Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to survive a ransomware attack without paying the ransom

bloomberg.com

Post reply on HN
Print view View original

101–110 of 168 posts

Re: How to survive a ransomware attack without paying the ransom

#101

Post by viraptor »

user5994461 wrote: post #89
viraptor wrote: post #52

Earlier quoted context omitted.

This is definitely doable, but it's harder than the naive solution so often it's not done. Same as log storage for example, or any other incremental data. Related - see how many examples of S3 policies split access into read and write rather than read, append, write. It doesn't even matter where the logic lives - only whether the storage service allows you to delete anything.

S3 is easy to handle but not intuitive. S3 always get write access from production systems because gotta be able to send the backup (anything strategy that aims to prevent writing to S3 is doomed). The trick is to get another S3 account (or any large storage really), to download everything from that bucket periodically. The "replication" needs read-only access to the first bucket. The second account doesn't need to b…

Versioned buckets and denying delete gives you an equivalent of an append-only backup. (As long as your backup tool supports that)

Re: How to survive a ransomware attack without paying the ransom

#102

Post by coronadisaster »

dencodev wrote: post #98
dheera wrote: post #55

Earlier quoted context omitted.

Yeah screw that paywall. Paste this into the console document.querySelector('.paywall-inline-tout').remove(); document.querySelectorAll('p').forEach(e => e.style.display='');

I prefer control-W

One of my extension appear to be blocking it because I didn't know it existed

Re: How to survive a ransomware attack without paying the ransom

#103

Post by darkerside »

DebtDeflation wrote: post #50
prennert wrote: post #16

Earlier quoted context omitted.

It is surprisingly difficult to make synchronisation work between two devices that might run different hard- and firmware and even potentially software versions. Cloud based APIs as middleware is soo much easier in comparison. I am completely with you conceptually, but from experience I can tell you that even if there is a commercial incentive to allow for local communication it takes a few days to get it working wit…

>It is surprisingly difficult to make synchronisation work between two devices No it isn't. We were doing it for years before "the cloud" or even the modern Internet even existed using Bluetooth, RF, IR, and cables. Have you ever looked at a .fit file on a Garmin watch? It's a binary format, but is straightforward to convert to CSV, and doesn't contain much beyond timestamp, latitude, longitude, altitude, heart rate,…

I imagine it's more difficult to make it so every one of your different devices (Garmin has an extensive lineup) is able to interface appropriately with every other device than it is to code against a straightforward HTTP(S) server sitting somewhere in the cloud under your complete control. Fits Hanlon's Razor better, too.

Re: How to survive a ransomware attack without paying the ransom

#104

Post by causality0 »

johannes1234321 wrote: post #97
nradov wrote: post #88

Earlier quoted context omitted.

FIT files aren't encrypted. You can copy them directly to your computer are parse them easily.

Last time I checked they hid the format description behind an NDA ... aside from that no issue indeed.

I never understood how that works. All it takes is one person to post it publicly and then everyone has it.

Re: How to survive a ransomware attack without paying the ransom

#105

Post by TwoBit »

PeterisP wrote: post #45
SV_BubbleTime wrote: post #19

Earlier quoted context omitted.

Pretty much this. Firewalls do absolutely nothing once someone got your weakest link to click something and go to town. From my last penn test it goes, phish, get a click and execute or credentials, use a hack like getting legacy NetBIOS exploit to give up hashes for all your users, crack the hashes and hope someone used a short 12 char password or something dictionary-easy like “Wr3st1ing1!”, then leverage that acce…

Your backups will contain all the backdoors that the attackers managed to deploy - so even ignoring the normal massive effort of restoring all your computers, you can't simply restore backups, you need to carefully audit everything that you're restoring to clean hardware, and you need everyone to change their credentials (and not just by appending "2" at the end) otherwise you'll be owned again immediately afterwards…

I think you only want your data files from the backup, not system files. But yeah some kinds of "data" files can be compromised too.

Re: How to survive a ransomware attack without paying the ransom

#107

Post by TwoBit »

aj3 wrote: post #22
larrymcp wrote: post #6

How is ransomware able to spread to all the PCs in a company? (Especially PCs at different locations around the globe) The malware needs to execute itself on each computer. But I would think this would be thwarted by hardware firewalls as well as apps like Windows Firewall. If my PC at work gets infected, somehow it can magically infect the guy down the hall's PC too? I thought that was made impossible years ago.

Apart from some special cases like Wannacry/NotPetya, ransomware crews do only as much lateral movement as is required for privilege escalation. Once they have DA, they can just disable protections and push malware centrally through AD.

It seems like a company's real challenge is preventing the escalation, more so than the initial compromise.

Re: How to survive a ransomware attack without paying the ransom

#109

Post by RandomWorker »

johannes1234321 wrote: post #96
DebtDeflation wrote: post #50

Earlier quoted context omitted.

>It is surprisingly difficult to make synchronisation work between two devices No it isn't. We were doing it for years before "the cloud" or even the modern Internet even existed using Bluetooth, RF, IR, and cables. Have you ever looked at a .fit file on a Garmin watch? It's a binary format, but is straightforward to convert to CSV, and doesn't contain much beyond timestamp, latitude, longitude, altitude, heart rate,…

And even many Garmin devices sync via the phone and app: My Edge bike computer connects via Bluetooth to the Garmin app, which uploads the file to the connect website and then downloads the analysis again. There is no technical hindrance for doing analysis in the app (I wrote my own decoders for the fit file format some time ago for building my own archive) except that this makes it simple to have consistent state an…

Except battery life. Nobody wants an apps that are battery hogs. Sending the data is less computationally expensive and therefore uses less energy. Also, takes out the difficulty figuring out how this processing might impact Various phone models, one word they didn’t care or were lazy both are bad pr.

Re: How to survive a ransomware attack without paying the ransom

#110

Post by M2Ys4U »

jvehent wrote: post #46
piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

Wait until this happens to your car...

This attack on Garmin has already grounded aeroplanes.
Post reply on HN