There's this point in Civilization (1) where you get Knights and your attack is 4 and mostly you're going against Phalanxes who are defense 2, and even with various advantages you still have a massive edge. That's where I feel we are with a lot of computer systems. It's far easier to attack than defend, and with Bitcoin it's easier than ever to transfer wealth anonymously. In the case of the knights eventually the defence got the edge again with the advent of firearms, but that could be a long time coming.
The ransomware surge
81–90 of 216 posts
Re: The ransomware surge
#82Earlier quoted context omitted.
becase BTC is the most common and there are still ways to obscure the audit trail, but the efficacy of such methods is declining.
most recently the twitter hacker was arrested after failing to use a btc mixer https://ciphertrace.com/twitter-hack-update-blockchain-analy... https://www.theverge.com/2021/3/16/22334421/twitter-hacker-b...
Less to do with bitcoin and more to do with random data you would not expect to identify you.
"(KYC) data associated with the accounts—such as ID, birthday and address—revealing their true identities"
Once the coins entered the mixing services they were gone.
It looks like they got the info from the Texas exchange.
Re: The ransomware surge
#83Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…
A crucial point you missed:
Ransomware gangs often destroy your backup infrastructure. So it's important to create pull-only backups or backups that cannot be deleted / overwritten.
Re: The ransomware surge
#84Earlier quoted context omitted.
I would like to see rate-limiting built into OS's. Eg. an application is only allowed to touch 100 files per second or 1000 files per hour. When it reaches those limits, it gets paused and a popup asks the user if this application really should be doing X. Then at least ransomware can't run through stuff too quickly.
Behavioral heuristics are best learned in-situ; you need to know how the software is used with which data to correctly profile normal behavior. Some users and workloads hate sandboxes, though, and a 'Run as Adminstrator'-esque familiar-escape thus demanded by users will no doubt destroy its utility. Ultimately, someone must correctly articulate what the system is supposed to do, and this requires knowledge.
Had to troubleshoot Windows software from a MAJOR shipping provider that popped up a “you must do this thing” on a fully up to date Win10 system today.
“The thing” would not work as an unprivileged user account and would only work as a right click run as administrator situation :-)
Re: The ransomware surge
#85Timely topic, the current Communications of the ACM has a more detailed article on this topic: https://dl.acm.org/doi/10.1145/3449054
Re: The ransomware surge
#86Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…
I sometimes do infrastructure consulting.
One of the first questions I ask is if they have at least one fully independent, full/incremental off-site backup that can't be corrupted from the main infrastructure, and if they have ever checked if they actually work and are restorable.
I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run IT.
No, the automatic 7 day RDS snapshots or turning on S3 versioning is not a sufficient backup. Neither is mirroring to a S3 Glacier bucket in the same org, or rsyncing to a a backup server in the same datacenter.
Backups are annoying and unglamorous. Nobody wants to do them, or do the tedious work of validating them or setting up something like an automated restore test.
Until the day you lose your data.
Re: The ransomware surge
#87The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetra…
>The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem.
The cause is definitely technical, it is a huge gaping hole in the design of modern operating systems that you could sail the Ever Given through sideways without incident.
Your operating system does not confer to the user the ability to delegate only X resources to the opening of a file, email, etc. They (the users) have no ability to limit side effects. Blaming them for your bad system isn't ever going to help fix things.
The missing system of limiting side effects is known as Capability Based Security. We all have a practical example of it in our wallet or purse. We can remove a unit of currency, hand it to someone else for a purchase, and that is the maximum we can lose, unless something extraordinary happens.
We all have outlets, which limit the amount of power they will supply, and some even check to make sure it isn't supplied through us, or into a system that has arcing issues. We never have to worry that turning on a lamp will take down the power grid.
Imagine if there were no circuit breakers or fuses, would blaming people for not being careful enough help make the system safer? No, of course not. Neither does blaming the user for your defective Operating System.
Re: The ransomware surge
#88Earlier quoted context omitted.
Yep, that's what people don't understand, you can ban centralized entities as much as you want, but you can't stop people from running arbitrary code on their devices which means it's impossible to shutdown a properly decentralized network.
If you can’t convert back to a national currency, nobody will care.
If you can use it as a currency some will care.
Re: The ransomware surge
#89The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetra…
There is no technical reason for allowing any random user to delete their data, or at least not requiring some specific capability that most processes don't have.
In fact, there were systems built this way in the 70's.
Re: The ransomware surge
#90Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…
A crucial point you missed: Ransomware gangs often destroy your backup infrastructure. So it's important to create pull-only backups or backups that cannot be deleted / overwritten.
> backups that cannot be deleted / overwritten
That gets complex if your database contains PII. If a user asks for their account to be deleted...