3 ms·

Running "low and slow" isn't a tremendously good strategy for ransomware. Slowly encrypting data over time is more likely to get caught and stopped, versus "sho

Running "low and slow" isn't a tremendously good strategy for ransomware. Slowly encrypting data over time is more likely to get caught and stopped, versus "shock and awe". I'm waiting until ransomware starts leveraging the encryption functionality in common backup systems. Not many sysadmins would notice if their backup encryption keys were changed-out for 6 months and deleted at the same time that the "encrypt all the data" event happened. (The only Customers I've ever worked with who were already doing air-gapped backup verification were regulated businesses in the financial sector.)

chongli 7y ago
Yeah, I was going to say: the last company I worked for sent their backups off-site on a nightly basis. They were also often requesting old tapes to be pulled in for the next night's delivery/pickup so that they could test against old data. It would be pretty hard to get your ransomware to encrypt all those offsite backups sitting in a vault somewhere.
munk-a 7y ago
I wonder if it might be worth it for the compromise to lie dormant for a while though - if the compromise was injected nine months ago and a ticking clock was started then full image backups will essentially be useless - as soon as the image is restored then the attack will re-trigger. This probably lowers the domain that can be effected because many potential targets won't have vectors that could be compromised in a compatible manner.
- morpheuskafka 7y ago
  They wouldn't be useable as full image backups, but if the data had not been encrypted yet, then that data is stored somewhere in the image and can be recovered, albeit perhaps with a lot of work. If you use thin clients or at least require all files to be stored on a centralized server, then no matter how many hundreds of PCs were affected, you'd only have to go through on set of images.

chongli 7y ago

Yeah, I was going to say: the last company I worked for sent their backups off-site on a nightly basis. They were also often requesting old tapes to be pulled in for the next night's delivery/pickup so that they could test against old data. It would be pretty hard to get your ransomware to encrypt all those offsite backups sitting in a vault somewhere.

munk-a 7y ago

I wonder if it might be worth it for the compromise to lie dormant for a while though - if the compromise was injected nine months ago and a ticking clock was started then full image backups will essentially be useless - as soon as the image is restored then the attack will re-trigger. This probably lowers the domain that can be effected because many potential targets won't have vectors that could be compromised in a compatible manner.

morpheuskafka 7y ago
They wouldn't be useable as full image backups, but if the data had not been encrypted yet, then that data is stored somewhere in the image and can be recovered, albeit perhaps with a lot of work. If you use thin clients or at least require all files to be stored on a centralized server, then no matter how many hundreds of PCs were affected, you'd only have to go through on set of images.