Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to survive a ransomware attack without paying the ransom

bloomberg.com

Post reply on HN
Print view View original

141–150 of 168 posts

Re: How to survive a ransomware attack without paying the ransom

#141

Post by SturgeonsLaw »

IshKebab wrote: post #36
nuker wrote: post #29

Earlier quoted context omitted.

Here is the diagram https://www.bleepingcomputer.com/news/security/evil-corp-blo...

That doesn't actually say at all. Symantec's report has more detail but it still has gaps: > The initial compromise of an organization involves the SocGholish framework, which is delivered to the victim in a zipped file via compromised legitimate websites. > The zipped file contains malicious JavaScript, masquerading as a browser update. So are people just like "this random website is trying to download a browser upd…

Windows caches the logons of the last few users as a hash on the local PC, malware can use those hashes to authenticate against network resources as that user. If one of those users was a domain admin, on most networks they can access just about anything

Re: How to survive a ransomware attack without paying the ransom

#142

Post by [deleted] »

em-bee wrote: post #128
jeffbee wrote: post #79

Earlier quoted context omitted.

Just having a decent and reasonable way to nuke and pave machines goes a long way. Most organizations don't have a good way to shoot a machine in the face and have it back up and serving in 2 minutes. Most organizations are absolutely married to "stateful services" like SQL databases with local storage, that are hard to kill, hard to restore, and give attackers a place to hang out. If you can take all your hosts down…

which company was it that randomly shot down machines in production to make sure the system would be resilient enough?

[deleted]

Re: How to survive a ransomware attack without paying the ransom

#143

Post by bestnameever »

matsemann wrote: post #32
Tiltowait-- wrote: post #11

Easy: restore from backups.

What if they hacked you months before pulling the trigger? The article mentions they were hacked in December and the attack launched in March. Restoring a backup would then still leave the hackers inside. And even if most data were backed up, most computers still have to be wiped and reinstalled. I don't think most companies backup the entire disks off all employees, it's normally just a dedicated file area. So while…

> Restoring a backup would then still leave the hackers inside.

Even if they could comfortably restore a backup from a year prior, they are left with hackers who know how to penetrate their network until they determine how it occurred..

Re: How to survive a ransomware attack without paying the ransom

#144

Post by cranekam »

FlyMoreRockets wrote: post #43
cpeterso wrote: post #20

Earlier quoted context omitted.

Offline backups are not a complete solution. What if your backups are infected with the virus? Even if the backups are uninfected, your IT department has to manually scrap and rebuild all your computers from data centers to the warehouse to the receptionist. And in the meantime, like the article described, you have to pay your employees and suppliers and continue to ship products to customers.

An important part of any backup strategy is testing your backups on a regular basis. Perhaps it could even be automated...

I think the point here is that it's not as trivial as having an offline copy of your SQL DB or whatever. If the ransomware has encrypted a huge chunk of your infra the chances are that you no longer have anything to restore the backup to — maybe your configurations are encrypted, your DB hosts aren't up, user accounts etc are missing. Assuming that only user data is affected and can be easily restored likely falls very short of the full picture. I expect the folks at Garmin are faced with an infrastructure that looks like a grenade fell into it.

Re: How to survive a ransomware attack without paying the ransom

#145

Post by tluyben2 »

I know this is always contentious but are there any of these ransomware attacks on non Windows machine? I mean prominent ones? I understand everyone is running Windows on the desktop, but why are Linux servers not targetted by the same thing as they are prominent? I know they get hacked all the time, but I never read stories like this about them. I read that mongo was hacked (and yeah, using mongo, sorry but...) which probably ran on Linux; however pure ransomware attacks I cannot find outside Windows. People keep saying that if other devices would be as popular, they would attack them; but for instance my mother has an ipad, android phone and a windows laptop, and the only (penis enlarger.....) malware is in windows which has an up to date AV. Android is more popular than Windows, Linux on servers is as well, iOS is as well. And yet all the crap is always Windows. I do not get it.

Re: How to survive a ransomware attack without paying the ransom

#148

Post by dangelov »

tluyben2 wrote: post #145

I know this is always contentious but are there any of these ransomware attacks on non Windows machine? I mean prominent ones? I understand everyone is running Windows on the desktop, but why are Linux servers not targetted by the same thing as they are prominent? I know they get hacked all the time, but I never read stories like this about them. I read that mongo was hacked (and yeah, using mongo, sorry but...) whic…

Here's an article about a recent Mac ransomware, it was on HN a while back.

https://www.wired.com/story/new-mac-ransomware-thiefquest-ev...

But still, a lot less of these stories than for Windows.

Re: How to survive a ransomware attack without paying the ransom

#149

Post by PeterisP »

TwoBit wrote: post #105
PeterisP wrote: post #45

Earlier quoted context omitted.

Your backups will contain all the backdoors that the attackers managed to deploy - so even ignoring the normal massive effort of restoring all your computers, you can't simply restore backups, you need to carefully audit everything that you're restoring to clean hardware, and you need everyone to change their credentials (and not just by appending "2" at the end) otherwise you'll be owned again immediately afterwards…

I think you only want your data files from the backup, not system files. But yeah some kinds of "data" files can be compromised too.

If you want to restore operations of a large company, data files are not really sufficient - if you have the data, but need to rebuild all the internal server and application infrastructure and configuration, then that's going to take you a very, very, very long time. It's tricky to rebuild from scratch even basic things such as email, file sharing, payroll and inventory control systems, etc when spread out over many countries and offices and scaled to, say, 10000 employees over the world; much less something like a smelting plant control system developed 25 years ago by a company who's now out of business.

Disaster recovery can be quick if you can restore hundreds of virtual servers (and you're going to have hundreds), whole key machines, and all the user and network config from backup. If all you have is data files and bare hardware, then the business is going to have a lot of expensive downtime while you rebuild all the infrastructure. "cattle not pets" approach and automated provisioning of machines from config files helps in this regard, but almost no company has that for all their critical infrastructure, especially if we're talking about non-IT companies whose critical infrastructure is not some single consumer-facing app (e.g. Twitter), but a diverse, distributed collection of third-party IT solutions for various business-critical needs.

Re: How to survive a ransomware attack without paying the ransom

#150

Post by PeterisP »

tluyben2 wrote: post #145

I know this is always contentious but are there any of these ransomware attacks on non Windows machine? I mean prominent ones? I understand everyone is running Windows on the desktop, but why are Linux servers not targetted by the same thing as they are prominent? I know they get hacked all the time, but I never read stories like this about them. I read that mongo was hacked (and yeah, using mongo, sorry but...) whic…

Ransomware attacks absolutely do target Linux servers because one needs to take down all the servers to have a proper business disruption for which someone will pay a million dollar ransom; in all the recent prominent attacks Linux servers were taken down as well.

Perhaps there's some issue with what you mean by "pure ransomware" - if you mean automatically spreading worms, then those aren't that relevant, prominent examples like Petya was four years ago; NotPetya was not ransomware but a destructive weapon, etc. In the current environment, and also in the attack described in this article, a "ransomware attack" means a takeover of your systems by a ransomware crew of hackers manually working on your specific network. They generally start with a spearphishing which targets Windows desktop machines because usually the easiest way to target Linux servers is through client-side attacks, obtaining user credentials and a foothold inside the network that helps with firewall restrictions.

Post reply on HN