Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to survive a ransomware attack without paying the ransom

bloomberg.com

Post reply on HN
Print view View original

121–130 of 168 posts

Re: How to survive a ransomware attack without paying the ransom

#121

Post by andreareina »

jlgaddis wrote: post #94
Kenji wrote: post #31

Earlier quoted context omitted.

Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. You really wonder that? I'm sorry, how stupid are you? It's obviously to harvest data and control users. We've been warning and educating people about this for decades. When are you guys starting to wake up a…

You are, of course, absolutely right. No one likes to admit that they screwed up, though -- and we all know that the truth can hurt sometimes. --- Unfortunately, you were (likely) downvoted mostly because your blunt, honest statement comes across as condescending and rude: " Maybe you're right, but you didn't have to be such an asshole about it." What those people are either not realizing or conveniently choosing to…

I think saying that that the parent's statement "comes across" as condescending and rude is taking the principle of charity and presumption of good faith a bit far. It is condescending and rude by any standard of good manners and productive conversation that I care to engage under.

If a child learns the hard way that X -> Y I don't berate them and call them stupid for not listening. It doesn't make them more likely to listen the next time. Same with adults, really.

Re: How to survive a ransomware attack without paying the ransom

#122

Post by bobbylarrybobby »

pmiller2 wrote: post #99
PeterisP wrote: post #51

Earlier quoted context omitted.

No, because you can't consider your backups as a "known good state". A malicious attack is fundamentally different from a disaster or accident. You should expect that any backup of systems (instead of backups of 100% pure data) will contain backdoors, that any weird systems (routers, printers, phone centrals) may be compromised even if they seem fine, and that the credentials of all the employees and any private keys…

Even “100% pure data” isn’t necessarily safe. Word documents, Excel sheets, PowerPoint decks, etc. (and their Google Docs counterparts) are all suspect, because they can contain embedded code. Some “data” formats are really not data formats at all, but code which produces the data you use ( e.g. PDF, Postscript, or any Excel sheet with formulas). It’s even possible to corrupt certain otherwise inert data files in suc…

Is there some other solution to this than to cryptographically sign 100% of the files in your system with a key that is only written down on paper?

Re: How to survive a ransomware attack without paying the ransom

#123

Post by com2kid »

buran77 wrote: post #42
feanaro wrote: post #38

Earlier quoted context omitted.

What makes it so difficult? What are some concrete problems you encountered?

It is not intrinsically difficult, it's made difficult by the fact that the companies themselves specifically want to have their infrastructure in the mix to have access to valuable user data. There's no particularly difficult challenge to sync the phone and watch directly, offline. A good chunk of revenue comes from services which rely on the data being in the cloud.

I worked on a competitor.

It was 100% about user expectations, the data was never mined for anything.

People use multiple phones, replace their phone, delete apps to free up space, and still expect their data to be there.

Running a cloud infrastructure for PII isn't exactly low cost, and bundling a life time subscription with a one time device purchase is horrible economics. It isn't done for no reason.

Re: How to survive a ransomware attack without paying the ransom

#124

Post by balladeer »

matsemann wrote: post #30
piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

Over two days now, and almost radio silence from Garmin. I can sympathize with their issues, but not keeping us informed at all about what's going on is quickly leading people to become angry on various fitness forums I frequent. Not a good way to treat us customers.

10 hours ago they linked a ridiculous and ridiculously short FAQ in this tweet https://twitter.com/GarminFitness/status/1287101514750754816

Re: How to survive a ransomware attack without paying the ransom

#125

Post by balladeer »

Kenji wrote: post #31
piokoch wrote: post #5

Garmin CEO at al must be reading this impatiently, looking for some clever-magic clue, which is not gonna arrive, I am afraid. Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. I can understand that some parts like "social" stuff might depend on some central…

Meanwhile Garmin watches users (like me) are wondering how it is that syncing my watch that I have bought with an application on my smartphone that I have bought requires presence of some distant online service. You really wonder that? I'm sorry, how stupid are you? It's obviously to harvest data and control users. We've been warning and educating people about this for decades. When are you guys starting to wake up a…

Are there there similar but open and private solutions to Garmin/etc for h/w and Strava/RunKeeper/etc for software?

Some solution where I can track my runs, swims, cyclings, treks just like Strava (et al) does does but I can choose to keep the data wherever I wish - local, or sync to an app on computer or to a self hosted server.

Maybe not Garmin but I would love to use such an iOS Strava alternative with similar accuracy and detail.

Re: How to survive a ransomware attack without paying the ransom

#126

Post by ultrarunner »

RandomWorker wrote: post #109
johannes1234321 wrote: post #96

Earlier quoted context omitted.

And even many Garmin devices sync via the phone and app: My Edge bike computer connects via Bluetooth to the Garmin app, which uploads the file to the connect website and then downloads the analysis again. There is no technical hindrance for doing analysis in the app (I wrote my own decoders for the fit file format some time ago for building my own archive) except that this makes it simple to have consistent state an…

Except battery life. Nobody wants an apps that are battery hogs. Sending the data is less computationally expensive and therefore uses less energy. Also, takes out the difficulty figuring out how this processing might impact Various phone models, one word they didn’t care or were lazy both are bad pr.

I can tell you that I would welcome the option to sync locally the last few days, even if I had to plug in my phone to support the massive power costs. Maybe they could offload the processing to the watch (since it already is able to display a summary of these files).

Re: How to survive a ransomware attack without paying the ransom

#127

Post by ultrarunner »

balladeer wrote: post #124
matsemann wrote: post #30

Earlier quoted context omitted.

Over two days now, and almost radio silence from Garmin. I can sympathize with their issues, but not keeping us informed at all about what's going on is quickly leading people to become angry on various fitness forums I frequent. Not a good way to treat us customers.

10 hours ago they linked a ridiculous and ridiculously short FAQ in this tweet https://twitter.com/GarminFitness/status/1287101514750754816

I wonder how many people Garmin has working on this. It seems like there’d be someone in an English speaking country that could come up with a statement and answer some questions. Do they have their marketing team busy negotiating with Evil Corp or something?

Re: How to survive a ransomware attack without paying the ransom

#128

Post by em-bee »

jeffbee wrote: post #79
rectang wrote: post #67

> In other words, it’s less a question of how to stop hackers from breaking in than how to best survive the inevitable damage. There doesn't seem to be conventional wisdom about how to build systems that are easy to restore. How do you optimize for recovery after an attack? How do you ensure that you've eliminated all the backdoors? My guess is a combination of "continuous restoration", version controlled code, and a…

Just having a decent and reasonable way to nuke and pave machines goes a long way. Most organizations don't have a good way to shoot a machine in the face and have it back up and serving in 2 minutes. Most organizations are absolutely married to "stateful services" like SQL databases with local storage, that are hard to kill, hard to restore, and give attackers a place to hang out. If you can take all your hosts down…

which company was it that randomly shot down machines in production to make sure the system would be resilient enough?

Re: How to survive a ransomware attack without paying the ransom

#129

Post by thomasahle »

feanaro wrote: post #38
prennert wrote: post #16

Earlier quoted context omitted.

It is surprisingly difficult to make synchronisation work between two devices that might run different hard- and firmware and even potentially software versions. Cloud based APIs as middleware is soo much easier in comparison. I am completely with you conceptually, but from experience I can tell you that even if there is a commercial incentive to allow for local communication it takes a few days to get it working wit…

What makes it so difficult? What are some concrete problems you encountered?

You need to open a connection, which requires user action. When both devices are already connected to the cloud, the synchronisation can be done "transparently", which is what users today have come to expect.

Another reason is that if you still want to sync with the cloud, you need two synchronisation systems that have to be kept in sync too.

Re: How to survive a ransomware attack without paying the ransom

#130

Post by scott_w »

halfcat wrote: post #64
scott_w wrote: post #41

Earlier quoted context omitted.

> The only thing that “saves” you from paying the ransom is good backups. But if a group is fairly competent, they’ll encrypt your backups too. So it needs to be offline. This is the part I’ve never understood. Surely you should be backing up in an append only fashion initiated from the backup server? My best guess is that this gets managed from AD as well, so they find it and take over?

> Surely you should be backing up in an append only fashion initiated from the backup server The key idea is assuming everything is compromised. Whether you use append or whatever, is not helpful if the functionality to change that configuration exists, because that gets changed, backup server is gone, backup storage is gone, etc. You have to design a system where even a rogue IT admin with full access to everything…

I never considered the rogue sysadmin perspective but it’s a good point!

I do wonder if some of my misunderstanding is because my experience is mostly SaaS companies, so paying external providers is more “natural” vs a company that makes its money selling units.

Post reply on HN