Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to survive a ransomware attack without paying the ransom

bloomberg.com

Post reply on HN
Print view View original

151–160 of 168 posts

Re: How to survive a ransomware attack without paying the ransom

#151

Post by PeterisP »

viraptor wrote: post #54
matsemann wrote: post #32

Earlier quoted context omitted.

What if they hacked you months before pulling the trigger? The article mentions they were hacked in December and the attack launched in March. Restoring a backup would then still leave the hackers inside. And even if most data were backed up, most computers still have to be wiped and reinstalled. I don't think most companies backup the entire disks off all employees, it's normally just a dedicated file area. So while…

Companies of non-trivial size often have (and should have) a system allowing for remote device management. Which means: - It should be easy to reinstall to a known good image with all the relevant software, settings, drivers, etc. then restore the backed up data. This is relatively common in corps. - Once you observe the malware and know how it reaches the C&C server, you can push rules blocking that host or block th…

"Once you observe the malware and know how it reaches the C&C server" presumes a single malware and a single mechanism for reaching the C&C server, which is unrealistic. We're not speaking about some piece of automated malware spreading on its own, which you could reverse engineer and see what it does and does not, we're talking about skilled people working for weeks to compromise your network. You should expect multiple different types of persistence, backdoors in publicly reachable systems and leaked privileged credentials.

Re: How to survive a ransomware attack without paying the ransom

#152

Post by PeterisP »

pmiller2 wrote: post #99
PeterisP wrote: post #51

Earlier quoted context omitted.

No, because you can't consider your backups as a "known good state". A malicious attack is fundamentally different from a disaster or accident. You should expect that any backup of systems (instead of backups of 100% pure data) will contain backdoors, that any weird systems (routers, printers, phone centrals) may be compromised even if they seem fine, and that the credentials of all the employees and any private keys…

Even “100% pure data” isn’t necessarily safe. Word documents, Excel sheets, PowerPoint decks, etc. (and their Google Docs counterparts) are all suspect, because they can contain embedded code. Some “data” formats are really not data formats at all, but code which produces the data you use ( e.g. PDF, Postscript, or any Excel sheet with formulas). It’s even possible to corrupt certain otherwise inert data files in suc…

Well, yes, I would not consider arbitrary documents as "pure data" - for that I was thinking as something like a dump of a particular database table contents only, separate from all the database structure/metadata/triggers/functions/etc.

You could restore a dump of pure structured data to a known clean system and that would be safe - but once you include arbitrary files as you describe, no way. Embedding malware in some periodically-accessed document on a public file share is a reasonable persistance mechanism for an attacker.

Re: How to survive a ransomware attack without paying the ransom

#153

Post by GordonS »

rectang wrote: post #67

> In other words, it’s less a question of how to stop hackers from breaking in than how to best survive the inevitable damage. There doesn't seem to be conventional wisdom about how to build systems that are easy to restore. How do you optimize for recovery after an attack? How do you ensure that you've eliminated all the backdoors? My guess is a combination of "continuous restoration", version controlled code, and a…

There are often 2 threats from a randsomware attack - what you describe mitigates against data loss, but not against data being posted online by an attacker.

Re: How to survive a ransomware attack without paying the ransom

#154

Post by buran77 »

com2kid wrote: post #123
buran77 wrote: post #42

Earlier quoted context omitted.

It is not intrinsically difficult, it's made difficult by the fact that the companies themselves specifically want to have their infrastructure in the mix to have access to valuable user data. There's no particularly difficult challenge to sync the phone and watch directly, offline. A good chunk of revenue comes from services which rely on the data being in the cloud.

I worked on a competitor. It was 100% about user expectations, the data was never mined for anything. People use multiple phones, replace their phone, delete apps to free up space, and still expect their data to be there. Running a cloud infrastructure for PII isn't exactly low cost, and bundling a life time subscription with a one time device purchase is horrible economics. It isn't done for no reason.

> the data was never mined for anything

Oh I wasn't implying what's generally seen as "data mining". But for such a company to offer many of the features in the paid services they need that data. They don't have to sell it to others, they only have to sell it back to the users as added services even included in the price of the hardware itself. Those added services can be as simple as sync between multiple phones or sharing on social media, or premium features like advanced analytics.

On the other hand this kind of data can be also sold entirely anonymized. Strava does this and many cities' urban planners buy the data to understand better how the city infrastructure is used by the people (running, cycling, etc.) and how to develop it.

I'm not saying there's no value in it, just that without it the value of the product decreases significantly. So it's in the manufacturer's best interest to have it as part of the basis of their offering.

Re: How to survive a ransomware attack without paying the ransom

#155

Post by johannes1234321 »

causality0 wrote: post #104
johannes1234321 wrote: post #97

Earlier quoted context omitted.

Last time I checked they hid the format description behind an NDA ... aside from that no issue indeed.

I never understood how that works. All it takes is one person to post it publicly and then everyone has it.

It works by having lawyers :)

And we'll, there seem to be ready to use libraries, you can use without signing the NDA: https://github.com/search?q=fit+garmin&type=

Re: How to survive a ransomware attack without paying the ransom

#156

Post by user5994461 »

viraptor wrote: post #101
user5994461 wrote: post #89

Earlier quoted context omitted.

S3 is easy to handle but not intuitive. S3 always get write access from production systems because gotta be able to send the backup (anything strategy that aims to prevent writing to S3 is doomed). The trick is to get another S3 account (or any large storage really), to download everything from that bucket periodically. The "replication" needs read-only access to the first bucket. The second account doesn't need to b…

Versioned buckets and denying delete gives you an equivalent of an append-only backup. (As long as your backup tool supports that)

Until the next developer/sysadmin comes along and update the bucket permissions to be able to send backups from yet another production system. :D

Re: How to survive a ransomware attack without paying the ransom

#157

Post by rectang »

GordonS wrote: post #153
rectang wrote: post #67

> In other words, it’s less a question of how to stop hackers from breaking in than how to best survive the inevitable damage. There doesn't seem to be conventional wisdom about how to build systems that are easy to restore. How do you optimize for recovery after an attack? How do you ensure that you've eliminated all the backdoors? My guess is a combination of "continuous restoration", version controlled code, and a…

There are often 2 threats from a randsomware attack - what you describe mitigates against data loss, but not against data being posted online by an attacker.

I disagree. Restoring quickly to a known-good state is a crucial aspect of shutting down an attack after the intrusion is detected. If you can't get the attacker out of the system, they will have more opportunity to exfiltrate data.

Re: How to survive a ransomware attack without paying the ransom

#158

Post by GordonS »

rectang wrote: post #157
GordonS wrote: post #153

Earlier quoted context omitted.

There are often 2 threats from a randsomware attack - what you describe mitigates against data loss, but not against data being posted online by an attacker.

I disagree. Restoring quickly to a known-good state is a crucial aspect of shutting down an attack after the intrusion is detected. If you can't get the attacker out of the system, they will have more opportunity to exfiltrate data.

I'm not disagreeing with having the ability to restore your data - plainly that's vital to business continuity.

My point is that it's not the only consideration.

Re: How to survive a ransomware attack without paying the ransom

#159

Post by rapnie »

terinjokes wrote: post #136
rapnie wrote: post #120

Earlier quoted context omitted.

Some that I know of: - https://codeberg.org/jannis/FitoTrack - https://github.com/OpenTracksApp/OpenTracks - https://gadgetbridge.org/

None of those are cycling computers. They are applications that can, in some situations, replace cycling computers. Hardware cycling computers, like the Garmin 830 or Wahoo Elemnt Roam, are physical hardware designed for the use case of being strapped to handlebars and being used in a wide range of environments. The battery life and performance is tuned towards always on GPS and Bluetooth for connecting to sensors. T…

Yes, true. Not exactly what you are looking for, but closer:

https://www.goldencheetah.org/

Among others reads .fit data directly from Garmin.

Re: How to survive a ransomware attack without paying the ransom

#160

Post by rapnie »

balladeer wrote: post #125
Kenji wrote: post #31

Earlier quoted context omitted.

Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. You really wonder that? I'm sorry, how stupid are you? It's obviously to harvest data and control users. We've been warning and educating people about this for decades. When are you guys starting to wake up a…

Are there there similar but open and private solutions to Garmin/etc for h/w and Strava/RunKeeper/etc for software? Some solution where I can track my runs, swims, cyclings, treks just like Strava (et al) does does but I can choose to keep the data wherever I wish - local, or sync to an app on computer or to a self hosted server. Maybe not Garmin but I would love to use such an iOS Strava alternative with similar acc…

Just posted https://www.goldencheetah.org/ above.
Post reply on HN