8 ms·

US mayors adopt resolution to not pay hackers over ransomware attacks

99 points by PatrolX 7y ago

mikece 7y ago
Is it just me or will hackers use this as a guide of whom to hack?
- hammock 7y ago
  I imagine that's the idea.
grendelt 7y ago
Ok, but how are they gonna get their data back? Just sacrifice it and lose all digital public records?
- tw04 7y ago
  Yes, and this is exactly why they should be keeping both digital (online and offline) as well as paper copies of their records. If they can't afford to have good backups of their data, they can't afford to have digital records in the first place. This is the equivalent of a community saying they can't afford filing cabinets so they just stack paper on the floor in the boiler room. Nobody would find that acceptable, and they shouldn't find this acceptable either.
  - SketchySeaBeast 7y ago
    "Why are they wasting OUR tax dollars on this ridiculous, unneeded, IT infrastructure! My property taxes are going up to pay for your incompetence!"
  - mc32 7y ago
    I think one issue is that they can’t know for certain when they became compromised. So they may be able to get data back but can’t know that that data has integrity, unless they’ve hashed it since the beginning of time.
  - Dylan16807 7y ago
    Honestly, though, if you just filter to what could be backed up on paper you'll find that backups are trivial. A pretty big storage room, stuffed with ten thousand bankers boxes, each holding five thousand double-sided sheets of paper? At a reasonably generous 80KB per side you have 8TB. That's one data tape. Even a "library of congress" is only 10TB.
- mikeash 7y ago
  How were they going to get their data back in the event of a fire, flood, power surge, or just some destructive malware?
- rolltiide 7y ago
  they'll pay cyber security experts, who will pay the hackers
fsagx 7y ago
Mayors will pay "cyber-security" consulting firm. The firm will pay the hackers. https://www.zdnet.com/article/georgia-county-pays-a-whopping-400000-to-get-rid-of-a-ransomware-infection/ https://www.zdnet.com/article/georgia-county-pays-a-whopping...
Someone1234 7y ago
Their assumption is that they're being targeted and that this "united front" will give attackers less reason to target them, when the harsh reality is that these CrytoMalware emails/IM Spam are being send to every business/government internationally looking for the softest targets. They should have passed a resolution to implement a 1-2-3 Backup Strategy with mandatory offline & offsite backups and testing protocols. But that would cost money and require competent management/oversight, instead they'd prefer to pass a meaningless fiat that won't do jack. Honestly until there are consequences for government officials/management nothing will change. This is 95% about poor resource management and 5% about CrytoMalware. Nobody should be paying, because they should ALREADY have multiple tiers of backups, that are audited, tested, and reviewed. PS - "It also encrypted our backups" is also pure incompetence. They just didn't want to manage rotated backups or pay the storage fee/costs of high density tape.
- flowersjeff 7y ago
  100% spot on!
- klodolph 7y ago
  The problem with 1-2-3 backup is 95% user education, policies, desktop administration, etc., and 5% making the copies of data. In my experience, at least. You need IT staff who are good at finding solutions that work for everyone. It would be nice if we could just stay “store it on the network drive” and then make backups, but users in the org don’t listen, and this is a fact of reality that you have to spend time & money to adapt to. So backup is a fairly big management & IT challenge that goes way beyond guidelines like 1-2-3. That, and due to legal restrictions, local governments are rarely empowered to hire the right IT staff capable of making it happen.
  - Someone1234 7y ago
    I'm not sure what your first paragraph is about. Windows hasn't worked like that in a very long time, a user's default storage locations (Desktop, Documents, etc) are all held centrally and it is completely transparent to the user. This is handled by Folder Redirection and a GPO policy. So no user education, desktop administration, or specific policies are required. You just need not to alter the defaults and you'll get a centrally managed set of user files perfectly suited to regular backups. The only thing that remains a challenge is offsite users/traveling. But an edge case isn't a justification for why you wouldn't use folder redirection within a monolithic organization like a local government. > That, and due to legal restrictions, local governments are rarely empowered to hire the right IT staff capable of making it happen. What "legal restrictions" stop government from hiring IT Staff?
flowersjeff 7y ago
Honestly, I can't add much more than what has already been said here... If your data/biz/org/etc is crippled because of these types of attacks, then you really need to have a frank discussion around IT/resource allocations/goals. These are 100% manageable (worst case).
- Johnny555 7y ago
  Is it 100% manageable? If the malware author manages to infiltrate your network and quietly starts infecting files and devices on your network over 6 months, even if you restore from a 7 month old backup, what about all of the files that were created between then and now -- are they all going to be recoverable even if you can find and remove the malware? Can you reliably detect all of the malware or will the attack sprout again from your printer in a few months?
deleted 7y ago
[deleted]
shakyshakyshaky 7y ago
This type of acausal deal only works for single-target attacks. If a bad actor is searching for a victim and sees two potential targets, one of which has resolved to never cede to their demands and one who wasn't commented, they will attack the ambivalent party. Malware is not a single target attack. Whether or not it's probably beneficial to attack one of these cities is not considered. Instead of making gestures, these mayors should be investing in better cybersecurity.
smileysteve 7y ago
Alternatively, they could move to secured cloud services; what with encryption at rest, nightly backups, and inactive file storage.
ourmandave 7y ago
Is it cheaper to pay the ransom to unencrypt your data or just buy a copy off the dark web? I assume the malware fucks stole a copy to auction off.
- rolltiide 7y ago
  the decryption keys are generated by entropy from the controller just having the software won't do you any good
qwerty456127 7y ago
Fascinating. The page manages to bypass uBlock Origin and pop up an ad window in the right bottom corner to start paying heavy (which my computer and connection can barely handle) video with sound (!) automatically.
lanrh1836 7y ago
I’m curious where the cities that have paid ransomware attackers acquired bitcoin. Did they literally just open a Coinbase account and send funds through there?
- Mountain_Skies 7y ago
  They probably had a consultant do it for them.
- solotronics 7y ago
  The city probably reached out to an IT security company and they did it.
saurik 7y ago
I am on a local city commission. As part of this, they gave me an email address (made me unhappy, but whatever). They sent me an email to my personal email address telling me how to log in to my city email address, explaining that my password was a trivial algorithm based on my name, followed by a number an exclamation point. This was a form email: every single address in the entire city has the same password format (with the same number, to be explicitly clear). They disabled the feature to let people change their password. So... anyone can log in to the email account of any official in this city and do stuff like delete mail before they see it (as even if they have audit trails turned on for administrators, the official can still delete mail from their own perspective, and would never know if someone helpfully deleted it "for them").
canuckPuck 7y ago
It's funny because ransomware is simply DRM coming in from the other direction. I can't help but laugh because it's such a clear demonstration of everything that's bad about DRM, except for the fact that, well, the message gets lost amid a tide of egotism and indignation. Oh, what fools these mortals be!
techslave 7y ago
this is beyond stupid. municipal IT systems are vulnerable because of poor resource availability and lack of budgets to properly secure them. paying the ransom ware folks should be considered the cost of doing business. it’s cheaper than actually securing the data. anyway it’s expected. the same mayors that underfund IT would be the same ones to make this ridiculous “red line”. good opportunity here for a cookie cutter IT consultancy to come in to all of these cities and offer cookie cutter service.

99 points by PatrolX 7y ago

mikece 7y ago

Is it just me or will hackers use this as a guide of whom to hack?

hammock 7y ago
I imagine that's the idea.

grendelt 7y ago

Ok, but how are they gonna get their data back? Just sacrifice it and lose all digital public records?

tw04 7y ago
Yes, and this is exactly why they should be keeping both digital (online and offline) as well as paper copies of their records. If they can't afford to have good backups of their data, they can't afford to have digital records in the first place. This is the equivalent of a community saying they can't afford filing cabinets so they just stack paper on the floor in the boiler room. Nobody would find that acceptable, and they shouldn't find this acceptable either.
- SketchySeaBeast 7y ago
  "Why are they wasting OUR tax dollars on this ridiculous, unneeded, IT infrastructure! My property taxes are going up to pay for your incompetence!"
- mc32 7y ago
  I think one issue is that they can’t know for certain when they became compromised. So they may be able to get data back but can’t know that that data has integrity, unless they’ve hashed it since the beginning of time.
- Dylan16807 7y ago
  Honestly, though, if you just filter to what could be backed up on paper you'll find that backups are trivial. A pretty big storage room, stuffed with ten thousand bankers boxes, each holding five thousand double-sided sheets of paper? At a reasonably generous 80KB per side you have 8TB. That's one data tape. Even a "library of congress" is only 10TB.
mikeash 7y ago
How were they going to get their data back in the event of a fire, flood, power surge, or just some destructive malware?
rolltiide 7y ago
they'll pay cyber security experts, who will pay the hackers

fsagx 7y ago

Mayors will pay "cyber-security" consulting firm. The firm will pay the hackers. https://www.zdnet.com/article/georgia-county-pays-a-whopping-400000-to-get-rid-of-a-ransomware-infection/ https://www.zdnet.com/article/georgia-county-pays-a-whopping...

Someone1234 7y ago

Their assumption is that they're being targeted and that this "united front" will give attackers less reason to target them, when the harsh reality is that these CrytoMalware emails/IM Spam are being send to every business/government internationally looking for the softest targets. They should have passed a resolution to implement a 1-2-3 Backup Strategy with mandatory offline & offsite backups and testing protocols. But that would cost money and require competent management/oversight, instead they'd prefer to pass a meaningless fiat that won't do jack. Honestly until there are consequences for government officials/management nothing will change. This is 95% about poor resource management and 5% about CrytoMalware. Nobody should be paying, because they should ALREADY have multiple tiers of backups, that are audited, tested, and reviewed. PS - "It also encrypted our backups" is also pure incompetence. They just didn't want to manage rotated backups or pay the storage fee/costs of high density tape.

flowersjeff 7y ago
100% spot on!
klodolph 7y ago
The problem with 1-2-3 backup is 95% user education, policies, desktop administration, etc., and 5% making the copies of data. In my experience, at least. You need IT staff who are good at finding solutions that work for everyone. It would be nice if we could just stay “store it on the network drive” and then make backups, but users in the org don’t listen, and this is a fact of reality that you have to spend time & money to adapt to. So backup is a fairly big management & IT challenge that goes way beyond guidelines like 1-2-3. That, and due to legal restrictions, local governments are rarely empowered to hire the right IT staff capable of making it happen.
- Someone1234 7y ago
  I'm not sure what your first paragraph is about. Windows hasn't worked like that in a very long time, a user's default storage locations (Desktop, Documents, etc) are all held centrally and it is completely transparent to the user. This is handled by Folder Redirection and a GPO policy. So no user education, desktop administration, or specific policies are required. You just need not to alter the defaults and you'll get a centrally managed set of user files perfectly suited to regular backups. The only thing that remains a challenge is offsite users/traveling. But an edge case isn't a justification for why you wouldn't use folder redirection within a monolithic organization like a local government. > That, and due to legal restrictions, local governments are rarely empowered to hire the right IT staff capable of making it happen. What "legal restrictions" stop government from hiring IT Staff?

flowersjeff 7y ago

Honestly, I can't add much more than what has already been said here... If your data/biz/org/etc is crippled because of these types of attacks, then you really need to have a frank discussion around IT/resource allocations/goals. These are 100% manageable (worst case).

Johnny555 7y ago
Is it 100% manageable? If the malware author manages to infiltrate your network and quietly starts infecting files and devices on your network over 6 months, even if you restore from a 7 month old backup, what about all of the files that were created between then and now -- are they all going to be recoverable even if you can find and remove the malware? Can you reliably detect all of the malware or will the attack sprout again from your printer in a few months?

deleted 7y ago

[deleted]

shakyshakyshaky 7y ago

This type of acausal deal only works for single-target attacks. If a bad actor is searching for a victim and sees two potential targets, one of which has resolved to never cede to their demands and one who wasn't commented, they will attack the ambivalent party. Malware is not a single target attack. Whether or not it's probably beneficial to attack one of these cities is not considered. Instead of making gestures, these mayors should be investing in better cybersecurity.

smileysteve 7y ago

Alternatively, they could move to secured cloud services; what with encryption at rest, nightly backups, and inactive file storage.

ourmandave 7y ago

Is it cheaper to pay the ransom to unencrypt your data or just buy a copy off the dark web? I assume the malware fucks stole a copy to auction off.

rolltiide 7y ago
the decryption keys are generated by entropy from the controller just having the software won't do you any good

qwerty456127 7y ago

Fascinating. The page manages to bypass uBlock Origin and pop up an ad window in the right bottom corner to start paying heavy (which my computer and connection can barely handle) video with sound (!) automatically.

lanrh1836 7y ago

I’m curious where the cities that have paid ransomware attackers acquired bitcoin. Did they literally just open a Coinbase account and send funds through there?

Mountain_Skies 7y ago
They probably had a consultant do it for them.
solotronics 7y ago
The city probably reached out to an IT security company and they did it.

saurik 7y ago

I am on a local city commission. As part of this, they gave me an email address (made me unhappy, but whatever). They sent me an email to my personal email address telling me how to log in to my city email address, explaining that my password was a trivial algorithm based on my name, followed by a number an exclamation point. This was a form email: every single address in the entire city has the same password format (with the same number, to be explicitly clear). They disabled the feature to let people change their password. So... anyone can log in to the email account of any official in this city and do stuff like delete mail before they see it (as even if they have audit trails turned on for administrators, the official can still delete mail from their own perspective, and would never know if someone helpfully deleted it "for them").

canuckPuck 7y ago

It's funny because ransomware is simply DRM coming in from the other direction. I can't help but laugh because it's such a clear demonstration of everything that's bad about DRM, except for the fact that, well, the message gets lost amid a tide of egotism and indignation. Oh, what fools these mortals be!

techslave 7y ago

this is beyond stupid. municipal IT systems are vulnerable because of poor resource availability and lack of budgets to properly secure them. paying the ransom ware folks should be considered the cost of doing business. it’s cheaper than actually securing the data. anyway it’s expected. the same mayors that underfund IT would be the same ones to make this ridiculous “red line”. good opportunity here for a cookie cutter IT consultancy to come in to all of these cities and offer cookie cutter service.