Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Another Ransomware Outbreak Is Going Global

forbes.com

Post reply on HN
Print view View original

281–290 of 435 posts

Re: Another Ransomware Outbreak Is Going Global

#281

Post by duskwuff »

eeeeeeeeeeeee wrote: post #155
80211 wrote: post #149

Earlier quoted context omitted.

People who don't run Windows shouldn't get cocky! There are many, many attacks on Linux: Here's one in the news from just last week. A ransomware where the victim agreed to pay the equivalent of US$1MM in bitcoin. https://arstechnica.com/security/2017/06/web-host-agrees-to-...

Something to keep in mind. They were running: Apache version 1.3.36 and PHP version 5.1.4 It's not like a brand new Ubuntu installation connected to the open Internet will suddenly be pwned. The owners of this company were beyond inept.

And that was probably the tip of the iceberg with regard to their outdated software -- Apache 1.3.36 and PHP 5.1.4 are both from around 2006, so I'd bet everything else in their stack was similarly old. Failing to update anything for 10+ years will get you in trouble, regardless of what OS it's on.

Re: Another Ransomware Outbreak Is Going Global

#282

Post by detaro »

floatboth wrote: post #277
tensor wrote: post #24

Earlier quoted context omitted.

They are if you send them offsite. Backups with version history are great if you can swing them.

Startup idea: zfssend.net, a place to send snapshots to As A Service :D

I think you are looking for https://rsync.net

Re: Another Ransomware Outbreak Is Going Global

#283

Post by floatboth »

detaro wrote: post #282
floatboth wrote: post #277

Earlier quoted context omitted.

Startup idea: zfssend.net, a place to send snapshots to As A Service :D

I think you are looking for https://rsync.net

The name I suggested was a clear reference to them. But they provide storage "accessible with any SSH/SFTP tool", not a place to `zfs send` to.

Re: Another Ransomware Outbreak Is Going Global

#284

Post by detaro »

floatboth wrote: post #283
detaro wrote: post #282

Earlier quoted context omitted.

I think you are looking for https://rsync.net

The name I suggested was a clear reference to them. But they provide storage "accessible with any SSH/SFTP tool", not a place to `zfs send` to.

http://www.rsync.net/products/zfsintro.html

Re: Another Ransomware Outbreak Is Going Global

#285

Post by kbenson »

dflock wrote: post #266
lordnacho wrote: post #247

Earlier quoted context omitted.

There's so many creative things you can do when you imagine yourself as one of these attackers. - Make a big target amount of money that any large company can pay, eg $10M, and tell people you'll release everyone's key if the amount is raised. - Use an online board like this one to control the state of your network. - Embarrass individual firms by posting pics of their offices from their own webcams. Etc, etc. I reck…

> Make a big target amount of money that any large company can pay, eg $10M That sounds like a good way to get state level actors on your case.

Yes, as long as the payments are individually relatively small and anonymous, it's easy for people to misunderstand the amount they may actually be getting. Once you paint a target in the millions, people will notice more, it will become a bigger news story, some congressman or another will make it a pet cause, and then you've got a lot or attention on you. Like any criminal enterprise, the less attention from authorities the better.

Re: Another Ransomware Outbreak Is Going Global

#287

Post by paulmd »

sillysaurus3 wrote: post #242
devcpp wrote: post #234

Earlier quoted context omitted.

Are you sure about that? You do know most organizations will implement that as a huge amount of bureaucracy for every commit, rather than proper man-hours of security-oriented development.

Only because most organizations don't know how to be effective at security. It's not hard. You don't actually have to change much. You just have to schedule regular pentests, ideally every couple weeks. Pentests protect everyone because it's our job to worry about all of the security flaws that you can't possibly be aware of in your normal day-to-day development cycle. There's just too much for any organization to kn…

Pentests aren't a magic bullet either. You can easily find a consultant who isn't going to rip you a new one.

Security is a mindset. Any "checklist" approach will eventually devolve into ass-covering by an organization that is not internally motivated to run a tight ship. Legitimate variances will be hassled to no end, while actual security vulnerabilities will be ignored.

Re: Another Ransomware Outbreak Is Going Global

#288

Post by smartbit »

Animats wrote: post #183

Maersk is down. Their main site says: Maersk IT systems are down We can confirm that Maersk IT systems are down across multiple sites and business units due to a cyber attack. We continue to assess the situation. The safety of our employees, our operations and customer's business is our top priority. We will update when we have more information.[1] Maersk is the largest shipping company in the world. 600 ships, with…

This afternoon I was sitting next to a Maersk employee when people walked in with bricked laptops. This person didn't believe it immediately (with all the fake news these days), he tried to get it verified through some former colleges. One minute later this laptop wasn't working anymore. He was lucky as his laptop was synced with a corporate subscription of one-drive and can continue from home on his personal iMac.

Externals and people with a MacBook could continue working.

Some departments request personal to stay home tomorrow.

Mail seems to also be down, although I don't understand as it is hosted on outlook.com

Re: Another Ransomware Outbreak Is Going Global

#289

Post by sillysaurus3 »

paulmd wrote: post #287
sillysaurus3 wrote: post #242

Earlier quoted context omitted.

Only because most organizations don't know how to be effective at security. It's not hard. You don't actually have to change much. You just have to schedule regular pentests, ideally every couple weeks. Pentests protect everyone because it's our job to worry about all of the security flaws that you can't possibly be aware of in your normal day-to-day development cycle. There's just too much for any organization to kn…

Pentests aren't a magic bullet either. You can easily find a consultant who isn't going to rip you a new one. Security is a mindset. Any "checklist" approach will eventually devolve into ass-covering by an organization that is not internally motivated to run a tight ship. Legitimate variances will be hassled to no end, while actual security vulnerabilities will be ignored.

In the real world, one of the only reasons people get pentests is because another company is forcing them to. That results in a document saying company B is secure.

This is a very effective approach at cutting through ass-covering. Company B has to fix the security problems uncovered in the pentest. There is no other option. And I've seen it take products from "SQL injection by typing an apostrophe" to "It'd be very difficult to exploit this app."

If that's not proof that pentsts are effective, then I'm not sure what would be.

We like to say that security is a mindset, but developers have way too much on their mind to be aware of every possible security vector. It's easier and more effective to punt and let us worry about it instead.

Re: Another Ransomware Outbreak Is Going Global

#290

Post by guilhermetk »

carvalho wrote: post #70
bkor wrote: post #12

The Netherlands and various other countries have created laws where either their version of the NSA and/or police can hoard 0days to be used for hacking. This massive outbreak is so widespread that at this stage it appears that it either was a very recent 0day or something which only recently was fixed by a patch. Instead of having loads of countries hoarding security problems I highly encourage a focus on security i…

It is basically WannaCry without the kill switch. It is using the same exploits (EternalBlue). Not some recent zero-day, but sloppy patching.

Seems like there is a kill switch: https://twitter.com/PTsecurity_UK/status/879779707075665922
Post reply on HN