Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Garmin received decryptor for WastedLocker ransomware

bleepingcomputer.com

Post reply on HN
Print view View original

11–20 of 27 posts

Re: Garmin received decryptor for WastedLocker ransomware

#11

Post by andreskytt »

danielheath wrote: post #10
andreareina wrote: post #9

Earlier quoted context omitted.

Immutable append-only backups would protect against this, right? Nuke the OS to make sure you're running on good software, then pull in data that's as good as it was when it was backed up.

Only to the degree that attackers can't figure out a way around them (given months of planning with access to internal systems & documentation). For instance: I have backups going to an append-only s3 bucket in a separate AWS account, but I don't have monitoring in place to ensure that bucket hasn't been wiped. An email would get generated, but it'd go to the root account holder, who may not notice in time.

Kinda makes me wish for the good old days when you could just store a pile of tape

Re: Garmin received decryptor for WastedLocker ransomware

#12

Post by hibbelig »

andreareina wrote: post #9
hibbelig wrote: post #7

Earlier quoted context omitted.

I recall a story here on HN, some days ago. A company was attacked, then the attackers waited some months to make sure that all backups had been contaminated, then they struck. So victims can only make sure that they have a malware checker that finds the culprit, then do fresh installs, then check each file before it's restored from backup. Sounds like a crazy amount of work.

Immutable append-only backups would protect against this, right? Nuke the OS to make sure you're running on good software, then pull in data that's as good as it was when it was backed up.

The old backups are clean, yes. But newer backups (created after infiltration) will be contaminated. Immutable and append-only doesn't help because the files were already contaminated when backed up.

The attacker could: get the victim infested with malware; ensure that the malware infects all new files; wait one year; then trigger the encrypt function.

If the victim pulls a file that is newer than one year old from backup, the victim will pull the malware from backup.

(Only if the file is of a type that could be infected in the first place, of course. README.txt will not be infected.)

Re: Garmin received decryptor for WastedLocker ransomware

#13

Post by NotSammyHagar »

I'm still hopeful that Garmin is prosecuted for paying the random. The us is actually sanctioning evil Corp. https://slate.com/technology/2020/07/garmin-cyberattack-rans...

I even have a Garmin device affected by this. I still want ransomware stopped.

Re: Garmin received decryptor for WastedLocker ransomware

#14

Post by nix23 »

andreskytt wrote: post #11
danielheath wrote: post #10

Earlier quoted context omitted.

Only to the degree that attackers can't figure out a way around them (given months of planning with access to internal systems & documentation). For instance: I have backups going to an append-only s3 bucket in a separate AWS account, but I don't have monitoring in place to ensure that bucket hasn't been wiped. An email would get generated, but it'd go to the root account holder, who may not notice in time.

Kinda makes me wish for the good old days when you could just store a pile of tape

Good old Days? There is a reason Financial Institutes still uses WORM tapes, and they are great!

Re: Garmin received decryptor for WastedLocker ransomware

#17

Post by mint2 »

I’m curious if the average company even bothers planning/testing their ability to recover from a ransom ware attack wo paying.

Like do they even bother planning for that or are they unaware of the risk or did they decide it’s more cost effective to purely rely on prevention and plan to pay any ransom.

I feel like there should be a regulation, where if they pay the ransom then they get a penalty of 2-5x the ransom charged.

Re: Garmin received decryptor for WastedLocker ransomware

#18

Post by wjnc »

Simulacra wrote: post #16

Since GARMIN is a publicly traded company, couldn’t an investor demand to know if the money was paid, and if they don’t get an answer, they could go to the SEC? Could they sue?

Interesting question. The dynamics surrounding which questions get proper answers in shareholder meetings is always interesting to me. There is no right way and bullshitting certain questions is an art. On grounds of material impact this question is hard to skip an answer to. Perhaps the payoff wasn't that material in the end, but the hack was. So even a small fry shareholder could ask this in the shareholder meeting and expect an answer. Skipping to answer good questions often leads to more in the future, so that's the balance the CEO and investor relations face. One could always reach out to analysts to try and get some critical mass going.

Re: Garmin received decryptor for WastedLocker ransomware

#19

Post by sharken »

NotSammyHagar wrote: post #13

I'm still hopeful that Garmin is prosecuted for paying the random. The us is actually sanctioning evil Corp. https://slate.com/technology/2020/07/garmin-cyberattack-rans... I even have a Garmin device affected by this. I still want ransomware stopped.

Ransomware that is a result of users clicking on update notices they should not click is very hard to protect against. Even Stuxnet was successful in crossing over to a separate network through the use of USB sticks. Source: https://en.m.wikipedia.org/wiki/Stuxnet

I get the sentiment that Garmin should suffer due to paying the ransom, but I bet a lot of american companies would act the same way if it was their company on the line.

At least this incident should serve as a warning to other companies that Ransomware is very real and there has to be a plan for recovery without paying the ransom.

Re: Garmin received decryptor for WastedLocker ransomware

#20

Post by mytailorisrich »

wjnc wrote: post #18
Simulacra wrote: post #16

Since GARMIN is a publicly traded company, couldn’t an investor demand to know if the money was paid, and if they don’t get an answer, they could go to the SEC? Could they sue?

Interesting question. The dynamics surrounding which questions get proper answers in shareholder meetings is always interesting to me. There is no right way and bullshitting certain questions is an art. On grounds of material impact this question is hard to skip an answer to. Perhaps the payoff wasn't that material in the end, but the hack was. So even a small fry shareholder could ask this in the shareholder meeting…

I would think that it will be duly included in the company's financial statements, so that the material impact of this overall is duly reported. But obviously there will be no reference to any ransom.

I would also suspect that they never paid any ransom. They probably only paid consulting fees to security/ransomware experts (wink wink).

Post reply on HN