3 ms·

Isn’t ransomware trivially preventable by backing up files, and having a completely different security procedure and credentials for modifying backups than doin

by woah 5y ago

Isn’t ransomware trivially preventable by backing up files, and having a completely different security procedure and credentials for modifying backups than doing anything else in the system?

benjohnson 5y ago
Used to be. Now they grab a copy of the data and threaten you with divulging it. That can be a huge problem.
- arp242 5y ago
  Also an outage in itself can be a major issue. A health care provider with no working computers is kind of dead in the water these days, and fixing all of this can take days or weeks.
pyrale 5y ago
The issue is that getting a competent workforce to maintain your systems is not always easy, especially if you're not in an industry with a connection to tech. Ransomware also targets individuals, which typically don't have the knowhow to sanitize their computers. Since our industry is kind of not caring about security wrt consumer goods, they're left to fend for themselves.
koheripbal 5y ago
Newer variants search and destroy backups first, and poison systems for a couple weeks before cryptolocking everything first.
- anonymousDan 5y ago
  Would be really interested to see a write-up of those poisoning variants. Presuming cold backups are tamperproof, it seems to me poisoning really only make sense when fresh data is significantly more valuable than historical (pre infection) data? If you had a hypothetically secure recovery testing procedure, then it should pick up the data is corrupted right? In which case you could tune the frequency of when you run it to reduce the amount of potential fresh data loss.
  - koheripbal 5y ago
    > only make sense when fresh data is significantly more valuable than historical This is the case for basically any transactional/accounting system. If you lose even one day's data, if often would make more sense to pay the ransom than try to reconstruct the transaction flow for that day (or portion of the day) that was lost.
anigbrowl 5y ago
Only if the victim is 100% sure that the ransomware gained entry to the system recently and by a known security failure, eg you click on a phishing link and then have a problem immediately afterwards. If there's any reason to believe that it could have been placed earlier and then the attacker waited a while to set it off, it means your backups are probably compromised too. Imagine you restore your backups (taking a whole weekend) but it turns out the ransomware is some kind of kernel-level hack that also patches ls to lie to you about file being there when they aren't (as an over-simplified example). Once you realize this you can switch to another tool and pinpoint where things are going wrong, but now restoration takes twice as long as before plus the farther back you go the more commercially valuable data you lose. You don't even need to compromise the backup software, as long as it looks like you might have done so.

by woah 5y ago

Isn’t ransomware trivially preventable by backing up files, and having a completely different security procedure and credentials for modifying backups than doing anything else in the system?

benjohnson 5y ago

Used to be. Now they grab a copy of the data and threaten you with divulging it. That can be a huge problem.

arp242 5y ago
Also an outage in itself can be a major issue. A health care provider with no working computers is kind of dead in the water these days, and fixing all of this can take days or weeks.

pyrale 5y ago

The issue is that getting a competent workforce to maintain your systems is not always easy, especially if you're not in an industry with a connection to tech. Ransomware also targets individuals, which typically don't have the knowhow to sanitize their computers. Since our industry is kind of not caring about security wrt consumer goods, they're left to fend for themselves.

koheripbal 5y ago

Newer variants search and destroy backups first, and poison systems for a couple weeks before cryptolocking everything first.

anonymousDan 5y ago
Would be really interested to see a write-up of those poisoning variants. Presuming cold backups are tamperproof, it seems to me poisoning really only make sense when fresh data is significantly more valuable than historical (pre infection) data? If you had a hypothetically secure recovery testing procedure, then it should pick up the data is corrupted right? In which case you could tune the frequency of when you run it to reduce the amount of potential fresh data loss.
- koheripbal 5y ago
  > only make sense when fresh data is significantly more valuable than historical This is the case for basically any transactional/accounting system. If you lose even one day's data, if often would make more sense to pay the ransom than try to reconstruct the transaction flow for that day (or portion of the day) that was lost.

anigbrowl 5y ago

Only if the victim is 100% sure that the ransomware gained entry to the system recently and by a known security failure, eg you click on a phishing link and then have a problem immediately afterwards. If there's any reason to believe that it could have been placed earlier and then the attacker waited a while to set it off, it means your backups are probably compromised too. Imagine you restore your backups (taking a whole weekend) but it turns out the ransomware is some kind of kernel-level hack that also patches ls to lie to you about file being there when they aren't (as an over-simplified example). Once you realize this you can switch to another tool and pinpoint where things are going wrong, but now restoration takes twice as long as before plus the farther back you go the more commercially valuable data you lose. You don't even need to compromise the backup software, as long as it looks like you might have done so.