5 ms·

Does anyone else feel that any organization that isn't doing regular secure backups with a way to restore that data deserves for this to happen? It like an airp

Does anyone else feel that any organization that isn't doing regular secure backups with a way to restore that data deserves for this to happen? It like an airplane running out of gas because the pilot forgot to fill up the tank. Its kind of step one of working with computers.

shajznnckfke 6y ago
“Deserve” doesn’t do anything for the people hurt by this, and it doesn’t justify the behavior of the hackers.
- dzhiurgis 6y ago
  Pay the ransom and nobody gets hurt. It's actually tiny price to pay compared to proper infrastructure. Insurers make trillions, it's nothing to them. The happy ending of this would be continuing to pay terrorists who keep you IT top notch...
  - Thorrez 6y ago
    Black hat bug bounty hunters, interesting.
sellyme 6y ago
I'm not sure that's of much comfort to the passengers on the plane.
agar 6y ago
You certainly express an unpopular opinion, and at first glance you are right: secure backups should be a priority for any IT organization. However, not all backups are continuous and pervasive. There are often backup windows, gaps, and processes that halt with no one noticing. Ryuk also actively disables and deletes backups to maximize impact, while also seeking out mount points that might be backup targets - and encrypts those as well. Of course, we're also talking about hospitals here. Even a well-managed system with hourly differential backups leaves plenty of time for radiology data to be lost in the critical hour before life saving surgery. More realistically though, how long would it take you to discover and remove a sophisticated penetration, then restore every device, ensure none of the restores are also infected by the malware that had probably been there for a while, and bring a hospital system with thousands of impacted systems back online? 72 hours? A week? A month? What happens to the patients? Admissions to the emergency room? What if adjacent hospitals are also hit, or are already impacted by the COVID spike and have no open beds? People literally die due to hospital ransomware attacks. No one deserves that. Ransomware is akin to kidnapping, it's just the data and customers that are held hostage, not kids or loved ones. Always blame the criminal, never the victim.
- sillysaurusx 6y ago
  Just wanted to say thank you for one of the most informative comments of the thread. Carry on.
- chrononaut 6y ago
  > Ransomware is akin to kidnapping There is an expectation that information and services are to be secured with a certain level of care and standards. I don't see how that applies to people. > Always blame the criminal, never the victim This argument excludes the concept of negligence. If the victim was grossly negligent then they are also to blame.
deleted 6y ago
[deleted]
Polylactic_acid 6y ago
Yes there probably is some blame on the hospitals for not securing things well, but there is a huge difference between preventing something from failing, and preventing something from being actively sabotaged. If a hospital had random power cables everywhere and someone tripped over one and unplugged an important device, that would be far far more on the side of the hospitals fault than an attack on the computer systems.
toomanybeersies 6y ago
> It like an airplane running out of gas because the pilot forgot to fill up the tank That has happened in the past: https://en.wikipedia.org/wiki/Gimli_Glider https://en.wikipedia.org/wiki/Gimli_Glider It's easy to say "well they should've filled the tank" when you're comfortably sitting on the ground, but it's little consolation for the people 30,000 feet in the air, or for the patients in hospital waiting for time critical, life saving treatment.
- vhodges 6y ago
  Just to clarify, they did fuel up, but made a calculation error (metric to imperial if iirc) on the amount and is why they ran out early.
PeterisP 6y ago
Most of current best practices for backups, redundancy and business continuity are intended for the risks of random disasters. Malicious attacks are substantially different. There are many organizations which are doing regular secure backups, but are doing so in a way that can be sabotaged once a skilled attacker gains domain admin privileges, and sabotaging backups is one of key things that the attackers are doing after they are in the network and before triggering the ransom encryption. We're not talking about a virus randomly spreading, in such high-ransom targeted attacks the preparation before triggering a ransom is done manually by skilled teams going on from one target to another.
moksly 6y ago
There are a lot of systems in a hospital. Maybe 3000 different systems, made by different suppliers, some long gone. In good countries, we maintain important records and have roll back capabilities on most of the things we control ourselves. But that doesn’t necessarily include the MRI machines windows XP that is maintained by some third party supplier that operates through another 3rd party seller, and that’s just one of the 3000 things that can go wrong. Then there is the parts where attacks will affect you, even if they don’t do any damage that can’t be reversed. Typically global internet access gets shut down during an attack, but that makes transfers harder. It also makes acute arrivals harder, because the ambulance helicopter might not be in range of your “internal internet” and thus may not be capable of feeding you important live data. Some attacks target the network itself, and while you’ll generally have a good set of people running that, they aren’t always a match for nation state backed hacking tools. So there is just a billion things that can go wrong, even if you have the best of the best working on it, and in many countries, there is a good chance that’s not even the case. I can count myself lucky to work in a country where we take digitisation very serious in the public sector, and I can easily see why things could go wrong.

shajznnckfke 6y ago

“Deserve” doesn’t do anything for the people hurt by this, and it doesn’t justify the behavior of the hackers.

dzhiurgis 6y ago
Pay the ransom and nobody gets hurt. It's actually tiny price to pay compared to proper infrastructure. Insurers make trillions, it's nothing to them. The happy ending of this would be continuing to pay terrorists who keep you IT top notch...
- Thorrez 6y ago
  Black hat bug bounty hunters, interesting.

sellyme 6y ago

I'm not sure that's of much comfort to the passengers on the plane.

agar 6y ago

You certainly express an unpopular opinion, and at first glance you are right: secure backups should be a priority for any IT organization. However, not all backups are continuous and pervasive. There are often backup windows, gaps, and processes that halt with no one noticing. Ryuk also actively disables and deletes backups to maximize impact, while also seeking out mount points that might be backup targets - and encrypts those as well. Of course, we're also talking about hospitals here. Even a well-managed system with hourly differential backups leaves plenty of time for radiology data to be lost in the critical hour before life saving surgery. More realistically though, how long would it take you to discover and remove a sophisticated penetration, then restore every device, ensure none of the restores are also infected by the malware that had probably been there for a while, and bring a hospital system with thousands of impacted systems back online? 72 hours? A week? A month? What happens to the patients? Admissions to the emergency room? What if adjacent hospitals are also hit, or are already impacted by the COVID spike and have no open beds? People literally die due to hospital ransomware attacks. No one deserves that. Ransomware is akin to kidnapping, it's just the data and customers that are held hostage, not kids or loved ones. Always blame the criminal, never the victim.

sillysaurusx 6y ago
Just wanted to say thank you for one of the most informative comments of the thread. Carry on.
chrononaut 6y ago
> Ransomware is akin to kidnapping There is an expectation that information and services are to be secured with a certain level of care and standards. I don't see how that applies to people. > Always blame the criminal, never the victim This argument excludes the concept of negligence. If the victim was grossly negligent then they are also to blame.

deleted 6y ago

[deleted]

Polylactic_acid 6y ago

Yes there probably is some blame on the hospitals for not securing things well, but there is a huge difference between preventing something from failing, and preventing something from being actively sabotaged. If a hospital had random power cables everywhere and someone tripped over one and unplugged an important device, that would be far far more on the side of the hospitals fault than an attack on the computer systems.

toomanybeersies 6y ago

> It like an airplane running out of gas because the pilot forgot to fill up the tank That has happened in the past: https://en.wikipedia.org/wiki/Gimli_Glider https://en.wikipedia.org/wiki/Gimli_Glider It's easy to say "well they should've filled the tank" when you're comfortably sitting on the ground, but it's little consolation for the people 30,000 feet in the air, or for the patients in hospital waiting for time critical, life saving treatment.

vhodges 6y ago
Just to clarify, they did fuel up, but made a calculation error (metric to imperial if iirc) on the amount and is why they ran out early.

PeterisP 6y ago

Most of current best practices for backups, redundancy and business continuity are intended for the risks of random disasters. Malicious attacks are substantially different. There are many organizations which are doing regular secure backups, but are doing so in a way that can be sabotaged once a skilled attacker gains domain admin privileges, and sabotaging backups is one of key things that the attackers are doing after they are in the network and before triggering the ransom encryption. We're not talking about a virus randomly spreading, in such high-ransom targeted attacks the preparation before triggering a ransom is done manually by skilled teams going on from one target to another.

moksly 6y ago

There are a lot of systems in a hospital. Maybe 3000 different systems, made by different suppliers, some long gone. In good countries, we maintain important records and have roll back capabilities on most of the things we control ourselves. But that doesn’t necessarily include the MRI machines windows XP that is maintained by some third party supplier that operates through another 3rd party seller, and that’s just one of the 3000 things that can go wrong. Then there is the parts where attacks will affect you, even if they don’t do any damage that can’t be reversed. Typically global internet access gets shut down during an attack, but that makes transfers harder. It also makes acute arrivals harder, because the ambulance helicopter might not be in range of your “internal internet” and thus may not be capable of feeding you important live data. Some attacks target the network itself, and while you’ll generally have a good set of people running that, they aren’t always a match for nation state backed hacking tools. So there is just a billion things that can go wrong, even if you have the best of the best working on it, and in many countries, there is a good chance that’s not even the case. I can count myself lucky to work in a country where we take digitisation very serious in the public sector, and I can easily see why things could go wrong.