Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to survive a ransomware attack without paying the ransom

bloomberg.com

Post reply on HN
Print view View original

81–90 of 168 posts

Re: How to survive a ransomware attack without paying the ransom

#81

Post by jbj »

piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

I never really liked the fact that I need an internet connection to sync the fit files from my activities from my watch via my smartphone to a database, in order to then download it from the web to see it.

Fortunately the watch appears as a usb device when connecting with a charging cable. So it is possible to get data out without relying on accounts and social features.

Re: How to survive a ransomware attack without paying the ransom

#82

Post by rectang »

wlll wrote: post #7
piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

What's the backstory for this?

https://www.garmin.com/en-US/outage/

Re: How to survive a ransomware attack without paying the ransom

#83

Post by WrtCdEvrydy »

I find it very interesting the Volume Shadow Copies and VLANs are basic tools that have been around forever, cost very little and can mitigate a lot of ransomware attempts.

There's no reason for the secretary's computer to be able to connect to the onsite SQL server... unless she uses an application that uses that SQL server.

Re: How to survive a ransomware attack without paying the ransom

#84

Post by user5994461 »

lostmsu wrote: post #65
6c696e7578 wrote: post #59

Earlier quoted context omitted.

The common components in the ransomware attacks is Windows and AD. Some leverage known exploits against elements like LSASS, so if the person infected has credentials for another computer, why not slurp up all the credential tokens on remote computers that you can log into too. If you use Linux/Unix on the other hand, you can do descent things to contain access. Firstly, elevated management accounts can restrict logi…

None of what you mentioned requires a lot of effort on Windows. Exploits in LSASS are no different from exploits in Linux kernel, and if you stay up to date and configure everything correctly you should be fine.

LSASS is a system process, need SE_DEBUG_PRIVILEGES to read its memory (full system administrator).

As far as I am aware, the last time there was an actual exploit in LSASS was in Windows XP.

Re: How to survive a ransomware attack without paying the ransom

#85

Post by zamadatix »

WrtCdEvrydy wrote: post #83

I find it very interesting the Volume Shadow Copies and VLANs are basic tools that have been around forever, cost very little and can mitigate a lot of ransomware attempts. There's no reason for the secretary's computer to be able to connect to the onsite SQL server... unless she uses an application that uses that SQL server.

The complicated part isn't figuring out that you should segment access or finding technology that lets you do it it's actually knowing what to segment in a way that balances risk with speed and cost.

The same is true for most things. Problems are often well known, solutions are often understood, but doing things is where the actual work is.

Re: How to survive a ransomware attack without paying the ransom

#86

Post by user5994461 »

redprince wrote: post #33
halfcat wrote: post #14

Earlier quoted context omitted.

Probably through Active Directory, which has the ability to deploy software. If a domain controller was compromised, the payload could be pushed out across the board. Endpoints like PCs and servers check in with domain controllers at recurring intervals, so even if all endpoints are behind firewalls and can’t talk to one another, they still reach out to domain controllers periodically to pull down configuration updat…

The few instances I was assisting companies with ongoing ransom ware attacks, all had a similar pattern. Some initial breach of a client system (think malicious office document) gave attackers a foothold inside the network. From there the attackers ultimately pivoted to own the Active Directory. Equipped with this level of access they identified key assets and proceeded to encrypt them. Backups, if not stored offline…

If only companies could get a team to identify key assets and make backups.

(They might still have to reimage all their machines but at least they still have a list of employees and customers)

Re: How to survive a ransomware attack without paying the ransom

#87

Post by dredmorbius »

aj3 wrote: post #22
larrymcp wrote: post #6

How is ransomware able to spread to all the PCs in a company? (Especially PCs at different locations around the globe) The malware needs to execute itself on each computer. But I would think this would be thwarted by hardware firewalls as well as apps like Windows Firewall. If my PC at work gets infected, somehow it can magically infect the guy down the hall's PC too? I thought that was made impossible years ago.

Apart from some special cases like Wannacry/NotPetya, ransomware crews do only as much lateral movement as is required for privilege escalation. Once they have DA, they can just disable protections and push malware centrally through AD.

DA / AD ???

Re: How to survive a ransomware attack without paying the ransom

#88

Post by nradov »

eatingCake wrote: post #34
prennert wrote: post #16

Earlier quoted context omitted.

It is surprisingly difficult to make synchronisation work between two devices that might run different hard- and firmware and even potentially software versions. Cloud based APIs as middleware is soo much easier in comparison. I am completely with you conceptually, but from experience I can tell you that even if there is a commercial incentive to allow for local communication it takes a few days to get it working wit…

My understanding[1] was that these types of devices sync by sending a blob over bluetooth to the paired cell phone, and then the cell phone uploads this to the cloud to be decrypted. What kinds of devices are you talking about? [1]: https://hackaday.com/2017/12/29/34c3-fitbit-sniffing-and-fir...

FIT files aren't encrypted. You can copy them directly to your computer are parse them easily.

Re: How to survive a ransomware attack without paying the ransom

#89

Post by user5994461 »

viraptor wrote: post #52
scott_w wrote: post #41

Earlier quoted context omitted.

> The only thing that “saves” you from paying the ransom is good backups. But if a group is fairly competent, they’ll encrypt your backups too. So it needs to be offline. This is the part I’ve never understood. Surely you should be backing up in an append only fashion initiated from the backup server? My best guess is that this gets managed from AD as well, so they find it and take over?

This is definitely doable, but it's harder than the naive solution so often it's not done. Same as log storage for example, or any other incremental data. Related - see how many examples of S3 policies split access into read and write rather than read, append, write. It doesn't even matter where the logic lives - only whether the storage service allows you to delete anything.

S3 is easy to handle but not intuitive. S3 always get write access from production systems because gotta be able to send the backup (anything strategy that aims to prevent writing to S3 is doomed).

The trick is to get another S3 account (or any large storage really), to download everything from that bucket periodically. The "replication" needs read-only access to the first bucket. The second account doesn't need to be accessed by anything or anybody so it is relatively safe.

Re: How to survive a ransomware attack without paying the ransom

#90

Post by lrnStats »

6c696e7578 wrote: post #59
larrymcp wrote: post #6

How is ransomware able to spread to all the PCs in a company? (Especially PCs at different locations around the globe) The malware needs to execute itself on each computer. But I would think this would be thwarted by hardware firewalls as well as apps like Windows Firewall. If my PC at work gets infected, somehow it can magically infect the guy down the hall's PC too? I thought that was made impossible years ago.

The common components in the ransomware attacks is Windows and AD. Some leverage known exploits against elements like LSASS, so if the person infected has credentials for another computer, why not slurp up all the credential tokens on remote computers that you can log into too. If you use Linux/Unix on the other hand, you can do descent things to contain access. Firstly, elevated management accounts can restrict logi…

This needs to be flagged
Post reply on HN