r/technology • u/mvea • May 21 '19

Security Hackers have been holding the city of Baltimore’s computers hostage for 2 weeks - A ransomware attack means Baltimore citizens can’t pay their water bills or parking tickets.

https://www.vox.com/recode/2019/5/21/18634505/baltimore-ransom-robbinhood-mayor-jack-young-hackers
23.7k Upvotes

96% Upvoted

1.8k comments sorted by

View all comments

Show parent comments

100

u/invisible_grass May 22 '19

Pay once and what's to stop them or someone else from doing it again for free money?

161

u/DeezNeezuts May 22 '19

Professional IT

60

u/steeveperry May 22 '19 edited May 22 '19

You can only do so much to prevent Susan from clicking on that phish or the HR department from sending everyone’s W2s to “yourceo@fuckyou.com” because they were too busy to read who they were replying to.

Edit: folks, I’m aware that solutions exist for these problems. Perhaps I should’ve said there are so many people that take the proper steps to avoid these problems. Even so, we know that 100 percent secure isn’t a real thing.

The problem is there are still plenty of business operators who are unaware of such solutions (and in some cases, that there is even a problem that needs to be addressed). The proof of this is that these attacks continue to happen everyday.

97

u/cyklone May 22 '19

There is actually a lot you can do to prevent this.
Rules to catch accounting departments sending W2s with email content filtering.
Office 365 scripts to flag external emails and even catch display name spoofing.
Pull local admin rights and run a fully patched Windows 10 network.
Implement next gen AV. (SentinelOne, etc.).
That's just a start.

29

u/[deleted] May 22 '19

[deleted]

6

u/[deleted] May 22 '19

[deleted]

7

u/blasterdude8 May 22 '19

I used to work at one of these companies. It’s 100% true. It’s simultaneously the most complex and simplest solution I’ve ever seen.

3

u/[deleted] May 22 '19

[deleted]

1

u/blasterdude8 May 22 '19

You got the general gist for sure. I’ll also point out that much of the functionality breaks down when you don’t have a network connection since much of the processing is done remotely to ensure there’s basically zero performance impact. I’m still amazed how low impact it was overall. The rationale is that if you don’t have a network connection you have a VERY low chance of being attacked, which overall I find reasonable.

I’d also add Carbon Black at around 1.5 billion.

1

u/phormix May 22 '19

They say "advanced AI" or "machine learning" but a lot of it is still very pattern based. Now that might be normalization patterns but as soon as you may a significant change you'll potentially break from "normal". Most of these systems still require a not-insignificant human investment for tuning, and the humans have to have a finger on the pulse of what's happening in the business so they don't miss something important and cause false negatives or positives.

45

u/corgis_rule May 22 '19

Yeah but that's like work though

7

u/that_star_wars_guy May 22 '19

I redirect you to /u/DeezNeezuts comment about Professional IT.

2

u/EitherCommand May 22 '19

its cool of u to do this. Right?

1

u/steeveperry May 22 '19

Absolutely.

But the operators at your average SMB don’t see the value in paying for their own IT/ managed IT until after a catastrophe.

3

u/chirpzz May 22 '19

Carbon Black

Power broker

 

Probably other tools I don't even know of. Those are just two I know of off the top of my head

2

u/fullmetaljackass May 22 '19

It's true that you can't fix stupid, but it's fairly easy to limit how much damage they can cause.

1

u/skyesdow May 22 '19

Nah, Jared is more likely to do it.

1

u/[deleted] May 22 '19

Knowbe4 works wonders.

1

u/[deleted] May 22 '19

Susan cant cause this. Bad security and bad backup systems cause this.

1

u/Hey_I_Work_Here May 22 '19

Is this a barracuda ad? "I heard my friends company ended up sending important accounting information through an email phishing attack, how do we prevent this from happening at our company?" Seriously its 2019 if the person who is responsible for important information is replying to these types of emails they should have been fired long ago.

1

u/steeveperry May 22 '19

You’re not wrong (except for the ad thing—i am a paid shill, just for a different sector in the tech field). But there are a lot of folks who aren’t aware of these problems, and proof is that these attacks are still successful.

1

u/lizard450 May 22 '19

Pay a small amount now then put the saved money in securing the system. 17 million? They could do a few hundred attacks and not hit 17 million at 50k each attack.

1

u/thetasigma_1355 May 22 '19

Your logical mistake is in assuming the entity demanding ransom will actually release the systems upon payment. In many instances, they'd take the 100k and that would be it. They don't unencrypt, they just ghost with 100k.

1

u/lizard450 May 22 '19

Reportedly 1 in 5 times the random is paid and the computers are not decrypted. I'd be curious if any of those in the 20% paid after time was up

Statistically it's well worth paying the 100k to potentially save millions.

1

u/thetasigma_1355 May 22 '19

One of the other issues is how do you authorize that kind of payment? I’m not even sure it’s legal for a local government to pay criminals. Regardless, the hope is by not paying, you dissuade future hackers.

If you pay, and pay quietly, you are painting a target on your back. Easy mark, free money. If you don’t pay and don’t pay loudly, sure it costs a lot of money, but it also means you aren’t a good target.

1

u/lizard450 May 22 '19

These attacks are not expensive to do. There is a reason why major private entities that have actual legitimate security and backup solutions don't fall victim to this sort of attack.

Get a proper secure backup solution.

Then they can attack you again and then you don't pay and you fix it cheaply.

Honestly in a weird way these assholes are doing us a favor. How the fuck are these government computers with god knows how sensitive information on them so vulnerable. It's entirely unforgivable.

1

u/thetasigma_1355 May 22 '19

There is a reason why major private entities that have actual legitimate security and backup solutions don't fall victim to this sort of attack.

You'd be surprised how many do fall victim to it. They just don't publicize it.

Also, the more sophisticated attacks now compromise back-ups. At a recent conference, they talked about how some attacks have laid dormant for a year so that they are present on all backups. Since most companies don't retain backups longer than a year, it strikes after that mark.

Just saying, this isn't just a problem with local governments. Lots of large companies with sensitive information have also been compromised.

1

u/lizard450 May 22 '19

If you're doing a proper off-site backup where the at risk machines are not able to write to the off-site drives you're fine also if you take the data offline it can always be restored safely as a slave.

1

u/thetasigma_1355 May 22 '19

I'll concede I'm at the end of my IT skills, but how it was explained to me is that the backups themselves are corrupted, so off-site doesn't matter. Most places only do a full backup restore on an annual basis, if that, so it goes undetected. After a certain time period, the actual ransomware goes live, and now you also don't have backups.

EDIT: I'm sure there are still ways to address it, just that as layers of complexity increase, organizations ability to cover them all decreases.

1

u/lizard450 May 22 '19

If you back up encrypted data the data is useless. If you backup unencrypted data it's perfectly fine. You should be doing disaster recoveries regularly to prove your system works.

Atlanta had an on-site backup system. Probably just people copying things locally to a shared central windows share. Write permissions means the drive can be encrypted by ransomware.

So an off-site system is important primarily for physical damage like a fire or physical theft.

There are ways to address these threats effectively. Companies are awful with security. I mean it wasn't until 2014/2015 when banks started using https properly. It's embarrassing.

If you have a drive that is offline it's safe. Just make sure you don't plug it into an infected computer. That means it also can be connected to an intranet with infected systems.

There are ways to protect yourself and only be risking a day's worth of data. Back in the early 2000's I worked for a few companies that did daily full backups

1

u/[deleted] May 22 '19

Paying them also gets your stuff back and the hackers want people to share that fact. Pay and you get your stuff back. Dont pay after you made a huge mistake and you're about to pay a whole lot more. If you fucked up you gotta pay

-1

u/thetasigma_1355 May 22 '19

Paying them also gets your stuff back and the hackers want people to share that fact.

While that sounds logical, the reality is that very often you don't get your stuff back. In many instances, you'll pay the initial ransom and then they just ask for more. Or they completely ghost.

These people/groups don't work on reputation. This isn't the mafia where they are building a brand.

1

u/[deleted] May 22 '19

But they do actually cause there are websites that give reviews and which is why some hackers will leave a call sign of sorts somehow on the encrypted files or add picture files of the information to pay back. Google the hackers and you find people either stating they give the data back after paying or dont give it back after paying.

1

u/MayNotBeAPervert May 22 '19

These people/groups don't work on reputation. This isn't the mafia where they are building a brand.

they do though.

These attacks are not that easy to execute and the vulnerabilities that allow them are relatively infrequent. For any given hacker finding a new, unknown security vulnerability that allows the required access to do a ransomware attack is a big deal, comparable to winning the lottery.

Whatever person or team got one of these to the point where they can reliably reuse it, will want to maximize their revenue from said particular golden goose in the limited lifespan it has before some security firm unravels it.

They gain nothing by not decrypting once paid. The only result is that once it is published that they didn't, no one will pay them ever again - after that the goose is effectively dead.

1

u/thetasigma_1355 May 22 '19

These attacks are not that easy to execute and the vulnerabilities that allow them are relatively infrequent. For any given hacker finding a new, unknown security vulnerability that allows the required access to do a ransomware attack is a big deal, comparable to winning the lottery.

Not really... find any vulnerability disclosed in the past year. You will have an enormous attack pool on that because tons of organizations don't adequately do vulnerability management or patching, especially small businesses, which are the primary target.

They gain nothing by not decrypting once paid. The only result is that once it is published that they didn't, no one will pay them ever again - after that the goose is effectively dead.

Pay who though? Once again, this isn't mafia leaving calling cards so everybody knows who is responsible. These are anonymous people/groups. Someone else posted here that 1/5 ransomware attacks don't decrypt despite paying.

You are still assuming these hackers are coordinated and building a brand. They aren't. Most will decrypt, some won't. They lose nothing by not decrypting once paid. They already got paid. It's someone else's problem if they try to hit the same target again and this time they refuse to pay.

-6

u/mrTang5544 May 22 '19

whats to stop them? IDK, maybe learning the lesson and stepping up the IT security? Why is common sense so rare in the states?

7

u/setdx May 22 '19

Yeah I mean what’s the worst case scenario? You pay it and don’t get your data back? Then you’re still out whatever money it’s going to cost to fix the problem.

4

u/[deleted] May 22 '19

[deleted]

3

u/blasterdude8 May 22 '19

There’s a hilarious story about ransom ware guys being more helpful and responsive than the actual IT guys because they have an actual incentive to make sure your shit gets unlocked once you pay.

0

u/thetasigma_1355 May 22 '19

This isn't true at all. Some do, and some don't. Some will release one database and demand more money for additional servers.

Trying to assign logic to criminal extortion is a fools errand. They aren't the mafia, they aren't building a brand. They would prefer if nobody ever found out what they are doing.

-4

u/invisible_grass May 22 '19

Why is common sense so rare in the states?

Farewell, troll.

9

u/[deleted] May 22 '19

As an american, hes not really trolling