10 ms·

Travelex being held to ransom by hackers

91 points by sjcsjc 7y ago

Scirra_Tom 7y ago
Devastating for them I imagine. Website offline since 31st December, purposefully timed attack for maximum disruption I would imagine. Looks like they had aspiration to IPO earlier in 2019, imagine this would now not be on the cards for a long time. I wonder how much the ransom is for. It appears to be an enormously damaging attack - I wonder if paying it is the best option for their business at this stage, then follow the money.
- rjmunro 7y ago
  The problem with paying it is that even if it works, and all the machines decrypt in a timely fashion, you have no idea if the attackers have left anything else in the network that they could use to enter again. You might not even find out the original entry point, and stop others following. Also it will be expensive.
  - zelon88 7y ago
    You still may never find the entry point if you don't recover the machines. Saudi Aramco and Maersk fell victim to similar ransomware attacks and practically had to start from scratch buying storage devices straight from manufacturers to get back online. NotPetya was so destructive it didn't leave behind much in the way of meaningful evidence. If you don't recover the encrypted data you probably won't recover evidence that points to patient zero anyway.
    - zerkten 7y ago
      Episodes 53 and 54 of https://darknetdiaries.com/episode/ https://darknetdiaries.com/episode/ are a good listen on this subject.
  - eli 7y ago
    A bigger problem is that you've now painted a huge target on your back as a company that is known to have security problems and pay ransoms.
- vrsfvwae5tbh 7y ago
  Finablr, Travelex's parent company IPO'd last year. Stock price is not looking too healthy today.
Angostura 7y ago
Most of the substantive reporting seems to point back to here: https://www.computerweekly.com/news/252476283/Cyber-gangsters-demand-payment-from-Travelex-after-Sodinokibi-attack https://www.computerweekly.com/news/252476283/Cyber-gangster...
LinuxBender 7y ago
This is probably a good reminder for everyone to ask how their customer data is backed up. Obvious your code is checked in to many git repos. Is your customer data on a server that automation can tamper with? If so, is a copy periodically written to a write-only destination that only a small number of people can manage, and then backed up to another location that a different group of people can manage? It probably also would not hurt to have a signed copy of a manifest that has checksums of all the files.
- Scoundreller 7y ago
  And a good reminder to get cash for your destination country before you get there where possible. The hole in the wall forex place near me has wayyyyyy better rates than an airport’s currency desk. Practically anyone does.
  - teagoat 7y ago
    I've found that typically the easiest and very close to the cheapest way to get foreign cash is to simply withdraw it from an ATM in the destination country. Always make sure that they're charging your bank in the local currency to avoid poor exchange rates. You'll usually pay a couple bucks at the ATM and a couple more at your bank (unless you use somebody like Charles Schwab), but even with a $5 surcharge, the market rate used usually beats out the rate you can get at a money changer or from your bank before you travel.
    - akamia 7y ago
      That's been my experience as well. Using credit cards when possible and withdrawing cash from ATMs are the two best ways to get a good exchange rate.
      - JeanMarcS 7y ago
        And if you can find places where there’s cashback, you can also skip the ATM fees
txcwpalpha 7y ago
The Travelex website said it was down due to "planned maintenance". Is that not an outright lie, since it was obviously down for other reasons? Is there anything preventing a company from lying about something like this?
- stronglikedan 7y ago
  No, and no, because they'd just say they started planning the maintenance as soon as they recognized the problem.
- mattlondon 7y ago
  In previous projects I have worked on many years ago, the "down for maintenance" page was the page that was automatically served by the reverse proxy whenever we took the backend app servers down for whatever reason (emergencies, planned releases etc) Granted this was years ago - I don't know what people do these days if all backend servers are unavailable. I guess the alternative to "planned maintenance" is the more-accurate message of "OMG - shit's on fire dude!" but that is not appropriate for corporate PR speak ;-) Sounds to me like someone probably got a "turn everything off while the police investigate - do not touch anything or we'll chop your fingers off/fire you" edict from management, so they wont even put up an unplanned-emergency message for fear of crossing-management/damaging evidence/screwing up while putting up a rushed message/letting hackers back in/etc
  - dustinmoris 7y ago
    This would be ok for the first hour/day when this happenend, but after a whole week when it's been clear that extremely sensitive customer information has been breached then this is not an acceptable response and/or excuse. They should put up a responsible message and pro-actively notify customers too. I hope they will get the highest possible fine for GDPR violations. This is an appalling response and treatment of customer data.
- kjaftaedi 7y ago
  Travelex operates in Europe and is bound by GDPR regulations. Travelex should have notified their supervisory authority within 72 hours of the breach, and are also required to notify end users in a timely manner. https://gdpr-info.eu/art-34-gdpr/ https://gdpr-info.eu/art-34-gdpr/ According to the article, end users still have not been notified. The lack of timely and proper notification as well as the misleading website information can be taken into account by the data protection authority in determining if the company should be fined, and the fines in question can be quite substantial.
fareesh 7y ago
What are the odds that they've exposed the personal information of thousands of airport travellers who have exchanged foreign currencies with them?
- Ligrev 7y ago
  Your guess is as good as anyone's. Given the way the communication is going, I'd say more likely than not. But the article says all computer systems are off which is clearly not the case so who knows...
- jiveturkey 7y ago
  Low in this case (read the CW article https://www.computerweekly.com/news/252476283/Cyber-gangsters-demand-payment-from-Travelex-after-Sodinokibi-attack https://www.computerweekly.com/news/252476283/Cyber-gangster...). The "ransom note" seems generic and it implies they aren't sophisticated data thieves, just disruptors. That said, there has been news of late that these kinds of attacks are indeed stepping up the value chain of stealing, selling, mining the data itself. But I would tend to think not, in this case, as the ransom note would have been much more severe.
- Scoundreller 7y ago
  I suppose most transactions don’t require ID. Maybe some countries require them for all. Anyone who pays the terrible airport rates for large conversions is probably laundering money. Literally every other option is better.
mattlondon 7y ago
Mini Ask HN: assuming you were designing a similar system, how would you design to prevent this happening? What would make your system "immune" from this sort of ransom attack so you could redeploy an be up and running again quickly? Sure there are the basic security hygiene steps etc, but what architectural steps can you take to combat this risk? I have some thoughts (e.g. append-only logs replicated in multiple places, everything 12-factor'd and containerised and ready to re-deploy at a moment's notice etc), but curious what prevailing wisdom is?
- Kalium 7y ago
  It's perhaps worth discussing the possibility that append-only logs replicated to multiple places may be likely to make the mishandling and theft of private data more likely, rather than less. The only real form of true immunity to private information theft is to have no private information. It's impossible to lose what you do not have. Everything else is layered controls and policies to detect, alarm, contain, deter, and otherwise enable you to deal with attacks as they come. That's what good defenses looks like for most companies - defense in depth. In practice, it often looks like aggressive patching policies and administrative controls coupled with careful monitoring, limited access to production, and regular audits. Security is a whole-enterprise problem, rather than a purely technical one that can be entirely addressed by code fixes.
  - rjmunro 7y ago
    Append-only logs replicated to multiple places is probably illegal under the GDPR. People have the right to demand all data about them is deleted, e.g. once they are no longer Travelex customers. An interesting question is would you rather your bank leaked some personal information about you, or would you rather they lost all your information, and therefore all of your money?
    - Kalium 7y ago
      Travelex, as a financial services company, is probably obligated to retain records. GDPR defers to these obligations. A company outside finance might definitely have these problems!
raesene9 7y ago
https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-hits-travelex-demands-3-million/ https://www.bleepingcomputer.com/news/security/sodinokibi-ra... has information about this being specific ransomware. One possible vector for the attack, from that article, is that apparently they had an unsecured pulse Secure VPN which has a known and quite nasty vulnerability, which is being actively exploited.
rajacombinator 7y ago
So the “camp out in airports and rip off naive travelers” company has bad tech? Shocking.
- joezydeco 7y ago
  That's a minor portion of their business, mostly to keep the name out there. The current business is in large B2B F/X transactions - friends of mine worked at a boutique firm in the midwest and both coasts (HIGHLY profitable) that was acquired by them in the 2000s.
ur-whale 7y ago
I find it interesting that the article makes no mention of why the hack was possible in the first place and how good or bad the security practices of Travelex were. Don't get me wrong, the criminals who conducted this should be tracked and brought to justice, but - to use an analogy - if your bank kept your hard-earned cash in a big pile next to the entrance door, wouldn't you feel a tad unhappy with the bank if it got stolen? And shoudldn't proper reporting paint a slightly more rounded picture of what actually happened (as in: how easy was it for the hackers to circumvent security measures at Travelex?)
nradov 7y ago
We need to make paying ransoms to hackers illegal. If that results in the victimized companies going bankrupt then that is an acceptable consequence pour encourager les autres.
- lallysingh 7y ago
  I think it has to come down to insurance-mandated security requirements.
- Scoundreller 7y ago
  And enforce it. Canada doesn’t let you pay hostage ransoms (per law), but has never charged anyone either.
jawns 7y ago
There is a very interesting wrinkle to this attack that I haven't heard of before, although I imagine this isn't the first attempt at it. Unlike typical ransomware, the threat isn't "we will delete all this data," but "we will sell all this data, and you will amass crippling fines under the GDPR regulations."
- Deimorz 7y ago
  Yeah, this is a relatively recent evolution of ransomware schemes: https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/ https://krebsonsecurity.com/2019/12/ransomware-gangs-now-out...
zrhswe 7y ago
I have no sympathy for them. They've charged extortionate exchange rates to travellers for decades, so now they get themselves extorted by hackers? Karmic justice.
olliej 7y ago
No they are not “weaponising GDPR”, they are simply making it more obvious which companies aren’t protecting your data.

91 points by sjcsjc 7y ago

Devastating for them I imagine. Website offline since 31st December, purposefully timed attack for maximum disruption I would imagine. Looks like they had aspiration to IPO earlier in 2019, imagine this would now not be on the cards for a long time. I wonder how much the ransom is for. It appears to be an enormously damaging attack - I wonder if paying it is the best option for their business at this stage, then follow the money.

rjmunro 7y ago
The problem with paying it is that even if it works, and all the machines decrypt in a timely fashion, you have no idea if the attackers have left anything else in the network that they could use to enter again. You might not even find out the original entry point, and stop others following. Also it will be expensive.
- zelon88 7y ago
  You still may never find the entry point if you don't recover the machines. Saudi Aramco and Maersk fell victim to similar ransomware attacks and practically had to start from scratch buying storage devices straight from manufacturers to get back online. NotPetya was so destructive it didn't leave behind much in the way of meaningful evidence. If you don't recover the encrypted data you probably won't recover evidence that points to patient zero anyway.
  - zerkten 7y ago
    Episodes 53 and 54 of https://darknetdiaries.com/episode/ https://darknetdiaries.com/episode/ are a good listen on this subject.
- eli 7y ago
  A bigger problem is that you've now painted a huge target on your back as a company that is known to have security problems and pay ransoms.
vrsfvwae5tbh 7y ago
Finablr, Travelex's parent company IPO'd last year. Stock price is not looking too healthy today.

Angostura 7y ago

Most of the substantive reporting seems to point back to here: https://www.computerweekly.com/news/252476283/Cyber-gangsters-demand-payment-from-Travelex-after-Sodinokibi-attack https://www.computerweekly.com/news/252476283/Cyber-gangster...

LinuxBender 7y ago

This is probably a good reminder for everyone to ask how their customer data is backed up. Obvious your code is checked in to many git repos. Is your customer data on a server that automation can tamper with? If so, is a copy periodically written to a write-only destination that only a small number of people can manage, and then backed up to another location that a different group of people can manage? It probably also would not hurt to have a signed copy of a manifest that has checksums of all the files.

Scoundreller 7y ago
And a good reminder to get cash for your destination country before you get there where possible. The hole in the wall forex place near me has wayyyyyy better rates than an airport’s currency desk. Practically anyone does.
- teagoat 7y ago
  I've found that typically the easiest and very close to the cheapest way to get foreign cash is to simply withdraw it from an ATM in the destination country. Always make sure that they're charging your bank in the local currency to avoid poor exchange rates. You'll usually pay a couple bucks at the ATM and a couple more at your bank (unless you use somebody like Charles Schwab), but even with a $5 surcharge, the market rate used usually beats out the rate you can get at a money changer or from your bank before you travel.
  - akamia 7y ago
    That's been my experience as well. Using credit cards when possible and withdrawing cash from ATMs are the two best ways to get a good exchange rate.
    - JeanMarcS 7y ago
      And if you can find places where there’s cashback, you can also skip the ATM fees

txcwpalpha 7y ago

The Travelex website said it was down due to "planned maintenance". Is that not an outright lie, since it was obviously down for other reasons? Is there anything preventing a company from lying about something like this?

stronglikedan 7y ago
No, and no, because they'd just say they started planning the maintenance as soon as they recognized the problem.
mattlondon 7y ago
In previous projects I have worked on many years ago, the "down for maintenance" page was the page that was automatically served by the reverse proxy whenever we took the backend app servers down for whatever reason (emergencies, planned releases etc) Granted this was years ago - I don't know what people do these days if all backend servers are unavailable. I guess the alternative to "planned maintenance" is the more-accurate message of "OMG - shit's on fire dude!" but that is not appropriate for corporate PR speak ;-) Sounds to me like someone probably got a "turn everything off while the police investigate - do not touch anything or we'll chop your fingers off/fire you" edict from management, so they wont even put up an unplanned-emergency message for fear of crossing-management/damaging evidence/screwing up while putting up a rushed message/letting hackers back in/etc
- dustinmoris 7y ago
  This would be ok for the first hour/day when this happenend, but after a whole week when it's been clear that extremely sensitive customer information has been breached then this is not an acceptable response and/or excuse. They should put up a responsible message and pro-actively notify customers too. I hope they will get the highest possible fine for GDPR violations. This is an appalling response and treatment of customer data.
kjaftaedi 7y ago
Travelex operates in Europe and is bound by GDPR regulations. Travelex should have notified their supervisory authority within 72 hours of the breach, and are also required to notify end users in a timely manner. https://gdpr-info.eu/art-34-gdpr/ https://gdpr-info.eu/art-34-gdpr/ According to the article, end users still have not been notified. The lack of timely and proper notification as well as the misleading website information can be taken into account by the data protection authority in determining if the company should be fined, and the fines in question can be quite substantial.

fareesh 7y ago

What are the odds that they've exposed the personal information of thousands of airport travellers who have exchanged foreign currencies with them?

Ligrev 7y ago
Your guess is as good as anyone's. Given the way the communication is going, I'd say more likely than not. But the article says all computer systems are off which is clearly not the case so who knows...
jiveturkey 7y ago
Low in this case (read the CW article https://www.computerweekly.com/news/252476283/Cyber-gangsters-demand-payment-from-Travelex-after-Sodinokibi-attack https://www.computerweekly.com/news/252476283/Cyber-gangster...). The "ransom note" seems generic and it implies they aren't sophisticated data thieves, just disruptors. That said, there has been news of late that these kinds of attacks are indeed stepping up the value chain of stealing, selling, mining the data itself. But I would tend to think not, in this case, as the ransom note would have been much more severe.
Scoundreller 7y ago
I suppose most transactions don’t require ID. Maybe some countries require them for all. Anyone who pays the terrible airport rates for large conversions is probably laundering money. Literally every other option is better.

mattlondon 7y ago

Mini Ask HN: assuming you were designing a similar system, how would you design to prevent this happening? What would make your system "immune" from this sort of ransom attack so you could redeploy an be up and running again quickly? Sure there are the basic security hygiene steps etc, but what architectural steps can you take to combat this risk? I have some thoughts (e.g. append-only logs replicated in multiple places, everything 12-factor'd and containerised and ready to re-deploy at a moment's notice etc), but curious what prevailing wisdom is?

Kalium 7y ago
It's perhaps worth discussing the possibility that append-only logs replicated to multiple places may be likely to make the mishandling and theft of private data more likely, rather than less. The only real form of true immunity to private information theft is to have no private information. It's impossible to lose what you do not have. Everything else is layered controls and policies to detect, alarm, contain, deter, and otherwise enable you to deal with attacks as they come. That's what good defenses looks like for most companies - defense in depth. In practice, it often looks like aggressive patching policies and administrative controls coupled with careful monitoring, limited access to production, and regular audits. Security is a whole-enterprise problem, rather than a purely technical one that can be entirely addressed by code fixes.
- rjmunro 7y ago
  Append-only logs replicated to multiple places is probably illegal under the GDPR. People have the right to demand all data about them is deleted, e.g. once they are no longer Travelex customers. An interesting question is would you rather your bank leaked some personal information about you, or would you rather they lost all your information, and therefore all of your money?
  - Kalium 7y ago
    Travelex, as a financial services company, is probably obligated to retain records. GDPR defers to these obligations. A company outside finance might definitely have these problems!

raesene9 7y ago

https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-hits-travelex-demands-3-million/ https://www.bleepingcomputer.com/news/security/sodinokibi-ra... has information about this being specific ransomware. One possible vector for the attack, from that article, is that apparently they had an unsecured pulse Secure VPN which has a known and quite nasty vulnerability, which is being actively exploited.

rajacombinator 7y ago

So the “camp out in airports and rip off naive travelers” company has bad tech? Shocking.

joezydeco 7y ago
That's a minor portion of their business, mostly to keep the name out there. The current business is in large B2B F/X transactions - friends of mine worked at a boutique firm in the midwest and both coasts (HIGHLY profitable) that was acquired by them in the 2000s.

ur-whale 7y ago

I find it interesting that the article makes no mention of why the hack was possible in the first place and how good or bad the security practices of Travelex were. Don't get me wrong, the criminals who conducted this should be tracked and brought to justice, but - to use an analogy - if your bank kept your hard-earned cash in a big pile next to the entrance door, wouldn't you feel a tad unhappy with the bank if it got stolen? And shoudldn't proper reporting paint a slightly more rounded picture of what actually happened (as in: how easy was it for the hackers to circumvent security measures at Travelex?)

nradov 7y ago

We need to make paying ransoms to hackers illegal. If that results in the victimized companies going bankrupt then that is an acceptable consequence pour encourager les autres.

lallysingh 7y ago
I think it has to come down to insurance-mandated security requirements.
Scoundreller 7y ago
And enforce it. Canada doesn’t let you pay hostage ransoms (per law), but has never charged anyone either.

jawns 7y ago

There is a very interesting wrinkle to this attack that I haven't heard of before, although I imagine this isn't the first attempt at it. Unlike typical ransomware, the threat isn't "we will delete all this data," but "we will sell all this data, and you will amass crippling fines under the GDPR regulations."

Deimorz 7y ago
Yeah, this is a relatively recent evolution of ransomware schemes: https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/ https://krebsonsecurity.com/2019/12/ransomware-gangs-now-out...

zrhswe 7y ago

I have no sympathy for them. They've charged extortionate exchange rates to travellers for decades, so now they get themselves extorted by hackers? Karmic justice.

olliej 7y ago

No they are not “weaponising GDPR”, they are simply making it more obvious which companies aren’t protecting your data.