Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The ransomware surge

bbc.com

Post reply on HN
Print view View original

141–150 of 216 posts

Re: The ransomware surge

#141

Post by viraptor »

curiousgal wrote: post #42
davethedevguy wrote: post #6

The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetra…

> Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. One bank I interned at sent people an email about the weather or something to that extent and each link had a unique identifier. Shaming each individual user is the best way for them to learn.

> Shaming each individual user is the best way for them to learn.

It's the best way for them to stop trusting the security team and never come in with any issue, even if it could be used as an early signal preventing bigger attack. Many people's jobs rely on them receiving emails from unknown sources and receiving files from them. Shaming them for "you should've known this specific link is bad" is counterproductive. That's even before we get to whether they would actually put in any credentials.

Phishing tests have value. Running them to shame people into compliance is a waste of time.

For better takes, there's a good thread https://twitter.com/hacks4pancakes/status/133487573995560550...

Re: The ransomware surge

#142

Post by fancyfish »

mikewarot wrote: post #87
davethedevguy wrote: post #6

The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetra…

>The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. The cause is definitely technical , it is a huge gaping hole in the design of modern operating systems that you could sail the Ever Given through sideways without incident. Your operating system does not confer to the user the ability to delegate only X resources to the opening of a file, email, etc.…

Curious, what are the viable capability based systems within the next decade or so? Fuschia?

Re: The ransomware surge

#143

Post by cloudking »

There's an argument to be made here for using hosted cloud providers instead of rolling your own servers, keeping your data off premise and relying on their security practices. The problem with managing your own servers and services is that you're constantly playing the security game, and responsible for keeping your systems secure and up to date. People hate on providers like Google, but the reality is they have _thousands_ of top tier engineers and security experts managing and monitoring their cloud services. Using their managed database and VM services are far more likely to provide better security than your in house IT team. When was the last time you heard of a Google Cloud customer falling victim to a ransomware attack? (I'm using Google as an example, can say the same for Microsoft, Amazon etc)

Re: The ransomware surge

#144

Post by SMAAART »

bitexploder wrote: post #128
SMAAART wrote: post #123

Earlier quoted context omitted.

> Backups are annoying and unglamorous It gets better (as in worse) someone can easily cut down back-up expenses, and become a hero by "balancing the budget with no disruptions to operations", get a fat bonus, and then after a year or so, leave. Their successors won't get any bonuses by increasing the budget for something that has no ROI. And randsomware is booming!

This is a somewhat cynical take, but there are kernels of truth in there. Often, organizations not focused on quality will allow such things to happen. More than one startup has also been out out of business by not having a backup. But it’s often negligence / ignorance and not budget. When you put all the cards on the table for an organization and give them the information they need, they make much better security ch…

It’s negligence / ignorance that leas to stupid budget cuts.

Re: The ransomware surge

#145

Post by mikewarot »

fancyfish wrote: post #142
mikewarot wrote: post #87

Earlier quoted context omitted.

>The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. The cause is definitely technical , it is a huge gaping hole in the design of modern operating systems that you could sail the Ever Given through sideways without incident. Your operating system does not confer to the user the ability to delegate only X resources to the opening of a file, email, etc.…

Curious, what are the viable capability based systems within the next decade or so? Fuschia?

Genode

Re: The ransomware surge

#146

Post by novok »

m3nu wrote: post #122
the_duke wrote: post #86

Earlier quoted context omitted.

I sometimes do infrastructure consulting. One of the first questions I ask is if they have at least one fully independent, full/incremental off-site backup that can't be corrupted from the main infrastructure, and if they have ever checked if they actually work and are restorable. I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run…

> Backups are annoying and unglamorous Three years ago, after doing YC Startup School, I built https://www.borgbase.com to offer the simple, but secure backup service I wanted myself. Today it’s a viable business and my customers are all great and value backups as essential part of their own business. Wouldn’t want to be in any other “more glamorous” corner of the industry. Also kudos to anyone - partner or competito…

Do you do offsite offline backups too with verification? What if your infra gets really hacked and they wipe out all of your customer's backup data everywhere? Just because borg clients have append only modes, it doesn't stop them from deleting the raw files on your drives.

Re: The ransomware surge

#147

Post by [deleted] »

viraptor wrote: post #126
danielheath wrote: post #102

Earlier quoted context omitted.

A few reasons come to mind. If you lose control of an aws root account it can take weeks to get it back. That’s probably enough time for the hackers to clean out the backups. Billing issues can lead to aws wiping out an account. For $work the backups are in AWS but using a different payment method, account owner etc to prevent cross contamination. Honestly, they should be outside aws entirely, but separate accounts i…

> If you lose control of an aws root account it can take weeks to get it back. > Billing issues can lead to aws wiping out an account. These are small-scale related issues though. When you're at the level where it's hard to have a reasonable backup outside of AWS, you can also resolve the root account issues fairly quickly by calling your TAM directly.

[deleted]

Re: The ransomware surge

#148

Post by m3nu »

novok wrote: post #146
m3nu wrote: post #122

Earlier quoted context omitted.

> Backups are annoying and unglamorous Three years ago, after doing YC Startup School, I built https://www.borgbase.com to offer the simple, but secure backup service I wanted myself. Today it’s a viable business and my customers are all great and value backups as essential part of their own business. Wouldn’t want to be in any other “more glamorous” corner of the industry. Also kudos to anyone - partner or competito…

Do you do offsite offline backups too with verification? What if your infra gets really hacked and they wipe out all of your customer's backup data everywhere? Just because borg clients have append only modes, it doesn't stop them from deleting the raw files on your drives.

If a storage server gets p0wned, the raw data could be deleted. That's true for every cloud provider. What's important, they still can't read the backup, since it's encrypted on the client. Storage servers are also isolated from each other and in different DCs, cities and regions.

Additional offline backups aren't really feasible past a certain data volume and daily change/velocity. I'd still encourage everyone to have them for their own essential data in addition to a cloud backup. E.g. by burning it to BluRay or tape (3-2-1 rule). You can see find my own, more philosophical discussion, of the topic here: https://docs.borgbase.com/strategy/. There I also distinguish between operational backups and archives. BorgBase is focused on the former. Offline backups are more suited for the latter.

Re: The ransomware surge

#149

Post by corinroyal »

networkimprov wrote: post #107
ericalexander0 wrote: post #106

Surprised at how much focus there is on backups as the solution. You'll never fully recover from those backups. Backups won't help you avoid fines, lawsuits, lost customers, and lost time. I run an open data set on data breaches. The vast majority of ransomware incidents start with a phishing email, to beach head, to find domain admin, to game over. The root problem is domain admin population size. Reduce it to zero…

A second root problem is the insanity of public SMTP on today's Internet: allowing anyone, claiming any identity, to send you any content without limits. I started the "mnm" open source project to enable a new email network, on a new protocol. More: https://mnmnotmail.org/ Follow: https://twitter.com/mnmnotmail

Thank you! I'm a huge fan of the mnm approach. I wish you tremendous success.

Re: The ransomware surge

#150

Post by AnIdiotOnTheNet »

the_duke wrote: post #86
korethr wrote: post #80

Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed…

I sometimes do infrastructure consulting. One of the first questions I ask is if they have at least one fully independent, full/incremental off-site backup that can't be corrupted from the main infrastructure, and if they have ever checked if they actually work and are restorable. I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run…

> I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run IT.

I am not even remotely surprised, because most companies are not IT oriented companies, and most of those either have managers that can't be made to understand the importance of DR, or (sadly) IT people who can't.

I myself am currently in a multi-year long political battle to justify a mere $600mo to get our DR env (built with old equipment that is on the verge of irrevocable failure) moved from a closet at a branch location to an actual co-lo that won't lose power and internet 3 times a week.

At least we finally got that backup generator approved for the corporate office after the third time a goose committed suicide on our power lines. Ugh...

Post reply on HN