How to survive a ransomware attack without paying the ransom • Hacker News Board

Re: How to survive a ransomware attack without paying the ransom

#51

Post by PeterisP » Sat, Jul 25, 2020, 9:28 PM UTC

fortran77 wrote: post #39

Isn't a ransomware attack no different from a catastrophic disk drive failure? You reformat and restore from backup. Of course, the companies profiled in that article had all their computers infected, so it could take some time. Still a recovery boot disk could be distributed and a clean image restored over the network.

No, because you can't consider your backups as a "known good state". A malicious attack is fundamentally different from a disaster or accident.

You should expect that any backup of systems (instead of backups of 100% pure data) will contain backdoors, that any weird systems (routers, printers, phone centrals) may be compromised even if they seem fine, and that the credentials of all the employees and any private keys/certificates have been exfiltrated, so they need to be changed.

Re: How to survive a ransomware attack without paying the ransom

#52

Post by viraptor » Sat, Jul 25, 2020, 9:32 PM UTC

scott_w wrote: post #41

SV_BubbleTime wrote: post #19

Earlier quoted context omitted.

Pretty much this. Firewalls do absolutely nothing once someone got your weakest link to click something and go to town. From my last penn test it goes, phish, get a click and execute or credentials, use a hack like getting legacy NetBIOS exploit to give up hashes for all your users, crack the hashes and hope someone used a short 12 char password or something dictionary-easy like “Wr3st1ing1!”, then leverage that acce…

> The only thing that “saves” you from paying the ransom is good backups. But if a group is fairly competent, they’ll encrypt your backups too. So it needs to be offline. This is the part I’ve never understood. Surely you should be backing up in an append only fashion initiated from the backup server? My best guess is that this gets managed from AD as well, so they find it and take over?

This is definitely doable, but it's harder than the naive solution so often it's not done. Same as log storage for example, or any other incremental data.

Related - see how many examples of S3 policies split access into read and write rather than read, append, write. It doesn't even matter where the logic lives - only whether the storage service allows you to delete anything.

Re: How to survive a ransomware attack without paying the ransom

#53

Post by naple » Sat, Jul 25, 2020, 9:39 PM UTC

I consider the modal on the bloomberg site a ransomware. Can't close till you pay. Joking :)

Re: How to survive a ransomware attack without paying the ransom

#54

Post by viraptor » Sat, Jul 25, 2020, 9:39 PM UTC

matsemann wrote: post #32

Tiltowait-- wrote: post #11

Easy: restore from backups.

What if they hacked you months before pulling the trigger? The article mentions they were hacked in December and the attack launched in March. Restoring a backup would then still leave the hackers inside. And even if most data were backed up, most computers still have to be wiped and reinstalled. I don't think most companies backup the entire disks off all employees, it's normally just a dedicated file area. So while…

Companies of non-trivial size often have (and should have) a system allowing for remote device management. Which means:

- It should be easy to reinstall to a known good image with all the relevant software, settings, drivers, etc. then restore the backed up data. This is relatively common in corps.

- Once you observe the malware and know how it reaches the C&C server, you can push rules blocking that host or block the bad binary network-wide.

Of course there will be companies that didn't have good enough system in place and once exploited are doomed.

Re: How to survive a ransomware attack without paying the ransom

#55

Post by dheera » Sat, Jul 25, 2020, 9:45 PM UTC

naple wrote: post #53

I consider the modal on the bloomberg site a ransomware. Can't close till you pay. Joking :)

Yeah screw that paywall. Paste this into the console

    document.querySelector('.paywall-inline-tout').remove();
    document.querySelectorAll('p').forEach(e => e.style.display='');

Re: How to survive a ransomware attack without paying the ransom

#56

Post by packet_nerd » Sat, Jul 25, 2020, 9:49 PM UTC

core_dumped wrote: post #13

larrymcp wrote: post #6

How is ransomware able to spread to all the PCs in a company? (Especially PCs at different locations around the globe) The malware needs to execute itself on each computer. But I would think this would be thwarted by hardware firewalls as well as apps like Windows Firewall. If my PC at work gets infected, somehow it can magically infect the guy down the hall's PC too? I thought that was made impossible years ago.

Firewalls can only protect against what's known. Once you've invented or discovered a method the firewall doesn't know about, you're trusted as much as any regular program. Sometimes even changing the binary or payload slightly will thwart some firewalls because they're precise machines looking for precise signatures. It's not super easy to get past a firewall with a known vulnerability, but not impossible. With a 0d…

This is true regarding "next-gen" firewalls. But, if you design a plain old segmentation strategy with simple but well thought out allow/deny rules, then a firewall will be pretty valuable in many situations.

Extreme example: you can think of an air gap as a "firewall" with all deny rules. Air gaps are pretty secure. (Yes, there are still way's in but finding them will be many orders of magnitude harder than finding a 0day in a "next-gen" firewall).

Another example: I put all printers in a dedicated VLAN and block all traffic in and out except specific print ports from the print server IP only. In practice, way more secure than any "next-gen" firewall will ever be.

Re: How to survive a ransomware attack without paying the ransom

#57

Post by hibbelig » Sat, Jul 25, 2020, 9:52 PM UTC

fortran77 wrote: post #39

Isn't a ransomware attack no different from a catastrophic disk drive failure? You reformat and restore from backup. Of course, the companies profiled in that article had all their computers infected, so it could take some time. Still a recovery boot disk could be distributed and a clean image restored over the network.

The network was infiltrated in December, the attack happened in March. So the last clean backup was from November. This would be a very old backup. Not sure how useful that would have been.

Re: How to survive a ransomware attack without paying the ransom

#58

Post by darkhorn » Sat, Jul 25, 2020, 10:06 PM UTC

larrymcp wrote: post #6

How is ransomware able to spread to all the PCs in a company? (Especially PCs at different locations around the globe) The malware needs to execute itself on each computer. But I would think this would be thwarted by hardware firewalls as well as apps like Windows Firewall. If my PC at work gets infected, somehow it can magically infect the guy down the hall's PC too? I thought that was made impossible years ago.

Some of our Windows computers were affected but none of our Linux computers were affected.

Re: How to survive a ransomware attack without paying the ransom

#59

Post by 6c696e7578 » Sat, Jul 25, 2020, 10:16 PM UTC

larrymcp wrote: post #6

How is ransomware able to spread to all the PCs in a company? (Especially PCs at different locations around the globe) The malware needs to execute itself on each computer. But I would think this would be thwarted by hardware firewalls as well as apps like Windows Firewall. If my PC at work gets infected, somehow it can magically infect the guy down the hall's PC too? I thought that was made impossible years ago.

The common components in the ransomware attacks is Windows and AD.

Some leverage known exploits against elements like LSASS, so if the person infected has credentials for another computer, why not slurp up all the credential tokens on remote computers that you can log into too.

If you use Linux/Unix on the other hand, you can do descent things to contain access. Firstly, elevated management accounts can restrict login sources, either by ssh authorized_keys or deny rules in sshd_config. Secondly, and very importantly, you can contain what applications can access through SELinux.

Running Windows these days is like walking around with "Kick me" hung around your neck.

Re: How to survive a ransomware attack without paying the ransom

#60

Post by rconti » Sat, Jul 25, 2020, 10:27 PM UTC

andrewcooke wrote: post #49

Kenji wrote: post #31

Earlier quoted context omitted.

Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. You really wonder that? I'm sorry, how stupid are you? It's obviously to harvest data and control users. We've been warning and educating people about this for decades. When are you guys starting to wake up a…

the garmin data actually is in an open format. i've written software to decode it using publicly available documentation. the software is free to use. you can copy the (.FIT) file off the watch over USB.

What about non-activity data, such as step counts, sleep data, pulse ox, etc?