Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to survive a ransomware attack without paying the ransom

bloomberg.com

Post reply on HN
Print view View original

61–70 of 168 posts

Re: How to survive a ransomware attack without paying the ransom

#61

Post by bloomingeek »

FlyMoreRockets wrote: post #8
lobster45 wrote: post #2

This is not really surviving. What do you need to do is prepare and to have off line backups

Offline backups have been a thing for decades. Why is this not standard practice? Especially for a technology company like Garmin. It can't be about cost savings, businesses still pay for insurance and security systems. For that matter, offsite backups should also be saved in case of fires, floods, tornadoes, theft, etc...

Exactly, Although not always practical, if kept virus free (which of course is possible), offline back ups are the best solution because it's never broken into. ANYTHING online is risky, we all know this, so why do corporations still practically ignore the obvious?

Re: How to survive a ransomware attack without paying the ransom

#62

Post by prennert »

buran77 wrote: post #42
feanaro wrote: post #38

Earlier quoted context omitted.

What makes it so difficult? What are some concrete problems you encountered?

It is not intrinsically difficult, it's made difficult by the fact that the companies themselves specifically want to have their infrastructure in the mix to have access to valuable user data. There's no particularly difficult challenge to sync the phone and watch directly, offline. A good chunk of revenue comes from services which rely on the data being in the cloud.

I agree that gathering user data might be a significant factor why even products of large companies do not support cloudless communication and sync.

I just wanted to point out that since cloud based communication is so easy nowadays, doing sync without cloud support is a significantly larger effort. Not unachievable though.

Re: How to survive a ransomware attack without paying the ransom

#63

Post by dehrmann »

latchkey wrote: post #9
wlll wrote: post #7

Earlier quoted context omitted.

What's the backstory for this?

Part of the backstory is that in 2010, they fired all the Garmin Connect staff [0]. More recently, they've been shut down [1]. [0] https://news.ycombinator.com/item?id=1196996 [1] https://news.ycombinator.com/item?id=23926289

I forgot about 0. I had to double check, but a high school friend was on that team.

Re: How to survive a ransomware attack without paying the ransom

#64

Post by halfcat »

scott_w wrote: post #41
SV_BubbleTime wrote: post #19

Earlier quoted context omitted.

Pretty much this. Firewalls do absolutely nothing once someone got your weakest link to click something and go to town. From my last penn test it goes, phish, get a click and execute or credentials, use a hack like getting legacy NetBIOS exploit to give up hashes for all your users, crack the hashes and hope someone used a short 12 char password or something dictionary-easy like “Wr3st1ing1!”, then leverage that acce…

> The only thing that “saves” you from paying the ransom is good backups. But if a group is fairly competent, they’ll encrypt your backups too. So it needs to be offline. This is the part I’ve never understood. Surely you should be backing up in an append only fashion initiated from the backup server? My best guess is that this gets managed from AD as well, so they find it and take over?

> Surely you should be backing up in an append only fashion initiated from the backup server

The key idea is assuming everything is compromised. Whether you use append or whatever, is not helpful if the functionality to change that configuration exists, because that gets changed, backup server is gone, backup storage is gone, etc.

You have to design a system where even a rogue IT admin with full access to everything can’t screw you. Usually that involves third parties where there is no mechanism for a rogue IT person or other attacker to delete your offline backups. So some people have Iron Mountain pick up disks in a lock box daily, or use an online backup service that specifically has features for this, where they keep extra copies of your backups completely offline and provide no mechanism for the customer to delete them.

Re: How to survive a ransomware attack without paying the ransom

#65

Post by lostmsu »

6c696e7578 wrote: post #59
larrymcp wrote: post #6

How is ransomware able to spread to all the PCs in a company? (Especially PCs at different locations around the globe) The malware needs to execute itself on each computer. But I would think this would be thwarted by hardware firewalls as well as apps like Windows Firewall. If my PC at work gets infected, somehow it can magically infect the guy down the hall's PC too? I thought that was made impossible years ago.

The common components in the ransomware attacks is Windows and AD. Some leverage known exploits against elements like LSASS, so if the person infected has credentials for another computer, why not slurp up all the credential tokens on remote computers that you can log into too. If you use Linux/Unix on the other hand, you can do descent things to contain access. Firstly, elevated management accounts can restrict logi…

None of what you mentioned requires a lot of effort on Windows. Exploits in LSASS are no different from exploits in Linux kernel, and if you stay up to date and configure everything correctly you should be fine.

Re: How to survive a ransomware attack without paying the ransom

#66

Post by viraptor »

6c696e7578 wrote: post #59
larrymcp wrote: post #6

How is ransomware able to spread to all the PCs in a company? (Especially PCs at different locations around the globe) The malware needs to execute itself on each computer. But I would think this would be thwarted by hardware firewalls as well as apps like Windows Firewall. If my PC at work gets infected, somehow it can magically infect the guy down the hall's PC too? I thought that was made impossible years ago.

The common components in the ransomware attacks is Windows and AD. Some leverage known exploits against elements like LSASS, so if the person infected has credentials for another computer, why not slurp up all the credential tokens on remote computers that you can log into too. If you use Linux/Unix on the other hand, you can do descent things to contain access. Firstly, elevated management accounts can restrict logi…

I think your generalisation doesn't work once you get to sites with advanced staff and budget. For example this will stop all but extremely targeted attacks: https://docs.microsoft.com/en-us/windows/security/threat-pro... but it requires a lot of time managing and the more varied things you do, the more annoying it will be to manage. (+ It's probably impossible for devs)

Re: How to survive a ransomware attack without paying the ransom

#67

Post by rectang »

> In other words, it’s less a question of how to stop hackers from breaking in than how to best survive the inevitable damage.

There doesn't seem to be conventional wisdom about how to build systems that are easy to restore. How do you optimize for recovery after an attack? How do you ensure that you've eliminated all the backdoors?

My guess is a combination of "continuous restoration", version controlled code, and a complete separation of code from data.

I want to read books about this but they don't seem to exist.

Re: How to survive a ransomware attack without paying the ransom

#68

Post by linsomniac »

The unfortunate thing is that the ransom probably is priced such that it's cheaper than the company resolving the problem on their own. Or the company would just resolve it without paying the ransom. On the other hand, it's bad on many fronts if the company just decides it is the cost of doing business, and doesn't do a great job of securing their systems in the future...

Many companies just get by, rather than doing serious security design. How do you change that culture in a company? Will paying the ransom do that? Probably if it only costs $1M to do. If it costs them $100M to do, would they do it?

Re: How to survive a ransomware attack without paying the ransom

#69

Post by marcinzm »

viraptor wrote: post #54
matsemann wrote: post #32

Earlier quoted context omitted.

What if they hacked you months before pulling the trigger? The article mentions they were hacked in December and the attack launched in March. Restoring a backup would then still leave the hackers inside. And even if most data were backed up, most computers still have to be wiped and reinstalled. I don't think most companies backup the entire disks off all employees, it's normally just a dedicated file area. So while…

Companies of non-trivial size often have (and should have) a system allowing for remote device management. Which means: - It should be easy to reinstall to a known good image with all the relevant software, settings, drivers, etc. then restore the backed up data. This is relatively common in corps. - Once you observe the malware and know how it reaches the C&C server, you can push rules blocking that host or block th…

The attackers likely compromised the computers using the remote device management system which means it's either disabled or unsafe to use.
Post reply on HN