Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The ransomware surge

bbc.com

Post reply on HN
Print view View original

131–140 of 216 posts

Re: The ransomware surge

#131

Post by fnord77 »

Veserv wrote: post #54
fnord77 wrote: post #35

Earlier quoted context omitted.

> Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? because software is tremendously complex with a large surface area to attack. And many OS features were designed when wide-scale hacking was not a problem.

Then that means the software is hopelessly inadequate for the current environment where wide-scale hacking is a constant problem. To echo what they said, why do we accept and deploy systems that catastrophically fail in circumstances that we know are going to occur? Why is it acceptable to take systems that were not previously connected and actively make a decision to connect them to internet if they are completely u…

why? because companies engineering the software cut corners to save costs, or their engineering talent isn't competent or talented enough to produce products that don't have majors vulns.

You can better believe software running an aircraft carrier has been hardened 12 ways til sunday. Prosumer operating systems - not so much.

Re: The ransomware surge

#132

Post by m3nu »

formerly_proven wrote: post #127
m3nu wrote: post #125

Earlier quoted context omitted.

Immutable backups are often overlooked. At borgbase.com, we call this “append-only” mode and the large majority of repositories uses it. With S3 (or similar) you would add some policies to disable deletions. So it’s usually doable, but needs to be considered when setting up the backup process.

Does the append-only mode you have in borgbase fix the issues of the append-only mode in Borg itself? https://borgbackup.readthedocs.io/en/stable/usage/notes.html... Because the way it works in Borg isn't really workable in practice, it only seems to be good to check a box.

We use the same public version of Borg, so those limitations apply. It’s still quite workable. Just prune from a different machine or once a year when the repo gets too large.

We may move to reject destructive commands from append-only repos in the future, but this will break existing workflows. Discussion on this here: https://feedback.borgbase.com/posts/28/reject-delete-and-pru...

Re: The ransomware surge

#133

Post by tootahe45 »

sneak wrote: post #120
tootahe45 wrote: post #22

Earlier quoted context omitted.

Already happening with 'unhosted' wallets being blocked or heavily scrutinized. My personal experience is as follows: Sent over 20 transactions from US exchange -> US exchange and no problems. Sent a single transaction from my unhosted software wallet -> US exchange, and got my account locked. Questioned on everything including my employer's information, had do re-do advanced KYC, source of funds etc. (The unhosted w…

Which exchange were you withdrawing from?

To be fair it was a regulated stable-coin issuer based in NY where i was redeeming stable-coins for USD, so the strictest of all AML was to be expected. I was just surprised the tech is already in place for a travel rule for crypto. If i would guess it would've been a company like chainanalysis aggregating the exchange data to enable this.

Re: The ransomware surge

#134

Post by fendy3002 »

akiselev wrote: post #55
thatguy0900 wrote: post #40

Earlier quoted context omitted.

How is wear and tear equivalent to hostile humans purposefully trying to fuck it up? Even military installations needs armed guards to stop people from just cutting through the fence. Wear and tear is more equivalent to keeping your site from going down to high traffic. Show me a road that's still safe when three guys with guns are standing in the middle of it shooting at passing drivers.

How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them? Engineers design stuff to withstand adversaries all the time, when it's required. Designing with adversaries in mind is always required for connected sy…

> How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them?

Well if they're exists, why don't we use them for everyone on daily basis, since it'll be safer? Because they're hella expensive and resources are limited.

If any smaller shops or businesses try to implement highest security for their system, their development and operation cost can multifold easily, and the ux can be reduced due to security.

Re: The ransomware surge

#135

Post by networkimprov »

bouncycastle wrote: post #124
networkimprov wrote: post #107

Earlier quoted context omitted.

A second root problem is the insanity of public SMTP on today's Internet: allowing anyone, claiming any identity, to send you any content without limits. I started the "mnm" open source project to enable a new email network, on a new protocol. More: https://mnmnotmail.org/ Follow: https://twitter.com/mnmnotmail

It looks very similar to Slack / Discord. However, if an org needs email, why can't they just configure their filters to move everything from outside the org in a special folder, and email server could further filter any link and put it through a warning page before redirecting to the link. We already have DKIM and SPF to verify if the domains of the sender. Just setting up these can work.

Have you looked through the FAQ and protocol draft?

https://mnmnotmail.org/faq.html

https://github.com/networkimprov/mnm/blob/master/Protocol.md

The mnm client app isn't chat-oriented like Slack & Discord, altho it does provide presence status for contacts who've opted into that.

Re: The ransomware surge

#136

Post by pixl97 »

bluGill wrote: post #113
tootahe45 wrote: post #13

I don't get why everybody cares so much about the ransomware/cryptominer part, but not the data being exfiltrated and sold/used for criminal activity part..

Most data just isn't that useful. Sure there are exceptions, but most isn't very useful. If you offered my company our competitors source code for free, we wouldn't take it - we have some ethics. I think most of you are in the same boat - even if you don't have strong company ethics are quick check would discover that you already know how to do everything they are doing, so time looking at their code is time you aren…

Um, ya, you are only thinking of US/EU companies. There are plenty of other places that would RIP off your code in a heartbeat.

Re: The ransomware surge

#137

Post by korethr »

ericalexander0 wrote: post #106

Surprised at how much focus there is on backups as the solution. You'll never fully recover from those backups. Backups won't help you avoid fines, lawsuits, lost customers, and lost time. I run an open data set on data breaches. The vast majority of ransomware incidents start with a phishing email, to beach head, to find domain admin, to game over. The root problem is domain admin population size. Reduce it to zero…

I didn't post about backups to imply that they're the solution to ransomware. But having seen what ransomware can do, I know that backups can be the difference between loss of productivity, and the end of the business.

If you are keeping to best practice, including the things you recommend, then you should hopefully never need backups. But I see backups akin to seat belts, motorcycle helmets, fire extinguishers, et. al. They are things you should hopefully never need if you aren't doing anything stupid or dangerous, but if the situation ever goes sideways, can be the difference between surviving or not.

Re: The ransomware surge

#138

Post by viraptor »

varispeed wrote: post #90
likecarter wrote: post #83

Earlier quoted context omitted.

A crucial point you missed: Ransomware gangs often destroy your backup infrastructure. So it's important to create pull-only backups or backups that cannot be deleted / overwritten.

> backups that cannot be deleted / overwritten That gets complex if your database contains PII. If a user asks for their account to be deleted...

It's not "cannot be overwritten ever". It's more "you can overwrite it using credentials stored in a safe location and never from the production environment".

Someone will always have permissions to remove or change the entries, just not easily and not in an automated daily process way.

Re: The ransomware surge

#139

Post by marcinzm »

tomrod wrote: post #99
varispeed wrote: post #90

Earlier quoted context omitted.

> backups that cannot be deleted / overwritten That gets complex if your database contains PII. If a user asks for their account to be deleted...

Would it be sufficient that the delete accounts script be managed and merged at restoration time?

You still have their data and anyone who bypasses the restoration script can get it so no.

Re: The ransomware surge

#140

Post by usrusr »

djoldman wrote: post #20

Can someone tell me where I'm wrong here: The solution to ransomware is to daily mirror every system to an append only backup and then just flash everything back if you get hit. You lose a few days...

If you mirror systems then you will find yourself in a halting problem world of restoring older and older backups only to discover that they, just like all the younger ones you tried so far turn out to be exact reproductions of a state already breached. If you store only content, rebuilding the environment will be quite a feat.
Post reply on HN