Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to survive a ransomware attack without paying the ransom

bloomberg.com

Post reply on HN
Print view View original

161–168 of 168 posts

Re: How to survive a ransomware attack without paying the ransom

#161

Post by jbj »

ultrarunner wrote: post #126
RandomWorker wrote: post #109

Earlier quoted context omitted.

Except battery life. Nobody wants an apps that are battery hogs. Sending the data is less computationally expensive and therefore uses less energy. Also, takes out the difficulty figuring out how this processing might impact Various phone models, one word they didn’t care or were lazy both are bad pr.

I can tell you that I would welcome the option to sync locally the last few days, even if I had to plug in my phone to support the massive power costs. Maybe they could offload the processing to the watch (since it already is able to display a summary of these files).

I used to sync my old 910 via ANT+ to my former Samsung Galaxy which has ANT+.

Using a third party transfer app. and then viewing it with another third party app, directly on my phone. no battery complaints, but those ANT transfers were pretty flakey.

I dont think you can browse files on the watch through bluetooth, but an OTG cable would do the trick.

Re: How to survive a ransomware attack without paying the ransom

#162

Post by jankiehodgpodge »

dzonga wrote: post #77

some of these companies, need to start suing microsoft. since it's usually windows affected by these malware attacks. if microsoft wants to keep serving the majority of the corp world, they need to have an os, based on user space system. i.e each program runs in it's own sandbox. and any data passed is via message passing.

I've seen hundreds of enterprise networks and you'd be surprised how many of them have passwords in public shares, no configured firewalls or software policies and only file level backups. We obviously can't know right now what Garmin's setup was but I'd wager they were guilty of something.

Re: How to survive a ransomware attack without paying the ransom

#163

Post by coolgeek »

jeffbee wrote: post #79
rectang wrote: post #67

> In other words, it’s less a question of how to stop hackers from breaking in than how to best survive the inevitable damage. There doesn't seem to be conventional wisdom about how to build systems that are easy to restore. How do you optimize for recovery after an attack? How do you ensure that you've eliminated all the backdoors? My guess is a combination of "continuous restoration", version controlled code, and a…

Just having a decent and reasonable way to nuke and pave machines goes a long way. Most organizations don't have a good way to shoot a machine in the face and have it back up and serving in 2 minutes. Most organizations are absolutely married to "stateful services" like SQL databases with local storage, that are hard to kill, hard to restore, and give attackers a place to hang out. If you can take all your hosts down…

This comment works equally well as nerd metal lyrics.

Re: How to survive a ransomware attack without paying the ransom

#164

Post by yencabulator »

balladeer wrote: post #124
matsemann wrote: post #30

Earlier quoted context omitted.

Over two days now, and almost radio silence from Garmin. I can sympathize with their issues, but not keeping us informed at all about what's going on is quickly leading people to become angry on various fitness forums I frequent. Not a good way to treat us customers.

10 hours ago they linked a ridiculous and ridiculously short FAQ in this tweet https://twitter.com/GarminFitness/status/1287101514750754816

And the link now leads to a 404 not found page.

Re: How to survive a ransomware attack without paying the ransom

#165

Post by pmiller2 »

PeterisP wrote: post #152
pmiller2 wrote: post #99

Earlier quoted context omitted.

Even “100% pure data” isn’t necessarily safe. Word documents, Excel sheets, PowerPoint decks, etc. (and their Google Docs counterparts) are all suspect, because they can contain embedded code. Some “data” formats are really not data formats at all, but code which produces the data you use ( e.g. PDF, Postscript, or any Excel sheet with formulas). It’s even possible to corrupt certain otherwise inert data files in suc…

Well, yes, I would not consider arbitrary documents as "pure data" - for that I was thinking as something like a dump of a particular database table contents only, separate from all the database structure/metadata/triggers/functions/etc. You could restore a dump of pure structured data to a known clean system and that would be safe - but once you include arbitrary files as you describe, no way. Embedding malware in s…

I would expect a SQL dump of a database to be safe, as long as the schema only contains standard data types and no BLOBs. Once you start throwing BLOBs in there, anything goes.

Re: How to survive a ransomware attack without paying the ransom

#166

Post by tluyben2 »

PeterisP wrote: post #150
tluyben2 wrote: post #145

I know this is always contentious but are there any of these ransomware attacks on non Windows machine? I mean prominent ones? I understand everyone is running Windows on the desktop, but why are Linux servers not targetted by the same thing as they are prominent? I know they get hacked all the time, but I never read stories like this about them. I read that mongo was hacked (and yeah, using mongo, sorry but...) whic…

Ransomware attacks absolutely do target Linux servers because one needs to take down all the servers to have a proper business disruption for which someone will pay a million dollar ransom; in all the recent prominent attacks Linux servers were taken down as well. Perhaps there's some issue with what you mean by "pure ransomware" - if you mean automatically spreading worms, then those aren't that relevant, prominent…

> obtaining user credentials and a foothold inside the network that helps with firewall restrictions.

Yes but those are somewhat human errors; my point is more along the lines that linux might be the primary target for the entire attack, but it always starts with attacks on Windows. I was looking for a case, specifically with ransomware, that started with Linux/Mac OS X instead of Windows.

In my opinion (and to be honest, PCI DSS actually enforces this some extend) it should not be possible to gather linux credentials from singular hacked machines. If you hack my system, you will not be able to login to our prod linux machines; you will need my hardware device to generate OTPs. This is what we actually do for a living, but it is rather weird that people don't just have google-authenticator as standard for lack of a hardware token; then your private key would still not get the hackers anywhere. Use hardware tokens + non-windows then basically none of these attacks would work.

Re: How to survive a ransomware attack without paying the ransom

#167

Post by tluyben2 »

dangelov wrote: post #148
tluyben2 wrote: post #145

I know this is always contentious but are there any of these ransomware attacks on non Windows machine? I mean prominent ones? I understand everyone is running Windows on the desktop, but why are Linux servers not targetted by the same thing as they are prominent? I know they get hacked all the time, but I never read stories like this about them. I read that mongo was hacked (and yeah, using mongo, sorry but...) whic…

Here's an article about a recent Mac ransomware, it was on HN a while back. https://www.wired.com/story/new-mac-ransomware-thiefquest-ev... But still, a lot less of these stories than for Windows.

Yes, but my question was specifically about a high profile one; so huge company or huge money stolen. This is just 'yes it exists' but nothing was done with it.

Re: How to survive a ransomware attack without paying the ransom

#168

Post by square_dog »

jonpurdy wrote: post #117
jeffbee wrote: post #79

Earlier quoted context omitted.

Just having a decent and reasonable way to nuke and pave machines goes a long way. Most organizations don't have a good way to shoot a machine in the face and have it back up and serving in 2 minutes. Most organizations are absolutely married to "stateful services" like SQL databases with local storage, that are hard to kill, hard to restore, and give attackers a place to hang out. If you can take all your hosts down…

I was thinking about this recently. Tight, centralized control over servers, employees computers, and devices is hard to set up, hard to manage, and a huge surface where misconfigurations can allow attackers to jump right in. Decentralization is the key. Microservices, or segregated services, stateless (as much as possible), and perhaps even partitioning groups of users into totally separated instances. One group get…

Historically, centralization in the computer world grew from the glass house in which the one computer a company or institution could afford to buy or lease was installed -- and programmed by the tech gurus colocated there. The centralization and batch processing constraints of that era are now obsolete, having been replaced by inexpensive distributable computing, data storage and network building blocks. I suspect that many organizations haven't fully embraced the far more reliable, dependable and scalable approach to delivering services is related more to managerial issues ("tried and proven") than technical creativity and ability. The "C-Team" needs to be sold on the benefits that are obvious to the tech gurus of today, in language corporate leadership can understand and motivate their commitment.
Post reply on HN