Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oakland declares state of emergency due to ransomware attack

nbcbayarea.com

Post reply on HN
Print view View original

31–40 of 86 posts

Re: Oakland declares state of emergency due to ransomware attack

#31

Post by prox »

PeterisP wrote: post #29
Keyframe wrote: post #19

Are there no agencies that can help out? CISA is, I guess, more of an advisory agency than operative? Or maybe there are but on federal level?

At this point it's too late, and before that they didn't really need advice or some fancy technology, they needed to dedicate enough resources/people/effort to simply do proper maintenance of their IT infrastructure. It's also plausible they simply couldn't afford the required resources, but that's not something fixable by CISA or other federal agencies.

It’s really easy to cut back on your IT infrastructure until stuff like this happens, and suddenly everyone is up in arms about why something isn’t working.

But it makes great budget headlines, “I slashed the IT budget in half!”

Re: Oakland declares state of emergency due to ransomware attack

#32

Post by alephnerd »

2Gkashmiri wrote: post #30

how many of these systems will be safe if they had linux running? just saying because the linux is a smaller target and it would be a long time till it reaches the "year of linux desktop"

The same amount as would be if they were using MacOS or Windows 11. This isn't an OS issue, this is a "I didn't manage and configure my ACLs and RBAC correctly to minimize lateral movement in my environment" problem. Linux isn't anymore secure than Windows in that regard, as can be seen with ransomware such as Elbie. I can also say with extremely high confidence that in a number of orgs that are ransomware victim are running Linux seployments for their servers (usually Centos 6.x-7.x or RHEL6-7)

Re: Oakland declares state of emergency due to ransomware attack

#33

Post by throwaway14356 »

imho we have to look at what limited set of tools and functionality we really use. The days where we didn't know what computers were used for are long gone and the justification for doing everything in software along with it. You want to exchange strings of text with video and images. Not much more than morse code offered. Direction of dataflow can be easily enforced in hardware. The backup drive takes input that you can't read, you break off part of the print and it becomes read only permanently. It can easily be made an insane amount of work to regain write ability.

A completely finished os can be stored on a read only device.

We just have to start from scratch :) that is all it takes :)

Re: Oakland declares state of emergency due to ransomware attack

#34

Post by alephnerd »

So I work in this space and I am honestly quite surprised by the users here who think a Linux deployment would do any better. They won't.

This isn't a Windows vs Linux vs Solaris vs BSD issue, this is a "did I manage and configure ACLs, RBAC, GPO, and other security features correctly" issue.

For example, I've had customers have had RHEL 6.x enviromments that still got hit because they wrote a security group that allows all traffic from all ports from 0.0.0.0/0 (aka everywhere).

Security issues always come down to misconfigurations and the lack of best practices in my experience. In that regard, the MS suite is actually superior to Linux because if you need a Security Solution Partner, Microsoft Professional Services is infinitely more competent than the largest Linux solution partner righ now (IBM).

Re: Oakland declares state of emergency due to ransomware attack

#35

Post by alephnerd »

Keyframe wrote: post #19

Are there no agencies that can help out? CISA is, I guess, more of an advisory agency than operative? Or maybe there are but on federal level?

When an extremely high profile attack like this happens, CISA ends up taking over the organization and revamping the entire organization's IT team. This happened to Atlanta back in 2018-19. It doesn't mitigate the current incident, but helps prevent the next one.

Re: Oakland declares state of emergency due to ransomware attack

#36

Post by taeric »

alephnerd wrote: post #34

So I work in this space and I am honestly quite surprised by the users here who think a Linux deployment would do any better. They won't. This isn't a Windows vs Linux vs Solaris vs BSD issue, this is a "did I manage and configure ACLs, RBAC, GPO, and other security features correctly" issue. For example, I've had customers have had RHEL 6.x enviromments that still got hit because they wrote a security group that all…

I'm with you right up to the "infinitely more competent" line.

The big thing that Microsoft and Windows have against them, is the crapshow that is all that they include on a standard installation. That said, from what I'm seeing, this is not really unique to Windows anymore. Seems everyone wants everything on the machine.

So, yes, it is theoretically possible to setup all access rules correctly. But it is essentially a lines of code problem, at this point. Given a mountain of things to setup, you will make a mistake somewhere.

Re: Oakland declares state of emergency due to ransomware attack

#37

Post by nradov »

taeric wrote: post #36
alephnerd wrote: post #34

So I work in this space and I am honestly quite surprised by the users here who think a Linux deployment would do any better. They won't. This isn't a Windows vs Linux vs Solaris vs BSD issue, this is a "did I manage and configure ACLs, RBAC, GPO, and other security features correctly" issue. For example, I've had customers have had RHEL 6.x enviromments that still got hit because they wrote a security group that all…

I'm with you right up to the "infinitely more competent" line. The big thing that Microsoft and Windows have against them, is the crapshow that is all that they include on a standard installation. That said, from what I'm seeing, this is not really unique to Windows anymore. Seems everyone wants everything on the machine. So, yes, it is theoretically possible to setup all access rules correctly. But it is essentially…

What specifically does a modern Windows installation include that is inappropriate or insecure in terms of default services or access rules?

Re: Oakland declares state of emergency due to ransomware attack

#38

Post by alephnerd »

taeric wrote: post #36
alephnerd wrote: post #34

So I work in this space and I am honestly quite surprised by the users here who think a Linux deployment would do any better. They won't. This isn't a Windows vs Linux vs Solaris vs BSD issue, this is a "did I manage and configure ACLs, RBAC, GPO, and other security features correctly" issue. For example, I've had customers have had RHEL 6.x enviromments that still got hit because they wrote a security group that all…

I'm with you right up to the "infinitely more competent" line. The big thing that Microsoft and Windows have against them, is the crapshow that is all that they include on a standard installation. That said, from what I'm seeing, this is not really unique to Windows anymore. Seems everyone wants everything on the machine. So, yes, it is theoretically possible to setup all access rules correctly. But it is essentially…

It's generally professional services that set up these deployments at scale. MS's PS team is extremely competent and does push best practices in my experience. The issue is organizations that cheap out and decide to have an IT Service Desk guy manage everything from deployment to network architecture to security - these are extremely hard problems that require a large team of SME, not a single guy doing the best he can. City of Oakland is one of those kinds of organizations IME.

Re: Oakland declares state of emergency due to ransomware attack

#39

Post by taeric »

nradov wrote: post #37
taeric wrote: post #36

Earlier quoted context omitted.

I'm with you right up to the "infinitely more competent" line. The big thing that Microsoft and Windows have against them, is the crapshow that is all that they include on a standard installation. That said, from what I'm seeing, this is not really unique to Windows anymore. Seems everyone wants everything on the machine. So, yes, it is theoretically possible to setup all access rules correctly. But it is essentially…

What specifically does a modern Windows installation include that is inappropriate or insecure in terms of default services or access rules?

Certainly a fair question, but a big part of the problem is I don't know the specifics of what is on a new installation anymore. Worse, I'm not sure where to find such a list.

Just scanning on the things they are proud to list at https://learn.microsoft.com/en-us/windows/whats-new/windows-..., I'd be worried about Teams, Windows 365, and Widgets. I'd also be worried about all trial software that is on the machine. I could not find a list of that, though.

And again, this is not unique to Windows. It used to be OEM bloat that was added to all things. In linux land, it would have been all of the "power tools" included by default.

Re: Oakland declares state of emergency due to ransomware attack

#40

Post by taeric »

alephnerd wrote: post #38
taeric wrote: post #36

Earlier quoted context omitted.

I'm with you right up to the "infinitely more competent" line. The big thing that Microsoft and Windows have against them, is the crapshow that is all that they include on a standard installation. That said, from what I'm seeing, this is not really unique to Windows anymore. Seems everyone wants everything on the machine. So, yes, it is theoretically possible to setup all access rules correctly. But it is essentially…

It's generally professional services that set up these deployments at scale. MS's PS team is extremely competent and does push best practices in my experience. The issue is organizations that cheap out and decide to have an IT Service Desk guy manage everything from deployment to network architecture to security - these are extremely hard problems that require a large team of SME, not a single guy doing the best he c…

I expect that pricing has made it so most all smaller places are these kinds of organizations.

And the incentives are to keep it that way. As long as MS's PS team can make more money from one whale of a customer than they can supporting local districts, expect that this will remain.

Such that I don't think it is excusable to say "if only they had paid the professional services."

Post reply on HN