Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oakland declares state of emergency due to ransomware attack

nbcbayarea.com

Post reply on HN
Print view View original

71–80 of 86 posts

Re: Oakland declares state of emergency due to ransomware attack

#71

Post by AlexandrB »

pjc50 wrote: post #28
qikInNdOutReply wrote: post #3

Earlier quoted context omitted.

If its really important. Airgap. Or VM-Wrapped with restore points. I completely understand that somebody does not want to upgrade into the warp-abyss-abomination of modern windows, especially if huge expenses software was written once, that needs backwards compatability or contains sensitive data. You can not use windows if you work for anything with sensitive data. In todays world the legacy is the good stuff. Just…

An airgapped system is one that's basically unusable because you can't communicate with other systems.

Can't help but think back to my youth where nearly every system was airgapped, but were plenty usable regardless.

Re: Oakland declares state of emergency due to ransomware attack

#72

Post by mr_mitm »

nradov wrote: post #37
taeric wrote: post #36

Earlier quoted context omitted.

I'm with you right up to the "infinitely more competent" line. The big thing that Microsoft and Windows have against them, is the crapshow that is all that they include on a standard installation. That said, from what I'm seeing, this is not really unique to Windows anymore. Seems everyone wants everything on the machine. So, yes, it is theoretically possible to setup all access rules correctly. But it is essentially…

What specifically does a modern Windows installation include that is inappropriate or insecure in terms of default services or access rules?

Just exposing SMB on port 445 by default is a huge issue. The vast majority of systems does not need to provide this service, yet there have been two catastrophic RCE vulnerabilities (MS08-067 and MS17-010) in this service. Also, it's basically like an SSH service for attackers to move laterally within the network. If it's not a file server, domain controller or print server, it should probably be turned off or at least severely restricted for a whitelist of hosts.

Next, the NTLMv2 authentication protocol is on by default and vulnerable to relay attacks and offline password guessing attacks. Plus: pass-the-hash vulnerable. Huge problem in corporate networks.

I'd argue the broadcast domain name resolution protocols like NBNS or mDNS are unsafe as well.

Disclaimer: if you were just talking about Windows on your home desktop PC, then yeah nevermind.

Re: Oakland declares state of emergency due to ransomware attack

#73

Post by mr_mitm »

midasuni wrote: post #5

I don’t get why any user has the ability to cause so much damage. Sure they can lock their own files out and need to restore from backup, but how can that knock out other departments, let alone things like email.

I'm a penetrations tester. When the client gives me a windows laptop with low privilege credentials, I'm typically domain admin by lunch time. Sometimes even before I finish my first cup of coffee. As a domain admin I could encrypt almost any computer, often including the backups.

Privilege escalation in Windows Active directory domains is really easy. Securing a large corporate network is really hard. Especially on a tight budget.

Re: Oakland declares state of emergency due to ransomware attack

#74

Post by taeric »

908B64B197 wrote: post #66
taeric wrote: post #40

Earlier quoted context omitted.

I expect that pricing has made it so most all smaller places are these kinds of organizations. And the incentives are to keep it that way. As long as MS's PS team can make more money from one whale of a customer than they can supporting local districts, expect that this will remain. Such that I don't think it is excusable to say "if only they had paid the professional services."

> Such that I don't think it is excusable to say "if only they had paid the professional services." Would you apply the same logic to road infrastructure? Why hire those licensed engineers...

The target of the question is to the vendor of the road, though? If I pay to get roads installed and they counter that I should have paid for a more expensive process? Yeah, I'd say that is inexcusable. If they have strong reason to think that who they are selling to cannot maintain things correctly, they should consider not selling.

Re: Oakland declares state of emergency due to ransomware attack

#77

Post by alephnerd »

908B64B197 wrote: post #69
alephnerd wrote: post #61

Earlier quoted context omitted.

A lot of organizations also don't have the money or processes in place to manage backups. It's a huge cost outlay and in cash strapped SLGs, it simply ain't happening - especially when any half decent talent can make way more money working remotely for companies that respect Engineering.

That sounds completely self-inflicted. What are they spending their money on? Not Oakland, but across the bridge, last I heard, 16 millions for a few tents [0]. [0] https://www.nbcbayarea.com/news/local/san-francisco-paying-1...

Debt. City of Oakland has has a budget deficit of around $100-200m a year for the past 10 years at least.

Re: Oakland declares state of emergency due to ransomware attack

#78

Post by pjmlp »

HybridCurve wrote: post #63
pjmlp wrote: post #22

Earlier quoted context omitted.

I love people that believe there exists a version of any operating system with C code on it, that can be deemed secure. https://en.wikipedia.org/wiki/Morris_worm

It is true that C does not protect against a class of errors related to memory safety, but it disingenuous to imply writing an OS in any other language will make it secure. At best, it will only reduce the porosity of the attack surface.

One of the reasons why Multics had a better security assessment than UNIX from DoD, was precisely how PL/I does strings and arrays.

Not wearing seatbelts and helmets doesn't save everyone, so it is worthless to use them as a vain attempt to save human lives.

Re: Oakland declares state of emergency due to ransomware attack

#79

Post by voidwtf »

mr_mitm wrote: post #68
chriscjcj wrote: post #48

It's been quite a few years since I did this kind of stuff for a living, so this may be an antiquated notion... "In my day," desktop computers saved their files to a server. That server would get backed up daily. The backup tapes/drives would be stored offline and rotated to an offsite location. (Back then you were more concerned about the building burning down than a ransomware attack.) The same would be true for an…

The article does not say anything about Oakland negotiating. They may just be in the "it takes some time" phase at the moment. Tapes are not exactly the fastest medium. Plus, you may want to determine the exact time at which you were compromised, or else you'll be restoring potentially tainted backups. Depending on how well you're organized that alone will take quite some time, especially considering that your logs m…

This right here, the company I work for did some back of the napkin calculations for restoration times for archival storage (tape) and determined that it’d take us 2 days to restore minimum and up to 7 days to restore if the queues were full. This was with Azure and a relatively small amount of data (around 6TB).

We’re using their immutable storage option, with a 60 day window with multiple rotation intervals, and just biting the bullet on the cost of cold storage vs archival because of how slow tape is.

I could definitely see a larger entity having significantly more data and the restoration process can’t even start until they finish triage. No point in restoring until you know the source of the intrusion or at least have a plan to prevent it from recurring.

Re: Oakland declares state of emergency due to ransomware attack

#80

Post by corbulo »

hanselot wrote: post #9
unxdfa wrote: post #2

This sort of stuff doesn’t surprise me any more. I’ve been on a number of “desktop support” sessions over the last few years and seen some shit. The common denominator seems to be entirely unpatched obsolete stuff (stock RTM windows 7 with stock IE in 2021 was my favourite) where either someone turned the updates off because they knew better or stopped paying their MSP for service immediately after they had been set…

I love people that believe there exists a version of windows that could be deemed secure. I was there once. Install the latest update to fix the security problems. Don't worry, our software becomes 300mb larger due to 500 other security problems we are rolling out today, but we managed to close off this one tiny hole over here. Why does it matter anyways. With both Intel and AMD running processors independent of your…

At this point I don't think the goal is to reach a state of 'secure'; it's shifting vulnerabilities around to be less predictable. Intentionally or not.
Post reply on HN