Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The ransomware surge

bbc.com

Post reply on HN
Print view View original

151–160 of 216 posts

Re: The ransomware surge

#151

Post by AnIdiotOnTheNet »

nicbou wrote: post #103
the_duke wrote: post #86

Earlier quoted context omitted.

I sometimes do infrastructure consulting. One of the first questions I ask is if they have at least one fully independent, full/incremental off-site backup that can't be corrupted from the main infrastructure, and if they have ever checked if they actually work and are restorable. I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run…

This applies to average people too. I wonder who among us can say they meet your (reasonable) standard. Like you said, backups are annoying and unglamorous. Yet, the data on my laptop is the only thing I could not replace. It's more important to me than my passport or my birth certificate. Its preservation is certainly worth a bit of thought.

...really? What are you keeping on your laptop that is so important to you? I can't think of anything on my computer that I couldn't lose and pretty much just shrug off.

Re: The ransomware surge

#152

Post by networkimprov »

corinroyal wrote: post #149
networkimprov wrote: post #107

Earlier quoted context omitted.

A second root problem is the insanity of public SMTP on today's Internet: allowing anyone, claiming any identity, to send you any content without limits. I started the "mnm" open source project to enable a new email network, on a new protocol. More: https://mnmnotmail.org/ Follow: https://twitter.com/mnmnotmail

Thank you! I'm a huge fan of the mnm approach. I wish you tremendous success.

You're most welcome! Patreon link on website ;-)

Re: The ransomware surge

#153

Post by anang »

marcinzm wrote: post #139
tomrod wrote: post #99

Earlier quoted context omitted.

Would it be sufficient that the delete accounts script be managed and merged at restoration time?

You still have their data and anyone who bypasses the restoration script can get it so no.

This is not true. The prevailing opinion is that backups do not need to be modified and that it’s enough to delete at restore time (and to of course not process the data again).

Re: The ransomware surge

#154

Post by a1369209993 »

mikewarot wrote: post #87
davethedevguy wrote: post #6

The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetra…

>The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. The cause is definitely technical , it is a huge gaping hole in the design of modern operating systems that you could sail the Ever Given through sideways without incident. Your operating system does not confer to the user the ability to delegate only X resources to the opening of a file, email, etc.…

> We all have outlets, which limit the amount of power they will supply, and some even check to make sure it isn't supplied through us, or into a system that has arcing issues.

Not that you don't have a point, but outlet safety measures only address accidental failures. A malicous device is perfectly capable of storing power in a battery or capacitor to exceed instantaneous power limits, or running at 12 amps (out of 15A fuses) 24/7 to pull much more power than you expect over time, or electrocuting you taser-style even if it doesn't have a high-current ground path. So while the safety features are useful, they're not particularly relevant to security.

The wallet example is pretty good, though, as is your actual point.

Re: The ransomware surge

#155

Post by fabflying »

m3nu wrote: post #122
the_duke wrote: post #86

Earlier quoted context omitted.

I sometimes do infrastructure consulting. One of the first questions I ask is if they have at least one fully independent, full/incremental off-site backup that can't be corrupted from the main infrastructure, and if they have ever checked if they actually work and are restorable. I'm continuously surprised how often the answer turns out to be no after dinner digging, even in larger companies with otherwise well-run…

> Backups are annoying and unglamorous Three years ago, after doing YC Startup School, I built https://www.borgbase.com to offer the simple, but secure backup service I wanted myself. Today it’s a viable business and my customers are all great and value backups as essential part of their own business. Wouldn’t want to be in any other “more glamorous” corner of the industry. Also kudos to anyone - partner or competito…

Was just looking for this, will give it a go

Re: The ransomware surge

#156

Post by a1369209993 »

danuker wrote: post #18
paulpauper wrote: post #9

Exchanges are good at blacklisting BTC ,so this means it will be hard for hackers to cash out. Just converting BTC into XMR is not a trivial process, as it needs to go through an exchange. Trustless cross chain transactions are still in infancy .

> Trustless cross chain transactions are still in infancy . They can technically exist?

> They can technically exist?

Yes, assuming sufficiently (not very) expressive transaction signing on said chains. Assume Alice wishes to exchange 1 ABC for Dan's 1 DEF. Alice publishes a transaction for 1 ABC with a UTXO that must be signed by both Alice and Dan. She then provides a zero-knowledge proof that her private key for that signature hashes to XXX. Dan then publishes a transaction for 1 DEF with a UTXO that requires a signature from Alice[0] and a hash preimage of XXX. Alice then pulishes a transaction moving that 1 DEF to her own whereever, which (since second-preimage attacks are hard) contains the private key Dan needs to claim the 1 ABC UTXO.

So this requires that chain ABC supports 2-of-2 (or k-of-n) signature requirements, and that chain DEF supports signature-and-hash-preimage requirements.

This simple protocol is vulnerable to losing money entirely if one party abandons it partway though, but that can mitigated by exchanging eg 0.1 ABC/DEF at a time, or by a more sophisticated exchange protocol.

Edit: 0: using a different key than the XXX preimage.

Re: The ransomware surge

#157

Post by [deleted] »

cloudking wrote: post #143

There's an argument to be made here for using hosted cloud providers instead of rolling your own servers, keeping your data off premise and relying on their security practices. The problem with managing your own servers and services is that you're constantly playing the security game, and responsible for keeping your systems secure and up to date. People hate on providers like Google, but the reality is they have _th…

[deleted]

Re: The ransomware surge

#158

Post by a1369209993 »

thatguy0900 wrote: post #15
jude- wrote: post #10

Ransomware wouldn't be a problem if the software industry took quality assurance seriously (or was regulated to do so), like every other engineering industry. There's little difference to me between an insecure program that allows hackers to hold your data for ransom, and a defective home appliance that occasionally starts electric fires.

Well every home appliance could easily start a fire if random malicious actors got to fuck with it while it was plugged in. You'll note that other engineering disciplines would also fall apart if hostile actors were constantly throwing explosives at the things they make 24/7.

Home appliances are designed not to connect to or interact with the internet. Software engineers could stand to learn a thing or two from that.

Re: The ransomware surge

#159

Post by closeparen »

m3nu wrote: post #125
rsync wrote: post #110

Earlier quoted context omitted.

"Ransomware gangs often destroy your backup infrastructure. So it's important to create pull-only backups or backups that cannot be deleted / overwritten." Every rsync.net customer has ZFS snapshots available in their account that are immutable . They are read-only. So, even if Mallory trashes your primary site and then gains access to your rsync.net credentials, the daily/weekly/monthly snapshots cannot be destroyed…

Immutable backups are often overlooked. At borgbase.com, we call this “append-only” mode and the large majority of repositories uses it. With S3 (or similar) you would add some policies to disable deletions. So it’s usually doable, but needs to be considered when setting up the backup process.

That’s all well and good for weather data, but if anything in your backup is in any way related to user behaviors or transactions, immutability is a crime.

Re: The ransomware surge

#160

Post by [deleted] »

Thorentis wrote: post #109

Just because lives aren't being directly targeted, how isn't this a form of terrorism? If your and your employee's livelihoods depends on your IT systems, and somebody intentionally destroys them, that is terrifying! Unless there is some serious teeth to any response to this, it will keep hapening. The FBI and the UK CCC can put out as many recommendations as they like about backups and updates, but criminals will ju…

[deleted]
Post reply on HN