Earlier quoted context omitted.
The attackers likely compromised the computers using the remote device management system which means it's either disabled or unsafe to use.
Sure, you need to make sure your AD and device management is clean before starting the process. My point was that once you're bootstraped you shouldn't need a fully manual recovery process.
How to survive a ransomware attack without paying the ransom
91–100 of 168 posts
Re: How to survive a ransomware attack without paying the ransom
#92Earlier quoted context omitted.
Backup price for 8TB is cheap enough. Backup price for 8PT does not scale well. I don’t know how much data Garmin has company wide. But it’s a lot different for me to consider offline backups as a simple service than a company this size and complexity.
There are plenty of companies that can backup 8PB of data from a wide variety of sources for you, and make it a relatively staitforward task to interegrate with them. There is complexity, yes, but it's mostly a solved problem. Disclaimer: I work for one.
I think the people who are the worst off have petabytes of business critical customer data, but don't do massive datamining projects on top of this. Then you end up with a data center that is 90% (business critical) prod, and triplicating that becomes much more relatively expensive than having a data center that is 20% prod.
Re: How to survive a ransomware attack without paying the ransom
#93Earlier quoted context omitted.
Apart from some special cases like Wannacry/NotPetya, ransomware crews do only as much lateral movement as is required for privilege escalation. Once they have DA, they can just disable protections and push malware centrally through AD.
DA / AD ???
Re: How to survive a ransomware attack without paying the ransom
#94Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…
Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. You really wonder that? I'm sorry, how stupid are you? It's obviously to harvest data and control users. We've been warning and educating people about this for decades. When are you guys starting to wake up a…
No one likes to admit that they screwed up, though -- and we all know that the truth can hurt sometimes.
---
Unfortunately, you were (likely) downvoted mostly because your blunt, honest statement comes across as condescending and rude: "Maybe you're right, but you didn't have to be such an asshole about it."
What those people are either not realizing or conveniently choosing to forget is that, just as you said, we've all been warned about this exact thing* for decades! Apparently, though, the message isn't geting through. When that happens, this type of "tone" becomes necessary in order to get people to pay attention.
Unfortunately, most will still choose not to heed the warnings. Evntually, when it (inevitably) happens to them, they'll say something like "Meanwhile ... users (like me) are wondering how it is that [this could happen]" and, of course, they'll avoid admitting any responsibility for their choices. They would much rather play the part of "completely innocent victim who could never have imagined something like this might happen".
---
It reminds me a lot of a small child that is told, repeatedly, "don't do 'X' because 'Y' will happen" and, later, is absolutely SHOCKED when they "learn" -- the hard way, typically -- that, when they do 'X', 'Y' happens.
Re: How to survive a ransomware attack without paying the ransom
#95Earlier quoted context omitted.
This reply strikes me as an uncharitable interpretation of OP’s statement. It’s also rude.
yeah. I kinda agree with the sentiment, but being rude doesn't help the cause
Unfortunately, a much stronger tone is often needed in order to to get people to pay attention.
Re: How to survive a ransomware attack without paying the ransom
#96Earlier quoted context omitted.
It is surprisingly difficult to make synchronisation work between two devices that might run different hard- and firmware and even potentially software versions. Cloud based APIs as middleware is soo much easier in comparison. I am completely with you conceptually, but from experience I can tell you that even if there is a commercial incentive to allow for local communication it takes a few days to get it working wit…
>It is surprisingly difficult to make synchronisation work between two devices No it isn't. We were doing it for years before "the cloud" or even the modern Internet even existed using Bluetooth, RF, IR, and cables. Have you ever looked at a .fit file on a Garmin watch? It's a binary format, but is straightforward to convert to CSV, and doesn't contain much beyond timestamp, latitude, longitude, altitude, heart rate,…
Re: How to survive a ransomware attack without paying the ransom
#97Earlier quoted context omitted.
My understanding[1] was that these types of devices sync by sending a blob over bluetooth to the paired cell phone, and then the cell phone uploads this to the cloud to be decrypted. What kinds of devices are you talking about? [1]: https://hackaday.com/2017/12/29/34c3-fitbit-sniffing-and-fir...
FIT files aren't encrypted. You can copy them directly to your computer are parse them easily.
Re: How to survive a ransomware attack without paying the ransom
#98I consider the modal on the bloomberg site a ransomware. Can't close till you pay. Joking :)
Yeah screw that paywall. Paste this into the console document.querySelector('.paywall-inline-tout').remove(); document.querySelectorAll('p').forEach(e => e.style.display='');
Re: How to survive a ransomware attack without paying the ransom
#99Isn't a ransomware attack no different from a catastrophic disk drive failure? You reformat and restore from backup. Of course, the companies profiled in that article had all their computers infected, so it could take some time. Still a recovery boot disk could be distributed and a clean image restored over the network.
No, because you can't consider your backups as a "known good state". A malicious attack is fundamentally different from a disaster or accident. You should expect that any backup of systems (instead of backups of 100% pure data) will contain backdoors, that any weird systems (routers, printers, phone centrals) may be compromised even if they seem fine, and that the credentials of all the employees and any private keys…
So, yes, while you’re technically correct that 100% inert and uncorrupted data files are safe, you have to prove that those files are not corrupted. And, so many data formats either are code or contain embedded code, so these need to be treated as suspect until proven otherwise, as well.
Re: How to survive a ransomware attack without paying the ransom
#100Earlier quoted context omitted.
What if they hacked you months before pulling the trigger? The article mentions they were hacked in December and the attack launched in March. Restoring a backup would then still leave the hackers inside. And even if most data were backed up, most computers still have to be wiped and reinstalled. I don't think most companies backup the entire disks off all employees, it's normally just a dedicated file area. So while…
Companies of non-trivial size often have (and should have) a system allowing for remote device management. Which means: - It should be easy to reinstall to a known good image with all the relevant software, settings, drivers, etc. then restore the backed up data. This is relatively common in corps. - Once you observe the malware and know how it reaches the C&C server, you can push rules blocking that host or block th…
It should be, but enterprise servers are often the embodiment of configuration drift.