13 ms·

Hackers extorted $1.14M from UCSF

247 points by Pick-A-Hill2019 6y ago

coderintherye 6y ago
Previous discussion here: https://news.ycombinator.com/item?id=23659590 https://news.ycombinator.com/item?id=23659590 And discussion from years back when they outsourced all of their IT: https://news.ycombinator.com/item?id=12870150 https://news.ycombinator.com/item?id=12870150
spzb 6y ago
Story is from June
stygiansonic 6y ago
Seems like randomware negotiation has become a professional service. See: https://www.prnewswire.com/news-releases/groupsense-launches-ransomware-negotiation-services-301139570.html https://www.prnewswire.com/news-releases/groupsense-launches... The negotiations here were similar to the ones CWT had, albeit a little less courteous: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W https://www.reuters.com/article/us-cyber-cwt-ransom/payment-...
jrochkind1 6y ago
> And an anonymous tip-off enabled BBC News to follow the ransom negotiations in a live chat on the dark web. So, that "anonymous tip-off" was obviously from the hackers, right? I guess the other option is a "whistleblower" at UCSF (would anyone else know about it?), but the hackers have a lot to benefit from everyone knowing about it, so next victim thinks "Gee, respected institutions like UCSF are willing to pay the ransom and didn't have the capability to recover otherwise, we should probably just pay the ransom too".
- dannyw 6y ago
  It’s also possible the darknet site is poorly secured and you can iterate through all conversations with some URL incrementing.
  - luckylion 6y ago
    That would still require someone to tell the BBC. I doubt that the BBC routinely enumerates hidden services and then looks to enumerate all potential chat rooms and randomly stumbled upon a negotiation.
    - dannyw 6y ago
      Security researchers do it all the time.
- riffic 6y ago
  the whistleblower option is the most probable one, isn't it? Universities have to operate in a transparent manner and have no incentive to obscure facts here.
  - jrochkind1 6y ago
    It doesn't sound like the university publicly and transparently revealed this -- the BBC wouldn't have to be cagey about how they listened in on the chat if that were true, they could just say "according to UCSF". But it wasn't that, it was an "anonymous tip-off". So we already know the university was not being transparent and open about it. When I say "whistleblower", I mean someone who secretly gave the BBC the info and remains secret because they weren't supposed to and would be disciplined at work for it. The university has PLENTY of incentive to obscure facts here, because the official line is that it's immoral to pay hackers like this (it encourages future hacks, law enforcement says not to do it), and because it reveals them as having made IT mistakes that led to a ransomware takeover where they decided their best/cheapest recovery option was to pay up (instead of restoring from backups etc). It does not make them look good to have paid up, that's plenty of incentive to not want the BBC to report it. Also, having spent many years working for universities, I think it's kind of cute that you think they "have to operate in a transparent manner." Would that it were true.
  - csense 6y ago
    > have no incentive to obscure facts They do. They got hacked, it makes them look incompetent. People might call for some of the staff to be fired for not having security or backups. Prospective students, research participants, etc. might hesitate to go to UCSF if their data's going to be exposed. Also, they paid the ransom. Funding sources from alumni to state legislatures might hesitate to give more dollars, if the university's using its money to pay off extortionists as opposed to improving education or lowering tuition. The university has lots of reasons to hide what happened.
- sbassi 6y ago
  some ramsomeware like Netwalker has public forums with announces, so the tip may come from anybody not involved with any of the 2 parties.
  - jrochkind1 6y ago
    Sounds like BBC literally eavesdropped on the chat, they were able to login to the chat. I'm doubting the public forum announcements give the public info to log into a chat where the hackers are negotiating with the target!
jeffbee 6y ago
Pretty remarkable that this data was worth at least a million dollars to UCSF, but it apparently wasn't worth paying for backups, or hiring IT staff who aren't idiots.
- _wldu 6y ago
  I think the idea is to pay them to not publicly release it rather than to get it back.
  - anthony_doan 6y ago
    Yeah this probably it since UCSF is the UC for only grad, no undergrad, and for medical. Those data could be HIPAA related.
    - gowld 6y ago
      Doesn't matter. HIPAA is already violated.
- hn_throwaway_99 6y ago
  > or hiring IT staff who aren't idiots. I hate comments like this. It seems quite prevalent in the software dev field to constantly shit on other developers while having 0 information about what the source of the issue was.
  - NegativeLatency 6y ago
    Probably should've been directed at the mangers/department head (not devs), but not having backups is most definitely not professional. EDIT: The CIO or whatever the title is makes $460K per year so they should for sure know to have and be responsible for proper backup/restore functionality.
  - throwaway749294 6y ago
    Well, they did gut their IT staff four years ago to replace them with low paid foreign workers. And reading the poor spelling and grammar in the negotiations makes me wonder if that’s somehow related.
ghjdrt 6y ago
Again, the Digital currency is a big thread to our society.
brian_herman__ 6y ago
I misread this as US CHESS Federation.
- JackFr 6y ago
  If US Chess Federation had a budget in the billions, that'd be a story by itself.
abeppu 6y ago
This article makes the point that law enforcement agencies take the stance that paying a ransom further encourages this behavior from hackers. In the case of state or public institutions like this, would it be advisable for legislatures to make it illegal for state entities to pay ransoms, and then very publicly announce these laws? I.e. can/should we make credible, public commitments in advance to not pay ransom, or to remove that choice from the organization-level administrators? Would this make these organizations less appealing targets? "Sorry, we are not authorized to pay you any ransom due to SB-XYZ. If you can get several hundred thousand signatures from CA residents to petition for a referendum to overturn this law, we may be able to pay you a ransom after ... well not the upcoming election but maybe the one after that."
- ajpkco 6y ago
  This doesn't work in practice, companies that aren't allowed to pay those ransoms usually use proxies (some other company that doesn't have to follow those restrictions) that will pay the hackers
  - archgoon 6y ago
    Isn't this the same problem that money laundering laws have to solve? It's hard, but its not insurmountable.
    - bilbo0s 6y ago
      Money laundering has the benefit of Federal law working to help the State laws. I think in an environment where there are 50 different legal regimes it's inevitable people will develop workarounds. You see legal arbitrage in every instance where legal differences exist between states. From corporate law to family law. I don't know why this would be any different. If you want to stop the hackers, make it a Federal crime to pay anyone. In that environment, there would be no circumventing the restriction at all.
      - JackFr 6y ago
scott-smith_us 6y ago
It really bugs me when I hear of institutions paying these ransoms. Regardless of the damage, I'd just take the bullet, fix my security, and not pay. Be consistent in this, and keep it up for a while. Long term: no more extortion for anyone.
- gowld 6y ago
  You can't retroactively fix your security. It can take a lot money (well spent, so that's fine) and time (which can be devastating) to recover the compromised system.
- gk1 6y ago
  > Regardless of the damage, I'd just take the bullet, fix my security, and not pay. It's irrational to "bite the bullet" if the damage is significantly greater than the ransom. Sure, it's better in the long term, but not for the person/organization being ransomed.
  - reaperducer 6y ago
    It's irrational to "bite the bullet" if the damage is significantly greater than the ransom. It's not irrational. It's called doing the right thing. Sure, it's better in the long term, but not for the person/organization being ransomed. That's called being selfish. One would expect an institution like UCSF to act for the benefit of all of society and not like a six-year-old grabbing all the Easter eggs at the hunt and saying, "I got mine!"
    - recursive 6y ago
      What you call "selfish" is also known by some as "rational". Maybe that will help.
      - jbm 6y ago
        We can't survive in a society where min/maxing benefit is the sole form by which we determine whether something is the correct action or not. I am sure you would agree that gender-based abortion, deforestation, and infinite copyright periods could be seen as "rational" to people in certain societies and certain economic situations. It doesn't mean that we should let such actions go without comment.
gowld 6y ago
These are acts of war by foreign entities against US citizens, hospitals, and governments. The lack of military response is dumbfounding and unacceptable. The NSA is recording every byte of data crossing our borders, and also much internal traffic, and they are unable or unwilling to track down these perpetrators?
- bovermyer 6y ago
  They're not always state actors, though. Sometimes it's just sociopaths who happen to be really good at compromising systems. Also, assuming the NSA has a copy of every byte of network data ever sent through the USA, that's a LOT of data. Processing that takes time.
tinyhouse 6y ago
What a shame the keep paying those hackers.
- deleted 6y ago
  [deleted]
stevebmark 6y ago
It's hard to empathize with a corrupt entity that makes billions a year from swindling students and patients, all while maintaining a non-profit status. Par for the course with universities and large hospitals. Profit focused corruption leads them to not paying a good IT team.
Vladi00 6y ago
Today's hackers are just like the pirates, robbers and thieves of the past. Many will find graish zones (e.g. software piracy) hoping to go undetected. Others will take high risk, high rewards (e.g. computer extortion, etc).
DevX101 6y ago
Attacks like this make me think there's a real ($1+ billion opportunity) business in making an tech-first insurance company for security incidents. Write insurance policies to major companies. But as a pre-condition for getting under-written you have to submit to periodic security review by legit security pros. Failure to adhere to security recommendations means your policy gets dropped.
- colejohnson66 6y ago
  I think those already exist. I’ve heard claims of insurance companies refusing to pay out for ransomware because they should’ve had backups (they’ll pay for recovery from backups, but not ransom).
- lawnchair_larry 6y ago
  That insurance already exists. Periodic review by security pros is pretty much worthless, however. Nearly every company that has been hit had review by security pros, and many had compliance certifications.
  - DevX101 6y ago
    How good are these reviews really? I'm thinking of top tier security pros on the calibre of Project Zero/Google. Doubt most hacks would have gotten past a thorough audit by those folks.
    - dboreham 6y ago
      This is the point. Any review process that's sufficiently mechanical to be duplicated at scale becomes a box-[ticking|checking] exercise with little actual value. E.g. you can verify that backups are made and can be restored but how do you find mission critical data that isn't subject to backup?
    - Veserv 6y ago
      No material difference from a defense perspective. Offensive prowess does not result in defensive prowess. Just look at the Android bug bounty program [1], only $250K for an remote kernel arbitrary code execution, or Apple [2], $250K for a one-click kernel arbitrary code execution. To be fair though, that is on the high end of security, you could probably totally compromise any Fortune 500 company for less than that. And no, I am not joking or exaggerating that is actually a serious statement. Really all these audits do is validate your security. If they find something at a price point then you are probably vulnerable at that price point. Think of it like a live-fire test of a bulletproof vest against a gun. If a bullet goes through then you probably can not protect against that. If it does not go through, you still can not be certain that it actually does provide comprehensive defense against that gun and bullet, but it is at least not totally ineffective. In the current state of the industry, any competent audit will find multiple critical vulnerabilities at these price points. It is like shooting an airsoft pellet at a "bulletproof vest" and seeing it pierce through. It is so fundamentally flawed that testing against a real gun (better offensive specialist) is kind of meaningless since to actually solve the problems you already need to completely redesign everything. Unfortunately, most companies who get such audits done think the takeaway is that the places the airsoft pellet went through must be the only problems, so if they just patch them up then everything else must be good because nothing pierced those other pieces instead of realizing that observable quality defects in one place probably means there are many unobserved quality defects in other places. [1] https://www.google.com/about/appsecurity/android-rewards/ https://www.google.com/about/appsecurity/android-rewards/ [2] https://developer.apple.com/security-bounty/ https://developer.apple.com/security-bounty/
ttul 6y ago
Email your congressman/woman: Paying extortion fees cybercriminals should be illegal - and severely so. With the stroke of a pen, a law making the practice illegal would immediately allow every institution and corporation in America to say, "We cannot pay your fee no matter how hard you press us, as we would face jail time if we did so." Would gangs still try to extort people? Of course. But large institutions would no longer be a target, because their internal controls would prevent the payment of extortion fees. Small organizations might still pay fees, but the potential take for gangs would be reduced remarkably.
- jimbob45 6y ago
  “We do not negotiate with terrorists” sounds like a great line but isn’t always practical in reality. If many people’s lives were on the line because of this hack, it would be difficult to justify not paying the fairly small ransom.
  - gnopgnip 6y ago
    If they were terrorists, sanctioned by the US government it is already illegal.
    - powersnail 6y ago
      Does the US government not exchange hostages with terrorists?
- abeppu 6y ago
  I think this is an interesting direction, but I wonder is there a successful precedent for something like this? Perhaps some government somewhere in the world has already tried this? And if not for hacking, data theft/encryption, maybe there are analogues like (and this is a stretch) large organizations that have managed to continue operating in regions where kidnapping for ransom is common?
  - greeneggs 6y ago
fortran77 6y ago
Well, they extorted it from Taxpayers. What does UCSF care?
deleted 6y ago
[deleted]
aborsy 6y ago
Can’t NSA (or FBI) track down these attackers, or help decrypt the data? At least then it makes a useful service for the public, also clears doubts on its crypto capabilities.
- cortexio 6y ago
  euuh no. Skillful hackers can remove their tracks 100% and decrypting is impossible unless u have a few thousand years depending on the encryption method. Just secure your computers/servers so unauthorized software cant be installed or executed. And maybe some IQ training for the people there, so they dont open stupid shit from their mailbox or the web.
atishay811 6y ago
A more capitalist solution to the random ware problem could be ransomware insurance ideally mandated. You get hit and the company pays. But your premium rises the next time and till forever. You can get premium incentives to do audits and update software. Lower premiums show up in the balance sheet as profit and therefore there is immediate incentive to act on security issues. The insurance company has enough incentive to track the victim that some action might get taken.
VectorLock 6y ago
US Treasury announced recently "Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments." I wonder if these will reduce these kind of payments in the future, which seemed to really be ramping up. https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf https://home.treasury.gov/system/files/126/ofac_ransomware_a...
Woodi 6y ago
And what about backups ? Is it cheaper to pay ransom then reinstall and copy data ? And then cut off f* internet until some security is in place ?? If that ransomware uses something like flash for persistence why not ask some jury to enforce hardware manufacturers to stop enabling worse and worse viruses ? Floppies, cd autoplay, usb, firewire, thunderbolt, 5G networking - everything exploitable right from the factory.
- tlogan 6y ago
  Actually, setting up a proper backup is last thing business want to spend money on. Why do you think there is so many "increase your sales" products and so very few "backup" products?
naveen99 6y ago
Enterprises generally go too far in the direction of restricting data access and copies of data, making themselves more fragile. They should outsource custodianship of data or do like what aws etc do, proper backups and fail tolerance.
SommaRaikkonen 6y ago
Hi, I'm not sure if my comment will be read since there are a lot of them already, but what would the best move be for a medium-sized company in this situation? Hypothetically, the fees won't be as astronomical like in UCSF's case but the importance of the data being held in ransom will still be the same. Should they take the risk of getting their financial/healthcare/IT data uploaded to the public if they don't pay the fee?
TacticalCoder 6y ago
So the bad guys used a public ledger (Bitcoin) to get paid? Why aren't the hackers asking for cryptocurrencies using zero-knowledge proofs like ZCash or Monero? Bitcoin? What's their plan next? I'm not saying you can't get away with this (there are coin "mixers" and decentralized exchanges) but still, this leaves lots of traces left and right. For example we saw a lot of people getting busted recently while they thought they were smart using cryptocurrencies, including a money launderer ring... And they were using mixers, decentralized exchanges, people located overal several countries/continents and whatnots if I recall correctly. Yet: all busted. For all we known in six months the headline could be: "Hackers who extorted 1.14M USD from UCSF arrested by Interpol" Besides that: what happened to offline backups? How exactly are hackers coming for cloned, unplugged, HDDs/SSDs stored on shelves / bank safes? (I know several companies doing just that as offline backups) I hope this serves as a wake up call to companies/institutions either not doing backup properly or outsourcing to incompetent companies not doing backups properly (the latter being not really excusable).
- SirYandi 6y ago
  I've wondered about this as well. What's stopping such criminals from purchasing Monero with the Bitcoin. Would that be enough to anonymize?
  - Zenbit_UX 6y ago
    Indeed, I imagine a service that accepts bitcoin and provides you monero would instantly anonymize you. To outside observers it would look like you sent the BTC to an exchange and they'd continue following them to innocent wallets while you've hopped off the network entirely.
- xur17 6y ago
  > So the bad guys used a public ledger (Bitcoin) to get paid? Why aren't the hackers asking for cryptocurrencies using zero-knowledge proofs like ZCash or Monero? Bitcoin? What's their plan next? I imagine they chose Bitcoin because it's the most liquid - they can just tell their victims to go to Coinbase or any cryptocurrency exchange to acquire it. If they ask for Zcash, the options are a lot more slim.
naveen99 6y ago
Maybe single source of truth has some downsides, like single point of vulnerability.
diebeforei485 6y ago
Well, didn't they fire tech staff and outsource the work? Sounds like it might not have been the best decision in hindsight.
hankchinaski 6y ago
now the question is, did they have an insurance in place? who will be held (legally and financially) accountable for the incident?
tmpz22 6y ago
So they outsourced all their IT to save money then got randomwared.
deleted 6y ago
[deleted]
arcticbull 6y ago
I for one love to see Bitcoin getting so much widespread adoption. That's the real story here.
silexia 6y ago
Establish a global death penalty for this crime.
brongondwana 6y ago
Filesystems that make this possible are the real crime against sanity. Most of the data would be stored on network shares, and the ransomware pulls the files, encrypts them, stores them back to the network share overwriting the original copy. Madness. Yes disk space isn't cheap, until you see the alternative. We have a basic network filestore at Fastmail, it's not even a key part of our offering, but it stores up to 30 old copies and if you keep overwriting it does exponential backoff so you have the oldest copy in the past 2 weeks, plus one from a week ago, plus one from 3 days ago, etc up until a bunch of very recent copies. Ransomware would have to be running for 2 weeks to wipe out all the original files - and during that time the massive increase in disk usage would alert operations to something going on! Likewise our email server software does integrity checks during replication between machines and won't perma-delete anything for a week after it gets expunged - and message content is immutable after writing, so changing anything is creating a new record and expunging the old one. It costs extra space - but being safe against a client virus like this encrypting all the data on network shares isn't rocket science, and the network filesystem vendors who don't default to data safety are as much to blame as anybody for this still being a problem in $CURRENT_YEAR.
sam1r 6y ago
This is from June...

Previous discussion here: https://news.ycombinator.com/item?id=23659590 https://news.ycombinator.com/item?id=23659590 And discussion from years back when they outsourced all of their IT: https://news.ycombinator.com/item?id=12870150 https://news.ycombinator.com/item?id=12870150

spzb 6y ago

Story is from June

stygiansonic 6y ago

Seems like randomware negotiation has become a professional service. See: https://www.prnewswire.com/news-releases/groupsense-launches-ransomware-negotiation-services-301139570.html https://www.prnewswire.com/news-releases/groupsense-launches... The negotiations here were similar to the ones CWT had, albeit a little less courteous: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W https://www.reuters.com/article/us-cyber-cwt-ransom/payment-...

jrochkind1 6y ago

> And an anonymous tip-off enabled BBC News to follow the ransom negotiations in a live chat on the dark web. So, that "anonymous tip-off" was obviously from the hackers, right? I guess the other option is a "whistleblower" at UCSF (would anyone else know about it?), but the hackers have a lot to benefit from everyone knowing about it, so next victim thinks "Gee, respected institutions like UCSF are willing to pay the ransom and didn't have the capability to recover otherwise, we should probably just pay the ransom too".

dannyw 6y ago
It’s also possible the darknet site is poorly secured and you can iterate through all conversations with some URL incrementing.
- luckylion 6y ago
  That would still require someone to tell the BBC. I doubt that the BBC routinely enumerates hidden services and then looks to enumerate all potential chat rooms and randomly stumbled upon a negotiation.
  - dannyw 6y ago
    Security researchers do it all the time.
riffic 6y ago
the whistleblower option is the most probable one, isn't it? Universities have to operate in a transparent manner and have no incentive to obscure facts here.
- jrochkind1 6y ago
  It doesn't sound like the university publicly and transparently revealed this -- the BBC wouldn't have to be cagey about how they listened in on the chat if that were true, they could just say "according to UCSF". But it wasn't that, it was an "anonymous tip-off". So we already know the university was not being transparent and open about it. When I say "whistleblower", I mean someone who secretly gave the BBC the info and remains secret because they weren't supposed to and would be disciplined at work for it. The university has PLENTY of incentive to obscure facts here, because the official line is that it's immoral to pay hackers like this (it encourages future hacks, law enforcement says not to do it), and because it reveals them as having made IT mistakes that led to a ransomware takeover where they decided their best/cheapest recovery option was to pay up (instead of restoring from backups etc). It does not make them look good to have paid up, that's plenty of incentive to not want the BBC to report it. Also, having spent many years working for universities, I think it's kind of cute that you think they "have to operate in a transparent manner." Would that it were true.
- csense 6y ago
  > have no incentive to obscure facts They do. They got hacked, it makes them look incompetent. People might call for some of the staff to be fired for not having security or backups. Prospective students, research participants, etc. might hesitate to go to UCSF if their data's going to be exposed. Also, they paid the ransom. Funding sources from alumni to state legislatures might hesitate to give more dollars, if the university's using its money to pay off extortionists as opposed to improving education or lowering tuition. The university has lots of reasons to hide what happened.
sbassi 6y ago
some ramsomeware like Netwalker has public forums with announces, so the tip may come from anybody not involved with any of the 2 parties.
- jrochkind1 6y ago
  Sounds like BBC literally eavesdropped on the chat, they were able to login to the chat. I'm doubting the public forum announcements give the public info to log into a chat where the hackers are negotiating with the target!

jeffbee 6y ago

Pretty remarkable that this data was worth at least a million dollars to UCSF, but it apparently wasn't worth paying for backups, or hiring IT staff who aren't idiots.

_wldu 6y ago
I think the idea is to pay them to not publicly release it rather than to get it back.
- anthony_doan 6y ago
  Yeah this probably it since UCSF is the UC for only grad, no undergrad, and for medical. Those data could be HIPAA related.
  - gowld 6y ago
    Doesn't matter. HIPAA is already violated.
hn_throwaway_99 6y ago
> or hiring IT staff who aren't idiots. I hate comments like this. It seems quite prevalent in the software dev field to constantly shit on other developers while having 0 information about what the source of the issue was.
- NegativeLatency 6y ago
  Probably should've been directed at the mangers/department head (not devs), but not having backups is most definitely not professional. EDIT: The CIO or whatever the title is makes $460K per year so they should for sure know to have and be responsible for proper backup/restore functionality.
- throwaway749294 6y ago
  Well, they did gut their IT staff four years ago to replace them with low paid foreign workers. And reading the poor spelling and grammar in the negotiations makes me wonder if that’s somehow related.

ghjdrt 6y ago

Again, the Digital currency is a big thread to our society.

brian_herman__ 6y ago

I misread this as US CHESS Federation.

JackFr 6y ago
If US Chess Federation had a budget in the billions, that'd be a story by itself.

abeppu 6y ago

This article makes the point that law enforcement agencies take the stance that paying a ransom further encourages this behavior from hackers. In the case of state or public institutions like this, would it be advisable for legislatures to make it illegal for state entities to pay ransoms, and then very publicly announce these laws? I.e. can/should we make credible, public commitments in advance to not pay ransom, or to remove that choice from the organization-level administrators? Would this make these organizations less appealing targets? "Sorry, we are not authorized to pay you any ransom due to SB-XYZ. If you can get several hundred thousand signatures from CA residents to petition for a referendum to overturn this law, we may be able to pay you a ransom after ... well not the upcoming election but maybe the one after that."

ajpkco 6y ago
This doesn't work in practice, companies that aren't allowed to pay those ransoms usually use proxies (some other company that doesn't have to follow those restrictions) that will pay the hackers
- archgoon 6y ago
  Isn't this the same problem that money laundering laws have to solve? It's hard, but its not insurmountable.
  - bilbo0s 6y ago
    Money laundering has the benefit of Federal law working to help the State laws. I think in an environment where there are 50 different legal regimes it's inevitable people will develop workarounds. You see legal arbitrage in every instance where legal differences exist between states. From corporate law to family law. I don't know why this would be any different. If you want to stop the hackers, make it a Federal crime to pay anyone. In that environment, there would be no circumventing the restriction at all.
    - JackFr 6y ago

scott-smith_us 6y ago

It really bugs me when I hear of institutions paying these ransoms. Regardless of the damage, I'd just take the bullet, fix my security, and not pay. Be consistent in this, and keep it up for a while. Long term: no more extortion for anyone.

gowld 6y ago
You can't retroactively fix your security. It can take a lot money (well spent, so that's fine) and time (which can be devastating) to recover the compromised system.
gk1 6y ago
> Regardless of the damage, I'd just take the bullet, fix my security, and not pay. It's irrational to "bite the bullet" if the damage is significantly greater than the ransom. Sure, it's better in the long term, but not for the person/organization being ransomed.
- reaperducer 6y ago
  It's irrational to "bite the bullet" if the damage is significantly greater than the ransom. It's not irrational. It's called doing the right thing. Sure, it's better in the long term, but not for the person/organization being ransomed. That's called being selfish. One would expect an institution like UCSF to act for the benefit of all of society and not like a six-year-old grabbing all the Easter eggs at the hunt and saying, "I got mine!"
  - recursive 6y ago
    What you call "selfish" is also known by some as "rational". Maybe that will help.
    - jbm 6y ago
      We can't survive in a society where min/maxing benefit is the sole form by which we determine whether something is the correct action or not. I am sure you would agree that gender-based abortion, deforestation, and infinite copyright periods could be seen as "rational" to people in certain societies and certain economic situations. It doesn't mean that we should let such actions go without comment.

gowld 6y ago

These are acts of war by foreign entities against US citizens, hospitals, and governments. The lack of military response is dumbfounding and unacceptable. The NSA is recording every byte of data crossing our borders, and also much internal traffic, and they are unable or unwilling to track down these perpetrators?

bovermyer 6y ago
They're not always state actors, though. Sometimes it's just sociopaths who happen to be really good at compromising systems. Also, assuming the NSA has a copy of every byte of network data ever sent through the USA, that's a LOT of data. Processing that takes time.

tinyhouse 6y ago

What a shame the keep paying those hackers.

deleted 6y ago
[deleted]

stevebmark 6y ago

It's hard to empathize with a corrupt entity that makes billions a year from swindling students and patients, all while maintaining a non-profit status. Par for the course with universities and large hospitals. Profit focused corruption leads them to not paying a good IT team.

Vladi00 6y ago

Today's hackers are just like the pirates, robbers and thieves of the past. Many will find graish zones (e.g. software piracy) hoping to go undetected. Others will take high risk, high rewards (e.g. computer extortion, etc).

DevX101 6y ago

Attacks like this make me think there's a real ($1+ billion opportunity) business in making an tech-first insurance company for security incidents. Write insurance policies to major companies. But as a pre-condition for getting under-written you have to submit to periodic security review by legit security pros. Failure to adhere to security recommendations means your policy gets dropped.

colejohnson66 6y ago
I think those already exist. I’ve heard claims of insurance companies refusing to pay out for ransomware because they should’ve had backups (they’ll pay for recovery from backups, but not ransom).
lawnchair_larry 6y ago
That insurance already exists. Periodic review by security pros is pretty much worthless, however. Nearly every company that has been hit had review by security pros, and many had compliance certifications.
- DevX101 6y ago
  How good are these reviews really? I'm thinking of top tier security pros on the calibre of Project Zero/Google. Doubt most hacks would have gotten past a thorough audit by those folks.
  - dboreham 6y ago
    This is the point. Any review process that's sufficiently mechanical to be duplicated at scale becomes a box-[ticking|checking] exercise with little actual value. E.g. you can verify that backups are made and can be restored but how do you find mission critical data that isn't subject to backup?
  - Veserv 6y ago
    No material difference from a defense perspective. Offensive prowess does not result in defensive prowess. Just look at the Android bug bounty program [1], only $250K for an remote kernel arbitrary code execution, or Apple [2], $250K for a one-click kernel arbitrary code execution. To be fair though, that is on the high end of security, you could probably totally compromise any Fortune 500 company for less than that. And no, I am not joking or exaggerating that is actually a serious statement. Really all these audits do is validate your security. If they find something at a price point then you are probably vulnerable at that price point. Think of it like a live-fire test of a bulletproof vest against a gun. If a bullet goes through then you probably can not protect against that. If it does not go through, you still can not be certain that it actually does provide comprehensive defense against that gun and bullet, but it is at least not totally ineffective. In the current state of the industry, any competent audit will find multiple critical vulnerabilities at these price points. It is like shooting an airsoft pellet at a "bulletproof vest" and seeing it pierce through. It is so fundamentally flawed that testing against a real gun (better offensive specialist) is kind of meaningless since to actually solve the problems you already need to completely redesign everything. Unfortunately, most companies who get such audits done think the takeaway is that the places the airsoft pellet went through must be the only problems, so if they just patch them up then everything else must be good because nothing pierced those other pieces instead of realizing that observable quality defects in one place probably means there are many unobserved quality defects in other places. [1] https://www.google.com/about/appsecurity/android-rewards/ https://www.google.com/about/appsecurity/android-rewards/ [2] https://developer.apple.com/security-bounty/ https://developer.apple.com/security-bounty/

ttul 6y ago

Email your congressman/woman: Paying extortion fees cybercriminals should be illegal - and severely so. With the stroke of a pen, a law making the practice illegal would immediately allow every institution and corporation in America to say, "We cannot pay your fee no matter how hard you press us, as we would face jail time if we did so." Would gangs still try to extort people? Of course. But large institutions would no longer be a target, because their internal controls would prevent the payment of extortion fees. Small organizations might still pay fees, but the potential take for gangs would be reduced remarkably.

jimbob45 6y ago
“We do not negotiate with terrorists” sounds like a great line but isn’t always practical in reality. If many people’s lives were on the line because of this hack, it would be difficult to justify not paying the fairly small ransom.
- gnopgnip 6y ago
  If they were terrorists, sanctioned by the US government it is already illegal.
  - powersnail 6y ago
    Does the US government not exchange hostages with terrorists?
abeppu 6y ago
I think this is an interesting direction, but I wonder is there a successful precedent for something like this? Perhaps some government somewhere in the world has already tried this? And if not for hacking, data theft/encryption, maybe there are analogues like (and this is a stretch) large organizations that have managed to continue operating in regions where kidnapping for ransom is common?
- greeneggs 6y ago

fortran77 6y ago

Well, they extorted it from Taxpayers. What does UCSF care?

deleted 6y ago

[deleted]

aborsy 6y ago

Can’t NSA (or FBI) track down these attackers, or help decrypt the data? At least then it makes a useful service for the public, also clears doubts on its crypto capabilities.

cortexio 6y ago
euuh no. Skillful hackers can remove their tracks 100% and decrypting is impossible unless u have a few thousand years depending on the encryption method. Just secure your computers/servers so unauthorized software cant be installed or executed. And maybe some IQ training for the people there, so they dont open stupid shit from their mailbox or the web.

atishay811 6y ago

A more capitalist solution to the random ware problem could be ransomware insurance ideally mandated. You get hit and the company pays. But your premium rises the next time and till forever. You can get premium incentives to do audits and update software. Lower premiums show up in the balance sheet as profit and therefore there is immediate incentive to act on security issues. The insurance company has enough incentive to track the victim that some action might get taken.

VectorLock 6y ago

US Treasury announced recently "Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments." I wonder if these will reduce these kind of payments in the future, which seemed to really be ramping up. https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf https://home.treasury.gov/system/files/126/ofac_ransomware_a...

Woodi 6y ago

And what about backups ? Is it cheaper to pay ransom then reinstall and copy data ? And then cut off f* internet until some security is in place ?? If that ransomware uses something like flash for persistence why not ask some jury to enforce hardware manufacturers to stop enabling worse and worse viruses ? Floppies, cd autoplay, usb, firewire, thunderbolt, 5G networking - everything exploitable right from the factory.

tlogan 6y ago
Actually, setting up a proper backup is last thing business want to spend money on. Why do you think there is so many "increase your sales" products and so very few "backup" products?

naveen99 6y ago

Enterprises generally go too far in the direction of restricting data access and copies of data, making themselves more fragile. They should outsource custodianship of data or do like what aws etc do, proper backups and fail tolerance.

SommaRaikkonen 6y ago

Hi, I'm not sure if my comment will be read since there are a lot of them already, but what would the best move be for a medium-sized company in this situation? Hypothetically, the fees won't be as astronomical like in UCSF's case but the importance of the data being held in ransom will still be the same. Should they take the risk of getting their financial/healthcare/IT data uploaded to the public if they don't pay the fee?

TacticalCoder 6y ago

So the bad guys used a public ledger (Bitcoin) to get paid? Why aren't the hackers asking for cryptocurrencies using zero-knowledge proofs like ZCash or Monero? Bitcoin? What's their plan next? I'm not saying you can't get away with this (there are coin "mixers" and decentralized exchanges) but still, this leaves lots of traces left and right. For example we saw a lot of people getting busted recently while they thought they were smart using cryptocurrencies, including a money launderer ring... And they were using mixers, decentralized exchanges, people located overal several countries/continents and whatnots if I recall correctly. Yet: all busted. For all we known in six months the headline could be: "Hackers who extorted 1.14M USD from UCSF arrested by Interpol" Besides that: what happened to offline backups? How exactly are hackers coming for cloned, unplugged, HDDs/SSDs stored on shelves / bank safes? (I know several companies doing just that as offline backups) I hope this serves as a wake up call to companies/institutions either not doing backup properly or outsourcing to incompetent companies not doing backups properly (the latter being not really excusable).

SirYandi 6y ago
I've wondered about this as well. What's stopping such criminals from purchasing Monero with the Bitcoin. Would that be enough to anonymize?
- Zenbit_UX 6y ago
  Indeed, I imagine a service that accepts bitcoin and provides you monero would instantly anonymize you. To outside observers it would look like you sent the BTC to an exchange and they'd continue following them to innocent wallets while you've hopped off the network entirely.
xur17 6y ago
> So the bad guys used a public ledger (Bitcoin) to get paid? Why aren't the hackers asking for cryptocurrencies using zero-knowledge proofs like ZCash or Monero? Bitcoin? What's their plan next? I imagine they chose Bitcoin because it's the most liquid - they can just tell their victims to go to Coinbase or any cryptocurrency exchange to acquire it. If they ask for Zcash, the options are a lot more slim.

naveen99 6y ago

Maybe single source of truth has some downsides, like single point of vulnerability.

diebeforei485 6y ago

Well, didn't they fire tech staff and outsource the work? Sounds like it might not have been the best decision in hindsight.

hankchinaski 6y ago

now the question is, did they have an insurance in place? who will be held (legally and financially) accountable for the incident?

tmpz22 6y ago

So they outsourced all their IT to save money then got randomwared.

deleted 6y ago

[deleted]

arcticbull 6y ago

I for one love to see Bitcoin getting so much widespread adoption. That's the real story here.

silexia 6y ago

Establish a global death penalty for this crime.

brongondwana 6y ago

Filesystems that make this possible are the real crime against sanity. Most of the data would be stored on network shares, and the ransomware pulls the files, encrypts them, stores them back to the network share overwriting the original copy. Madness. Yes disk space isn't cheap, until you see the alternative. We have a basic network filestore at Fastmail, it's not even a key part of our offering, but it stores up to 30 old copies and if you keep overwriting it does exponential backoff so you have the oldest copy in the past 2 weeks, plus one from a week ago, plus one from 3 days ago, etc up until a bunch of very recent copies. Ransomware would have to be running for 2 weeks to wipe out all the original files - and during that time the massive increase in disk usage would alert operations to something going on! Likewise our email server software does integrity checks during replication between machines and won't perma-delete anything for a week after it gets expunged - and message content is immutable after writing, so changing anything is creating a new record and expunging the old one. It costs extra space - but being safe against a client virus like this encrypting all the data on network shares isn't rocket science, and the network filesystem vendors who don't default to data safety are as much to blame as anybody for this still being a problem in $CURRENT_YEAR.

sam1r 6y ago

This is from June...