Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Danish cloud host says customers ‘lost all data’ after ransomware attack

techcrunch.com

Post reply on HN
Print view View original

61–70 of 81 posts

Re: Danish cloud host says customers ‘lost all data’ after ransomware attack

#61

Post by theshrike79 »

bombolo wrote: post #17
theshrike79 wrote: post #7

Earlier quoted context omitted.

And what if the backup you're copying to cold storage is also encrypted? How did the saying go? You don't have backups until you've successfully restored from them or something like that. =) Basically any 3-2-1 system is Schrödinger's backup until you've actually used it.

So you only have 1 backup that you daily overwrite?

You can have X daily backups in rotation and after X days of infiltration they're all garbage because they were overwritten by the malware-encrypted code.

A backup isn't real until you've restored from it. That's why you should restore from backups regularly. Firstly so that you know the process and see it actually works and secondly you can confirm you're actually backing up what you think you are backing up.

We've all set backup scripts and forgot to include new directories or files in the configuration as time went on... =)

Re: Danish cloud host says customers ‘lost all data’ after ransomware attack

#62

Post by _joel »

fuzztester wrote: post #59
_joel wrote: post #51

Earlier quoted context omitted.

HN doesn't do sarcasm.

They do, quite a bit. Just check the number of comments with /s at the end. People sometimes even say "you forgot to put a /s" or the like, in reply to an obviously sarcastic comment.

That's a Reddit thing, not HN. Normally I see stuff downvoted if it has /s.

Re: Danish cloud host says customers ‘lost all data’ after ransomware attack

#63

Post by smarx007 »

tommiegannert wrote: post #60
smarx007 wrote: post #49

Earlier quoted context omitted.

How can you trust the webpage of a system that was recently attacked?

If not attacked and the page says not attacked: trustworthy. If not attacked and the page says attacked: not trustworthy. If attacked and the page says not attacked: not trustworthy. If attacked and the page says attacked: trustworthy. As long as the page says "attacked", it seems likely they were attacked? Why would they state it themselves if it wasn't true, losing trust for no reason?

It’s not a bad starting logic.

However, there is a thing called “defacing”. In the process, the attackers share false information implying that more damage was done than in reality.

My general rule is to stop trusting a compromised digital system until I hear from a person (journalist, in this case) confirming that the control over the system has been restored.

If journalists do not verify the facts themselves or via trusted (human) sources, it’s not journalism but syndication.

Realistically, the news was published yesterday and the notice is dated a week ago. I doubt that a company of IT experts would have failed to take a fake notice down. But I stand by my assessment of TechCrunch journalistic standards.

Re: Danish cloud host says customers ‘lost all data’ after ransomware attack

#64

Post by beardyw »

candiodari wrote: post #42
benterix wrote: post #33

Earlier quoted context omitted.

If they are not incremental but append only, an air gap is not strictly needed and can be used as an additional safeguard performed less frequently because of manual overhead. The crux of the matter is to assume the main system has been compromised and preventing overwriting existing data.

... until the next update to these viruses. To utterly destroy an organisation you don't erase or encrypt their data. You change it. Slowly. A little by a little. A birthday here, a name there, a number ... Using the normal ways to change this data. In this way you can go undiscovered for years, employees get blamed for making stupid errors for a LONG time and there is absolutely no way to fix things, no matter what…

But for ransomware there needs to be a hope of restoring the data. In this case the value would need to be more oblique.

Re: Danish cloud host says customers ‘lost all data’ after ransomware attack

#65

Post by westernpopular »

Ekaros wrote: post #11
dusted wrote: post #6

Yesterday, All those backups seemed a waste of pay. Now my database has gone away. Oh I believe in yesterday. Suddenly, There's not half the files there used to be, And there's a milestone hanging over me The system crashed so suddenly. I pushed something wrong What it was I could not say. Now all my data's gone and I long for yesterday-ay-ay-ay. Yesterday, The need for back-ups seemed so far away. I knew my data was…

Also temporally separated. That is you must have backup that is beyond attackers time horizon. This is only way to get back at least something.

What does time horizon mean?

Re: Danish cloud host says customers ‘lost all data’ after ransomware attack

#66

Post by PrimeMcFly »

tryauuum wrote: post #47
PrimeMcFly wrote: post #21

The solution to ransomware? Backups. It's not more complicated than that. It's honestly puzzling that ransomware is the issue it is, crippling entire organizations. It just means they have inept IT teams. Sucks this Danish cloud host provider didn't back stuff up properly.

shaming is easy maybe they were backing up their stuff properly, but backups were wiped as well. even if you have some fancy append-only storage someone still has access to it and that access can be misued.

> maybe they were backing up their stuff properly, but backups were wiped as well.

You realize this is contradictory?

Re: Danish cloud host says customers ‘lost all data’ after ransomware attack

#67

Post by csydas »

benterix wrote: post #33
beardyw wrote: post #4

Earlier quoted context omitted.

Backups need an air gap.

If they are not incremental but append only, an air gap is not strictly needed and can be used as an additional safeguard performed less frequently because of manual overhead. The crux of the matter is to assume the main system has been compromised and preventing overwriting existing data.

I would not agree with this. Append-only file systems and storages aren't a bad idea and definitely help with accidental overwrites, but these systems have been punked quite frequently in many ways, and I've worked with backup companies that home-rolled their own append-only backup implementations.

It didn't stop attackers from using extremely common ways to punk the systems even under the best circumstances for the systems. A forgotten password gets leaked, using the backup applications/storage system's own encryption schemes against the victims, just deleting entire volumes or compromising the OS on the systems, the list goes on.

I wouldn't consider append-only an anti-ransomware technique, it just stops one of many common ways of compromising data. This is good, but I wouldn't rely on it to protect against even a run of the mill ransomware scheme.

Re: Danish cloud host says customers ‘lost all data’ after ransomware attack

#68

Post by chrisandchris »

westernpopular wrote: post #65
Ekaros wrote: post #11

Earlier quoted context omitted.

Also temporally separated. That is you must have backup that is beyond attackers time horizon. This is only way to get back at least something.

What does time horizon mean?

An attacker may intrude your environment and slowly destroy data without you realizing. If this process takes e.g. 10 days, you need backups for 11 days to be safe.

This scenario happens often (as far as I know) with ransomare attacks (on personal devices): Encrypt least used documents first. Probably noone will realize it over weeks that data "is gone".

Re: Danish cloud host says customers ‘lost all data’ after ransomware attack

#70

Post by tatersolid »

beardyw wrote: post #64
candiodari wrote: post #42

Earlier quoted context omitted.

... until the next update to these viruses. To utterly destroy an organisation you don't erase or encrypt their data. You change it. Slowly. A little by a little. A birthday here, a name there, a number ... Using the normal ways to change this data. In this way you can go undiscovered for years, employees get blamed for making stupid errors for a LONG time and there is absolutely no way to fix things, no matter what…

But for ransomware there needs to be a hope of restoring the data. In this case the value would need to be more oblique.

The ransomware gang buys put options on the victim’s stock. Sabotage-backed options scams have been around for a long time.
Post reply on HN