Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The ransomware surge

bbc.com

Post reply on HN
Print view View original

121–130 of 216 posts

Re: The ransomware surge

#121

Post by sneak »

amelius wrote: post #7
sneak wrote: post #3

This is going to be the rationale given for the heavy-handed cryptocurrency regulation they're going to bring down on all the exchanges that US persons can access. Pretty soon all you'll be able to legally access as a USian is "Bitcoin!(tm)"[1] (like what PayPal is doing), not the actual uncut blockchain bitcoin that you can send and receive at will. [1]: https://www.epsilontheory.com/in-praise-of-bitcoin/

Personally, I don't see the problem. 1. Bitcoin drives up GPU costs. 2. Bitcoin makes it ridiculously easy to commit certain forms of crime. 3. And Bitcoin's energy footprint hurts the planet.

Putting an entire society under ubiquitous surveillance to catch a tiny minority of criminals isn't a good bargain. Fact is, though, that's not even why they do it.

Eventually you get to the point where you see that the information and ultimate large scale control permitted by the collection of that information is itself the end goal, and that it has nothing to do with detecting or preventing crime.

Re: The ransomware surge

#122

Post by m3nu »

the_duke wrote: post #86
korethr wrote: post #80

Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…

I sometimes do infrastructure consulting. One of the first questions I ask is if they have at least one fully independent, full/incremental off-site backup that can't be corrupted from the main infrastructure, and if they have ever checked if they actually work and are restorable. I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run…

> Backups are annoying and unglamorous

Three years ago, after doing YC Startup School, I built https://www.borgbase.com to offer the simple, but secure backup service I wanted myself. Today it’s a viable business and my customers are all great and value backups as essential part of their own business. Wouldn’t want to be in any other “more glamorous” corner of the industry. Also kudos to anyone - partner or competitor - working in this “unglamorous” space. You’re all doing great work.

Re: The ransomware surge

#123

Post by SMAAART »

the_duke wrote: post #86
korethr wrote: post #80

Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…

I sometimes do infrastructure consulting. One of the first questions I ask is if they have at least one fully independent, full/incremental off-site backup that can't be corrupted from the main infrastructure, and if they have ever checked if they actually work and are restorable. I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run…

> Backups are annoying and unglamorous

It gets better (as in worse) someone can easily cut down back-up expenses, and become a hero by "balancing the budget with no disruptions to operations", get a fat bonus, and then after a year or so, leave.

Their successors won't get any bonuses by increasing the budget for something that has no ROI.

And randsomware is booming!

Re: The ransomware surge

#124

Post by bouncycastle »

networkimprov wrote: post #107
ericalexander0 wrote: post #106

Surprised at how much focus there is on backups as the solution. You'll never fully recover from those backups. Backups won't help you avoid fines, lawsuits, lost customers, and lost time. I run an open data set on data breaches. The vast majority of ransomware incidents start with a phishing email, to beach head, to find domain admin, to game over. The root problem is domain admin population size. Reduce it to zero…

A second root problem is the insanity of public SMTP on today's Internet: allowing anyone, claiming any identity, to send you any content without limits. I started the "mnm" open source project to enable a new email network, on a new protocol. More: https://mnmnotmail.org/ Follow: https://twitter.com/mnmnotmail

It looks very similar to Slack / Discord.

However, if an org needs email, why can't they just configure their filters to move everything from outside the org in a special folder, and email server could further filter any link and put it through a warning page before redirecting to the link.

We already have DKIM and SPF to verify if the domains of the sender. Just setting up these can work.

Re: The ransomware surge

#125

Post by m3nu »

rsync wrote: post #110
likecarter wrote: post #83

Earlier quoted context omitted.

A crucial point you missed: Ransomware gangs often destroy your backup infrastructure. So it's important to create pull-only backups or backups that cannot be deleted / overwritten.

"Ransomware gangs often destroy your backup infrastructure. So it's important to create pull-only backups or backups that cannot be deleted / overwritten." Every rsync.net customer has ZFS snapshots available in their account that are immutable . They are read-only. So, even if Mallory trashes your primary site and then gains access to your rsync.net credentials, the daily/weekly/monthly snapshots cannot be destroyed…

Immutable backups are often overlooked. At borgbase.com, we call this “append-only” mode and the large majority of repositories uses it. With S3 (or similar) you would add some policies to disable deletions. So it’s usually doable, but needs to be considered when setting up the backup process.

Re: The ransomware surge

#126

Post by viraptor »

danielheath wrote: post #102
tomrod wrote: post #98

Earlier quoted context omitted.

> No, the automatic 7 day RDS snapshots or turning on S3 versioning is not a sufficient backup. Neither is mirroring to a S3 Glacier bucket in the same org, or rsyncing to a a backup server in the same datacenter. Why?

A few reasons come to mind. If you lose control of an aws root account it can take weeks to get it back. That’s probably enough time for the hackers to clean out the backups. Billing issues can lead to aws wiping out an account. For $work the backups are in AWS but using a different payment method, account owner etc to prevent cross contamination. Honestly, they should be outside aws entirely, but separate accounts i…

> If you lose control of an aws root account it can take weeks to get it back.

> Billing issues can lead to aws wiping out an account.

These are small-scale related issues though. When you're at the level where it's hard to have a reasonable backup outside of AWS, you can also resolve the root account issues fairly quickly by calling your TAM directly.

Re: The ransomware surge

#127

Post by formerly_proven »

m3nu wrote: post #125
rsync wrote: post #110

Earlier quoted context omitted.

"Ransomware gangs often destroy your backup infrastructure. So it's important to create pull-only backups or backups that cannot be deleted / overwritten." Every rsync.net customer has ZFS snapshots available in their account that are immutable . They are read-only. So, even if Mallory trashes your primary site and then gains access to your rsync.net credentials, the daily/weekly/monthly snapshots cannot be destroyed…

Immutable backups are often overlooked. At borgbase.com, we call this “append-only” mode and the large majority of repositories uses it. With S3 (or similar) you would add some policies to disable deletions. So it’s usually doable, but needs to be considered when setting up the backup process.

Does the append-only mode you have in borgbase fix the issues of the append-only mode in Borg itself? https://borgbackup.readthedocs.io/en/stable/usage/notes.html... Because the way it works in Borg isn't really workable in practice, it only seems to be good to check a box.

Re: The ransomware surge

#128

Post by bitexploder »

SMAAART wrote: post #123
the_duke wrote: post #86

Earlier quoted context omitted.

I sometimes do infrastructure consulting. One of the first questions I ask is if they have at least one fully independent, full/incremental off-site backup that can't be corrupted from the main infrastructure, and if they have ever checked if they actually work and are restorable. I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run…

> Backups are annoying and unglamorous It gets better (as in worse) someone can easily cut down back-up expenses, and become a hero by "balancing the budget with no disruptions to operations", get a fat bonus, and then after a year or so, leave. Their successors won't get any bonuses by increasing the budget for something that has no ROI. And randsomware is booming!

This is a somewhat cynical take, but there are kernels of truth in there. Often, organizations not focused on quality will allow such things to happen. More than one startup has also been out out of business by not having a backup. But it’s often negligence / ignorance and not budget. When you put all the cards on the table for an organization and give them the information they need, they make much better security choices.

Re: The ransomware surge

#129

Post by g_p »

bluGill wrote: post #112
g_p wrote: post #53

Earlier quoted context omitted.

It is, but solving that problem would entail re-training staff, reduce "productivity", and moreover, cost money... Many companies have cut their IT provision below what is needed to simply stand still. IT is a cost to their business, not a revenue source. They don't consider the counter-factual of "well, what if we didn't use IT and computers and the internet" when valuing what IT is bringing to their business. If th…

MBAs don't like wasting money. If bad IT costs them money or sales they care. If they can reduce the costs without losing that money they will. However they don't know how to solve this optimization problem and are learning the hard way when they get it wrong.

I think part of the issue is also that the negative impact of getting IT wrong is delayed, and often lands after your middle managers have moved on to other organisations, thus don't see the impact of cutting costs repeatedly.

Since there's no visible problem (nothing catches fire) the day, week or month after cutting spend on IT, it's an unnecessary expense in the eyes of beancounters.

Re: The ransomware surge

#130

Post by spideymans »

disabled wrote: post #115
tenebrisalietum wrote: post #111

Earlier quoted context omitted.

Can ransomware leak on to your always-connected NAS?

Yes, of course. This is one of the reasons why I have 3 copies of everything I use (local/computer, cloud, NAS). This is particularly why I have a cloud backup, with blockchain data authentication. But, this is a basic overview of how to prevent NAS ransomware attacks: https://www.howtogeek.com/435452/how-to-secure-your-synology... There is better advice elsewhere but this is a good start. This may be a good comment…

Can you elaborate some more on your cloud backup solution? More specifically, I'm curious about the privacy/security aspect. It's the main reason why I've been somewhat hesitant to adopt cloud backups for my own computers. \
Post reply on HN