoring with that but using standard OSS tooling.

What? No, the ransomware people truly do send a decryption tool, or the decryption functionality is built into the ransomware. Do you think they are sending people some AES key and then everyone goes off and builds some python tool to decrypt his data?

This is a fundamental misunderstanding of the ransomware business. The whole reason people pay up is because the hackers don't run and leave you hanging; if you pay they will decrypt your data. Trust and convenience are essential to making this work.

Great, we should get the word out then that some don't.

Perhaps a few cases of high-profile companies falsly claiming „wow, what a load of shit! we got ransommed and after paying up the hackers disappeared! we had to restore from backup, AND the money is gone“.

What are the hackers gonna do, sue those companies? :-)

Oh I don't know. Maybe the hackers will hold their operation hostage for ransom? Get the money and get some nice PR all at the same time!

I would also fear retribution by colleagues: one bad actor that does not keep his end of the bargain is bad for business for the rest.

> they cannot be that stupid

Oh yes they can.

Also, assume you have the key - what you do with it? You don't know how the files were encrypted, in which way they were stored afterwards, etc. There are many ways one can encrypt and write data, even with the same key - you obviously need the algorithm, but also there are often parameters (e.g. block sizes), storage formats etc. The easiest way to deliver all that is to provide a program.

Otherwise, what a random "press any key" IT person would do with an encryption key? They probably don't even have any tools that can do encryption on any of the systems. Do they have to write those themselves? Use OSS tools - which ones? With which parameters? What if it doesn't work?

> No company that just have been hacked would run a binary received from the hackers in order to restore the systems, they cannot be that stupid.

Uh, why? The system is already compromised. They’re already in.

Well if the company is already that messed up to not have backups and desperate that they paid criminals...

One would hope they'd just run the decryption program on each computer, not connected to the network. Or maybe hire some experts to extract the decryption key.

> More charitable reading is that the encryption key was sent over, and they started restoring with that but using standard OSS tooling.

That would make a lot more sense but I also bet there's a non-zero chance that in a day some dumb media outlet will conflate those tools as "hacker tools" and the headline will be "Hacker tools used in Colonial pipeline hack available freely on Internet. News at 10."

These inane arguments didn't kill GTA, or virtually anything else. How are they going to kill OSS that hasn't needed mainstream appeal and still doesn't? So, maybe some high school kids end up on the github pages and become 1337 hackers? Quite a stretch..

How do they decrypt it then?? Just show the key to the computer??

Pretty hilarious to see all these comments from people who have no idea what they are talking about.

Thinking $5m is a "high" ransom, thinking that there is no way they would send a decryption binary rather than a key.

Why don't you just actually research how these schemes function before commenting? The team that did this has a pretty consistent MO and five million was a massive discount.

> If some kind of software was provided by the attackers, and Colonial installed it, this could be far from over.

To be fair, malicious code has already ran on the affected machines, so if the ransomware authors wanted to do further damage they wouldn't need a malicious decryptor to do that.

So you'd either:

1) not trust the ransomware authors, rebuild everything from scratch (potentially paying the ransom and reverse-engineering the decryptor or running it isolated from the internet) and make sure to not carry over any executable code that could allow potential malware to persist

2) trust the ransomware authors and not rebuild everything, in which case you may as well run their decryptor

The ransomware typically has both the encrypter and decryptor built in.

It's a simple matter of copy-pasting the key into a box, and the decryption will happen.

Over a slow network link (like a VPN to a remote NAS), I could totally imagine it taking days/weeks/months to scan every file though...

I’ve only helped people pay a couple of times but they always provided a shoddy .exe decryptor.

Consider that most victims are small fry who would not know what to do with just a key.

> I thought the protocol for these attacks was to send the decryption keys, not provide a "decrypting tool."

Fair, but anyone who pays me $5M and wants a powershell script gets one, and an air freshener of their choice.

I don’t think the hacking group would want to show future targets that paying the ransom won’t get them un-hacked. People would stop paying them. It would be bad for business.

If anything they’re working on speeding up their decrypting tool for the next release :)

Don't rely on technical details from Bloomberg.

It could be something as simple as decrypting some files with PGP or some open source tool

Reply on news.ycombinator.com