Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The ransomware surge

bbc.com

Post reply on HN
Print view View original

101–110 of 216 posts

Re: The ransomware surge

#101

Post by Craighead »

g_p wrote: post #21
tootahe45 wrote: post #13

I don't get why everybody cares so much about the ransomware/cryptominer part, but not the data being exfiltrated and sold/used for criminal activity part..

My cynical suspicion is because exfiltration/sale doesn't prevent the business from continuing to operate, pretending nothing is wrong, and gaslighting their users via reassuring language if anyone finds out or is approached. When the data is encrypted and locked up, the company itself cries foul (not out of care for people's data) as it can't keep doing whatever mundane things it was doing day-to-day.

Mundane... like providing health care?

Re: The ransomware surge

#102

Post by danielheath »

tomrod wrote: post #98
the_duke wrote: post #86

Earlier quoted context omitted.

I sometimes do infrastructure consulting. One of the first questions I ask is if they have at least one fully independent, full/incremental off-site backup that can't be corrupted from the main infrastructure, and if they have ever checked if they actually work and are restorable. I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run…

> No, the automatic 7 day RDS snapshots or turning on S3 versioning is not a sufficient backup. Neither is mirroring to a S3 Glacier bucket in the same org, or rsyncing to a a backup server in the same datacenter. Why?

A few reasons come to mind.

If you lose control of an aws root account it can take weeks to get it back. That’s probably enough time for the hackers to clean out the backups.

Billing issues can lead to aws wiping out an account.

For $work the backups are in AWS but using a different payment method, account owner etc to prevent cross contamination. Honestly, they should be outside aws entirely, but separate accounts is a good start.

Re: The ransomware surge

#103

Post by nicbou »

the_duke wrote: post #86
korethr wrote: post #80

Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…

I sometimes do infrastructure consulting. One of the first questions I ask is if they have at least one fully independent, full/incremental off-site backup that can't be corrupted from the main infrastructure, and if they have ever checked if they actually work and are restorable. I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run…

This applies to average people too. I wonder who among us can say they meet your (reasonable) standard.

Like you said, backups are annoying and unglamorous. Yet, the data on my laptop is the only thing I could not replace. It's more important to me than my passport or my birth certificate. Its preservation is certainly worth a bit of thought.

Re: The ransomware surge

#104

Post by kemonocode »

korethr wrote: post #80

Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…

Modern ransomware gangs focus more on data exfiltration rather than actually locking down data, and it lets them remain undetected for longer too. That said, yes, correct, having good and reliable backups is vital.

Re: The ransomware surge

#105

Post by nicbou »

jude- wrote: post #10

Ransomware wouldn't be a problem if the software industry took quality assurance seriously (or was regulated to do so), like every other engineering industry. There's little difference to me between an insecure program that allows hackers to hold your data for ransom, and a defective home appliance that occasionally starts electric fires.

We can do this, but it has a price the market is not willing to pay, except in rare cases.

Re: The ransomware surge

#106

Post by ericalexander0 »

Surprised at how much focus there is on backups as the solution. You'll never fully recover from those backups. Backups won't help you avoid fines, lawsuits, lost customers, and lost time.

I run an open data set on data breaches. The vast majority of ransomware incidents start with a phishing email, to beach head, to find domain admin, to game over.

The root problem is domain admin population size. Reduce it to zero with privileged access management to avoid ransomware.

https://ericalexander.org/SecurityBreach/#/

Re: The ransomware surge

#107

Post by networkimprov »

ericalexander0 wrote: post #106

Surprised at how much focus there is on backups as the solution. You'll never fully recover from those backups. Backups won't help you avoid fines, lawsuits, lost customers, and lost time. I run an open data set on data breaches. The vast majority of ransomware incidents start with a phishing email, to beach head, to find domain admin, to game over. The root problem is domain admin population size. Reduce it to zero…

A second root problem is the insanity of public SMTP on today's Internet: allowing anyone, claiming any identity, to send you any content without limits.

I started the "mnm" open source project to enable a new email network, on a new protocol.

More: https://mnmnotmail.org/

Follow: https://twitter.com/mnmnotmail

Re: The ransomware surge

#108

Post by disabled »

nicbou wrote: post #103
the_duke wrote: post #86

Earlier quoted context omitted.

I sometimes do infrastructure consulting. One of the first questions I ask is if they have at least one fully independent, full/incremental off-site backup that can't be corrupted from the main infrastructure, and if they have ever checked if they actually work and are restorable. I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run…

This applies to average people too. I wonder who among us can say they meet your (reasonable) standard. Like you said, backups are annoying and unglamorous. Yet, the data on my laptop is the only thing I could not replace. It's more important to me than my passport or my birth certificate. Its preservation is certainly worth a bit of thought.

> Like you said, backups are annoying and unglamorous.

It’s called having a network attached storage (NAS) device. I have a Synology NAS, which I backup to, continuously at 5 minute intervals.

Warning: Microsoft image and file backups sometimes do not work.

I recommend Acronis True Image instead, which comes with antivirus. It pretty much always works, never falter never fail. Get the version that allows you to back up to the cloud with blockchain features. You will be happy you did.

Re: The ransomware surge

#109

Post by Thorentis »

Just because lives aren't being directly targeted, how isn't this a form of terrorism? If your and your employee's livelihoods depends on your IT systems, and somebody intentionally destroys them, that is terrifying!

Unless there is some serious teeth to any response to this, it will keep hapening. The FBI and the UK CCC can put out as many recommendations as they like about backups and updates, but criminals will just keep finding targets, or upping the damage.

It is time to consider these attacks as terrorism, and respond to state sponsored terror attacks accordingly.

Re: The ransomware surge

#110

Post by rsync »

likecarter wrote: post #83
korethr wrote: post #80

Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…

A crucial point you missed: Ransomware gangs often destroy your backup infrastructure. So it's important to create pull-only backups or backups that cannot be deleted / overwritten.

"Ransomware gangs often destroy your backup infrastructure. So it's important to create pull-only backups or backups that cannot be deleted / overwritten."

Every rsync.net customer has ZFS snapshots available in their account that are immutable. They are read-only.

So, even if Mallory trashes your primary site and then gains access to your rsync.net credentials, the daily/weekly/monthly snapshots cannot be destroyed.

Post reply on HN