US travel firm $4.5M ransom negotiation open chat

Post by dannyw » Tue, Aug 04, 2020, 6:09 AM UTC

MattSayar wrote: post #445

ryan_j_naughton wrote: post #27

Earlier quoted context omitted.

> It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. That argument could be used to justify any theft or even kidnapping. I know many people who grew up in countries where kidnapping was a very real concern. Consequently, they had to adopt "greater security practices" and it had a very real, negative effect on their lives. There are real harms to ra…

In addition, the company isn't the only victim in a ransomware attack, its customers are too. And does anyone really believe the hackers deleted the data off their own servers? They can easily double-dip by selling that information. It's valuable, so why would they delete it?

Post by benlumen » Tue, Aug 04, 2020, 8:41 AM UTC

usrusr wrote: post #417

benlumen wrote: post #394

Earlier quoted context omitted.

> To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. I see your point but this is flat-out organized crime, extortion to be precise. How long will it be before we're all making protection payments to ransomware groups?

A difference to physical "protection" schemes is that the group you'd pay to might actually keep other groups out of what they consider their turf. Ransomware attacks are not geographically bound so I really doubt that similar structures would develop there. With growing numbers of ransomers demands just wouldn't stop until either the company runs out if money or security gets good enough to keep them out.

Post by limomium » Tue, Aug 04, 2020, 1:47 PM UTC

DangitBobby wrote: post #470

limomium wrote: post #440

Earlier quoted context omitted.

What? I mean back up your data. Not your whole... computer, or whatever. Install latest software, import data from back up, back in business. It's trivial to tell intact data from ransomed data - the latter looks like random noise, as it's encrypted. If your backup process "isn't that simple", then you should make it that simple . Otherwise failure looms.

You misunderstand. I'm saying the network has potentially been infiltrated for months, and there's no telling what configuration and files have been altered to facilitate future infiltration. See further discussion here: https://news.ycombinator.com/item?id=23929344 Particularly this conversation: https://news.ycombinator.com/item?id=23951941

Post by meshaneian » Wed, Aug 05, 2020, 12:05 AM UTC

wlesieutre wrote: post #411

netflixandkill wrote: post #404

Earlier quoted context omitted.

Back in 2018 I spent six months trying to get a small software shop to implement automated backups as their answer to ransomware fears.(on top of the usual anti-malware and restrictions on lateral movement where we could put those in) They didn't object to the idea insomuch as they had somehow convinced themselves that they needed some kind of security specific product. We were never able to tease the shape or color…

Marketing opportunity for a backup product named Ransomware Protect?

Post by DangitBobby » Wed, Aug 05, 2020, 5:06 AM UTC

limomium wrote: post #475

DangitBobby wrote: post #470

Earlier quoted context omitted.

You misunderstand. I'm saying the network has potentially been infiltrated for months, and there's no telling what configuration and files have been altered to facilitate future infiltration. See further discussion here: https://news.ycombinator.com/item?id=23929344 Particularly this conversation: https://news.ycombinator.com/item?id=23951941

Disconnect entire network. Factory reset all devices. Reinstall latest everything.