How to survive a ransomware attack without paying the ransom • Hacker News Board

Re: How to survive a ransomware attack without paying the ransom

#31

Post by Kenji » Sat, Jul 25, 2020, 8:42 PM UTC

piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service.

You really wonder that? I'm sorry, how stupid are you? It's obviously to harvest data and control users. We've been warning and educating people about this for decades. When are you guys starting to wake up and voting with your wallet? Open services! Open software! Open formats! Own your data! Own your devices! Your life will be full of such disruptions if you keep using products that let corporations dominate you.

Re: How to survive a ransomware attack without paying the ransom

#32

Post by matsemann » Sat, Jul 25, 2020, 8:42 PM UTC

Tiltowait-- wrote: post #11

Easy: restore from backups.

What if they hacked you months before pulling the trigger? The article mentions they were hacked in December and the attack launched in March. Restoring a backup would then still leave the hackers inside.

And even if most data were backed up, most computers still have to be wiped and reinstalled. I don't think most companies backup the entire disks off all employees, it's normally just a dedicated file area. So while the data can be restored, the IT department still have to set up hundreds of computers for all kinds of different workers or machines on the spot.

Nothing is ever easy, don't be so dismissive about things you haven't thought through.

Re: How to survive a ransomware attack without paying the ransom

#33

Post by redprince » Sat, Jul 25, 2020, 8:44 PM UTC

halfcat wrote: post #14

larrymcp wrote: post #6

How is ransomware able to spread to all the PCs in a company? (Especially PCs at different locations around the globe) The malware needs to execute itself on each computer. But I would think this would be thwarted by hardware firewalls as well as apps like Windows Firewall. If my PC at work gets infected, somehow it can magically infect the guy down the hall's PC too? I thought that was made impossible years ago.

Probably through Active Directory, which has the ability to deploy software. If a domain controller was compromised, the payload could be pushed out across the board. Endpoints like PCs and servers check in with domain controllers at recurring intervals, so even if all endpoints are behind firewalls and can’t talk to one another, they still reach out to domain controllers periodically to pull down configuration updat…

The few instances I was assisting companies with ongoing ransom ware attacks, all had a similar pattern. Some initial breach of a client system (think malicious office document) gave attackers a foothold inside the network. From there the attackers ultimately pivoted to own the Active Directory. Equipped with this level of access they identified key assets and proceeded to encrypt them. Backups, if not stored offline, were rendered useless.

It is quite challenging to recover from this kind of breach since the attackers had every opportunity to touch every system connected to the AD and leave backdoors behind. I have seen companies trashing their whole AD, re-imaging all machines and basically starting from scratch at great cost.

Re: How to survive a ransomware attack without paying the ransom

#34

Post by eatingCake » Sat, Jul 25, 2020, 8:46 PM UTC

prennert wrote: post #16

piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

It is surprisingly difficult to make synchronisation work between two devices that might run different hard- and firmware and even potentially software versions. Cloud based APIs as middleware is soo much easier in comparison. I am completely with you conceptually, but from experience I can tell you that even if there is a commercial incentive to allow for local communication it takes a few days to get it working wit…

My understanding[1] was that these types of devices sync by sending a blob over bluetooth to the paired cell phone, and then the cell phone uploads this to the cloud to be decrypted. What kinds of devices are you talking about?

[1]: https://hackaday.com/2017/12/29/34c3-fitbit-sniffing-and-fir...

Re: How to survive a ransomware attack without paying the ransom

#35

Post by JohnTHaller » Sat, Jul 25, 2020, 8:49 PM UTC

piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

A Fitbit won't even sync with the app on your phone unless it has internet access and can connect to Fitbit's cloud servers. Without them it's basically a paperweight.

Re: How to survive a ransomware attack without paying the ransom

#36

Post by IshKebab » Sat, Jul 25, 2020, 8:51 PM UTC

nuker wrote: post #29

larrymcp wrote: post #6

How is ransomware able to spread to all the PCs in a company? (Especially PCs at different locations around the globe) The malware needs to execute itself on each computer. But I would think this would be thwarted by hardware firewalls as well as apps like Windows Firewall. If my PC at work gets infected, somehow it can magically infect the guy down the hall's PC too? I thought that was made impossible years ago.

Here is the diagram https://www.bleepingcomputer.com/news/security/evil-corp-blo...

That doesn't actually say at all. Symantec's report has more detail but it still has gaps:

> The initial compromise of an organization involves the SocGholish framework, which is delivered to the victim in a zipped file via compromised legitimate websites.

> The zipped file contains malicious JavaScript, masquerading as a browser update.

So are people just like "this random website is trying to download a browser update, ok I'll unzip it and run it, even though I never normally have to do this". Seems plausible.

Then:

> Privilege escalation was performed using a publicly documented technique [there's a link] involving the Software Licensing User Interface tool (slui.exe), a Windows command line utility that is responsible for activating and updating the Windows operating system.

> The attackers used the Windows Management Instrumentation Command Line Utility (wmic.exe) to execute commands on remote computers, such as adding a new user or executing additional downloaded PowerShell scripts.

It's not really clear to me how local privilege escalation allows you to execute commands on remote computers though.

Re: How to survive a ransomware attack without paying the ransom

#37

Post by PeterisP » Sat, Jul 25, 2020, 8:54 PM UTC

larrymcp wrote: post #6

How is ransomware able to spread to all the PCs in a company? (Especially PCs at different locations around the globe) The malware needs to execute itself on each computer. But I would think this would be thwarted by hardware firewalls as well as apps like Windows Firewall. If my PC at work gets infected, somehow it can magically infect the guy down the hall's PC too? I thought that was made impossible years ago.

The key point there is that all the recent major events generally are not an automated attack by a simple virus, in such situations the malware opens a command&control link that is [ab]used by multiple skilled people for weeks to gain persistence, move laterally throughout the network, find systems and user accounts with elevated privileges, disable monitoring and backups, deploy to all machines just as your administrators can (because at that point they are the de facto admins of all your systems) and only "pull the trigger" of ransomware when all the prep work is done.

In the case discussed in this article, attackers took three months between the initial compromise and the ransomware attack. One can do a lot in that time.

Re: How to survive a ransomware attack without paying the ransom

#38

Post by feanaro » Sat, Jul 25, 2020, 8:56 PM UTC

prennert wrote: post #16

piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

It is surprisingly difficult to make synchronisation work between two devices that might run different hard- and firmware and even potentially software versions. Cloud based APIs as middleware is soo much easier in comparison. I am completely with you conceptually, but from experience I can tell you that even if there is a commercial incentive to allow for local communication it takes a few days to get it working wit…

What makes it so difficult? What are some concrete problems you encountered?

Re: How to survive a ransomware attack without paying the ransom

#39

Post by fortran77 » Sat, Jul 25, 2020, 8:56 PM UTC

Isn't a ransomware attack no different from a catastrophic disk drive failure? You reformat and restore from backup. Of course, the companies profiled in that article had all their computers infected, so it could take some time. Still a recovery boot disk could be distributed and a clean image restored over the network.

Re: How to survive a ransomware attack without paying the ransom

#40

Post by PeterisP » Sat, Jul 25, 2020, 8:58 PM UTC

IshKebab wrote: post #36

nuker wrote: post #29

Earlier quoted context omitted.

Here is the diagram https://www.bleepingcomputer.com/news/security/evil-corp-blo...

That doesn't actually say at all. Symantec's report has more detail but it still has gaps: > The initial compromise of an organization involves the SocGholish framework, which is delivered to the victim in a zipped file via compromised legitimate websites. > The zipped file contains malicious JavaScript, masquerading as a browser update. So are people just like "this random website is trying to download a browser upd…

If you gain local privilege escalation on some workstation user, you can gain access to credentials of user(s) of that workstation which allow you to impersonate that user throughout the network.

If it's a privileged user, then you can move to many more workstations, if it's a non-privileged user then you may be able to use their normal access (email, network shares, access to internal applications) to try and trip some privileged user into compromising their workstation in a way that you could not from the outside. Or you can wait a month until some tech support person logs in to that workstation and you can steal their credentials.