Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Another Ransomware Outbreak Is Going Global

forbes.com

Post reply on HN
Print view View original

331–340 of 435 posts

Re: Another Ransomware Outbreak Is Going Global

#331

Post by singularity2001 »

tyingq wrote: post #135
maddyboo wrote: post #127

Does anyone know if any tools exist on Linux which can be used for early detection of ransomeware? Something that monitors file access, disk activity, etc. for suspicious behavior and can trigger some action or alert? I think I remember some discussion about using a 'canary file' - some innocent looking file with known contents which should never be modified. If a modification is detected, you know something fishy is…

Aide is a popular utility to monitor for changes to files on Linux systems. http://aide.sourceforge.net You could also use the built in audit subsystem if you wanted to watch a specific canary file, directory, filesysyem, etc. https://www.linux.com/learn/customized-file-monitoring-audit...

what a horrible interface

  aide 
  Couldn't open file /var/lib/aide/please-dont-call-aide-without-parameters/aide.db for reading

  aide -i
  Couldn't open file /var/lib/aide/please-dont-call-aide-without-parameters/aide.db.new for writing

Re: Another Ransomware Outbreak Is Going Global

#332

Post by ktta »

lilott8 wrote: post #319
olewhalehunter wrote: post #211

Earlier quoted context omitted.

OSHA violation in 2025: operator was not using a deterministic operating system

what you are suggesting has grave realities for those who cannot or do not want to mess with formal verification techniques. This is the future of computing and a lot of people will be left behind once this catches on.

>lot of people will be left behind once this catches on

if this catches on.

Re: Another Ransomware Outbreak Is Going Global

#333

Post by tetha »

smartbit wrote: post #288
Animats wrote: post #183

Maersk is down. Their main site says: Maersk IT systems are down We can confirm that Maersk IT systems are down across multiple sites and business units due to a cyber attack. We continue to assess the situation. The safety of our employees, our operations and customer's business is our top priority. We will update when we have more information.[1] Maersk is the largest shipping company in the world. 600 ships, with…

This afternoon I was sitting next to a Maersk employee when people walked in with bricked laptops. This person didn't believe it immediately (with all the fake news these days), he tried to get it verified through some former colleges. One minute later this laptop wasn't working anymore. He was lucky as his laptop was synced with a corporate subscription of one-drive and can continue from home on his personal iMac. E…

I gotta say, I really like that I managed to get my own, snowflake, self-managed linux notebook at my place of work.

I mean all of IT can access the box once I give them the password for the vault I gave them. That's just the right thing to do. But no one touches or updates my fortress of last hope but me, from a local shell.

Re: Another Ransomware Outbreak Is Going Global

#334

Post by [deleted] »

Animats wrote: post #269
Animats wrote: post #183

Maersk is down. Their main site says: Maersk IT systems are down We can confirm that Maersk IT systems are down across multiple sites and business units due to a cyber attack. We continue to assess the situation. The safety of our employees, our operations and customer's business is our top priority. We will update when we have more information.[1] Maersk is the largest shipping company in the world. 600 ships, with…

The web sites that are supposed to give APM port status are frozen. It appears that many (all?) APM terminals worldwide are not accepting incoming trucks. Unclear whether ships are being unloaded. There's surprisingly little info about this from the actual ports. Even Twitter output has become so PR-controlled that nobody involved is getting important information out. APM, Maersk, and the Port of Los Angeles all have…

[deleted]

Re: Another Ransomware Outbreak Is Going Global

#335

Post by Consultant32452 »

sillysaurus3 wrote: post #289
paulmd wrote: post #287

Earlier quoted context omitted.

Pentests aren't a magic bullet either. You can easily find a consultant who isn't going to rip you a new one. Security is a mindset. Any "checklist" approach will eventually devolve into ass-covering by an organization that is not internally motivated to run a tight ship. Legitimate variances will be hassled to no end, while actual security vulnerabilities will be ignored.

In the real world, one of the only reasons people get pentests is because another company is forcing them to. That results in a document saying company B is secure. This is a very effective approach at cutting through ass-covering. Company B has to fix the security problems uncovered in the pentest. There is no other option. And I've seen it take products from "SQL injection by typing an apostrophe" to "It'd be very…

There's different levels of penetration testing too. I worked at a SaaS startup and when we got our first big customer they demanded we get a third party to run a pen test on us. They basically ran their script and gave us a report. There might have been some minimal going back and forth about some false positives, but that was about it. That's better than nothing, but may not be what some of the more technically/security minded folks here at would consider a real pen test.

Re: Another Ransomware Outbreak Is Going Global

#337

Post by SnowingXIV »

veb wrote: post #296
elcapitan wrote: post #272

Kill switch has been found: https://twitter.com/PTsecurity_UK/status/879779707075665922

The killswitch: https://twitter.com/0xAmit/status/879789734469488642

This confirmed to work? Anyone else speak on this? If so props to the guy who discovered this.

Re: Another Ransomware Outbreak Is Going Global

#338

Post by spydum »

ryankupyn wrote: post #310
merrickread wrote: post #216

Earlier quoted context omitted.

I dream of seeing a "security first" development process adopted ..

What I really want to see is security being integrated into the development process as a conscious tradeoff teams have to make. When a new feature is proposed, it's rare to hear someone object on the grounds that it could potentially add new vulnerabilities, but in the long run an approach that recognizes and considers those risks would be beneficial. At the same time, this is incredibly hard to do - managers celebra…

Definitely a problem. People (incorrectly) compare vulnerability scanning with pen testing. Vuln scanning often is a component of a pen test, but we do a bad job explaining the distinction. Pen test should attempt to use the app(s), maybe test the people and process, not just profile the software versions and complain they are out of date or misconfigured.

Re: Another Ransomware Outbreak Is Going Global

#339

Post by tyingq »

singularity2001 wrote: post #331
tyingq wrote: post #135

Earlier quoted context omitted.

Aide is a popular utility to monitor for changes to files on Linux systems. http://aide.sourceforge.net You could also use the built in audit subsystem if you wanted to watch a specific canary file, directory, filesysyem, etc. https://www.linux.com/learn/customized-file-monitoring-audit...

what a horrible interface aide Couldn't open file /var/lib/aide/please-dont-call-aide-without-parameters/aide.db for reading aide -i Couldn't open file /var/lib/aide/please-dont-call-aide-without-parameters/aide.db.new for writing

I suppose, but it's not really made as a one off run-a-command type tool. It needs set up so that you can compare now to then.

Having no parameters specified doing something real is probably not desired, as it would overwrite the DB that your aide Cron job is running.

That's why your Linux distro (not aide) picked those funny defaults.

Re: Another Ransomware Outbreak Is Going Global

#340

Post by kuon »

Those attacks are still "gentle" as if you have (and you should) a read only backup you can resolve it with near 0 dataloss.

What I fear are cancer like virus, not wiping or encrypting data at time T, but introducing subtle errors on a longer period. You would be contacted by hackers saying your last 6 months of data contain error. That's scary.

Post reply on HN