Once scammers know you're a mark, they'll exploit it. This is why email lists are next to gold to scammers, because they're lists of people or organizations who have parted with their money under false pretenses before, and are most likely willing to do so again in the future.
80% of orgs that paid the ransom were hit again
261–270 of 386 posts
Re: 80% of orgs that paid the ransom were hit again
#262Shouldn't they improve their security?
Given 0-day vulnerabilities and supply chain risks, I'm going to take a little bit of poetic license and say it's impossible to stop ransomware attacks, certainly with commercially viable levels of investment in infosec. You can mitigate some of the exposure, but the level of validation required to continuously guarantee that those mitigations are intact and effective. So attacks will continue, the level of impact wi…
maybe, but most ransomware attacks aren't via zero-days but via simpler means. Also ransomware infects a whole network and so part of the cause is systems that allow that.
Re: 80% of orgs that paid the ransom were hit again
#263Re: 80% of orgs that paid the ransom were hit again
#264Earlier quoted context omitted.
The entry points are "whatever works". Typically: * Password spraying from previous data leaks * Good old-fashioned fishing * Bugs in anything that's common in enterprises, exposed to the Internet and not patched fast enough, including MS Exchange, various security/VPN products, vcenter, you name it. All of these had pretty critical pre-auth bugs exposed just this year * malicious browser plugins * malicious O365 app…
Lack of MFA, lack of hardware whitelisting, servers exposed directly to the Internet, lack of user privilege restrictions, allowing passwords that are known-compromised, ...
If so, it doesn't make sense to blame Putin. The blame lies on US lawmakers, for not incentivizing US businesses to have a budget for fixing these sorts of issues. For example, when companies such as Equifax are hacked because of poor security practices do they pay a penalty? No. That's the problem.
Re: 80% of orgs that paid the ransom were hit again
#265Earlier quoted context omitted.
Coming soon: ransomware with subscription business model
That's already a thing "SCHWIRTZ: What DarkSide does is they're a ransomware creator. So they create the program that is uploaded into a victim's computer system that locks down their data. But what they do is they basically contract out to these affiliates who are other hackers. And these are the people that are responsible for actually penetrating the victim's computer services. And what they do is operate basicall…
I think they meant the ransom as a subscription service, not malware to franchisees as a service.
Re: 80% of orgs that paid the ransom were hit again
#266from my experience responding to these. orgs that entertain the ide of paying the ransom often do not care about root cause analysis to the degree they should.
orgs that completely ignore payment as an option spend their time identifying the entry point, and vulns, and close those before restoring or rebuilding.
Re: 80% of orgs that paid the ransom were hit again
#267Earlier quoted context omitted.
The responsibility lies at the nation-state level, and the clear decision is for Governments to ban the formal exchange of cryptocurrencies. As soon as this occurs, ransomware events will collapse since the ransoms will become unpayable. The negatives of cryptocurrencies (ransomware enablement, chip and electricity shortages, scams) clearly outweigh the positives at this point.
If you believe banning cryptocurrencies will suddenly stop ransomware, then I have a bridge to sell you.
There is an easy fix here: make it illegal for companies to transact in crypt currencies. Then they would have no way of paying a ransom without engaging in illegal activities. This would destroy the ransomware business model.
Re: 80% of orgs that paid the ransom were hit again
#268Re: 80% of orgs that paid the ransom were hit again
#269I don't see any discussion of typical entry points. How do these guys get into the system? Is it by having someone download a malicious file? If so what type of file? PDF? MS Office? If so Adobe and Microsoft should be held accountable for their security holes, only then will they have enough motivation to maybe consider rewriting some of their code in a safer language such as Rust.
Agree. There is much confusion and many bad analogies surrounding this issue. Some claim - without evidence - that nation states are behind it. Which, with a moments reflection, is absurd; nation states may have an interest in disabling certain systems for military purposes (at the appropriate time), but no nation state needs ransom money. Easier ways for a government to get money; namely, just print some. Others lik…
>no nation state needs ransom money. Easier ways for a government to get money; namely, just print some
Sure, this is obvious, makes intuitive sense, except...it explains why something like Iran-Contra or the equivalent in other countries can't happen.
Re: 80% of orgs that paid the ransom were hit again
#270Earlier quoted context omitted.
That assumes the backup couples the data and compute together, like a system image or something. If the backup is just data and is somewhere else, you can just rebuild the compute infrastructure from a known secure state (which arguably may require rebuilding the entire compute environment). Even if your backup does couple the data and compute together, if it's simply time based (not sure what other event you could u…
First of all the goal is to make people not trust their backups. So they study and target the systems that do backups and restores. If you are separating data from systems, they have a number of tricks. One is to have the backup system corrupt data in subtle ways. Sure, you have a backup. But you can't trust it. And they make sure that you KNOW you can't trust it by pointing you at some easily verifiable corruption..…
The data corruption approach is devious and something I hadn't considered, but I also feel like it eliminates much of an attacker's advantage. The more extensive the corruption, the more likely it will draw attention, possibly to the ransomware itself, so an attacker would want to keep this to a minimum. In turn, a victim would probably choose to live with minor data corruption over paying a ransom, or at least I'd expect the payout threshold to greatly diminish vs the scenario where 100% of the data is held hostage.