Hacker News Reader

Comment by marcosdumay | Hacker News Reader

Once the criminals start maintaining their own backups of victims data and helping them restore from rival attacks, they can successfully call themselves a mob.

Somehow, that's a quite believable scenario.

View on HN

https://en.wikipedia.org/wiki/History_of_firefighting#Rome

Fire fighting in Rome had a similar premise.

Free market in action.

Doesn’t mean the free market doesn’t work. Asking people to pay before putting out the fire could be seen as a pay per use model. While a government run service funded by tax dollars could be seen as a subscription service that price discriminates on income tax rates.

In both cases it’s the market at play.

Free market requires strong property rights, as private property is a legal fiction which otherwise does not exist enough to sustain a market.

This is instead a dysfunctional government approaching anarcho-individualism.

I think wikipedia got the details wrong there. Crassus didn't offer to buy the burning buildings, he offered to put fires out. At least, that's how I understood it years ago and that's what Wiki's own source shows-- http://www.trivia-library.com/b/richest-people-in-history-ma... .

edit: Actually, Plutarch wrote that Crassus did buy the burning buildings.

That's interesting - I definitely have heard it taught the way Wikipedia has it. But I suppose some website here or there doesn't really count as much of a source when we're talking of events so far in the past. Maybe someone can provide a primary source or two?

Hmm, I dug further. The story probably comes from Plutarch (Lives), "[Crassus] would buy houses that were afire, and houses which adjoined those that were afire, and these their owners would let go at a trifling price owing to their fear and uncertainty"[1].

Plutarch was closer to Crassus than I am so I guess I can't argue.

[1] https://penelope.uchicago.edu/Thayer/e/roman/texts/plutarch/...

The privately owned fire brigades in NYC 100 years ago weren't much better. The free market at work:

https://www.youtube.com/watch?v=9zoXk1vnmcg

The real Bowery Boys would sometimes sabotage other companies' insured buildings by setting the fires.

https://en.wikipedia.org/wiki/Bowery_Boys

Setting fires on other peoples' property is not "the free market at work".

But the rest of it was. The part in the first half of my message and the linked video is entirely free-market.

Also, please do the work to expound on your claim.

> do the work to expound on your claim

A free market system requires protection of property rights. Arson violates property rights, and so is not free market.

What type of market is it when there is no regulation to protect rights, whether property, natural, or civil?

Anarchy is one. Communism is the other, as you have no property rights.

These are political systems, not economic systems.

When I hear people describe a free market, the respect for property rights is sacrosanct yet many also push back on regulation. This confuses me. Regulation typically seeks to ensure rights are respected.

If only organizations would backup their own data. Then they could just restore and avoid paying.

I have a backup device of my own at home and that's the one I have to use. The company I work relies on some MSFT service that is pretty inflexible and won't back up the entire machine.

Backup is only part of the picture, one needs a proper disaster recovery strategy that is tested and updated. Otherwise it could turn out that backups exist, but it'd take half a year to bootstrap the company back into function using them. Backing up and restoring one PC is trivial, doing the same to 10000 PCs and another 1000 of interconnected software systems is a whole different business.

Many people’s backup routines aren’t good enough.

Some of these guys encrypt over a period of time which is long enough to exceed the backup rotation. Their code decrypts on request, until the trigger day, when it posts the banners and deletes itself.

Maybe corporations should make it standard practice to have cold storage backups that are physically disconnected from the network (by humans) in a rotated fashion. Backup A is physically disconnected on B days and backup B is physically disconnected on A days.

Or stored an a cloud storage provider that supports S3-style object lock.

That's why you have a combination of rotating backups, say 7, one a day, and non-rotating permanent backups, say once a week.

Also, one should use "append only" backups (such as tape), or a disk drive designed to be append only with hardware write enables.

With a de-duplicating backup system like Borg, you can keep more backups in the same space. borgbase.com provides append-only and 2FA, which keeps your backups secure.

There is also the threat of leaking private data. Companies which collect PII could be liable if it's proven they were negligent.

If only organizations would backup their own data. Then they could just restore and avoid paying.

This is commonly suggested, and entirely useless.

What the ransomware groups do is put a time bomb on the computer, then leave it to trigger on a future condition. Your backup will backup the time bomb, and the second you restore it, it also goes boom. And therefore your backup is a perfect copy of your data but entirely useless.

One should still be able to just mount the disk and not boot the OS associated to browse through the files? Not fully automated but at least some solution and maybe worthwhile for smaller businesses

This is not entirely useless as you still have a backup of the data, you just need to restore it without the "time bomb".

Good luck finding the time bomb. See also my above comments about ways that they can corrupt data.

That assumes the backup couples the data and compute together, like a system image or something. If the backup is just data and is somewhere else, you can just rebuild the compute infrastructure from a known secure state (which arguably may require rebuilding the entire compute environment).

Even if your backup does couple the data and compute together, if it's simply time based (not sure what other event you could use really, perhaps some pure probabilistic function), then it seems like you can just trick the environment that the time is something else to get back in.

The real underpinning issue is that this stuff breaks the state of the infrastructure and the business can't afford the downtime to go around and repair these issues.

If you have your infrastructure build out mostly automated, that automation is backed up, and critical data is backed up, then you can reasonably sidestep these issues (I supposed a real thorough breach might integrate the ransomware in this very automation system but it should be reasonable to root out). The other issue is of course if the intruders threaten to release private data (empkoyee and customer PII, financials, so on). There's also business integrity but that doesn't really seem to matter anymore.

First of all the goal is to make people not trust their backups. So they study and target the systems that do backups and restores. If you are separating data from systems, they have a number of tricks. One is to have the backup system corrupt data in subtle ways. Sure, you have a backup. But you can't trust it. And they make sure that you KNOW you can't trust it by pointing you at some easily verifiable corruption...and not letting you know what ELSE they changed.

But as for an event to use, what they can do is have the machine check a remote URI to see whether it should let the system run, and if it should then set itself up to lock things at a specified time. In order to restore that you need to have it starting on a network with networking to a system that has the attacker's private key to sign the request. This is not an environment that you are able to create.

The data corruption approach is devious and something I hadn't considered, but I also feel like it eliminates much of an attacker's advantage. The more extensive the corruption, the more likely it will draw attention, possibly to the ransomware itself, so an attacker would want to keep this to a minimum. In turn, a victim would probably choose to live with minor data corruption over paying a ransom, or at least I'd expect the payout threshold to greatly diminish vs the scenario where 100% of the data is held hostage.

Any source to support this assertion? Never heard from any professional security reporting that they actually do that, and sounds very Hollywood. Most cases I've heard about are dumb simple - just encrypt everything you have write access to and ask for money. You don't need a complex operation when a simple one brings the same amount of cash. These people aren't making a movie, they are making money, and less they have to work for it, the better. Simple is always cheaper and more efficient, in crime too.

How do you go about testing your personal backups? I find my own desktop is harder to verify than a server with automated tests

What I do is see if it can be read by an independent system. For example, many dvd players can read media files plugged into a USB port. Put some media files on your backup drive, and see if your dvd player can read them.

You have to have backup. You can't trust professional crooks, because - well - they're crooks.

If you are penetrated, it's not so easy as just restoring your data from backup. You have to sterilise the machines you are restoring to. And you have to sterilise the data you want to restore. CM automation can deal with the system sterlisation, but I don't know how to sterilise data without using human judgement.

Don't get penetrated.

> they can successfully call themselves a mob

Or Backblaze's evil twin.

Ablaze?

Frontblaze

Freezefront

If only there were organizations who weren't criminals at all and who could be paid by a company to maintain backups of the company's data.

It's a crowded marketplace, anybody who wants to succeed in there needs some growth hacking. Where in this case "growth hacking" hacking literally means hacking.

If only managers would perceive the money spent to pay such organizations as a necessity rather than burned cash

As randomware attacks become more prevalent I suspect managers’ impressions will change!

The criminals already do often recommend firms to manage the payment and recovery process.

I think they can start calling themselves the corporate IT department.

Perhaps the red team, there is more to IT than backups

For a second there, I thought you were going to say they can call themselves a backup service.

Reply on news.ycombinator.com