4 ms·
How do you know they weren't already paying at least two engineers to fortify their systems?
by lern_too_spel 6y ago
How do you know they weren't already paying at least two engineers to fortify their systems?
- mensetmanusman 6y agoHmm. I’m guessing not having backups means they may have been paying one person but also giving that person way too many responsibilities such that they couldn’t focus on doing a backup well.
- jaclaz 6y agoThey did have the backups, the ransomware was paid for (maybe) not having the stolen data published/sold. >The university said its staff restored from backups; however, the ransomware gang threatened to release student-related data online, which, in turn, made university management re-think their approach towards not paying the attackers.
- Klinky 6y agoEven worse, because we can totally trust data can't be copied or released once an extortionist ransom is paid to malevolent hackers. I am sure this ransomware gang is on the up and up and operating in a good faith to honor the agreement. In a few months we may see "University of Utah pays another $457k to the same ransomware gang".
- AnIdiotOnTheNet 6y agoIt is not in the best interest of the ransomware gang to ignore their part of the bargain. If that second headline happens, it will be a signal to every one of their future victims that they will not honor agreements and you're better off not paying them. This is why the vast majority of encryption-based ransomware puts a lot of effort into ensuring they really can decrypt your files after you pay them.
- folmar 6y agoI see very little chance of gang successfully identifying itself to the victim in a credible way.
- winkeltripel 6y agoPublic keys seem to work pretty well. I haven't a clue as to why a gang can't use public key encryption.
- Klinky 6y agoRansomware extortion artists have already been proven to be hit or miss when it comes to following through on what they promised. The whole concern about releasing this data to the internet is that it'd end up in the hands of bad actors, but uhhhh the damage is already done if the bad actors already have the data. Do the students really feel comfortable that only one gang of nefarious hackers have their data?
- R0b0t1 6y agoThe ransom was paid by an insurance provider, so they were at least doing something to acquire coverage.
- pc86 6y agoPart of it. They covered the rest.
- paulpauper 6y agoprobably insurance is cheaper than hiring sec experts
- adrr 6y agoInsurance coverage is common. Depending on coverage amount may require independent audits.
- exdsq 6y agoThe fact they have backups is litterally at the top of the article...
- mensetmanusman 6y agoWups! I assumed ransomware was always a class of attack wherein non backed up data was at risk. This seems like a failed ransomware attack where the university just got unencrypted information stolen that they didn’t want released.
- ziddoap 6y ago>a class of attack wherein non backed up data was at risk Ransomware is just the act of preventing access to data, with the access being reinstated after paying a fee to the attacker. Generally accomplished by encryption. Whether or not the victim has mitigations, backups, etc. holds no relevance to the class of attack. >This seems like a failed ransomware attack It's not really a failed ransomware attack. The attack was successful (they were able to encrypt some data), followed by successful reinstatement of access to the data by using backups, followed by successful extortion by the attacker.
- sgustard 6y agoHow do you know those two engineers aren't $457k richer now?