4 ms·

Atlanta city government systems down due to ransomware attack

67 points by el_duderino 9y ago

abhiminator 9y ago
> Based on the screenshot, one security expert WXIA showed it to said that it resembled the message from a variant of Samsam, a family of ransomware that struck a number of hospitals two years ago. Could this be one of those that exploited a Java de-serialization vulnerability in Java-based application servers a couple of ago as the excerpt says? Java is an absolute buggy bag full of vulnerabilities, can't believe people/organizations still run this shit.
- cremp 9y ago
  As opposed to Node.js and use npm? I can't believe that companies want to shoot themselves in the foot.
  - CaptSpify 9y ago
    Just because node.js and npm are terrible doesn't detract from the fact that java is terrible |;)
- bitmapbrother 9y ago
  >Java is an absolute buggy bag full of vulnerabilities, can't believe people/organizations still run this shit. Are you sure you didn't mean Windows?
- nartz 9y ago
  Sigh - its extremely naive to call "java" the issue. Every language, framework, OS, kernel (and frankly, even hardware) have their vulnerabilities. These types of comments sort of grind my gears.
  - orf 9y ago
    And some languages, frameworks, OS and kernels have more vulnerabilities than others. That's what parent is saying.
- ulkesh 9y ago
  You are either trolling or obviously have no clue what you are talking about. Enjoy the ignorance, I hear it's bliss!
iooi 9y ago
> Employees received emails from the city's information technology department instructing them to unplug their computers if they noticed anything suspicious. Ouch, that sort of communication policy seems ripe for phishing attacks.. "If you see anything suspicious, please report them here https://.." https://.."
- yequalsx 9y ago
  I wanted to click that link you have to see where it went. But I know better! It's hard sometimes to not tempt fate.
  - Jeff_Brown 9y ago
    In a lot of browsers, if you right-click you can choose "copy URL" to see what it says (and then maybe search for it online without visiting it).
    - mynewtb 9y ago
      Thanks to JavaScript that URL can be something completely different.
      - Jeff_Brown 9y ago
        Different from what? Do you mean it's not necessarily a URL? Or do you mean clicking on it could take you somewhere other than where you would go if you chose "copy url" and manually pasted it into the address bar? (And if the latter, is that true even on a forum like this that makes you post comments as plain text?)
        avhon1 9y ago
        > Do you mean it's not necessarily a URL? Javascript or no, the href attribute of an <a> tag does not have to be a URL in order for it to be clickable. (Whether or not it will do anything useful is another matter.) > Or do you mean clicking on it could take you somewhere other than where you would go if you chose "copy url" and manually pasted it into the address bar? This is possible with Javascript - capture the click event before the browser's <a> tag handling and load any page you want. > is that true [possible] even on a forum like this that makes you post comments as plain text? No. /u/mynewtb was talking about clickable hyperlinks where clicking on them takes you to a different place than the tag's href. On sites like HN, where all comments are plain text, there are no hyperlinks in comments. On sites like Reddit, you can use Markdown to add clickable hyperlinks to your comments, but you can't add <script> tags in order to manipulate what clicking the pyperlink does. In either case, an attacker would have to do XSS in order to change where you go when you click a link. This attack / trick is entirely feasible within first-party content or third-party content that is allowed to use external Javascript or inline <script> tags (for example, HTML email).
campuscodi 9y ago
Source: http://www.11alive.com/article/news/local/cyber-attack-hits-atlanta-city-computers-everyone-who-has-done-business-with-city-may-be-at-risk/85-530947288 http://www.11alive.com/article/news/local/cyber-attack-hits-... Press conference: https://twitter.com/Cityofatlanta/status/976920585434423296 https://twitter.com/Cityofatlanta/status/976920585434423296
sneak 9y ago
* Atlanta city government systems down due to using outdated, insecure software. At which point do we simply say “systems susceptible to most types of malware are unsuitable for critical work”?
- delecti 9y ago
  I'm not sure what you're suggesting. Software that is suitable for critical work today might not be tomorrow.
  - pennaMan 9y ago
    "systems susceptible to most types of malware today are unsuitable for the critical work of the day" keep your systems up to date.
    - michaericalribo 9y ago
      "If it ain't broke don't fix it" is the typical line item that covers "keep systems up to date" in city government, next to the standard budget allocation, "$0".
      - pennaMan 9y ago
        But it IS broken. Like an old rusted lock.
AceyMan 9y ago
>Employees told to turn off PCs [...] ... because no Domain Admin knows how to write two PowerShell expressions, obvi. ¯\_(ツ)_/¯ Horrible to see this, it goes without saying, but unless they have an A-Team like at Maersk they are likely well and truly screwed. (me: originally from the ATL burbs.)

67 points by el_duderino 9y ago

> Based on the screenshot, one security expert WXIA showed it to said that it resembled the message from a variant of Samsam, a family of ransomware that struck a number of hospitals two years ago. Could this be one of those that exploited a Java de-serialization vulnerability in Java-based application servers a couple of ago as the excerpt says? Java is an absolute buggy bag full of vulnerabilities, can't believe people/organizations still run this shit.

cremp 9y ago
As opposed to Node.js and use npm? I can't believe that companies want to shoot themselves in the foot.
- CaptSpify 9y ago
  Just because node.js and npm are terrible doesn't detract from the fact that java is terrible |;)
bitmapbrother 9y ago
>Java is an absolute buggy bag full of vulnerabilities, can't believe people/organizations still run this shit. Are you sure you didn't mean Windows?
nartz 9y ago
Sigh - its extremely naive to call "java" the issue. Every language, framework, OS, kernel (and frankly, even hardware) have their vulnerabilities. These types of comments sort of grind my gears.
- orf 9y ago
  And some languages, frameworks, OS and kernels have more vulnerabilities than others. That's what parent is saying.
ulkesh 9y ago
You are either trolling or obviously have no clue what you are talking about. Enjoy the ignorance, I hear it's bliss!

iooi 9y ago

> Employees received emails from the city's information technology department instructing them to unplug their computers if they noticed anything suspicious. Ouch, that sort of communication policy seems ripe for phishing attacks.. "If you see anything suspicious, please report them here https://.." https://.."

yequalsx 9y ago
I wanted to click that link you have to see where it went. But I know better! It's hard sometimes to not tempt fate.
- Jeff_Brown 9y ago
  In a lot of browsers, if you right-click you can choose "copy URL" to see what it says (and then maybe search for it online without visiting it).
  - mynewtb 9y ago
    Thanks to JavaScript that URL can be something completely different.
    - Jeff_Brown 9y ago
      Different from what? Do you mean it's not necessarily a URL? Or do you mean clicking on it could take you somewhere other than where you would go if you chose "copy url" and manually pasted it into the address bar? (And if the latter, is that true even on a forum like this that makes you post comments as plain text?)
      - avhon1 9y ago
        > Do you mean it's not necessarily a URL? Javascript or no, the href attribute of an <a> tag does not have to be a URL in order for it to be clickable. (Whether or not it will do anything useful is another matter.) > Or do you mean clicking on it could take you somewhere other than where you would go if you chose "copy url" and manually pasted it into the address bar? This is possible with Javascript - capture the click event before the browser's <a> tag handling and load any page you want. > is that true [possible] even on a forum like this that makes you post comments as plain text? No. /u/mynewtb was talking about clickable hyperlinks where clicking on them takes you to a different place than the tag's href. On sites like HN, where all comments are plain text, there are no hyperlinks in comments. On sites like Reddit, you can use Markdown to add clickable hyperlinks to your comments, but you can't add <script> tags in order to manipulate what clicking the pyperlink does. In either case, an attacker would have to do XSS in order to change where you go when you click a link. This attack / trick is entirely feasible within first-party content or third-party content that is allowed to use external Javascript or inline <script> tags (for example, HTML email).

campuscodi 9y ago

Source: http://www.11alive.com/article/news/local/cyber-attack-hits-atlanta-city-computers-everyone-who-has-done-business-with-city-may-be-at-risk/85-530947288 http://www.11alive.com/article/news/local/cyber-attack-hits-... Press conference: https://twitter.com/Cityofatlanta/status/976920585434423296 https://twitter.com/Cityofatlanta/status/976920585434423296

sneak 9y ago

* Atlanta city government systems down due to using outdated, insecure software. At which point do we simply say “systems susceptible to most types of malware are unsuitable for critical work”?

delecti 9y ago
I'm not sure what you're suggesting. Software that is suitable for critical work today might not be tomorrow.
- pennaMan 9y ago
  "systems susceptible to most types of malware today are unsuitable for the critical work of the day" keep your systems up to date.
  - michaericalribo 9y ago
    "If it ain't broke don't fix it" is the typical line item that covers "keep systems up to date" in city government, next to the standard budget allocation, "$0".
    - pennaMan 9y ago
      But it IS broken. Like an old rusted lock.

AceyMan 9y ago

>Employees told to turn off PCs [...] ... because no Domain Admin knows how to write two PowerShell expressions, obvi. ¯\_(ツ)_/¯ Horrible to see this, it goes without saying, but unless they have an A-Team like at Maersk they are likely well and truly screwed. (me: originally from the ATL burbs.)