How to survive a ransomware attack without paying the ransom • Hacker News Board

Re: How to survive a ransomware attack without paying the ransom

#71

Post by viraptor » Sat, Jul 25, 2020, 10:55 PM UTC

marcinzm wrote: post #69

viraptor wrote: post #54

Earlier quoted context omitted.

Companies of non-trivial size often have (and should have) a system allowing for remote device management. Which means: - It should be easy to reinstall to a known good image with all the relevant software, settings, drivers, etc. then restore the backed up data. This is relatively common in corps. - Once you observe the malware and know how it reaches the C&C server, you can push rules blocking that host or block th…

The attackers likely compromised the computers using the remote device management system which means it's either disabled or unsafe to use.

Sure, you need to make sure your AD and device management is clean before starting the process. My point was that once you're bootstraped you shouldn't need a fully manual recovery process.

Re: How to survive a ransomware attack without paying the ransom

#72

Post by pengaru » Sat, Jul 25, 2020, 10:56 PM UTC

piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

Obviously there's a business incentive to maximize gatekeeping. Even if the gate's left wide open (for now), having control of a gate is of tremendous potential value.

Just imagine how much more $$ one can elicit in an acquisition if potential buyers may add tolls to an already established and well-traveled gate.

Re: How to survive a ransomware attack without paying the ransom

#73

Post by rasz » Sat, Jul 25, 2020, 10:56 PM UTC

feanaro wrote: post #38

prennert wrote: post #16

Earlier quoted context omitted.

It is surprisingly difficult to make synchronisation work between two devices that might run different hard- and firmware and even potentially software versions. Cloud based APIs as middleware is soo much easier in comparison. I am completely with you conceptually, but from experience I can tell you that even if there is a commercial incentive to allow for local communication it takes a few days to get it working wit…

What makes it so difficult? What are some concrete problems you encountered?

Releasing the clutches of control over user data/devices is a very difficult concept to grasp for particular type of business people.

Re: How to survive a ransomware attack without paying the ransom

#74

Post by marcus_holmes » Sat, Jul 25, 2020, 11:06 PM UTC

atdrummond wrote: post #44

Kenji wrote: post #31

Earlier quoted context omitted.

Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. You really wonder that? I'm sorry, how stupid are you? It's obviously to harvest data and control users. We've been warning and educating people about this for decades. When are you guys starting to wake up a…

This reply strikes me as an uncharitable interpretation of OP’s statement. It’s also rude.

yeah. I kinda agree with the sentiment, but being rude doesn't help the cause

Re: How to survive a ransomware attack without paying the ransom

#75

Post by hprotagonist » Sat, Jul 25, 2020, 11:14 PM UTC

It is always a temptation for a rich and lazy nation,
To puff and look important and to say: –
"Though we know we should defeat you,
we have not the time to meet you.
We will therefore pay you cash to go away."
And that is called paying the Dane-geld;
But we've proved it again and again,
That if once you have paid him the Dane-geld

You never get rid of the Dane.

http://www.kiplingsociety.co.uk/poems_danegeld.htm

parenthetically, this is equally true of toddler-geld.

Re: How to survive a ransomware attack without paying the ransom

#76

Post by t-shaped » Sat, Jul 25, 2020, 11:14 PM UTC

rectang wrote: post #67

> In other words, it’s less a question of how to stop hackers from breaking in than how to best survive the inevitable damage. There doesn't seem to be conventional wisdom about how to build systems that are easy to restore. How do you optimize for recovery after an attack? How do you ensure that you've eliminated all the backdoors? My guess is a combination of "continuous restoration", version controlled code, and a…

If there's a book that you want to read, but it hasn't been written yet, then you must write it.

- Toni Morrison

Re: How to survive a ransomware attack without paying the ransom

#77

Post by dzonga » Sat, Jul 25, 2020, 11:19 PM UTC

some of these companies, need to start suing microsoft. since it's usually windows affected by these malware attacks. if microsoft wants to keep serving the majority of the corp world, they need to have an os, based on user space system. i.e each program runs in it's own sandbox. and any data passed is via message passing.

Re: How to survive a ransomware attack without paying the ransom

#78

Post by rectang » Sat, Jul 25, 2020, 11:23 PM UTC

halfcat wrote: post #64

scott_w wrote: post #41

Earlier quoted context omitted.

> The only thing that “saves” you from paying the ransom is good backups. But if a group is fairly competent, they’ll encrypt your backups too. So it needs to be offline. This is the part I’ve never understood. Surely you should be backing up in an append only fashion initiated from the backup server? My best guess is that this gets managed from AD as well, so they find it and take over?

> Surely you should be backing up in an append only fashion initiated from the backup server The key idea is assuming everything is compromised. Whether you use append or whatever, is not helpful if the functionality to change that configuration exists, because that gets changed, backup server is gone, backup storage is gone, etc. You have to design a system where even a rogue IT admin with full access to everything…

> You have to design a system where even a rogue IT admin with full access to everything can’t screw you.

OK, brilliant — this is a nice articulation of a fundamental principle.

Do you know of any books that describe how to design such systems?

Guaranteeing that offline backups exist is a great start, but if the backups contain backdoors, restoring could be extremely laborious and yet unsuccessful.

Re: How to survive a ransomware attack without paying the ransom

#79

Post by jeffbee » Sat, Jul 25, 2020, 11:23 PM UTC

rectang wrote: post #67

> In other words, it’s less a question of how to stop hackers from breaking in than how to best survive the inevitable damage. There doesn't seem to be conventional wisdom about how to build systems that are easy to restore. How do you optimize for recovery after an attack? How do you ensure that you've eliminated all the backdoors? My guess is a combination of "continuous restoration", version controlled code, and a…

Just having a decent and reasonable way to nuke and pave machines goes a long way. Most organizations don't have a good way to shoot a machine in the face and have it back up and serving in 2 minutes. Most organizations are absolutely married to "stateful services" like SQL databases with local storage, that are hard to kill, hard to restore, and give attackers a place to hang out.

If you can take all your hosts down and bring them all back up quickly, that gives you at least one tool for disrupting the attackers.

Re: How to survive a ransomware attack without paying the ransom

#80

Post by user5994461 » Sat, Jul 25, 2020, 11:26 PM UTC

dzonga wrote: post #77

some of these companies, need to start suing microsoft. since it's usually windows affected by these malware attacks. if microsoft wants to keep serving the majority of the corp world, they need to have an os, based on user space system. i.e each program runs in it's own sandbox. and any data passed is via message passing.

Microsoft has pretty good security nowadays.

It's the fault of companies for never upgrading their machines, giving full administrators access to every employee and using Admin123 as the domain administrator password account.

If we believe the article, the virus came from an attachment in an email to a random employee. Why are executable attachments not blocked? Why is an executable running as an unprivileged user able to storm through every computer in the company?