US travel firm $4.5M ransom negotiation open chat • Hacker News Board

Re: US travel firm $4.5M ransom negotiation open chat

#411

Post by wlesieutre » Mon, Aug 03, 2020, 1:46 PM UTC

netflixandkill wrote: post #404

hellotomyrars wrote: post #40

While these stories are becoming all too common I’d like to think that while we’re in a golden age of being a ransomware payouts, it will lead to actually caring about security by many of the high-profile affected companies. While the overall cost may be low for them, if they don’t make meaningful changes to prevent these issues in the future, it’s not hard to imagine it might add up quickly. I don’t support these at…

Back in 2018 I spent six months trying to get a small software shop to implement automated backups as their answer to ransomware fears.(on top of the usual anti-malware and restrictions on lateral movement where we could put those in) They didn't object to the idea insomuch as they had somehow convinced themselves that they needed some kind of security specific product. We were never able to tease the shape or color…

Marketing opportunity for a backup product named Ransomware Protect?

Re: US travel firm $4.5M ransom negotiation open chat

#412

Post by [deleted] » Mon, Aug 03, 2020, 1:54 PM UTC

jjeaff wrote: post #281

rudolph9 wrote: post #173

Earlier quoted context omitted.

This is such a regressive mindset. Why not ban the encryption while we’re at it? Instead of bashing it, how about we come up with solutions to the problems?

Encryption has shown itself to have innumerable good uses. What legitimate utility has crypto currency provided?

[deleted]

Re: US travel firm $4.5M ransom negotiation open chat

#413

Post by cheez » Mon, Aug 03, 2020, 1:59 PM UTC

dlubarov wrote: post #270

cheez wrote: post #144

Earlier quoted context omitted.

What happens when crypto tumblers run away with the money

There are projects like Miximus, which is an Eth tumbler with no operator. Participants deposit funds into a smart contract, then when they want to withdraw later, they use zero-knowledge proofs to show that they know one of the private keys without revealing which one. There's also Zcash, which applies similar logic to all shielded transactions.

Oh that's nice.

Re: US travel firm $4.5M ransom negotiation open chat

#414

Post by AnIdiotOnTheNet » Mon, Aug 03, 2020, 2:05 PM UTC

staticassertion wrote: post #403

wffurr wrote: post #400

Earlier quoted context omitted.

How do top tier tech companies, who are very likely continuous targets for this kind of thing, avoid ransomware attacks? I know there's nothing like that at my employer.

There are two big things you want to do: 1) App whitelisting. This is not the strongest mitigation (attackers with exploits can move in memory), but it stops drive-bys and 99% of malware, plus it massively reduces noise on the network. 2) Reduce lateral movement. If the attacker accesses an employee laptop, encrypts it, but can't move to other devices, that's not a very compelling ransom.

Active defense is another option. It is possible to set up a trap such that when certain canary resources are modified they trigger an action to disconnect and lock out the offending user account as well as alert admins to the issue.

98% of the time this will be triggered by an admin performing a task that just happens to touch that resource, but it is incredibly helpful the other 2% of the time.

Re: US travel firm $4.5M ransom negotiation open chat

#415

Post by kerkeslager » Mon, Aug 03, 2020, 2:07 PM UTC

tsimionescu wrote: post #305

kerkeslager wrote: post #200

Earlier quoted context omitted.

> Just wanted to make this same point - right now, cryptocurrency has negative value for society. Perhaps this is a justification for banning the current implementations. Ehhhh, I think the overall impact of Bitcoin is negative, but the "democratizing large-scale crime" argument is a pretty poor argument for why that is. First, Bitcoin isn't "democratizing" anything good or bad--people need to stop using this word wi…

Even if the ransomware perpetrators aren't selling the data, do you think there is any real chance that a company that just paid millions of dollars in ransom would next go and invest more money into security? More likely, other criminals will come knocking on the same company's systems and get that data for other purposes.

> Even if the ransomware perpetrators aren't selling the data, do you think there is any real chance that a company that just paid millions of dollars in ransom would next go and invest more money into security?

Yes. Or, they can get hacked again and pay another ransom until they learn their lesson.

Re: US travel firm $4.5M ransom negotiation open chat

#416

Post by AnIdiotOnTheNet » Mon, Aug 03, 2020, 2:07 PM UTC

greesil wrote: post #98

hellotomyrars wrote: post #40

While these stories are becoming all too common I’d like to think that while we’re in a golden age of being a ransomware payouts, it will lead to actually caring about security by many of the high-profile affected companies. While the overall cost may be low for them, if they don’t make meaningful changes to prevent these issues in the future, it’s not hard to imagine it might add up quickly. I don’t support these at…

Think of it as a very expensive bug bounty.

Yeah, let's just equate criminal behavior with doing people a service, that's going to reflect well on people in IT.

Re: US travel firm $4.5M ransom negotiation open chat

#417

Post by usrusr » Mon, Aug 03, 2020, 2:11 PM UTC

benlumen wrote: post #394

dannyw wrote: post #17

Earlier quoted context omitted.

To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. The money is funnelled to a criminal group, but what difference does it make? Some people consider the USG to be a criminal group; many people are out on the streets for that. My tax dollars directly go to corrupt crooks and nonexistent companies claimi…

> To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. I see your point but this is flat-out organized crime, extortion to be precise. How long will it be before we're all making protection payments to ransomware groups?

A difference to physical "protection" schemes is that the group you'd pay to might actually keep other groups out of what they consider their turf. Ransomware attacks are not geographically bound so I really doubt that similar structures would develop there. With growing numbers of ransomers demands just wouldn't stop until either the company runs out if money or security gets good enough to keep them out.

Re: US travel firm $4.5M ransom negotiation open chat

#418

Post by awakeasleep » Mon, Aug 03, 2020, 2:13 PM UTC

tiew9Vii wrote: post #386

koonsolo wrote: post #367

Earlier quoted context omitted.

> It’s sad that it’s come to this point but the end result may be better for everyone. Meanwhile in the real world, a company I develop for implemented the most draconian security measures to "prevent ransomware". Development environment is a virtual machine at the other end of the world, with disabled copy-pasting from and to the local system. A complete separation between safe internal network and unsafe developmen…

Had one of these. All development through Citrix. The security policy was draconian to the extent I’m sure it was well intentioned but led you to do things in the least secure way possible as it was the only way to complete a contract. I.e the servers on the other end running Windows 7 (in late 2019) where so old they didn’t have the required cpu instruction set to run some required software. Likewise input lag was e…

The organization has externalized all the responsibility for the next breach to you, the individual contributor who is breaking security protocol to get work done.

When we little employees roll our eyes and say "this doesn't make sense," we're telling ourselves a comforting lie because the situation you describe DOES make sense- from the organizational perspective.

Management did everything their rules allow to make the computing environment safe, but you, the individual, hacked an unsafe circumvention into the workflow by finagling some personal website and using SCP. I bet none of that process is documented- and if it is, whoever made that documentation is now the responsible party and fall guy.

Re: US travel firm $4.5M ransom negotiation open chat

#419

Post by dopamean » Mon, Aug 03, 2020, 2:17 PM UTC

uncleputin wrote: post #376

gruez wrote: post #158

Earlier quoted context omitted.

But why 1 BTC? That's worth more than 10k. Surely they could have sent a fraction? Or maybe they didn't know bitcoins can be split?

10k is not that much considering they are ready to pay out 5M

No but isn't it just as easy to send a fraction of a bitcoin? Why spend a whole one to do something you could do with 1/100th?

Re: US travel firm $4.5M ransom negotiation open chat

#420

Post by jjoonathan » Mon, Aug 03, 2020, 2:17 PM UTC

staticassertion wrote: post #409

mox1 wrote: post #407

Earlier quoted context omitted.

As someone who runs a Banks internal Red Team group, the App Whitelisting is the biggest roadblock for us. Carbon Black (if properly setup and tuned) is a large leap to overcome. Drive-by attacks just stop, you need a dedicated method to bypass Carbon Black. That is usually very org dependent. You don't known Carbon Black is there until something doesn't work. That "not working" propagates an alert up to the security…

App whitelisting is rarely rolled out, but it's just such a definitive win these days. a) You just kill ~85% of malware (rough estimate, probably technically higher, but I'm basing that on stats around interpreter-based/LOLBAS malware). Anything that isn't targeted is probably dead in the water. b) You know exactly what's running on everyone's computers, more or less, so you have a way easier time baselining and buil…

It's easy-mode for security because it offloads the cost of security to employees. Done right, many hands make light work. Done wrong, it's the very picture of "if nobody can use it, hackers can't either."

I'm interested in learning how to do this right, because I've only ever seen it done wrong. How do you streamline the process for getting programs approved? How do you accommodate developers who need to generate and run code?