Hacker News Reader

Comment by anikan_vader | Hacker News Reader

Looks like ransomware criminals are going for the subscription model.

Once the criminals start maintaining their own backups of victims data and helping them restore from rival attacks, they can successfully call themselves a mob.

Somehow, that's a quite believable scenario.

https://en.wikipedia.org/wiki/History_of_firefighting#Rome

Fire fighting in Rome had a similar premise.

I think wikipedia got the details wrong there. Crassus didn't offer to buy the burning buildings, he offered to put fires out. At least, that's how I understood it years ago and that's what Wiki's own source shows-- http://www.trivia-library.com/b/richest-people-in-history-ma... .

edit: Actually, Plutarch wrote that Crassus did buy the burning buildings.

That's interesting - I definitely have heard it taught the way Wikipedia has it. But I suppose some website here or there doesn't really count as much of a source when we're talking of events so far in the past. Maybe someone can provide a primary source or two?

Hmm, I dug further. The story probably comes from Plutarch (Lives), "[Crassus] would buy houses that were afire, and houses which adjoined those that were afire, and these their owners would let go at a trifling price owing to their fear and uncertainty"[1].

Plutarch was closer to Crassus than I am so I guess I can't argue.

[1] https://penelope.uchicago.edu/Thayer/e/roman/texts/plutarch/...

Free market in action.

Free market requires strong property rights, as private property is a legal fiction which otherwise does not exist enough to sustain a market.

This is instead a dysfunctional government approaching anarcho-individualism.

Doesn’t mean the free market doesn’t work. Asking people to pay before putting out the fire could be seen as a pay per use model. While a government run service funded by tax dollars could be seen as a subscription service that price discriminates on income tax rates.

In both cases it’s the market at play.

The privately owned fire brigades in NYC 100 years ago weren't much better. The free market at work:

https://www.youtube.com/watch?v=9zoXk1vnmcg

The real Bowery Boys would sometimes sabotage other companies' insured buildings by setting the fires.

https://en.wikipedia.org/wiki/Bowery_Boys

Setting fires on other peoples' property is not "the free market at work".

But the rest of it was. The part in the first half of my message and the linked video is entirely free-market.

Also, please do the work to expound on your claim.

> do the work to expound on your claim

A free market system requires protection of property rights. Arson violates property rights, and so is not free market.

What type of market is it when there is no regulation to protect rights, whether property, natural, or civil?

Anarchy is one. Communism is the other, as you have no property rights.

These are political systems, not economic systems.

When I hear people describe a free market, the respect for property rights is sacrosanct yet many also push back on regulation. This confuses me. Regulation typically seeks to ensure rights are respected.

If only organizations would backup their own data. Then they could just restore and avoid paying.

I have a backup device of my own at home and that's the one I have to use. The company I work relies on some MSFT service that is pretty inflexible and won't back up the entire machine.

Many people’s backup routines aren’t good enough.

Some of these guys encrypt over a period of time which is long enough to exceed the backup rotation. Their code decrypts on request, until the trigger day, when it posts the banners and deletes itself.

That's why you have a combination of rotating backups, say 7, one a day, and non-rotating permanent backups, say once a week.

Also, one should use "append only" backups (such as tape), or a disk drive designed to be append only with hardware write enables.

With a de-duplicating backup system like Borg, you can keep more backups in the same space. borgbase.com provides append-only and 2FA, which keeps your backups secure.

Maybe corporations should make it standard practice to have cold storage backups that are physically disconnected from the network (by humans) in a rotated fashion. Backup A is physically disconnected on B days and backup B is physically disconnected on A days.

Or stored an a cloud storage provider that supports S3-style object lock.

Backup is only part of the picture, one needs a proper disaster recovery strategy that is tested and updated. Otherwise it could turn out that backups exist, but it'd take half a year to bootstrap the company back into function using them. Backing up and restoring one PC is trivial, doing the same to 10000 PCs and another 1000 of interconnected software systems is a whole different business.

You have to have backup. You can't trust professional crooks, because - well - they're crooks.

If you are penetrated, it's not so easy as just restoring your data from backup. You have to sterilise the machines you are restoring to. And you have to sterilise the data you want to restore. CM automation can deal with the system sterlisation, but I don't know how to sterilise data without using human judgement.

Don't get penetrated.

There is also the threat of leaking private data. Companies which collect PII could be liable if it's proven they were negligent.

How do you go about testing your personal backups? I find my own desktop is harder to verify than a server with automated tests

What I do is see if it can be read by an independent system. For example, many dvd players can read media files plugged into a USB port. Put some media files on your backup drive, and see if your dvd player can read them.

If only organizations would backup their own data. Then they could just restore and avoid paying.

This is commonly suggested, and entirely useless.

What the ransomware groups do is put a time bomb on the computer, then leave it to trigger on a future condition. Your backup will backup the time bomb, and the second you restore it, it also goes boom. And therefore your backup is a perfect copy of your data but entirely useless.

That assumes the backup couples the data and compute together, like a system image or something. If the backup is just data and is somewhere else, you can just rebuild the compute infrastructure from a known secure state (which arguably may require rebuilding the entire compute environment).

Even if your backup does couple the data and compute together, if it's simply time based (not sure what other event you could use really, perhaps some pure probabilistic function), then it seems like you can just trick the environment that the time is something else to get back in.

The real underpinning issue is that this stuff breaks the state of the infrastructure and the business can't afford the downtime to go around and repair these issues.

If you have your infrastructure build out mostly automated, that automation is backed up, and critical data is backed up, then you can reasonably sidestep these issues (I supposed a real thorough breach might integrate the ransomware in this very automation system but it should be reasonable to root out). The other issue is of course if the intruders threaten to release private data (empkoyee and customer PII, financials, so on). There's also business integrity but that doesn't really seem to matter anymore.

First of all the goal is to make people not trust their backups. So they study and target the systems that do backups and restores. If you are separating data from systems, they have a number of tricks. One is to have the backup system corrupt data in subtle ways. Sure, you have a backup. But you can't trust it. And they make sure that you KNOW you can't trust it by pointing you at some easily verifiable corruption...and not letting you know what ELSE they changed.

But as for an event to use, what they can do is have the machine check a remote URI to see whether it should let the system run, and if it should then set itself up to lock things at a specified time. In order to restore that you need to have it starting on a network with networking to a system that has the attacker's private key to sign the request. This is not an environment that you are able to create.

The data corruption approach is devious and something I hadn't considered, but I also feel like it eliminates much of an attacker's advantage. The more extensive the corruption, the more likely it will draw attention, possibly to the ransomware itself, so an attacker would want to keep this to a minimum. In turn, a victim would probably choose to live with minor data corruption over paying a ransom, or at least I'd expect the payout threshold to greatly diminish vs the scenario where 100% of the data is held hostage.

One should still be able to just mount the disk and not boot the OS associated to browse through the files? Not fully automated but at least some solution and maybe worthwhile for smaller businesses

Any source to support this assertion? Never heard from any professional security reporting that they actually do that, and sounds very Hollywood. Most cases I've heard about are dumb simple - just encrypt everything you have write access to and ask for money. You don't need a complex operation when a simple one brings the same amount of cash. These people aren't making a movie, they are making money, and less they have to work for it, the better. Simple is always cheaper and more efficient, in crime too.

This is not entirely useless as you still have a backup of the data, you just need to restore it without the "time bomb".

Good luck finding the time bomb. See also my above comments about ways that they can corrupt data.

> they can successfully call themselves a mob

Or Backblaze's evil twin.

Ablaze?

Frontblaze

Freezefront

If only there were organizations who weren't criminals at all and who could be paid by a company to maintain backups of the company's data.

It's a crowded marketplace, anybody who wants to succeed in there needs some growth hacking. Where in this case "growth hacking" hacking literally means hacking.

If only managers would perceive the money spent to pay such organizations as a necessity rather than burned cash

As randomware attacks become more prevalent I suspect managers’ impressions will change!

The criminals already do often recommend firms to manage the payment and recovery process.

I think they can start calling themselves the corporate IT department.

Perhaps the red team, there is more to IT than backups

For a second there, I thought you were going to say they can call themselves a backup service.

AB testing shows 80% of the customers like it

Their engagement is through the roof and we have the data to prove it

Their growth hacking worked

To unsubscribe you have to talk to a sales representative and send in a fax.

Just click that innocent looking unsubscribe link at the bottom of the email. Case solved!

Hardest part is to find subscribers, from then on the milking process is easy. Leaving the joke aside, does this mean that the systems remained unprotected after the initial ransom was paid or that they continued to threat leaking sensitive data?

Paying the ransom a second time would guarantee nothing. Neither was paying the first time either.

If they were caught in the first place and paid up, the attacker presumably learned enough about the infra to find another way in? Or it was social engineering.

Like, is a company who runs its IT infra on Windows XP and pays the ransom likely to switch to the latest and greatest, no expenses spared, in a total and utter overhaul of all their systems? Or will they only try to patch the holes that were already revealed and gloss over the rest? Blame it on the intern, all that.

I wonder if there are like Russian mob investors in these cybercrime "startups" and they also have to make decks that show YoY revenue / user growth. Lmao!

Well, to my understanding, fronting money in drug deals for a cut and interest is a common model crime already, so I would say it's more likely than you think. The only difference between VC funding and bankrolling the mob is one is legal.

I wonder if this hurts their reputation.

If they earn a reputation of coming back for seconds...

Two things:

People fix things faster to prevent double dipping.

People opt to not pay the initial ransom if they’re going to be taken hostage again.

It’s a kind of tragedy of the commons where the commons are the potential victims.

It doesn’t even have to be the same attacker. The attacker could just as easily sell the info to another attacker.

Plus, if the original vuln used to gain access is still open, there’s no reason why somebody else doesn’t find it later.

Which vulnerability did the attackers use to gain initial access? Do the attackers disclose this along with decrypting the data? And are you sure they didn't leave a sleeper Trojan behind for later?

A few months ago one chat between hackers and the company was leaked. The hacker actually explained how to fix the vulnerabilities. On mobile but it should show up in google (think it was posted here on hn also)

This assumes the blackmailer is trustworthy.

They're becoming a file encryption service. No one can steal your files either because they will just get encrypted trash.

Though I suppose those thieves could also pay for the encryption key, or just go directly to the "service provider" for a paid copy.

“Data escrow service”

RaaS

Do they have the Java SDK released yet?

I'm looking forward to one of them going public in a country where ransomware is legal lol, seems like they've got really solid ARR.

Well beating up someone to death will bring you money once, beaing someone multiple times will bring you more money.

Ransom gangs are business oriented.

Meh, it looks like the ransom businesses have customer retention problem if only 80% stay.

How the hell do people got hit with ransomware anyway? Do they not have offline nightly backups of critical data?

See my post in the peer thread.

Why not just the prices up?

Reply on news.ycombinator.com