Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Worsening State of Ransomware

cacm.acm.org

Post reply on HN
Print view View original

111–120 of 139 posts

Re: The Worsening State of Ransomware

#111

Post by bena »

7786655 wrote: post #37
bena wrote: post #20

Earlier quoted context omitted.

It also ignores the perverse game being played. Defense has to work every time. Attackers just have to get through once. That's a game that favors the attackers.

Game 1: Every time offence scores, they get $100 of defense's money. Game 2: Every time offence scores, they get $100 of my money. Defense loses nothing. Neither is fair to defence, but game 2 is unfair to me , and that's what's important.

But what you are advocating for is a game in which if you aren't perfect, you are harshly punished.

I just hope no one ever holds you up to the standards you demand of everyone else.

Re: The Worsening State of Ransomware

#112

Post by pinkybanana »

bradleyjg wrote: post #57
pinkybanana wrote: post #51

Earlier quoted context omitted.

It is quite difficult to have global, functioning blacklist system. I would guess for example some country in Asia might have quite different blacklist compared to let's say to some country in Europe. From criminals perspective they probably have money launderers on darknet markets who are willing to take the dirty crypto, deduct their hefty fee and offer clean crypto instead.

A bitcoin that couldn’t be spent anywhere outside of e.g. China would be far less valuable than one that could be spent anywhere. At very least this would reduce the profitability of ransomware attacks.

How much less valuable exactly would you estimate? These markets for dirty bitcoins probably already exist, I would guess. I think someone would swap dirty btc to clean with price like 10% or maybe 20%. For criminals that would be just the cost of laundering the coins.

Re: The Worsening State of Ransomware

#113

Post by [deleted] »

WalterBright wrote: post #105
jl6 wrote: post #39

Earlier quoted context omitted.

This is one reason I still do manual backups as well as automated backups. The manual backup is to HDDs that sit on a shelf, offline, unplugged.

Yeah, but to read the backup you've got to attach it to your compromised system. Boom, it's corrupted. A physical read-only switch is required.

[deleted]

Re: The Worsening State of Ransomware

#114

Post by bradleyjg »

GauntletWizard wrote: post #79
bradleyjg wrote: post #54

Earlier quoted context omitted.

Depends on what you think the point of cryptocurrency is. I’ve heard a lot of different explanations over the years. I believe the most popular one currently is an inflation resistant store of value, which should be compatible with blacklists. As for timing, either blocking spending or tracing the transaction back to a person is equally valuable as a deterrent.

Here’s how blacklists destroy your “store of value” argument: Transactions don’t require the receiver’s consent. It’s easy to find large wallets (wallet balance is public record), and then once you’ve carried out your ransomeware attack and gotten paid, your black wallet sends to whatever poor schmuck you want to destroy. Because sends blacken anything they touch, you’ve just turned a lot of money into nothing, at th…

The blacken anything it touches wasn’t my argument. Investigate everything it touches, yes, but if it turns out to be no connection you just confiscate the proceeds of a crime and move on.

Re: The Worsening State of Ransomware

#115

Post by bradleyjg »

toss1 wrote: post #109
bradleyjg wrote: post #42

Earlier quoted context omitted.

Crypto, or at least bitcoin, is not anonymous. On the contrary the payment trail is there for the whole world to see. Governments could blacklist those coins such that no exchange or legitimate vendor would ever take them. They choose not for whatever reason but not because the technology offers anonymity.

And there are plenty of ways to circumvent that, including converting it to various privacy coins, using mixer services, using it to buy mining power, etc., etc., etc. Heck, crypto may have even more ways to launder money than cash, and those won't go away with blacklists - which will just make the "privacy" coins, services, etc. more valuable. The only way it could even plausibly work is for every visible and darkne…

Nothing is ever perfect. It doesn’t mean you shouldn’t at least try to track down criminals. Which has essentially been the West’s response to ransomware so far.

Re: The Worsening State of Ransomware

#116

Post by detaro »

7786655 wrote: post #102
detaro wrote: post #97

Earlier quoted context omitted.

"I don't like how these people aren't punished how I want, so let's sanction crime against them" is a ... questionable concept, to phrase it nicely. Lot's of nasty precedents. Are you sure kindergardens are punished reliably enough for lapses of security? Also: Ransomware gangs also target companies that do not have "enormous amounts of user's personal and financial data". Since too many companies didn't pay ransomwa…

No, but the alternative is that they would have stolen the data anyway. So it's either neutral or positive. >let's sanction crime against them If it were legal it wouldn't be a crime. >Are you sure kindergardens are punished reliably enough for lapses of security? Given that I rarely hear about children being kidnapped out of kindergartens, I would assume so. I'm not well educated on this, though, since I don't have…

> No, but the alternative is that they would have stolen the data anyway.

No it's not, but because random data stealing is a lot less lucrative than ransoming.

Re: The Worsening State of Ransomware

#117

Post by nicoburns »

WalterBright wrote: post #103
nicoburns wrote: post #4

> Gangs also have begun encrypting backup systems, including cloud storage services such as Office 365 and Drop-box. Although 56% of the firms surveyed by Sophos regained control of their data through backups, that window appears to be closing. "[Cybergangs] have realized that the ransom demand becomes powerless if you have a full backup set in place and you can revert to it," This is why our backups at work write to…

> with permissions Even more secure would be hardware write only storage. CD-ROMs fit in this category, but they aren't big enough. But all we need are hard disk drives with a physical write-enable switch. Turn it on, write your backup, turn it off. No software can then alter it. A stupidly simple idea, and yet every time I mention it in HN it gets dismissed, denigrated, etc. Apparently people like malware, ransomwar…

Perhaps, but I once had two hard drives die on me within the space of a few days (different brands), and since then I like to have a copy of my data in the cloud somewhere. Non-writeable doesn't help much if you can't read it either!

Re: The Worsening State of Ransomware

#118

Post by pitay »

WalterBright wrote: post #105
jl6 wrote: post #39

Earlier quoted context omitted.

This is one reason I still do manual backups as well as automated backups. The manual backup is to HDDs that sit on a shelf, offline, unplugged.

Yeah, but to read the backup you've got to attach it to your compromised system. Boom, it's corrupted. A physical read-only switch is required.

Booting to a Live USB/DVD/CD and then doing the backup while in the booted Live OS would minimize the chances of corruption of the backup, either reading from it or writing to it.

Not ironclad but pretty good. Issues with it that first come to mind are the live operating system image was already compromised when it was written to say the USB disk, or compromised firmware, and of course user error (nothing to do with ransomware in this case). I am not familiar with this stuff so I may be missing something very important, if so tell me about it.

Re: The Worsening State of Ransomware

#119

Post by benjohnson »

EvanAnderson wrote: post #61
netflixandkill wrote: post #31

Earlier quoted context omitted.

There are USB drives that do vaguely similar things but it's all in software. It's difficult to do that unless the filesystem has append only functionality, metadata blocks are rewritten all the time even if data isn't. For anyone who has serious (I.e. $$$) need of that they already have tapes and optical WORM media though. You can do something conceptually similar with any sort of NAS that provides immutable snapsho…

Are there any NAS devices with out-of-band management actually available, though?

Spin up a FreeBSD box, enable ZFS snapshots and disable SSH? You’d only be able to destroy the snapshots from a monitor and keyboard under normal circumstances.

Re: The Worsening State of Ransomware

#120

Post by benjohnson »

WalterBright wrote: post #105
jl6 wrote: post #39

Earlier quoted context omitted.

This is one reason I still do manual backups as well as automated backups. The manual backup is to HDDs that sit on a shelf, offline, unplugged.

Yeah, but to read the backup you've got to attach it to your compromised system. Boom, it's corrupted. A physical read-only switch is required.

There are USB to SATA controllers that default to read only - typically used for forensics reasons. About $250 if I remember correctly.
Post reply on HN