21–30 of 89 posts
"Fortunately, no personal identifying information was exposed." How can they know this?
No insights on that, but this is more the way I read such statements:
This is their report of what they know.
Common sense dictates that this does not mean much as we normally only know a fraction of what is.
However it might also be a sign that they are not yet aware of much at all as it is that overly unspecific.
How did we end up at a point where we are this reliant on the internet? Any truly critical system should not be connected to the public internet. Computers with internet connections are for sending email and reading Wikipedia. Any data critical to your organization should be accessed from separate terminals connected via LAN. No VPN, that's still the internet. Do that, and unless you're the CIA you will never be hack…
Having worked in healthcare up until very recently I can assure you a bunch of unpatched XP machines connected via LAN will still be rampantantly infected regardless if they have access to the internet. Wannacry was just absolutely rampant on these systems for years. At the same time the publicly inbound accessible servers in the DMZ never had an issue because we were actually able to manage the security controls on…
Earlier quoted context omitted.
Having worked in healthcare up until very recently I can assure you a bunch of unpatched XP machines connected via LAN will still be rampantantly infected regardless if they have access to the internet. Wannacry was just absolutely rampant on these systems for years. At the same time the publicly inbound accessible servers in the DMZ never had an issue because we were actually able to manage the security controls on…
Why did those machines have uncovered USB ports?
The medical device? They didn't, WannaCry would spread over the LAN to the systems silently then when the vendor came to do maintenance on a system or an upgrade they would become a transport vector between sites.
Generic? Because limiting college computers to only be able to work on what you can type into each one you visit makes them relatively useless and creates a much larger burden than managing security.
Nations should lessen the penalties for white-hat and even grey-hat hackers who report their findings. They should have strong protections; they are helping all of society and national security. Instead, we have politicians and executives who make legal threats to cover their mistakes and everyone suffers for it. I have this view because I have personally walked away from security problems I've discovered simply by p…
you mean increase the rewards?
Hey, I actually have experience with that school! I did some consulting with them about a decade ago. The ransomware attack certainly didn't help, but it is wildly misleading to say, or even imply that caused them to shut down. The actual reasons: (a) They filled a niche that didn't need to be filled anymore. They used to absorb students from other local universities (ISU, UIS, UIUC). Those schools have realized the…
Hey, I actually have experience with that school! I did some consulting with them about a decade ago. The ransomware attack certainly didn't help, but it is wildly misleading to say, or even imply that caused them to shut down. The actual reasons: (a) They filled a niche that didn't need to be filled anymore. They used to absorb students from other local universities (ISU, UIS, UIUC). Those schools have realized the…
What would be a comparable industry perspective to the way colleges fight over tuition generators (students)? Oil companies fighting over oil fields?
A tragedy That needs to happen The humanizing done about how its was something like an HBCU and weathered other calamities is sad, should also be a wakeup call to other organizations
I don't know why this was down voted, but I agree, that this tragic shutdown makes it clear that Ransomeware affects the real world.
Whoever sold the vulnerable software should be liable for damages.