Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to survive a ransomware attack without paying the ransom

bloomberg.com

Post reply on HN
Print view View original

111–120 of 168 posts

Re: How to survive a ransomware attack without paying the ransom

#111

Post by myself248 »

prennert wrote: post #16
piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

It is surprisingly difficult to make synchronisation work between two devices that might run different hard- and firmware and even potentially software versions. Cloud based APIs as middleware is soo much easier in comparison. I am completely with you conceptually, but from experience I can tell you that even if there is a commercial incentive to allow for local communication it takes a few days to get it working wit…

And yet my Timex Datalink did it flawlessly in 1994, using nothing more than the predictable flicker of a CRT raster.

> make it safe and reliable in all eventualities

You mean precisely like it isn't now?

I'd much rather have something fail locally based on conditions that I can affect, than fail remotely and be completely out of my control.

Re: How to survive a ransomware attack without paying the ransom

#112

Post by sukilot »

causality0 wrote: post #104
johannes1234321 wrote: post #97

Earlier quoted context omitted.

Last time I checked they hid the format description behind an NDA ... aside from that no issue indeed.

I never understood how that works. All it takes is one person to post it publicly and then everyone has it.

Maybe they are rot13 encrypted.

Re: How to survive a ransomware attack without paying the ransom

#113

Post by tridentlead »

RandomWorker wrote: post #109
johannes1234321 wrote: post #96

Earlier quoted context omitted.

And even many Garmin devices sync via the phone and app: My Edge bike computer connects via Bluetooth to the Garmin app, which uploads the file to the connect website and then downloads the analysis again. There is no technical hindrance for doing analysis in the app (I wrote my own decoders for the fit file format some time ago for building my own archive) except that this makes it simple to have consistent state an…

Except battery life. Nobody wants an apps that are battery hogs. Sending the data is less computationally expensive and therefore uses less energy. Also, takes out the difficulty figuring out how this processing might impact Various phone models, one word they didn’t care or were lazy both are bad pr.

Not true. It is much, much more energy intensive to run an RF link up to a tower or WiFi than to sum 2000 rows of 10 column wide data. RF works by emitting energy into free space, and there is absolutely no way it is cheaper for this type of thing (especially if it takes the transmitter out of sleep mode, like if you’re really out there and in airplane mode).

Re: How to survive a ransomware attack without paying the ransom

#115

Post by ithkuil »

jlgaddis wrote: post #95
marcus_holmes wrote: post #74

Earlier quoted context omitted.

yeah. I kinda agree with the sentiment, but being rude doesn't help the cause

Apparently the "friendly" warnings of the last few decades have largely went ignored. Unfortunately, a much stronger tone is often needed in order to to get people to pay attention.

Or to stop paying attention, as when you avoid listening to that crazy person shouting in the subway

Re: How to survive a ransomware attack without paying the ransom

#116

Post by jlarocco »

prennert wrote: post #16
piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

It is surprisingly difficult to make synchronisation work between two devices that might run different hard- and firmware and even potentially software versions. Cloud based APIs as middleware is soo much easier in comparison. I am completely with you conceptually, but from experience I can tell you that even if there is a commercial incentive to allow for local communication it takes a few days to get it working wit…

> It is surprisingly difficult to make synchronisation work between two devices that might run different hard- and firmware and even potentially software versions. Cloud based APIs as middleware is soo much easier in comparison.

Even if that were true (and it's not), it's not how Garmin sync works. The website isn't cloud based middleware, and the watch and phone sync over bluetooth. It really is as dumb and frustrating as the OP describes.

Before syncing with the watch, over bluetooth, the app connects to the Garmin website. If the web connection fails then the transfer fails.

Re: How to survive a ransomware attack without paying the ransom

#117

Post by jonpurdy »

jeffbee wrote: post #79
rectang wrote: post #67

> In other words, it’s less a question of how to stop hackers from breaking in than how to best survive the inevitable damage. There doesn't seem to be conventional wisdom about how to build systems that are easy to restore. How do you optimize for recovery after an attack? How do you ensure that you've eliminated all the backdoors? My guess is a combination of "continuous restoration", version controlled code, and a…

Just having a decent and reasonable way to nuke and pave machines goes a long way. Most organizations don't have a good way to shoot a machine in the face and have it back up and serving in 2 minutes. Most organizations are absolutely married to "stateful services" like SQL databases with local storage, that are hard to kill, hard to restore, and give attackers a place to hang out. If you can take all your hosts down…

I was thinking about this recently. Tight, centralized control over servers, employees computers, and devices is hard to set up, hard to manage, and a huge surface where misconfigurations can allow attackers to jump right in.

Decentralization is the key. Microservices, or segregated services, stateless (as much as possible), and perhaps even partitioning groups of users into totally separated instances. One group gets attacked and service only goes out for the 1000 users in the group. Of course, infrastructure costs would go up but maybe not that much (since you need less resources for 1000 users than 100,000). This is relatively easy to build from scratch these days thanks to various IaaS providers and DevOps tools (obviously hard for established companies with legacy tech).

Then, keep employee computers totally separate from production servers. Let employees back them up themselves, especially since so much can just be stored in the cloud (I'll get there next). Forget about VPNs where everyone can talk to everyone else. Don't try to save money by hosting your own Jira and Bitbucket instances. Pay extra for Atlassian to host for you, then let them deal with security (actually it's cheaper from what I remember). Companies already pay for Office 365 and don't self-host that. Don't host your own email servers. Just focus on the core of what the company needs to do and that's it.

This way you spread your attack surface across a whole bunch of services that are better than you at security, and you get the benefit of not having to deal with other issues. If Atlassian or Cloudflare goes down, no big deal; they'll fix it. And all your other stuff still works.

Re: How to survive a ransomware attack without paying the ransom

#118

Post by AlotOfReading »

Kenji wrote: post #31
piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. You really wonder that? I'm sorry, how stupid are you? It's obviously to harvest data and control users. We've been warning and educating people about this for decades. When are you guys starting to wake up a…

In the interests of making this somewhat productive, what open alternatives are there that we should be using? For instance, is there a commercially available, open source cycling computer that I can put my money towards?

For a different industry, is there an open source e-reader I can support instead of Amazon/kobo/nook?

Maybe I'm stupid as you say, but I genuinely don't know if these things are out there and a quick Google search didn't turn up anything I'd call usable.

Re: How to survive a ransomware attack without paying the ransom

#119

Post by mjcohen »

sukilot wrote: post #112
causality0 wrote: post #104

Earlier quoted context omitted.

I never understood how that works. All it takes is one person to post it publicly and then everyone has it.

Maybe they are rot13 encrypted.

Quadruple rot13 for enhanced security.

Re: How to survive a ransomware attack without paying the ransom

#120

Post by rapnie »

AlotOfReading wrote: post #118
Kenji wrote: post #31

Earlier quoted context omitted.

Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. You really wonder that? I'm sorry, how stupid are you? It's obviously to harvest data and control users. We've been warning and educating people about this for decades. When are you guys starting to wake up a…

In the interests of making this somewhat productive, what open alternatives are there that we should be using? For instance, is there a commercially available, open source cycling computer that I can put my money towards? For a different industry, is there an open source e-reader I can support instead of Amazon/kobo/nook? Maybe I'm stupid as you say, but I genuinely don't know if these things are out there and a quic…

Some that I know of:

- https://codeberg.org/jannis/FitoTrack

- https://github.com/OpenTracksApp/OpenTracks

- https://gadgetbridge.org/

Post reply on HN