5 ms·

They're not just outing them, they're dumping their data. That changes the risk dynamic significantly. Before, if you didn't pay, you didn't get your data bac

They're not just outing them, they're dumping their data. That changes the risk dynamic significantly. Before, if you didn't pay, you didn't get your data back. Now, you don't pay, they expose all your data to the world. For some companies, that will be a significantly more compelling reason to pay the ransom.

rev_null 7y ago
If you don't pay and they expose your data to the world, doesn't that mean you can effectively get it back without paying?
- turbostyler 7y ago
  Big brain time
- inetknght 7y ago
  What makes you think the data is complete and/or hasn't been poisoned?
- giancarlostoro 7y ago
  What if the data is highly proprietary and now all your competitors have access?
  - simcop2387 7y ago
    There are legal avenues you can use for that. the bigger danger (for most cases at least) is raised by your sibling, you can't trust the data anymore to be the same either innocently or maliciously.
jacquesm 7y ago
On the plus side, you get your data back. Kidding aside, these are serious breaches and it would be good to at least have the names of the companies out there. By law they were required to report anyway and the local authorities in turn would publish / fine. So downloading this data would be strictly off-limits but the names of the companies should be public so that people at least have a chance to know that they have been affected.
rolltiide 7y ago
One way of leaving it to the people to make the wealth trickle down!
tomp 7y ago
Looks like they're doing our job. First, the message was "backup your data". Now, they also added "encrypt your data"!
- jfengel 7y ago
  Does encryption really help? If they've compromised your system well enough to lock you out of it, aren't they likely to have nabbed your passwords in the process? Even if you were incredibly careful, there's not much you can do about a keylogger. If you could prevent a keylogger, you could lock them out entirely.
  - tomp 7y ago
    Maybe? AFAIK having more walls will result in less intrusions... Like, I imagine that you can delete/encrypt all the files simply by having a local username / network filesystem accesss. Doesn't necessarily mean you also managed to hack usernames/passwords/databases/source code... Each wall is another barrier to pass/hack!
    - cosmodisk 7y ago
      You can have 25 walls if you want but all it takes is Sally in accounts who thinks it's a good idea to open this one email attachment...If went rogue I'd probably be able to hack my company left and right and I'm not even remotely someone with those skills.
      - tomp 7y ago
        Relying on every employee to not do something "stupid" (i.e. stupid to us but how would a non-programmer know without extensive training) is a fundamentally flawed approach... Companies need to think about this, need to adapt processes to account for failure at as many levels as possible. "bus factor" and so on.
      - seventhtiger 7y ago
        If you're letting arbitrary attachments in and allowing arbitrary executables to run then Sally is the victim of gross incompetence. Everyone has jobs to do and they can't do them effectively if you need them to think through information security for every interaction. You have to build the rails and create a safe work area. User education is truly the last layer because if everything fails maybe the user will remember something we said. Rogue employees require a lot more traditional security and trust. Someone could always just physically destroy company property, and Sally could always approve fraudulent transactions, so you have to start there and it'll get you pretty far.
smsm42 7y ago
Shouldn't any breach like that automatically be treated as data breach? I mean, maybe the crooks wouldn't publish the data, but they certainly had access to it and could resell it to whoever is willing to pay anyway, even if you paid the ransom. There's no way to ensure that doesn't happen.
- jacquesm 7y ago
  Absolutely. Unless you still have ironclad logging showing that no data was transferred.

rev_null 7y ago

If you don't pay and they expose your data to the world, doesn't that mean you can effectively get it back without paying?

turbostyler 7y ago
Big brain time
inetknght 7y ago
What makes you think the data is complete and/or hasn't been poisoned?
giancarlostoro 7y ago
What if the data is highly proprietary and now all your competitors have access?
- simcop2387 7y ago
  There are legal avenues you can use for that. the bigger danger (for most cases at least) is raised by your sibling, you can't trust the data anymore to be the same either innocently or maliciously.

jacquesm 7y ago

On the plus side, you get your data back. Kidding aside, these are serious breaches and it would be good to at least have the names of the companies out there. By law they were required to report anyway and the local authorities in turn would publish / fine. So downloading this data would be strictly off-limits but the names of the companies should be public so that people at least have a chance to know that they have been affected.

rolltiide 7y ago

One way of leaving it to the people to make the wealth trickle down!

tomp 7y ago

Looks like they're doing our job. First, the message was "backup your data". Now, they also added "encrypt your data"!

jfengel 7y ago
Does encryption really help? If they've compromised your system well enough to lock you out of it, aren't they likely to have nabbed your passwords in the process? Even if you were incredibly careful, there's not much you can do about a keylogger. If you could prevent a keylogger, you could lock them out entirely.
- tomp 7y ago
  Maybe? AFAIK having more walls will result in less intrusions... Like, I imagine that you can delete/encrypt all the files simply by having a local username / network filesystem accesss. Doesn't necessarily mean you also managed to hack usernames/passwords/databases/source code... Each wall is another barrier to pass/hack!
  - cosmodisk 7y ago
    You can have 25 walls if you want but all it takes is Sally in accounts who thinks it's a good idea to open this one email attachment...If went rogue I'd probably be able to hack my company left and right and I'm not even remotely someone with those skills.
    - tomp 7y ago
      Relying on every employee to not do something "stupid" (i.e. stupid to us but how would a non-programmer know without extensive training) is a fundamentally flawed approach... Companies need to think about this, need to adapt processes to account for failure at as many levels as possible. "bus factor" and so on.
    - seventhtiger 7y ago
      If you're letting arbitrary attachments in and allowing arbitrary executables to run then Sally is the victim of gross incompetence. Everyone has jobs to do and they can't do them effectively if you need them to think through information security for every interaction. You have to build the rails and create a safe work area. User education is truly the last layer because if everything fails maybe the user will remember something we said. Rogue employees require a lot more traditional security and trust. Someone could always just physically destroy company property, and Sally could always approve fraudulent transactions, so you have to start there and it'll get you pretty far.

smsm42 7y ago

Shouldn't any breach like that automatically be treated as data breach? I mean, maybe the crooks wouldn't publish the data, but they certainly had access to it and could resell it to whoever is willing to pay anyway, even if you paid the ransom. There's no way to ensure that doesn't happen.

jacquesm 7y ago
Absolutely. Unless you still have ironclad logging showing that no data was transferred.