80% of orgs that paid the ransom were hit again | Hacker News Reader

80% of orgs that paid the ransom were hit again

venturebeat.com

736 pointslxm373 comments

What I suspect: the first ransom was paid by insurance, therefore it didn't hurt them, therefore they didn't bother protect themselves for the second.

Now just wait to see what will happen to your insurance rate after you pay the third ransom.

They certainly will begin to understand the need for backups.

Most of these start as phishes to lower level employees. It makes sense to me that’ll happen again and I’m not sure I can say the solution is better backups.

Another issue with backups, is are you restoring to an already infected / immediately infectable state?

I think the better closer is “The certainly will begin to take security, training, and best practices seriously”.

I'd like to think security training can take care of it, that people can be careful and considerate and have a skeptical eye about every single message they receive. But it only takes one person and these huge companies employ so many people. So many times, even at companies with really strict security training I've seen people just walk away from their unlocked computers, click random links in emails, stuff like that. People are always the first line of defense but it's one of those one-sided battles, where every single person in the entire company has to make 0 mistakes, and an attacker only has to get lucky once.

Which is why you need a level above the individual to protet from attacks.

It sucks locking things down for each employee, and subjecting them to bureaucracy to unlock things they need to do, but it's better than ransomware.

It's unrealistic to expect every employee to catch hacking attempts 100% of the time.

A single computer should never have access to all the company's data. Neither should a single login.

It's like compartmentalization on a battleship. A single hole won't sink it, in fact, many holes won't.

Most people's enterprise software is akin to an already waterlogged dingy.

> where every single person in the entire company has to make 0 mistakes, and an attacker only has to get lucky once

Good post. I don’t mean this criticism for you specifically. But, why is there an assumption among HN types that there are no bad-actors among the insiders? You can have all the safeguards you want, but if an insider deliberately installs something, you’re screwed.

In some industries — armored trucks, banks, military stuff — there is a huge emphasis on background checks, security clearances, and the like to weed out bad actors. (And, even then, it often fails.)

I sense there is nothing similar for employees handling the company’s data. Obviously, there might be background checks and the like — hell, McDonalds has background checks. But, I’m not aware of the intensive FBI-style screening you see in the aforementioned realms.

Am I wrong?

How many thousands of people, for instance, could corrupt or lock the data at, say, Amazon? Are these people scrutinized to the same level as standard Brinks Armored Truck driver? I doubt it.

I guess there's two questions:

- is protecting against internal sabotage actually different that protecting against external attack. I don't think it's all that different. It comes down to authenticating actions and enforcing the principle of least privilege. If you built a system that was actually secure (i.e. one that depends on reasonable inconveniences, rather than one that depends on people to be perfect all the time or is so inconvenient it inclines them to do the digital equivalent of jamming the door open) it is likely that it will be secure enough against most internal saboteurs.

- is protecting against internal sabotage going to pay off? Most people probably aren't inclined to deliberately target their own company. It's far more likely that there is a bad actor in the world who wants to target your company, than that there is in your company. And making a person's job secure less stable is probably going to make them more likely to be a saboteur, so you should carefully evaluate whether gratuitously adding stress to someone who might get behind on their mortgage is a good idea. (Which I suppose is what this kind of background check would cause.)

Malware comes from the outside. Stealing company secrets and selling them is what I would be worried about from internal threats. Either way least access necessarily where possible is a good strategy.

> Most people probably aren't inclined to deliberately target their own company. It's far more likely that there is a bad actor in the world who wants to target your company, than that there is in your company.

“Most” people are law abiding. So, I agree with the first sentence.

The second sentence, however, has little support. The universe of people who can do these types of attacks is large, but not universal. You need computer skills. Necessarily. Those with computer skills are usually already part of the industry. How many disgruntled people pass through the FAANGs each year? Now add in all the IT positions at the banks.

In short, there are probably tens of thousands of domestic ‘bad actors’ who have (or will have in their careers) access.

Probably more.

> The second sentence, however, has little support.

Your argumentation doesn't challenge the truth of falsity of the statement, nor does it go towards challenging my conclusion. It seems to assume I've said "there are probably no internal bad actors", when I've said "securing your system against external bad actors will deal with the cases more likely to occur, and will usually be sufficient against the less likely cases".

'X is more likely than Y and preventing X mitigates Y to a tolerable level' is not equal to saying 'Y probably doesn't happen'.

> How many disgruntled people pass through the FAANGs each year? Now add in all the IT positions at the banks.

Obviously the probability increases significantly with the number of employees, but I don't think that switches the probabilities. Still, the most important companies to consider are the companies which, unlike FAANGs, aren't really in a position to make independent judgement about their risk profile, but whose existence depends on their records/data. And even someone with as many employees as the US government probably has more people outside of their employ who want to target them than inside, although surely they always have some of both.

I'm not sure what the relevance of your reference to computer skills is. In order to ransomware a company, as far as I know, you need to buy software off the darkweb and run it from a vulnerable location. I suppose technically that requires computer skills, but it's surely not what you mean. And the companies which are vulnerable to ransomware are not all employers of significant numbers of technically skilled people.

In any case, I don't think even a gratuitous reevaluation of the probabilities significantly changes my conclusion. Even if we assumed the improbable notion that every single company in the word has a disgruntled employee and that there are no external crooks, the process of securing the system against external crooks will make it far more survivable against single internal bad actors, and the effect it has on the employees will be less likely to produce internal bad actors.

I don’t disagree with the general idea: there’s a large overlap in internal and external security.

The entire issue just leaves me with a nagging feeling that something fundamental is being overlooked. There is something profoundly different in modern companies that didn’t exist a few years earlier; namely, a very tight concentration of data/ops/control. Whether it’s external or internal, it seems a single person can do catastrophic damage to the company AND the customers. Fifty years ago, for instance, in a typical auto plant, I doubt a single person could have truly devastated the company (short of a bomb or arson or something). Nowadays, we’re moving towards systems where not only could a single bad actor cripple the company but also cause all the cars already sold to stop. (I exaggerate a bit, but you get my point I hope... )

Here's a bit of detail about an internal attack I was involved with: http://boston.conman.org/2004/09/19.1 It wasn't a disgruntled employee---it was an employee who was hired by another party to get hired by the target, spend six months there, and did his thing on a particular date.

Yeah this is a great point, you gotta figure that armored trucks, banks, military stuff, they all have functional physical access control, clearly defined risks, established value, etc. The person wheeling the dolly full of cash and the driver of the truck... well you know those two people are going to be handling bulk cash. The MP guarding the nukes is standing at the checkpoint. Check em' because you can just move on to the next person.

But in the corporate world, theres gotta be huge variance, but so many don't give a flying flamingo who's scoping out what, unless somebody is forcing the issue (and also auditing and reporting to the compliance department, whatever thats for).

They know the people in the NOC/SOC, the C-suite has equity, there may be physical access control, cameras and proxcards out the wazoo, but when Marge from bizdev needs those emails for the marketing newsletter or whatever, she is gonna get them immediately and hand them right over to the intern or vendor or Doug, whatever his job is.

For all the obscene value that the data and access represents, its encrypted, right? What could go wrong? Want to background check the sales people? But... look at this guy's resume! He's only asking 80% of the market rate! These dialysis machines sure won't renew their support contract by themselves.

Best case scenario is that the costs mount even higher into the stratosphere and people start demanding a second look. It's been a while, Maersk, JP Morgan, TransUnion, Colonial Pipeline, Beef, Hospitals, Schools, the OPM (for god's sake...) billions or trillions of dollars. It doesn't seem to be a priority.

>> But it only takes one person and these huge companies employ so many people.

No. It never takes only one employ clicking a bad link. It takes that click, plus a browser/email/os system that allow for random code to executed. It take an IT department that has allowed individual non-IT employees to use computers with elevated privileges. It requires a management structure that has failed to invest in proper off-site/cold backups. It requires an organization that doesn't have a proper business continuity plan.

And at the top of the incompetency pyramid, it requires a vendor that sells an email system that allows evil email messages to somehow infect entire operating systems. Want your email to connect to your office suite? Sure. Want to install random software based on clicked links? Sure thing. Want to update your firewall, install a new browsers and simultaneously backup all your encryption keys to a random server in the far east? Why not! Anything to make your operating system experience seamless.

that's what I'm saying. Just training isn't enough the system has to be hardened.

Notice the previous comment about developers not allowed to be admin of their own machines? On computers with a good security model developers don't need to be admin of their own machines, but that wasn't thought of.

I don’t get the point of not allowing administrator to the local machine to employees. The local machine is practically a throwaway in my opinion. Why should we care about it? The shared folder is much more vital to the business.

Yeah anytime a job locks admin access to a local machine I assume their network security is full of holes, and I'm usually right about that assumption.

It makes some attacks a lot easier. You usually need admin access to install a rootkit so your virus can re-install itself. You also get full control over the network stack, which makes it trivial to MitM traffic. Admin access will let you disable whatever security monitoring tools are installed so you can stay undetected for longer.

Locking down admin access is less about protecting the local machine and more about preventing the laptop from becoming a jumping off point into more important pieces of infrastructure. It's by no means fool proof, but it adds another security feature that has to be countered.

I don't know whether it's worth the trouble it creates, but I don't think it's totally without justification.

I genuinely don't put any faith in education. Every phishing education program I've seen has effectively said "look out for weird emails, (perhaps with misspellings) and if you see them report them to security!" I haven't seen any which went into the real specifics which might actually educate users:

- A phishing email which can pwn you without user interaction is basically unheard of.

- Even malicious sites generally can't do anything bad simply by visiting them. (and yes, I'm aware browser exploitation exists, but it is exceedingly rare)

- Ultimately, it's entering your credentials in a malicious site which is what puts users at risk. A user must click a malicious link (sometimes two) and then intentionally enter their credentials into the malicious site.

Between this, and the fact that users must read emails, visit sites, and enter their credentials over and over, just to get through their workday, I believe the outcome is that user education doesn't amount to much. It would be much better if a normal user's workflow didn't usually require clicking on email links and then entering their credentials. The fact that this is required means that even a savvy users will eventually be tired / rushed / working on automatic and get owned.

Which is why basic stuff like MFA and MDM (block sign-ins coming from non compliant devices) works wonders against ransomware attacks.

Can't wait for WebAuthN to proliferate.

> A phishing email which can pwn you without user interaction is basically unheard of.

If you extend from "email" to the other communication tools that companies use today (and do use for inter-company communications too), there actually have been a number of these in the past year.

Outlook [3] had one that didn't require downloading the file, exactly - the "Preview" window from just clicking the attachment once, was enough.

Microsoft Teams [0], Jabber [1] and Slack [2] were all hit by real 0-interaction RCEs.

[0] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md

[1] https://nvd.nist.gov/vuln/detail/CVE-2020-3495

[2] https://hackerone.com/reports/783877

[3] https://nvd.nist.gov/vuln/detail/CVE-2020-1349

Bluecoat proxies are amazing at creating the wrong user behaviour, since when spegno fails all the ones I've seen fallback to basic auth asking for your company network credentials in a basic auth box on the browser.

> Most of these start as phishes to lower level employees. It makes sense to me that’ll happen again and I’m not sure I can say the solution is better backups.

Why? Secretary gets a call from a nigerian prince, starts that letter.exe she gets in her e-mail, her computer gets fscked, IT takes her drive, restores a clean image, and she gets back to work.

If the only copy of some important document is on his/her pc, or that pc can overwrite/delete the only copy, then they've fscked up by design... and yes, now better backups would help.

And let's not discount the moral of low paid, overworked employees, and companies that let low level managers run roughshod over lower level employees. My point is don't discount inside corporate espionage by disgruntled any level employees.

Thank goodness I didn't have access to a script that would lock up at least two of my past employers when coming up years ago? Then again, I personally haven't been that mad, but boy do I know employees who were.

I could say that we are all choir boys, but you piss on an employee, especially during a recession, well let's just say I have seen unpstanding guys rub magnets over hard drives over pure apathy. (The guy didn't know about strength of magnents, and it did not hurt anything.)

Plugging in a usb, or downloading a suspicious email is something I can see happening, especially to "those" companies.

I imagine Xfinity employees dream about it?

"I have seen unpstanding guys rub magnets over hard drives over pure apathy."

Open up a spinning rust hard drive and you will find two very strong magnets inside, positioned opposite each other.

This isn't why it didn't work though: disks tolerate smooth magnetic field gradients just fine. To wipe them you want a chaotic, noisy electromagnet.

Wow, interesting. How does that work?!

Basically it's the transition in field strength, not the field, which flips a bit. So you need a moving magnetic field, and you need to cause a lot of changes because HDDs have all sorts of error correction.

I used to care for the security of my work machine. I was sole admin. No corporate crap- or spyware. I was responsible and I learned a lot.

We got bought. Big corp enforced Endpoint Management and a whole barrage of corporate spyware.

I am not an admin anymore. I can't even use an AdBlock solution anymore.

And guess what. I don't give a damn anymore. If the device enforces an update, so he it. If I have to double approve every external mail address when sending, so be it.

But I don't feel ownership or responsibility anymore. Should corporate overlords care. I am out.

I have a direct A/B experiment on this: I have one work laptop which is centrally managed by big-corp IT (I'm not the admin), and one laptop which is a project machine which I manage and admin.

Guess what? The big-corp IT managed computer which I only use to check email and edit Word docs is almost unusably slow, weighed down as it is with antivirus, surveillance software, centralized updates, etc. The project machine which I manage and have admin access to remains snappy despite its workload (Visual Studio) and older hardware.

Also, you gotta love the "cost savings" of let's outsource our IT, not let developers be admins on their own machine: now we have to buy secondary machines that developers ARE admin of, so they can get their work done.

If a developer needs to be admin to do their work the os needs a better security model.

That's highly dependent on the type of development work. I'm a kernel developer and I need regular access to privileged components of the system for a wide variety of reasons. It could be argued that all standard *nix/windows/mac systems need a better security model to better isolate specific tasks, but for much of what I need to do (e.g., create, modify file systems/boot loaders/kernels, ptrace processes, etc...), if I'm allowed to do it at all, I can get anywhere else anyway, so I may as well just have full admin and save everyone some headaches.

And I'd argue this isn't only true for kernel development. In some cases, sure, but certainly not enough to make such a blanket statement.

You shouldn't be doing your kernel development testing on the same machine as you do your office tasks.

Though I will agree there are exceptions, you are not one

Preach! I have the same issues,but my last place had me as IT for the whole (small) shop, and when they outsouced IT ('we need you on important_thing') they had me install all of the Corp Spyware (because 'why would we ask them to send their own techs, then we would have to wait for them to schedule us in, you do it- it'll be faster!) and I watched with Despair as all resources went to AV (gotta love that Norton 360, so secure), key-logging, sending everything out by the millisecond. It was like watching a dumpster fire.

I kept my machine as it was, explaining that if anything happened to those units (bad updates, blah blah), mine would be unaffected and mine was completely necessary.

Lo, and behold! That very day everyone was complaining how slow their computers were, how even basic websites now took ages to load, and they did.

The owner refused to admit he made a bad decision and stayed with that 'IT' 'company' for over a year, and didn't get rid of them until I'd left and no one was available who could triage, and they saw just how little that 'company' did, and just how much I was made to cover for them

> The owner refused to admit he made a bad decision and stayed with that 'IT' 'company' for over a year, and didn't get rid of them until I'd left and no one was available who could triage, and they saw just how little that 'company' did, and just how much I was made to cover for them

That last part leaps out at me as particularly interesting: highlighting behind-the-scenes firefighting work is always tricky. Management doesn't want to acknowledge that it's necessary, while engineering maybe shies away from managerial caricaturization of what ultimately amounts to implementational minutiae. How'd you end up conveying the behind-the-scenes work you did in these kinds of situations?

It sounds like they didn’t convey it all. As I read it, the boss only learned about the heroics after the employee had left and no one was around to put out the fires. And that sounds normal for the situation, because management did not want to hear about it.

Fun note at that. If nothing happens the CIO states boastfully how their spyware prevented crap from happening. If shit happens it is elaborate stuff we need more protection against.

There are many steps in the chain between a phish message and a ransomware attack - the user opening a phish is just one of them. You might prevent lateral movement afterwards, you may detect the attack in time (there often are days or even weeks between the phish and the ransom) to protect it, you might prevent the payload from reaching the user, etc. So yes, you're right, the solution is not just better backups but stepping up the whole security game - however that takes will, money and quite some time.

>... however that takes will, money and quite some time.

And the accounting folks will not be fans of anything that costs money. They will just say "But we haven't been attacked a second time, why should we pay for mitigation services and implementations??"

That's the "it takes will" part.

Organizations can and do take many decisions of which "the accounting folks" are not fans of, the accounting people can and do say such things about the costs, but they don't have a veto. Arguments about cost of mitigation are valid in general, but leaders and owners can choose the priorities, and the responsibility and blame for these choices is fully on them (for their will or lack of will), not on "the accounting folks" arguments.

Also, sometimes that accounting argument is entirely valid. For example, look at the recent case of First American Financial - https://krebsonsecurity.com/2021/06/first-american-financial... - if the consequence of leaking the sensitive financial documents of millions of customers is just 500k, then it definitely is cheaper to just accept the hacks and pay the compensation, because investing in proper security would be much more expensive than that.

Backups might get you up and running again, but the new hotness is threatening to release trade secrets, competitive advantages, and embarrassing emails. Even with an ironclad recovery some people might be inclined to pay in such a situation.

True, but companies may be less likely to pay. I'm confident that our major competitors have enough ethics to not look at our trade secrets if released, and the minor ones that would don't have the ability to hide their tracks and so in court they will be shut down.

> Most of these start as phishes to lower level employees.

They used to (and probably still) do this. But more recently these folk are paying access brokers. A bit like bank robbers teaming up with criminal locksmiths.

> It makes sense to me that’ll happen again and I’m not sure I can say the solution is better backups.

You'll ideally need:

- Better security awareness training to cover human weakness such as spotting dodgy email and what to do if you click a link

- Patch vulnerabilities quickly as this will reduce risk considerably

- Company wide tested and sufficient backup strategy (most companies fail on this) to protect key identified data assets

- Regularly pen-test both your internal and external environments

Obviously it doesn't stop there, but those are key.

Or they overhauled the IT team.

I'd say chances are somebody brought up concerns at most of these places but management told them not to worry for one reason or another.

Untested backups and DR/BCP procedures aren't backups.

Snapshots aren't backups.

Backups that aren't physically-isolated, typically offsite, aren't backups.

Well then, It’s starting to sound like backups aren’t what a business needs.

Backups are there to provide a business continuity in wide range of disruptions. What you want to protect your business from is up to you, but typically you need protection from all things OP mentioned.

Backups and disaster recovery sites are definitely important from business continuity perspective, but there is a bigger risk of leaking PII and other sensitive information such as SIN / Social security numbers if the software vendor has access to it. Your business might be able to recover from backup if the hacker has not encrypted it, but the hacker for sure will be maliciously using the PII information to send phishing emails.

These are somewhat orthogonal issues.

1. Test and encrypt backups.

2. Don't get hacked. Defense-in-depth philosophy and rigorous, routine social-engineering training/testing. If you get hacked, it's usually game over. Defend systems like the business depends on it because it does.

3. Limit exfil: extra security for PII, exfil detection, and [HN]I[DP]S.

Why are offsite write only continuously incremental snapshots from a full start not backups?

"Off-site write only continuously incremental snapshots from a full start", that can be interpreted as a backup strategy (i.e. a DB would do something like that with full/diff/log backups), but you just changed what snapshots means.

What OP tried to demonstrate that backups need to protect from bad changes, on physical, logical, and business layer, from data corruptions to 'oops' scenarios (i.e. drop table). Standard snapshots for sure don't protect from all those.

Also for a good backup strategy, you need - "a full start" once in a while, because corruption in "full backup" will invalid all incremental snapshots - regular restore of a backup for e2e validation

Alright, was curious as this is how I have been handling my third layer of backups for quite a while now, regular incremental encrypted zfs snapshots to an offsite storage provider using API keys that only have write priveleges. Wanted to make sure it wasn't something about "snapshots" which made this a bad idea in a way I hadn't thought of. Doesn't seem that's the case.

Please define snapshot.

I suspect you mean filesystem snapshots and as long as the snapshot lives on the same physical media you are correct. But when you take the snapshot and transfer it to a physically separate location where it cannot be altered it sounds like a backup to me.

Physically-separate location or not snapshots that can be added, updated, culled, or deleted by local systems aren't backups, they're replication. Replication replicates problems.

Vaulted offsite on at-rest storage media is the only valid way to store backups. Every other "convenient" "backup" service or snapshot replication process is a liability businesses must avoid. Lose all your data, 50%+ you're out of business, and The End.

The insurance cost is increasing due to rising ransomware attacks. This is causing a lot of stress within insurance companies and insured companies. An HBR post cited that this is a new niche for insurance companies and 5 big ransom demands can wipe out the insurance premium they collected from 250 customers.

Relevant analysis here:

http://www.vendormanagementoffice.net/2021/06/cyber-insuranc...

Rudyard Kipling explained this:

---

But we've proved it again and again, / That if once you have paid him the Dane-geld / You never get rid of the Dane.

--- https://www.poetryloverspage.com/poets/kipling/dane_geld.htm....

By paying, you’ve just proven that you are a profitable target to hit.

I'm from Dublin. We didn't pay the Danegeld, and in retaliation they built a city.

Could you explain that a bit? :o

Danes/Vikings established Dublin, and Irish urbanism generally. They're like our Romans.

I was just throwing some complexity into the Danegeld narrative.. not sure what it means in terms of the metaphor. Maybe ransomware hackers eventually build operating systems?

The most important line:

> 80% of organizations that paid the ransom were hit by a second attack, and almost half were hit by the same threat group.

The same group!

Makes sense to me. From what I've read, it's pretty clear the ransom payment is for a one-time ability to get your data back. It's not advertised as some sort of permanent opt-out.

Makes more sense if the group offered a subscription model for decrypting files encrypted by that group. Then you wouldn't have to keep paying the big lump sum.

A referral revenue sharing program for jaded employees would probably do well also.

...and if you pay for our Premium Level Service, we'll secure your systems against other criminal enterprises as well!

What Hackers Can Learn From The Sopranos.

That's a nice network you have there. It would be ashamed if something happened to it if you know what I mean.

Some groups will actually tell you how they got in and help you patch your systems.

Some groups will hack you AND also uninstall viruses emanating from other groups, or they will hack you and patch other flaws so that other malwares cannot take their spot. It's all game theory.

isn't that just plain strategy?

Game theory is more or less “plain strategy.”

Although I think false advertising would be the least of their worries if they decided to do it.

Everyone knows that once you find a loose slots machine, you keeping playing it.

You might come back next week, but if it just jackpotted it's empty right now.

That's so 1980s! Now, they update the balance on your Player's Card.

Not if the slot machine had an insurance company payout for them

Different groups have different policies. I believe some do actually add you to a whitelist if you pay and grant you at least a year or two before your immunity expires. (Maybe some do permanent whitelists? Not sure.)

Something something Norton Anti-Virus something.

It's right there in the small print. These companies sure know about that.

Where is the hacker's Honor... Cmon man

It went away when telling someone their system was broken stopped being treated a favor and started being treated as a crime.

All the good guys shut up, and so you're left with the criminals who then exploit the flaws instead.

Coming soon: ransomware with subscription business model

I up voted you for the lulz, but I'm actually unsure if this isn't the basic "legitimate" business model for everyone anyway.

I'm not so unsure - that's what make's it funny

“Up next on ‘You Won’t Believe It’, viruses were created by the antivirus industry”

That's already a thing

"SCHWIRTZ: What DarkSide does is they're a ransomware creator. So they create the program that is uploaded into a victim's computer system that locks down their data. But what they do is they basically contract out to these affiliates who are other hackers. And these are the people that are responsible for actually penetrating the victim's computer services. And what they do is operate basically on a subscription service. You, as an affiliate, can sign on to DarkSide services, in which case you get access to their malware, their ransomware to use for a fee that operates on a sliding scale depending upon the size of the ransom."

https://www.npr.org/2021/06/10/1005093802/inner-workings-of-...

I think they meant the ransom as a subscription service, not malware to franchisees as a service.

Yeah, the data remains permanently encrypted but you can access it. You pay X dollars per month for that access. They even provide protection against other gangs as well as offsite "backup" themselves. Plus your business can be an infection vector for other enterprises and individuals. The actual fees start low...

I think it is, actually. Well, not advertised; but these big ransoms, they can be negotiated. And one of the victim company's requirements will be that if I pay, then you agree to leave me alone.

I think these negotiations are fine, if you're just buying time to gather your backups; I've assumed the payouts were made by insurance companies, so go ahead - buy a zero-value promise from a gang of crooks, if you want.

But your org has been rooted (at best, you can't prove it hasn't). Compromised systems can't be really be cleaned, they have to be reinstalled from scratch, if you want to have confidence in them.

And an attack can be stored in data - which you're about to restore from backup. That's a problem I have faced, and I chose to ignore that threat. No choice - I didn't know how to address it then, and I still don't now.

My half-baked opinions about ransomware are largely based on watching this documentary: https://www.bbc.co.uk/programmes/w172wx9056p6bd6

> And one of the victim company's requirements will be that if I pay, then you agree to leave me alone.

I'm curious how one would enforce that. From the fact that the ransom got paid in the first place, we can establish that there's no legal body that's able and willing to exercise any authority over the ransomware group. So it's not like you can sue them for breach of contract.

Perhaps you can rely on the honor system? Though, given this is a group of professional extortionists we're talking about, if you choose to go that route, you may be at elevated risk of getting what you deserve.

It's a matter of reputation.

If a ransomware group has a reputation of not actually delivering the unlock upon payment, or of re-infection shortly afterwards, the decision to pay them becomes harder to defend.

A sticky problem indeed. I'm sure their sock puppet budgets must run into the tens of dollars.

I don't know that you can even reliably identify what ransomware group you're dealing with. They seem to use similar software, wallet addresses can change, people can claim to be some group they aren't, etc. And they probably identify potential victims with similar methods and tools.

How would the statistics then be gathered that half were hit by the same?

You sure some ransomware crooks don't provide contracts to their clients?

It makes you think about how many of those are inside jobs and/or compromised employees. In the case of colonial, it would seem highly likely given it was a credential compromise, but then again secure passwords are a known weakness

"threat group" is odd phrasing, is it really the same actual group?

I'm shocked at such unethical practices by the hackers. I expected better from a group of terrorists.

I'm kind of reminded of the mafia and their protection rackets. Obviously, you never could trust criminal organizations. At the same time, if you're a medium-sized corporation or small business and they have your important data, and you know you could pay to get it back, what do you do? I can imagine they really have some people by the balls, metaphorically speaking. They could drive you bankrupt.

I hope the authorities find a way to go after these people, but it's obviously got to be difficult, because they might well be in China or Russia. It would take some international cooperation that's probably impossible right now.

In the meantime... Switch to Linux, have a competent offsite backup strategy...?

Unless the attackers revealed their exploit, it probably wasn't fixed and they just got in again the same way.

I would leave a backdoor too if I was them (maybe not what they did)... I wonder how many paid for a 2nd and 3rd time...

Wonder what percentage of those that were hit had someone actively looking to get back in. Maybe 20% learned their lesson and improved their security. I wonder how many iterations of this will it take for most companies to learn that leaving your doors unlocked in a shady neighborhood/the internet is a bad idea.

if it were me, I'd leave webshells or other backdoors to let myself back in if they didn't do proper cleanup. Especially if they paid, I have a "known good" customer.

What would be the incentive not to? Honor among thieves?

You know they’re vulnerable to the attack (the hard part?) so why not keep doing it until they shore up their defenses.

Short term you benefit from the second random. Long term, you may make people less likely to pay your ransoms.

I mean, of course! This is like classic sales book play. Your previous "costumers" are almost always less effort to dollar than new prospects.

Were I an evil criminal, I'd include a backdoor in the restore image I gave them, so that I could attack the same people again.

I mean they just proved that they are willing to pay the ransom. If they are also unwilling or unable to clean up their shop and keep it from happening again, it surely will.

It is almost like the groups hacking them are providing a good service. If they get hacked once, shit happens. But if it happens multiple times then someone should probably answer for it.

"We don't have money in the budget for backups. But we do have money in a different budget for ransom payments!"

"how much you got?"

RAAS, Ransomware As A Service

The responsibility lies at the nation-state level, and the clear decision is for Governments to ban the formal exchange of cryptocurrencies.

As soon as this occurs, ransomware events will collapse since the ransoms will become unpayable.

The negatives of cryptocurrencies (ransomware enablement, chip and electricity shortages, scams) clearly outweigh the positives at this point.

Cryptocurrencies are decentralized. It would have to be banned literally every country in the world for them not to be able to use it and convert to a non-digital currency. Good luck with that.

And I'm sure they'd just invent or go back to some other method -- possibly riskier and more violent -- so they can continue to ransom money from people.

> Cryptocurrencies are decentralized. It would have to be banned literally every country in the world for them not to be able to use it and convert to a non-digital currency. Good luck with that.

The effect would not come from the criminals being able to cash out, it would come from the company not being able to cash in. If cryptocurrency were to be banned and public exchanges were closed purchasing cryptocurrency to the tune of millions of dollars worth becomes practically impossible for a regular company without connections in the space. If the company is not able to pay the ransom, the entire venture is pointless.

> And I'm sure they'd just invent or go back to some other method -- possibly riskier and more violent -- so they can continue to ransom money from people.

Sure, there will be other methods of transferring some amount of money. To the tune of millions of dollars, though? Unlikely. Cryptocurrency enables these companies to pay ransoms of this amount. Without cryptocurrency you might be able to ask for a 50K ransom instead of a 5M ransom, but that reduces your payout by 100X. 5M is enough to retire from. 50K is less than the yearly wage these people can make.

It's not like ransomware didn't exist before cryptocurrency, we know what ransomware without cryptocurrency looks like. What cryptocurrency changed is the scale of the payout. Instead of getting a few thousand dollars in gift cards the hackers are now rewarded with millions in bitcoins. It is hard to deny that the change in incentives caused by cryptocurrency is the primary driver behind the huge increase in ransomware attacks in the last few years.

Crypto can work peer-to-peer even with fiat echanges shut down.

Sure, it would be more difficult if crypto is illegal, but I think because of the difficulty of getting it, crypto prices would skyrocket.

Everyone will also move to using the privacy coins too. So, banning crypto might actually be beneficial for it as it would incentivise crypto projects to improve privacy and decentralization even more.

A ban won't stop people from using it or developing it in their homes.

> Crypto can work peer-to-peer even with fiat echanges shut down.

Sure, nowhere in my post do I deny that an underground market won't exist. In fact, I directly hint to the fact that it will exist. What matters for this problem is how easy it is to buy $X million worth of bitcoins for a company. Currently this is easy. If you have $X million in your bank account, you can go to one of these exchanges and buy $X million worth of bitcoin.

With the exchanges shut down, how would a company buy $X million worth of bitcoin? Where do they go? How do they not get scammed while doing so? It's not like companies can easily move $X million to another country where it would be legal to buy crypto either. After all, if they could move money in a bank that easily, crypto would not be required at all for the purpose of ransomware. They could just move the $X million directly! People use crypto for ransomware because it is not so easy to move money of this magnitude.

> Sure, it would be more difficult if crypto is illegal, but I think because of the difficulty of getting it, crypto prices would skyrocket.

That seems unlikely. A bank run seems the most likely scenario with a massive drop in price being the result, even if only a few high-impact regions would make it illegal (e.g. the US and EU). Regular people and large investors would cash out almost immediately upon hearing the news. Why would regular people want to own an illegal currency that they cannot trade for anything besides maybe drugs on the black market?

The reason the majority of people own crypto now is not because of the utility - it is because there are legal crypto exchanges that they can use to trade them back to the actual currency that they use (generally dollars or euros). If people have to go through illegal networks in order to perform these exchanges (and remember, exchanges for fiat money would be illegal and hence risky) the entire value proposition is lost.

> Everyone will also move to using the privacy coins too. So, banning crypto might actually be beneficial for it as it would incentivise crypto projects to improve privacy and decentralization even more.

I wouldn't even propose banning cryptocurrencies entirely. Shutting down the exchanges and banning the trade of cryptocurrency for fiat seems more than sufficient for this purpose. Cryptocurrencies can continue to exist on their own and perhaps find a use/purpose of their own. The back-and-forth exchange for fiat is what is problematic.

This might even be good for cryptocurrencies as a platform, as the focus would shift back to the underlying technology and its use cases rather than the investor crowd that doesn't give a shit about the technology and only cares about making a quick buck.

> A bank run seems the most likely scenario

Sure, there would be an initial bank runk, but a ban would also have unintended consequences such as making coins more scarce, thus unintentionally driving speculative demand and cause people to turn to the black market, especially if there are bank runs on fiat itself (I know, extremist, but you never know - I've personally eyewitnessed a national currency imploding once).

> This might even be good for cryptocurrencies as a platform

I guess we have something we agree on. Also a ban would encourage more activism and push cryptocurrencies to their full potential (of side-stepping the bans by going to fully decentralized exchanges and peer-to-peer) and weed out a lot of the snake oil in the space.

Do I see a ban to be successful for what what it intends to do? Maybe temporarily, but in the long term it will fail and backfire.

If you believe banning cryptocurrencies will suddenly stop ransomware, then I have a bridge to sell you.

There is an easy fix here: make it illegal for companies to transact in crypt currencies. Then they would have no way of paying a ransom without engaging in illegal activities. This would destroy the ransomware business model.

Then you hire the services of brokers that don't have the same compunctions about transacting in crypto. And even if you were to magically erase all cryptocurrency from the earth, it wouldn't still stop ransomware, or the same state sponsored actors would gravitate towards even worse things.

It's like nobody has learned a thing from the war on drugs, my point being: you deal with the root cause of the disease (infosec in most companies and even government offices is a joke and bad people have taken notice), not playing whack-a-mole with the symptoms (crypto use) that hint towards systemic decay.

The root cause is the blackmailers/thieves committing the crime, not that the crime was easy. Addressing the root cause might include things like improving education and reducing poverty. That in combination with a bam on paying ransoms would likely reduce these crimes.

There was ransomware before crypto currencies. There will be ransomware after crypto currencies.

There was? How did it work? Bank transfers?

Ever heard of corporate kidnappings?

Yes, actually, people overestimate the reversibility of wire transfers. And before cryptocurrency, there were still shady money services such as Liberty Reserve or Perfect Money with little qualms about their habitual clientele.

(not saying I think this is a solution, but...)

If the goal is to stop companies from paying ransom, then why not just make that illegal?

Better yet, add a 200% tax on top of ransom payments. That will tranfer the profits to the government. The attackers will know that the ability to pay is cut to 1/3.

It is already illegal to pay most ransomware gangs in the USA:

https://home.treasury.gov/policy-issues/financial-sanctions/...

In the theoretical universe where banning crypto is possible, yes it would stop almost all ransomware of the scale we see reported in news today.

There's just no other form of payment which would work for them. You can't easily go "can I have $50k worth of giftcards" and on the receiving side you can't easily validate or sell millions of them without tanking the value. Any kind of wire transfer would expose the source immediately at that scale. There's only so much money you can move through services that give you kickbacks of various kinds. What else is left?

Basically unless ransomware teams know of a new really good way of laundering money without a trail, or are happy to take a massive pay cut, that would be the end of most of their operations.

>...theoretical universe where banning crypto is possible...

Money grows on trees, there, too.

I'll bet you dollars to donuts that if you made crypto illegal, there's still a whole lot of countries that won't give a shit and the problem will only get worse.

All these situations are nebulous and complicated, something as simple as legally banning crypto is not going to solve the problems.

Suitcase full of gold coins delivered somewhere in Russia would be an easy replacement for crypto coins.

That doesn't sound easy at all.

This view is similar to saying things like "The terrorists and the media have a symbiotic relationship and the media is responsible for enabling terrorist attacks, therefore let's ban the media".

Ah yes, we should outlaw the ability for people to send money to each other and have civilization take the burden of incompetent corporations that can't be bothered to follow basic infosec practices (let alone whatever product they are selling in the first place is probably garbage and has no value beyond monopoly).

The ransom side is already a crime, and it being labeled a crime doesn't stop it from happening. Laws don't prevent crime.

Looks like ransomware criminals are going for the subscription model.

Hardest part is to find subscribers, from then on the milking process is easy. Leaving the joke aside, does this mean that the systems remained unprotected after the initial ransom was paid or that they continued to threat leaking sensitive data?

Paying the ransom a second time would guarantee nothing. Neither was paying the first time either.

If they were caught in the first place and paid up, the attacker presumably learned enough about the infra to find another way in? Or it was social engineering.

Like, is a company who runs its IT infra on Windows XP and pays the ransom likely to switch to the latest and greatest, no expenses spared, in a total and utter overhaul of all their systems? Or will they only try to patch the holes that were already revealed and gloss over the rest? Blame it on the intern, all that.

To unsubscribe you have to talk to a sales representative and send in a fax.

Just click that innocent looking unsubscribe link at the bottom of the email. Case solved!

Once the criminals start maintaining their own backups of victims data and helping them restore from rival attacks, they can successfully call themselves a mob.

Somehow, that's a quite believable scenario.

https://en.wikipedia.org/wiki/History_of_firefighting#Rome

Fire fighting in Rome had a similar premise.

Free market in action.

Doesn’t mean the free market doesn’t work. Asking people to pay before putting out the fire could be seen as a pay per use model. While a government run service funded by tax dollars could be seen as a subscription service that price discriminates on income tax rates.

In both cases it’s the market at play.

Free market requires strong property rights, as private property is a legal fiction which otherwise does not exist enough to sustain a market.

This is instead a dysfunctional government approaching anarcho-individualism.

I think wikipedia got the details wrong there. Crassus didn't offer to buy the burning buildings, he offered to put fires out. At least, that's how I understood it years ago and that's what Wiki's own source shows-- http://www.trivia-library.com/b/richest-people-in-history-ma... .

edit: Actually, Plutarch wrote that Crassus did buy the burning buildings.

That's interesting - I definitely have heard it taught the way Wikipedia has it. But I suppose some website here or there doesn't really count as much of a source when we're talking of events so far in the past. Maybe someone can provide a primary source or two?

Hmm, I dug further. The story probably comes from Plutarch (Lives), "[Crassus] would buy houses that were afire, and houses which adjoined those that were afire, and these their owners would let go at a trifling price owing to their fear and uncertainty"[1].

Plutarch was closer to Crassus than I am so I guess I can't argue.

[1] https://penelope.uchicago.edu/Thayer/e/roman/texts/plutarch/...

The privately owned fire brigades in NYC 100 years ago weren't much better. The free market at work:

https://www.youtube.com/watch?v=9zoXk1vnmcg

The real Bowery Boys would sometimes sabotage other companies' insured buildings by setting the fires.

https://en.wikipedia.org/wiki/Bowery_Boys

Setting fires on other peoples' property is not "the free market at work".

But the rest of it was. The part in the first half of my message and the linked video is entirely free-market.

Also, please do the work to expound on your claim.

> do the work to expound on your claim

A free market system requires protection of property rights. Arson violates property rights, and so is not free market.

What type of market is it when there is no regulation to protect rights, whether property, natural, or civil?

Anarchy is one. Communism is the other, as you have no property rights.

These are political systems, not economic systems.

When I hear people describe a free market, the respect for property rights is sacrosanct yet many also push back on regulation. This confuses me. Regulation typically seeks to ensure rights are respected.

I think they can start calling themselves the corporate IT department.

Perhaps the red team, there is more to IT than backups

> they can successfully call themselves a mob

Or Backblaze's evil twin.

Ablaze?

Frontblaze

Freezefront

If only organizations would backup their own data. Then they could just restore and avoid paying.

I have a backup device of my own at home and that's the one I have to use. The company I work relies on some MSFT service that is pretty inflexible and won't back up the entire machine.

Backup is only part of the picture, one needs a proper disaster recovery strategy that is tested and updated. Otherwise it could turn out that backups exist, but it'd take half a year to bootstrap the company back into function using them. Backing up and restoring one PC is trivial, doing the same to 10000 PCs and another 1000 of interconnected software systems is a whole different business.

Many people’s backup routines aren’t good enough.

Some of these guys encrypt over a period of time which is long enough to exceed the backup rotation. Their code decrypts on request, until the trigger day, when it posts the banners and deletes itself.

Maybe corporations should make it standard practice to have cold storage backups that are physically disconnected from the network (by humans) in a rotated fashion. Backup A is physically disconnected on B days and backup B is physically disconnected on A days.

Or stored an a cloud storage provider that supports S3-style object lock.

That's why you have a combination of rotating backups, say 7, one a day, and non-rotating permanent backups, say once a week.

Also, one should use "append only" backups (such as tape), or a disk drive designed to be append only with hardware write enables.

With a de-duplicating backup system like Borg, you can keep more backups in the same space. borgbase.com provides append-only and 2FA, which keeps your backups secure.

There is also the threat of leaking private data. Companies which collect PII could be liable if it's proven they were negligent.

If only organizations would backup their own data. Then they could just restore and avoid paying.

This is commonly suggested, and entirely useless.

What the ransomware groups do is put a time bomb on the computer, then leave it to trigger on a future condition. Your backup will backup the time bomb, and the second you restore it, it also goes boom. And therefore your backup is a perfect copy of your data but entirely useless.

One should still be able to just mount the disk and not boot the OS associated to browse through the files? Not fully automated but at least some solution and maybe worthwhile for smaller businesses

This is not entirely useless as you still have a backup of the data, you just need to restore it without the "time bomb".

Good luck finding the time bomb. See also my above comments about ways that they can corrupt data.

That assumes the backup couples the data and compute together, like a system image or something. If the backup is just data and is somewhere else, you can just rebuild the compute infrastructure from a known secure state (which arguably may require rebuilding the entire compute environment).

Even if your backup does couple the data and compute together, if it's simply time based (not sure what other event you could use really, perhaps some pure probabilistic function), then it seems like you can just trick the environment that the time is something else to get back in.

The real underpinning issue is that this stuff breaks the state of the infrastructure and the business can't afford the downtime to go around and repair these issues.

If you have your infrastructure build out mostly automated, that automation is backed up, and critical data is backed up, then you can reasonably sidestep these issues (I supposed a real thorough breach might integrate the ransomware in this very automation system but it should be reasonable to root out). The other issue is of course if the intruders threaten to release private data (empkoyee and customer PII, financials, so on). There's also business integrity but that doesn't really seem to matter anymore.

First of all the goal is to make people not trust their backups. So they study and target the systems that do backups and restores. If you are separating data from systems, they have a number of tricks. One is to have the backup system corrupt data in subtle ways. Sure, you have a backup. But you can't trust it. And they make sure that you KNOW you can't trust it by pointing you at some easily verifiable corruption...and not letting you know what ELSE they changed.

But as for an event to use, what they can do is have the machine check a remote URI to see whether it should let the system run, and if it should then set itself up to lock things at a specified time. In order to restore that you need to have it starting on a network with networking to a system that has the attacker's private key to sign the request. This is not an environment that you are able to create.

The data corruption approach is devious and something I hadn't considered, but I also feel like it eliminates much of an attacker's advantage. The more extensive the corruption, the more likely it will draw attention, possibly to the ransomware itself, so an attacker would want to keep this to a minimum. In turn, a victim would probably choose to live with minor data corruption over paying a ransom, or at least I'd expect the payout threshold to greatly diminish vs the scenario where 100% of the data is held hostage.

Any source to support this assertion? Never heard from any professional security reporting that they actually do that, and sounds very Hollywood. Most cases I've heard about are dumb simple - just encrypt everything you have write access to and ask for money. You don't need a complex operation when a simple one brings the same amount of cash. These people aren't making a movie, they are making money, and less they have to work for it, the better. Simple is always cheaper and more efficient, in crime too.

How do you go about testing your personal backups? I find my own desktop is harder to verify than a server with automated tests

What I do is see if it can be read by an independent system. For example, many dvd players can read media files plugged into a USB port. Put some media files on your backup drive, and see if your dvd player can read them.

You have to have backup. You can't trust professional crooks, because - well - they're crooks.

If you are penetrated, it's not so easy as just restoring your data from backup. You have to sterilise the machines you are restoring to. And you have to sterilise the data you want to restore. CM automation can deal with the system sterlisation, but I don't know how to sterilise data without using human judgement.

Don't get penetrated.

The criminals already do often recommend firms to manage the payment and recovery process.

For a second there, I thought you were going to say they can call themselves a backup service.

If only there were organizations who weren't criminals at all and who could be paid by a company to maintain backups of the company's data.

It's a crowded marketplace, anybody who wants to succeed in there needs some growth hacking. Where in this case "growth hacking" hacking literally means hacking.

If only managers would perceive the money spent to pay such organizations as a necessity rather than burned cash

As randomware attacks become more prevalent I suspect managers’ impressions will change!

Why not just the prices up?

I wonder if this hurts their reputation.

If they earn a reputation of coming back for seconds...

Two things:

People fix things faster to prevent double dipping.

People opt to not pay the initial ransom if they’re going to be taken hostage again.

It’s a kind of tragedy of the commons where the commons are the potential victims.

It doesn’t even have to be the same attacker. The attacker could just as easily sell the info to another attacker.

Plus, if the original vuln used to gain access is still open, there’s no reason why somebody else doesn’t find it later.

Which vulnerability did the attackers use to gain initial access? Do the attackers disclose this along with decrypting the data? And are you sure they didn't leave a sleeper Trojan behind for later?

A few months ago one chat between hackers and the company was leaked. The hacker actually explained how to fix the vulnerabilities. On mobile but it should show up in google (think it was posted here on hn also)

This assumes the blackmailer is trustworthy.

RaaS

Do they have the Java SDK released yet?

They're becoming a file encryption service. No one can steal your files either because they will just get encrypted trash.

Though I suppose those thieves could also pay for the encryption key, or just go directly to the "service provider" for a paid copy.

“Data escrow service”

AB testing shows 80% of the customers like it

Their engagement is through the roof and we have the data to prove it

Their growth hacking worked

I'm looking forward to one of them going public in a country where ransomware is legal lol, seems like they've got really solid ARR.

How the hell do people got hit with ransomware anyway? Do they not have offline nightly backups of critical data?

See my post in the peer thread.

I wonder if there are like Russian mob investors in these cybercrime "startups" and they also have to make decks that show YoY revenue / user growth. Lmao!

Well, to my understanding, fronting money in drug deals for a cut and interest is a common model crime already, so I would say it's more likely than you think. The only difference between VC funding and bankrolling the mob is one is legal.

Well beating up someone to death will bring you money once, beaing someone multiple times will bring you more money.

Ransom gangs are business oriented.

Meh, it looks like the ransom businesses have customer retention problem if only 80% stay.

Meaningless stat without a baseline to compare against. How many who didn't pay were hit again?

If the attacker isn't paid for the first attack, why would she attack again? She's not doing it for the lulz!

I do agree with you that there should be more visibility for the "silent majority" of firms who operate their businesses responsibly, and therefore don't ever need to pay ransom.

Because second attacker might not be briefed by the first one.

If they actually have proper backups to avoid paying the first one, my guess is they are much more likely to also have the skills to prevent a second breach.

I agree on backups and actually working and robust restore system.

Cheapest way to avoid paying ransoms.

You can never be sure about 100% hacker safe but backup/restore system can be life saver

And also due to the attacks being cheap to run

If the victim doesn't pay the first time, they suffer consequences and next time might decide to pay instead.

ISTM we only hear about the tiny minority of "victims" who do "suffer consequences". Most organizations who get ransomed just shut off a bunch of unnecessary stuff, re-provision the necessary stuff with passwords turned off, restore from backup, and hire some security consultants.

I'm sorry but I have to ask: why assume the attacker is female?

It seems like "they're" would've been a better choice there, as there are a plurality of attackers in the world.

Why not? Why assume that they are male?

Statistically it seems the safer bet that they are male.

Probably trying to diversify pronoun usage. Would we be pointing this out if they said 'he'?

No, because for better or worse “he” is the default for a plurality or unknown gender in most (all?) romance languages, including English. Times and sensitivities change but “she” still connotes more knowledge than “he” so it’s bound to cause some confusion.

what was true centuries ago is no longer true. "he" is not gender neutral in English, in any sense of the term. it's only used as such in historical writing - languages evolve over time. "she" connotes as much knowledge as "he".

Language changes over time, yes, but also over space. Something other than 'he' might be default where you are, but not where I am.

"Mallory" is commonly understood to be a woman's name. Come to think of it, so is "Trudy".

It's interesting to see the various reactions to a perfectly innocent idiom.

https://en.wikipedia.org/wiki/Alice_and_Bob#Cast_of_characte...

The first time I saw this (using female pronouns for an unidentified person instead of "him/her" or "they") was in RMS's writings. So instead of using the indefinite/singular they, RMS would just say she/her. I thought it was an interesting way to hack language to break assumptions we have about gender, especially in technology.

To preempt criticism.

I understand how this sort of off-topic snag can feel provocative, but please don't copy it into the thread where it can turn into an entire flamewar. There's nothing new in any of this at this point, and therefore nothing interesting. When there's nothing interesting, discussions turn nasty. Solution: focus on the interesting specific information and diffs in a post, and ignore the provocative bits.

https://news.ycombinator.com/newsguidelines.html

That's not for us to intellectually deduce, give the numbers. They have it. Is it 79%? 99? 1?

Maybe it's all automated shotgun based attacks and they don't close the holes and so the act of paying the ransom is statistically meaningless

This is shoddy journalism. Might as well just say "X%". It implies you shouldn't pay lest you fall victim again but they don't actually say that.

Things that implicate what they refuse to say is kind of suspect

The "journalism" has been shoddy from the start. This entire "Russians are pwning the electric company" meme has always been motivated more by politics, CYA, PR, and marketing than it has by anything real. TFA itself is a mail-it-in, paraphrase-the-press-release "effort". They actually link to the press release rather than the original marketing document; it's possible TFA's authors haven't read the latter! There's no guarantee the marketing document answers your question, but if you have an email address you don't mind getting spammed you could find out for yourself. [0] I don't have such an email address.

[0] https://www.cybereason.com/ebook-ransomware-the-true-cost-to...

The whole point of gathering statistics is that making up logic for what could be the case is generally a massive waste of time.

The attacks are likely automated. Like any computer virus.

It's likely the reinfection rate is high in both cases since it's so difficult to ensure every possible back door has been closed.

“Never negotiate with terrorists” is a simple and clear mantra, and as most clear and simple concepts it hides a lot of assumptions.

One of them is you are ready to lose the hostage in the worst case scenario. That’s how the police sees it, because the society benefits more from being firm in individual cases than losing a few of its members that might not come back anyway.

That’s a hard one to swallow, hard enough that govs also sometimes can’t follow the mantra and just pay the ransom.

It’s crazy hard to get people to sacrifice themselves for the better good, it’s yet a bigger ask for corporations who already screw the public day in day out.

Never negotiate with terrorists is only a thing because it puts you in a stronger negotiation position.

And it's just posturing. I'm sure the US negotiates with groups it labels as terrorists through backchannels.

Literally every government says this publicly, and then negotiates privately.

From the perspective of the individual, there is no greater good than defending one’s self.

Hardly. There are many philosophies that argue that the greatest good lies with how we interact with the other.

And on a purely primal level it's common to prioritize one's offspring over one's self. I think most cultures recognize this intuitively.

I’m not arguing philosophy. I’m arguing how absurd the statement “it’s crazy hard to get people to sacrifice themselves for the better good” is, as if OP would sacrifice his or herself for anyone here they didn’t know.

What a grand delusional statement, like the sibling comment here. It’s literally arguing moral superiority while ignoring pragmatic reality.

Maybe you watch a little bit too much television, but there are plenty of spouses out there who would, for example, not want their wife to die in childbirth if they had the option.

If you don't see the chasm between "people should sacrifice themselves for the greater good" (which I'd generally disagree with, particularly if you're not defining what the greater good is) and "there is no greater good than defending one’s self" then I can't help you.

What an absurd statement, to just say unequivocally, ignoring the plenty of philosophies and ethical systems have disagreed entirely with that.

Yeah, totally absurd. Would you sacrifice your life for the strangers on this forum? Let me guess, no? Huh, wild.

Wait, so you think that defending anonymous strangers from the internet is an exhaustive set of circumstances where one might risk their life?

Oh, of course.

Yawn.

There are people who would.

I tried to put it in a neutral way, and I think it’s a far from a black and white issue.

Not to go too sideways, but hostage (with humans, not data) situations are typically about other people. When you’re the target, it’s not your life on the line, but your loved/valuable ones. So you’re not defending just yourself, you actually have to care about at least someone else to have it happen to you. And some care about a lot more than just their loved ones, they’ll also think about their friends, family, sometimes the rest of the society.

Everyone is different and there is no absolute best, but let’s at least recognize it’s complex and there’s lots of ways to think about it.

From another comment, it looks that mantra will become law in the US

https://cisomag.eccouncil.org/paying-ransom-is-now-illegal-u...

Isn't that just applying existing sanction law to ransomware?

I mean couldn't government pay the ransom and then go great lengths to track the suspects and send special forces after them? Surely US govt. has the ability to track almost anyone.

Having US govt. on your ass should a decent deterrent.

Just take a look at how hard FBI came down on cartels and individuals who were involved in killing Enrique Camarena. Cartel leaders were arrested in Mexico and several individual in the US.

That introduces a scale problem. Even for the US.

It appears that some of the major ransomware gangs are operating from Russia and are tolerated by the government, as long as they don't hit domestic targets.

The US cannot really send special forces there without risking a massive escalation.

I'm sure the US has hundreds of spies and personnel in Russia at any point in time.

But sending a spy to a software developers house and assassinating them probably isn't going to stop the problem - more people will spring up doing the same.

We might not though. We don't even have a main diplomat there.

Russia has always been notoriously hard to spy on.

I would not be surprised if there was only a handful of well placed assets and most of the spying being done electronically.

No, but the people operating in Russia like to travel elsewhere, and do.

Also, the US and allies can enforce Russian AML laws as written on paper. If, say, the UK freezes all of Oleg Deripaska's assets there, Vova will absolutely get the message. We're not going to bring down the Russian government with military force for a million different reasons, but doing it with sanctions and prosecution is a totally different story.

When they do US gets them. That happens from time to time, if you watch the news, you notice there are guys caught periodically who thought it's time for a nice vacation in Spain resting from their criminal activities... only to be picked up in the airport. However, the smarter ones stay put inside Russia and those are hard to get.

Best example was when VW's Oliver Schmidt was arrested in Miami as he was changing planes. He was in trouble from the emissions fraud scheme.

Yup, for example that credit card frauder who went to the Maldives..

The US government has negotiated with the Taliban (a formally designated terrorist group) for prisoner exchanges.

https://www.bbc.com/news/world-asia-50471186

The "don't negotiate with terrorists" is itself a negotiation tactic meant to lower the attack surface of any entity.

It's the sort of thing you say publicly, but then privately you settle with your adversary.

Absolutism is never a useful tactic.

Yes, but getting your opponent to believe you will take an absolute position is often the most useful tactic.

> Absolutism is never a useful tactic.

That sounds pretty absolutest.

I absolutely never always disagree, most of the time.

Everything in moderation, especially moderation.

Taxation works exactly like this.

You might even want to establish an isolated society, but if you try, good luck dealing with the IRS.

I don’t think this mantra was ever anything more than a meme. LE always negotiate, this mantra is designed to just better their negotiating position

> because the society benefits

That's the theory. But much like war on drugs or TSA, whether its real-world outcomes match the theoretical ones is debatable.

https://www.newamerica.org/international-security/policy-pap...

> “Never negotiate with terrorists” is a simple and clear mantra, and as most clear and simple concepts it hides a lot of assumptions.

This has nothing to do with that idea.

The reason the orgs paid the random once was because they had a severe lack of backup and other data safety protocols in combination with a vector to be infected (from all what we know, the latter is common and difficult to avoid): paying the ransom is likely their only choice to maintain the business.

It is not surprising at all that these orgs can and will be infected again, and will continue to show a lack in the security and data safety departments, and so they will continue to pay ransoms.

It's sort of an inverse survivorship bias: if you get infected once because you're susceptible, you're likely to get infected again unless you fix your susceptibility.

It has from a certain angle: For society/the internet as a whole it might be better for no one to pay the ransom at the cost of some of them perishing. The ransomware attacks would become unprofitable and would eventually stop. But to assume any organization wouldn't pay the ransom if its survival depends on it is obviously unrealistic.

I think that mantra does work here.

I would be totally fine with legislation making it illegal to pay in the case of ransomware attacks. Some companies might be completely destroyed by an attack that they can't pay off, but that is for the greater good of society: if criminals know companies have a low probability of paying since they're legally barred from doing so, they're less likely to target them.

When they hit a hospital, what is the hospital supposed to do? Not negotiate, for some "greater good" and let patients die?

https://threatpost.com/ransomware-hits-hospitals-hardest/162...

They’re supposed to back up their data and set up proper contingencies. By failing to do so, they are already putting patients lives in the hands of the encryptors.

Yes. Of course they were supposed to do so, then. But they didn't, and now they've been hit. Now, in the real world, what are they supposed to do: pay, or hold out and let the patients die as punishment for the hospital's mistakes?

Let the patients die. That’s on the hackers hands, not the hospital. Additionally, you’re making a huge assumption that the hackers are willing to escalate themselves to mass murders, which is a big leap most criminals aren’t willing to take.

> Of course they were supposed to do so, then. But they didn't, and now they've been hit.

In order for this to be a useful tactic, there needs to be no defection. The only way there can be no defection is if the legislature prohibits defection.

At that point, the hospital is on notice that they have to apply adequate security measures against this kind of attack. For instance, hospitals normally have power supplies that are capable of getting them through foreseeable blackouts. If they're going to rely on computer systems in the treatment of patients, they had better make sure they're secure. Right now, today, it isn't a surprise.

And the hackers are on notice that they are effectively killing the patients. The hackers are after the money. If the threat of death will get them the money, they're all for it. If it won't, they'll move on to a country where it does work.

I am sure an IRL hostage situation alrrady happened at an hospital, so we could have the answer in a variety of cases.

My opinion would be the hospital should open up to the police and accept their fate whatever the outcome. The gov./police makes the calculation of the impact of X people dying a very public way, the Y amount that is requested, and the ton of other wildcards (e.g. can we catch the gang now ? after the ransom is paid ? void the ransom some way afterwards ? limit the number of death in other ways ? what will the other victims take away fom this case ?).

At the end of it there should be a custom approach to that specific situation and not some blanklet policy application.

This also assumes a cooperative and somewhat decent police force, which might not be the case everywhere (but then I think we're screwed anyway)

Until your own child or spouse is held hostage or sequestrated. You will negotiate.

"“Never negotiate with terrorists” is a simple and clear mantra, and as most clear and simple concepts it hides a lot of assumptions"

The word 'terrorists', for one. It's mostly used to mean 'my opponents' these days.

What we are facing with ransomware is not insurrectionists or protestors, but gangsters. They make their living by stealing from people, cheating them, and threatening them. Many insurrectionists are honourable people that you can safely make a deal with. There is no gangster with that property.

Take backups, test the recovery procedure, don't make bargains with gangsters.

> who already screw the public day in day out

And then everyone clapped at the high-brow analysis.

It’s not really about sacrificing people for the greater good. Negotiating has high externalities that include future murders. Like all externalities, the involved people don’t give a shit.

I don't see any discussion of typical entry points. How do these guys get into the system? Is it by having someone download a malicious file? If so what type of file? PDF? MS Office? If so Adobe and Microsoft should be held accountable for their security holes, only then will they have enough motivation to maybe consider rewriting some of their code in a safer language such as Rust.

Agree.

There is much confusion and many bad analogies surrounding this issue.

Some claim - without evidence - that nation states are behind it. Which, with a moments reflection, is absurd; nation states may have an interest in disabling certain systems for military purposes (at the appropriate time), but no nation state needs ransom money. Easier ways for a government to get money; namely, just print some.

Others liken it to the mafia or cartel or other well-organized criminal organizations. This too misses the mark.

Like most business crimes, the culprit is almost always an insider. Period. As the tools to pull this off are trivial to come by on the internet, the obvious suspect would be some disgruntled IT person within the company.

It’s as if — after a bank robbery — everyone claims it must have been some crack team of Russians flown in under radar in helicopters. Instead, they should be looking at the numerous employees who have access to the security system and the safe.

But, it’s much more exciting to pretend that Putin is sponsoring hackers to get trivial amounts of money from companies across the globe. Ha.

I’m not even an IT guy, but at my last job, even I had access sufficient to destroy or corrupt all the data. That was before cryptocurrency and the like... I assume assembling a ransomware set of tools off the internet is no more or less difficult than it was to assemble a set of tools to make pirated copies of AdobePhotshop back in the day.

>no nation state needs ransom money. Easier ways for a government to get money; namely, just print some

Sure, this is obvious, makes intuitive sense, except...it explains why something like Iran-Contra or the equivalent in other countries can't happen.

> Easier ways for a government to get money; namely, just print some.

What is money? If a government wants more domestic resources, it can get it by printing money. If a state is so limited in domestic resources that it fundamentally needs resources from outside, printing money doesn't help. Printing money can help a state devote more of its country's resources to trade, but if no one wants to trade with you at any cost, it doesn't matter what parts of the local economy the state controls.

North Korea has incentives compatible with these kinds of acts, and relatively few interesting ways of deploying software engineers locally.

The entry points are "whatever works".

Typically:

* Password spraying from previous data leaks

* Good old-fashioned fishing

* Bugs in anything that's common in enterprises, exposed to the Internet and not patched fast enough, including MS Exchange, various security/VPN products, vcenter, you name it. All of these had pretty critical pre-auth bugs exposed just this year

* malicious browser plugins

* malicious O365 apps

... and so on.

Lack of MFA, lack of hardware whitelisting, servers exposed directly to the Internet, lack of user privilege restrictions, allowing passwords that are known-compromised, ...

If so, it doesn't make sense to blame Putin. The blame lies on US lawmakers, for not incentivizing US businesses to have a budget for fixing these sorts of issues. For example, when companies such as Equifax are hacked because of poor security practices do they pay a penalty? No. That's the problem.

There is a lot of blame to go around.

- VBA macros

- ActiveX for legacy ad-hoc software

Once you pay 'em the Danegeld

You'll never be rid of the Dane

I don't see why you have to pick on the Danes :)

But the similarities are there, although the person's behind the ransomware attacks are probably not vikings.

https://www.poetryloverspage.com/poets/kipling/dane_geld.htm...

https://en.wikipedia.org/wiki/Danegeld

The ancestors of the Russians were themselves Vikings. Their kingdom of Rus is where the name came from.

Pay or not - you gotta fix security.

Outsourcing it to el-cheapo, offshore middlemen is not going to cut it.

According to a study by Cybereason, which sells endpoint protection software.

One has to wonder if Cybereason measured the 80% figure from their own clients - endpoint protection is the lowest form of security.

Alternatively, Cybereason are probably in a really good position to snarf passwords and then parallel construct an attack from a third party who gives a few major individual shareholders a kickback.

Does endpoint security even work?

Anyone else think we should make it illegal to pay ransom?

These people are just financing the next generation of cyber criminals.

Once people stop paying, people will stop attacking.

I think we should actually legalize ransomware. By that I mean create a government-ran national bug bounty program. All companies of a certain size are automatically included in it. Bounties are awarded based off severity, and bounties are paid for by fines to the companies hit.

Interesting idea. But what you're describing is absolutely not "ransomware."

It is already illegal in the US as of late 2020. But we know nothing really happens when corporations break the law.

https://cisomag.eccouncil.org/paying-ransom-is-now-illegal-u...

Only for sanctioned parties I believe — which would apply for any money transfers regardless of purpose. Most random criminal rw attackers are not going to be on a sanction list.

Yes, because criminals definitely follow the law.

No, you become a criminal by paying. You continue not being a criminal by not paying.

No. Not with profit margins that high compared to operational cost, it would not be an effective deterrent. They will just continue to hit as many targets as possible. You would end up punishing the victims. What if they target some really critical infrastructure, where it would be rational to just pay and then fix the holes? Seek exemptions from law for each?

But it would be very interesting to see if the ransomware gangs can devise a scheme that gives the payer plausible deniability.

There's a somewhat better article about the survey here [1], including which countries were surveyed.

It looks like you can download the full report by filling out a form [2]. (So I didn't.)

[1] https://www.zdnet.com/article/most-firms-face-second-ransomw... [2] https://www.cybereason.com/ebook-ransomware-the-true-cost-to...

Hey guys - I know security is hard to justify cost-wise but if you get hit by ransomware then shape up and actually do some due-diligence around your data stewardship.

Wait - is this how the market fixes poor security practices?

More like a hostile and unregulated environment adding costs to doing business.

Does it really surprise anyone that criminals would (re)target a place that paid out quickly and made their "jobs" easier? The aim is to get paid as quickly as possible with the least complexity and move on to the next target, is it not? If you're a freelancer and you have 10 clients and 8 always pay within 14 days of invoice and the other 2 let it drag on 90+ days and having to send out "reminder" letters, who do you favor doing business with?

I believe that's a big part of why governments don't negotiate with terrorists and police just stall for time in real world ransom cases.

Except that is a terrible analogy and has everything to do with a poor security culture on the firm's part because IT is treated as a liability rather than an asset.

I think the analogy is apt since both paying terrorists and ransomers is counterproductive.

If you pay the terrorists they just do it again. If you pay the ransomers they just do it again. And the payment increases their capabilities.

I think, except for rare conditions where a temporary need exists, it’s a net negative to pay.

But I think the security flaws that allow random ware typically are a sign of institutional incompetence so it makes sense they would also be incompetent to pay, and pay again, and pay again. Rather than to prevent the attack or to correct the flaw that allowed the attack.

"We don't negotiate with terrorists" is more of a slogan than a real policy[1].

[1] https://www.foreignaffairs.com/articles/2007-01-01/negotiati...

The difference is that even if you don't negotiate with terrorists, they can still terrorize you. It's impossible to successfully ransom someone without their cooperation.

Doesnt this just mean that 80% of orgs that were hit with ransomware attacks just didn't bother to fix their infosec, and got hit again because they left the same holes open to be exploited?

Fool me once, shame on you. Fool me twice, shame on me.

Most likely.

It can just as easily mean that the attacker found a second exploit after the first was resolved.

Since so many were hit by the very same ransomware group, it's likely that the attacker spotted a second exploit during the first attack. It's easier to spot things when you've already busted your way in and have the run of the place.

i.e. An attacker breaks into a system using one vulnerability, spots a few more vulnerabilities while snooping for data, files them away for future reference, extracts a ransom, and then repeats the process later after the victim fixes the first vulnerability but fails to address the others.

The takeaway lesson appears to be that, if you are hacked and fix the vulnerability that made it possible, you shouldn't stop there. You're marked as a target that pays and detailed information on your system is now out there. Even having fixed the first hack, you're more vulnerable than ever.

So ransomware already means they got into the system, they could open a new secret backdoor or completely tear down your security if they wanted to. Plus it takes time to identify the ransomware to undo/remove it, so in that time they could attack again. paying ransomware ransoms is just saying "pretty please don't do this again".

Yes, but even more importantly it means they don’t have proper backups and disaster recovery.

> Fool me once, shame on you. Fool me twice, you're not going to fool me twice.

- These Companies (probably)

Please never take these security surveys seriously.

Most are created by companies looking for media coverage and are just made up.

> 80% of orgs that paid the ransom were hit again

This isn't true and I'm not sure why people think it is. This is not how the world works. Ransom crews are not cartoons, they are people like the rest of us running a business.

At a very high level, sure, ransom paid then they might be 'hit again' by a random hacker testing the defences next year. Is that 'hit again'? 'Hit again' is not 'ransom again'

If this is cookie cutter ransomware that's automated and you pay an automated system to un-encrypt. Sure the worm or what not will attack again is you don't fix that worms hole.

This has zero to do with REvil and all the famous ransom crews that the title implies. That should be pretty obvious.

This may be an impossible question to ask: does anybody know of organizations running entirely dark copies of infrastructure possibly using an entirely different stack up to the application layer? Rather than redundancy, which is an announced component of your infrastructure available for failover and thus known to attackers, this dark infrastructure exists unknown to all but a select few employees and can be engaged during a ransomware attack. Throw the old infrastructure away and rebuild new dark infra. I have heard at least one story of something like this earlier today when discussing this headline. Curious how common it is.

Keeping two infras in sync means that you gotta have some kind of formalized management process. If you do have that, then there isn't much value in having the fail over up and running at all time, you can just build/launch it if needed.

This is easy in a containerized env, if you don't have that luxury having batch scripts that can provision all the critical servers quickly does the trick. This combined with reliable database backups should be enough to make the impact of such an attack trivial.

See also: why people who want to pay to not see ads are ideal ad targets.

And that's why you never pay dane-geld[1]

[1]https://en.wikipedia.org/wiki/Dane-geld_(poem)

How long do major companies keep back ups? It seems like all of these companies that keep getting hit with ransomware Only have last weeks back up laying around. Why can’t you go back eight months? True the data is going to be lacking, but at least the structure is going to be there. I completely understand that a Trojan or a virus can get locked into a back up and it just keeps getting backed up, but if you go far enough back you will find a clean copy.

I have yearly backups for three years. Right now, we could use one of those.

At my last place, they only kept 1 year and monthly, but the problem was it was hundreds of terabytes of data on lots of VMs. We tried to restore backups and it was going to take longer than the long weekend just for file transfer.

I don’t know what normal process is, but I believe I saw file locker Trojan that didn’t hit every byte of the drive; but rather crawled the file system and did a bit on every file header for speed. So I imagine it’s still faster to pay and fix than restore from backups for some.

The company I work for does nightly back ups and we keep them for five years in cold storage. Our CTO got hit with an attack years ago that almost cost him his job at another company, and he vowed to never let it happen again. Are we unusual for this?

This is a good case of the prisoners dilemma. If the groups of attackers don’t hit the same victims twice, it would increase their chances of getting paid for each attack. Whilst also everyone is tempted to re-hit a victim who has already proved their willingness to pay, but this decreases the willingness for each victim to pay because they have seen that it won’t actually protect against a new attack.

"After an organization experienced a ransomware attack, the top 5 solutions implemented included security awareness training (48%), security operations (SOC) (48%), endpoint protection (44%), data backup and recovery (43%), and email scanning (41%)."

Only 43% of organizations invested in data backup and recovery after a randsomware attack? I would expect that number to be closer to 100%!

And how many of that 43% actually put in place a method to test their backups regularly? I'd bet its less than 5%

Makes sense. We have a company with bad security practices (not easy to fix), inadequate disaster recovery strategy (not easy to fix) and willing to pay money to criminals to make problems go away. Of course it's an ideal target. I wonder if by now the criminals compile and trade the list of easy target companies.

Seems like the ones with the payloads distribute it to more than one affiliate. Or at least a previously hit target does not get a mark that is globally respected.

The fast growth desires lead to a lot of vulnerabilities, yesterday I signed up to a service and they emailed me my own username and password, simple plain text. Incredible.

Shouldn't they improve their security?

About half did. From the article...

> After an organization experienced a ransomware attack, the top 5 solutions implemented included security awareness training (48%), security operations (SOC) (48%), endpoint protection (44%), data backup and recovery (43%), and email scanning (41%). The least deployed solutions post-attack included web scanning (40%), endpoint detection and response (EDR) and extended detection and response (XDR) technologies (38%), antivirus software (38%), mobile and SMS security solutions (36%), and managed security services provider (MSSP) or managed detection and response (MDR) provider (34%). Only 3% of respondents said they did not make any new security investments after a ransomware attack.

Given 0-day vulnerabilities and supply chain risks, I'm going to take a little bit of poetic license and say it's impossible to stop ransomware attacks, certainly with commercially viable levels of investment in infosec. You can mitigate some of the exposure, but the level of validation required to continuously guarantee that those mitigations are intact and effective.

So attacks will continue, the level of impact will hopefully be reduced along with the commensurate justifiable ransom payment.

maybe, but most ransomware attacks aren't via zero-days but via simpler means. Also ransomware infects a whole network and so part of the cause is systems that allow that.

Security is impossible. As long as there are incentives, nothing will be secure. It’s just a matter of incentive/difficulty. With enough incentive stuxnet or solar winds or omb are possible. Bitcoin values are causing this equilibrium to be disrupted, making this appear as though it were a new problem.

"And that is called paying the Dane-geld;

But we've proved it again and again,

That if once you have paid him the Dane-geld

You never get rid of the Dane."

https://www.poetryloverspage.com/poets/kipling/dane_geld.htm...

Ransomware attacks are multi-round games.

If an insurance company would also offered IT security included in the premium, they should be able privide better security at a lower total cost. Actuaries could even asist in calculating how much risk is mitigated by each security measure, and optimize meausures to match costs to risk.

Once scammers know you're a mark, they'll exploit it. This is why email lists are next to gold to scammers, because they're lists of people or organizations who have parted with their money under false pretenses before, and are most likely willing to do so again in the future.

I wish this said how many of those hit again also paid again. I find it easy to believe that you could be hit twice in a row despite your best intentions, but hard to believe that you'd need to pay the second time if you had established a backup solution.

Note that,

> 80% of organizations that paid the ransom were hit by a second attack, and almost half were hit by the same threat group

Why would victims pay them? Why would the attackers bother to reinfect? Just up the price on the original infection, after the first payment.

What percentage of orgs that didn't pay the ransom were hit again?

I simply can't fathom why any organisation can't go offline for an hour or so to rebuild their systems from backups, rather than go offline for days or more while ransom is being paid.

Supposing they have backups and that the backups werent compromised.

An argument some have suggested is to make it illegal to pay ransoms. But with crypto, someone could pay it for you (maybe the hacker), just to have charges filled on the victim.

Get attacked once? It's on me. Get attacked TWICE by the same group and did absolutely nothing to better the security after the first attack? Yeah, it's on you.

The amazing part is they allowed themselves to get hit again. You'd think these organizations would tighten security after the first one...

Once they are in, who knows what back doors the installed

What does the outcome distribution look like if you don't pay the ransom?

What percent of orgs that did not pay the ransom get hit again?

from my experience responding to these. orgs that entertain the ide of paying the ransom often do not care about root cause analysis to the degree they should.

orgs that completely ignore payment as an option spend their time identifying the entry point, and vulns, and close those before restoring or rebuilding.

It is Sales101 - Getting business from an existing customer is easier than on-boarding a new one.

Why not just criminalize paying ransoms? Remove incentives and don't fund criminals.

Because in the short term, this could have some pretty nasty consequences for some companies that are hit the hardest, and few politicians want to take that hit.

There is no honor among thieves.

Ransomware is why all my important data is backed up to dumb media--optical disks.

Ransomware is actually a net benefit. They force information security into the business agenda in a way that we haven’t really been able to accomplish before. You can now quantify the cost of getting pwned. It’s a bit like the immune system needing pathogens every once in a while.

This argument is reasonable-ish but wrong. Companies have long been subject to information security crises. Earlier, there were viruses; today, it is ransomware. Business practices will change in a way that makes these hacks less feasible, but not most businesses just aren't interested in it. The fantastic new security of the future won't be secure by design, it'll be known-ransomware-proof.

(Also, implicit in the claim is the argument that any activity is good activity. I don't think that holds: I think paying for security guards and spending disk space or CPU cycles on security measures are necessary, but not beneficial. Probably, the world would be better if there are no bad actors. But I can only assent to your claim if I believe that the world is better if we protect against bad actors than if we have no bad actors and no protection. This is probably the cause of you getting downvoted.)

What percent that didn't though? Basic controls here...

IS ANYONE SURPRISED?!

Because that’s where the money is, someone once said.

Solution: Don't pay the ransom, instead offer a bounty 'Wanted dead or alive (preferred dead of course, if it can be made to look like an accident)'

Why would you expect otherwise?

how many were hit again who didn't pay?

The standard business solution to solve security issues - for example like having all your database in a public folder - is to get a guy to implement "security" (whatever that means) who is 40 years old and is really confident he knows what he is doing. He will go configure some firewalls and stuff that has absolutely nothing to do with preventing any real risk aside from automated attacks. Every time someone still gets the files from some 90's vuln, everyone is surprised that some sooper dooper hacker wizard was able to own their fortune 500 company.

> The least deployed solutions post-attack included web scanning (40%), endpoint detection and response (EDR) and extended detection and response (XDR) technologies (38%), antivirus software (38%), mobile and SMS security solutions (36%), and managed security services provider (MSSP) or managed detection and response (MDR) provider (34%). Only 3% of respondents said they did not make any new security investments after a ransomware attack.

uh huh. uh huh. uh huh. uh huh.

Meanwhile, for example, earlier today: a web search for "cat /etc/passwd" blocks my IP. What even is the point of this article? _Of course_ if you don't patch they will just hack you again. _Of course_ if your company follows terrible 90's practices, it will get owned again.

So, what age must one be to supervise implementing security practices at an organization?

Did you choose 40 year old because it’s too old, or because it’s too young? I genuinely can’t tell

The essential point is that he's 40 and still doesn't know what he's doing (a common problem in any technical field).

Reply on news.ycombinator.com