Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The ransomware surge

bbc.com

Post reply on HN
Print view View original

71–80 of 216 posts

Re: The ransomware surge

#71

Post by hi5eyes »

jude- wrote: post #56
RcouF1uZ4gsC wrote: post #43

Earlier quoted context omitted.

Dollars are a little different in that transferring large amounts anonymously is hard. Collecting the ransom is probably the point of highest vulnerability and that is something law enforcement agencies like the FBI have used to catch kidnappers. However, with cryptocurrency, that vulnerability is mitigated a lot, and that completely changes the dynamics. There is a reason, the ransomware attackers aren't demanding s…

Good thing, then, that Bitcoin is anything but anonymous.

https://techcrunch.com/2021/03/26/chainalysis-raises-100m-do... 2b for a company cexs use to filter out dirty crypto

Re: The ransomware surge

#74

Post by JasonFruit »

throw1122 wrote: post #60
gizmo686 wrote: post #28

Earlier quoted context omitted.

Implicit in this comment is the assumption that current technology is pretty much the best we can do? > IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? Modern security…

>Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? Because there's not enough money in making things bug-free from the start. It is possible (see seL4 and They Write the Right Stuff), but the incentives aren't there. Some kind of liability or minimum standard (similar to building code) would help, but I'm not sure just how it would be best imple…

That money would have to come from somewhere, though, and that's the pockets of consumers. Do they, in general, care enough? Is the security of software worth enough to them to spend the extra money? You don't just get what you pay for; you get what you're willing to pay for. And does the consumer have the expertise to evaluate the costliness of the threat or the security of the software? For that matter, I doubt the majority of developers have that expertise.

You're not wrong about why it doesn't exist, but I'm not convinced the market conditions exist to rectify that.

Re: The ransomware surge

#75

Post by amelius »

RcouF1uZ4gsC wrote: post #23

I think it is likely that there will be a real world kidnapping where the kidnappers demand a Bitcoin ransom. Once this happens, Bitcoin will get rapidly regulated out of existence by governments. Imagine if it follows the usual stereotypical news coverage. An attractive, photogenic American woman goes to a foreign country and gets kidnapped. Later the kidnappers send ransom demands with a Bitcoin address. This would…

Perhaps governments should make it illegal to pay ransom in crypto-currencies (or even ransom in general).

This might not stop the kidnappings, but at least it could stop large organizations from paying ransomware.

Re: The ransomware surge

#76

Post by Nursie »

rawtxapp wrote: post #41
seibelj wrote: post #36

Earlier quoted context omitted.

Will increase the utility of decentralized exchanges like Uniswap and DeFi in general. The more CEX gets regulated the less people will want / need to use them.

Yep, that's what people don't understand, you can ban centralized entities as much as you want, but you can't stop people from running arbitrary code on their devices which means it's impossible to shutdown a properly decentralized network.

If you can’t convert back to a national currency, nobody will care.

Re: The ransomware surge

#77

Post by contingencies »

londons_explore wrote: post #58
g_p wrote: post #8

Earlier quoted context omitted.

Absolutely this - most ransomware attacks are pretty unsophisticated. You don't need privilege escalation, or an exploit. You can carry out the attack using just basic user permissions. You are exploiting a basic "problem" of most modern OSs (that apps run "as" the user executing them) - the user/group permission model ceases to work in 2021 with non-expert users. Portal-based access to individual files via secure OS…

I would like to see rate-limiting built into OS's. Eg. an application is only allowed to touch 100 files per second or 1000 files per hour. When it reaches those limits, it gets paused and a popup asks the user if this application really should be doing X. Then at least ransomware can't run through stuff too quickly.

Behavioral heuristics are best learned in-situ; you need to know how the software is used with which data to correctly profile normal behavior. Some users and workloads hate sandboxes, though, and a 'Run as Adminstrator'-esque familiar-escape thus demanded by users will no doubt destroy its utility. Ultimately, someone must correctly articulate what the system is supposed to do, and this requires knowledge.

Re: The ransomware surge

#78

Post by toss1 »

djoldman wrote: post #20

Can someone tell me where I'm wrong here: The solution to ransomware is to daily mirror every system to an append only backup and then just flash everything back if you get hit. You lose a few days...

The threat to that is a silent encryptiion on that goes on for weeks before the alert/ransom is demanded. Your mirrors are now full of encrypted trash, or you need to go back a month or more.

This could be managed with a backup that maintains 'fingerprint' hashes of all the files, tracks the changes and alerts if there are too many, or alternatively, the user/admin litters the system with a set of canary files of the same type that should never change, and the backup system halts and alerts if any of them do.

I'd like to see a utility to just check a set of canary files for changes. Anyone know of one?

Re: The ransomware surge

#79

Post by operator-name »

Since nobody has linked it, here is the primary source, the report mentioned in the article: https://securityandtechnology.org/ransomwaretaskforce/report...

As an aside does anyone know (with citations) the history and why reputable news publications like the BBC or reuters never cite their sources? It's always seemed odd that even quacks and conspiracy cites (mis)use sources whilst well respected publishers don't.

Re: The ransomware surge

#80

Post by korethr »

Backups.

I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup.

You might get a call from one of your application engineers shortly before bed on a Friday night that the web front-ends are acting weird, and they can't get in to troubleshoot, and then 10 minutes later come to discover that the latest strain of Ryuk has laid waste to 2/3s of the servers and workstations across the company. And then all of a sudden, those VM snapshots you'd been copying off to another file share with a shell script have become your salvation. Yeah, containing Ryuk and the rest of incident response mode are going to suck, but at least now you don't have to write an apology to your customers that the data they entrusted to you has been irrevocably lost.

In case you're wondering, no, that did not literally happen to me. But it is a mild fictionalization of someone I know.

Keep backups, and test your restores regularly, people.

Post reply on HN