5 ms·

> Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that t

by aazaa 5y ago

> Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system, one of the people familiar with the company’s efforts said. I thought the protocol for these attacks was to send the decryption keys, not provide a "decrypting tool." If some kind of software was provided by the attackers, and Colonial installed it, this could be far from over. Also, if the company has backups, then why not use them instead? If they're incomplete, then that's the real problem.

capableweb 5y ago
Probably a reporter/reporting issue. No company that just have been hacked would run a binary received from the hackers in order to restore the systems, they cannot be that stupid. But then again, they did pay the ransom and also seemingly can't restore their systems from backups, so who knows how stupid they really are? More charitable reading is that the encryption key was sent over, and they started restoring with that but using standard OSS tooling.
- hangonhn 5y ago
  > More charitable reading is that the encryption key was sent over, and they started restoring with that but using standard OSS tooling. That would make a lot more sense but I also bet there's a non-zero chance that in a day some dumb media outlet will conflate those tools as "hacker tools" and the headline will be "Hacker tools used in Colonial pipeline hack available freely on Internet. News at 10."
  - Red_Leaves_Flyy 5y ago
    These inane arguments didn't kill GTA, or virtually anything else. How are they going to kill OSS that hasn't needed mainstream appeal and still doesn't? So, maybe some high school kids end up on the github pages and become 1337 hackers? Quite a stretch..
- stefan_ 5y ago
  What? No, the ransomware people truly do send a decryption tool, or the decryption functionality is built into the ransomware. Do you think they are sending people some AES key and then everyone goes off and builds some python tool to decrypt his data? This is a fundamental misunderstanding of the ransomware business. The whole reason people pay up is because the hackers don't run and leave you hanging; if you pay they will decrypt your data. Trust and convenience are essential to making this work.
  - deleted 5y ago
    [deleted]
  - axiosgunnar 5y ago
    Great, we should get the word out then that some don't. Perhaps a few cases of high-profile companies falsly claiming „wow, what a load of shit! we got ransommed and after paying up the hackers disappeared! we had to restore from backup, AND the money is gone“. What are the hackers gonna do, sue those companies? :-)
    - abrawill 5y ago
      Oh I don't know. Maybe the hackers will hold their operation hostage for ransom? Get the money and get some nice PR all at the same time!
  - superjan 5y ago
    I would also fear retribution by colleagues: one bad actor that does not keep his end of the bargain is bad for business for the rest.
- solarkraft 5y ago
  > No company that just have been hacked would run a binary received from the hackers in order to restore the systems, they cannot be that stupid. Uh, why? The system is already compromised. They’re already in.
  - bellyfullofbac 5y ago
    Well if the company is already that messed up to not have backups and desperate that they paid criminals... One would hope they'd just run the decryption program on each computer, not connected to the network. Or maybe hire some experts to extract the decryption key.
- smsm42 5y ago
  > they cannot be that stupid Oh yes they can. Also, assume you have the key - what you do with it? You don't know how the files were encrypted, in which way they were stored afterwards, etc. There are many ways one can encrypt and write data, even with the same key - you obviously need the algorithm, but also there are often parameters (e.g. block sizes), storage formats etc. The easiest way to deliver all that is to provide a program. Otherwise, what a random "press any key" IT person would do with an encryption key? They probably don't even have any tools that can do encryption on any of the systems. Do they have to write those themselves? Use OSS tools - which ones? With which parameters? What if it doesn't work?
- megablast 5y ago
  How do they decrypt it then?? Just show the key to the computer??
- whimsicalism 5y ago
  Pretty hilarious to see all these comments from people who have no idea what they are talking about. Thinking $5m is a "high" ransom, thinking that there is no way they would send a decryption binary rather than a key. Why don't you just actually research how these schemes function before commenting? The team that did this has a pretty consistent MO and five million was a massive discount.
londons_explore 5y ago
The ransomware typically has both the encrypter and decryptor built in. It's a simple matter of copy-pasting the key into a box, and the decryption will happen. Over a slow network link (like a VPN to a remote NAS), I could totally imagine it taking days/weeks/months to scan every file though...
Nextgrid 5y ago
> If some kind of software was provided by the attackers, and Colonial installed it, this could be far from over. To be fair, malicious code has already ran on the affected machines, so if the ransomware authors wanted to do further damage they wouldn't need a malicious decryptor to do that. So you'd either: 1) not trust the ransomware authors, rebuild everything from scratch (potentially paying the ransom and reverse-engineering the decryptor or running it isolated from the internet) and make sure to not carry over any executable code that could allow potential malware to persist 2) trust the ransomware authors and not rebuild everything, in which case you may as well run their decryptor
booleandilemma 5y ago
I don’t think the hacking group would want to show future targets that paying the ransom won’t get them un-hacked. People would stop paying them. It would be bad for business. If anything they’re working on speeding up their decrypting tool for the next release :)
ben509 5y ago
Don't rely on technical details from Bloomberg.
Neil44 5y ago
I’ve only helped people pay a couple of times but they always provided a shoddy .exe decryptor. Consider that most victims are small fry who would not know what to do with just a key.
yodelshady 5y ago
> I thought the protocol for these attacks was to send the decryption keys, not provide a "decrypting tool." Fair, but anyone who pays me $5M and wants a powershell script gets one, and an air freshener of their choice.
EthOptimist 5y ago
It could be something as simple as decrypting some files with PGP or some open source tool

by aazaa 5y ago

capableweb 5y ago

Probably a reporter/reporting issue. No company that just have been hacked would run a binary received from the hackers in order to restore the systems, they cannot be that stupid. But then again, they did pay the ransom and also seemingly can't restore their systems from backups, so who knows how stupid they really are? More charitable reading is that the encryption key was sent over, and they started restoring with that but using standard OSS tooling.

hangonhn 5y ago
> More charitable reading is that the encryption key was sent over, and they started restoring with that but using standard OSS tooling. That would make a lot more sense but I also bet there's a non-zero chance that in a day some dumb media outlet will conflate those tools as "hacker tools" and the headline will be "Hacker tools used in Colonial pipeline hack available freely on Internet. News at 10."
- Red_Leaves_Flyy 5y ago
  These inane arguments didn't kill GTA, or virtually anything else. How are they going to kill OSS that hasn't needed mainstream appeal and still doesn't? So, maybe some high school kids end up on the github pages and become 1337 hackers? Quite a stretch..
stefan_ 5y ago
What? No, the ransomware people truly do send a decryption tool, or the decryption functionality is built into the ransomware. Do you think they are sending people some AES key and then everyone goes off and builds some python tool to decrypt his data? This is a fundamental misunderstanding of the ransomware business. The whole reason people pay up is because the hackers don't run and leave you hanging; if you pay they will decrypt your data. Trust and convenience are essential to making this work.
- deleted 5y ago
  [deleted]
- axiosgunnar 5y ago
  Great, we should get the word out then that some don't. Perhaps a few cases of high-profile companies falsly claiming „wow, what a load of shit! we got ransommed and after paying up the hackers disappeared! we had to restore from backup, AND the money is gone“. What are the hackers gonna do, sue those companies? :-)
  - abrawill 5y ago
    Oh I don't know. Maybe the hackers will hold their operation hostage for ransom? Get the money and get some nice PR all at the same time!
- superjan 5y ago
  I would also fear retribution by colleagues: one bad actor that does not keep his end of the bargain is bad for business for the rest.
solarkraft 5y ago
> No company that just have been hacked would run a binary received from the hackers in order to restore the systems, they cannot be that stupid. Uh, why? The system is already compromised. They’re already in.
- bellyfullofbac 5y ago
  Well if the company is already that messed up to not have backups and desperate that they paid criminals... One would hope they'd just run the decryption program on each computer, not connected to the network. Or maybe hire some experts to extract the decryption key.
smsm42 5y ago
> they cannot be that stupid Oh yes they can. Also, assume you have the key - what you do with it? You don't know how the files were encrypted, in which way they were stored afterwards, etc. There are many ways one can encrypt and write data, even with the same key - you obviously need the algorithm, but also there are often parameters (e.g. block sizes), storage formats etc. The easiest way to deliver all that is to provide a program. Otherwise, what a random "press any key" IT person would do with an encryption key? They probably don't even have any tools that can do encryption on any of the systems. Do they have to write those themselves? Use OSS tools - which ones? With which parameters? What if it doesn't work?
megablast 5y ago
How do they decrypt it then?? Just show the key to the computer??
whimsicalism 5y ago
Pretty hilarious to see all these comments from people who have no idea what they are talking about. Thinking $5m is a "high" ransom, thinking that there is no way they would send a decryption binary rather than a key. Why don't you just actually research how these schemes function before commenting? The team that did this has a pretty consistent MO and five million was a massive discount.

londons_explore 5y ago

The ransomware typically has both the encrypter and decryptor built in. It's a simple matter of copy-pasting the key into a box, and the decryption will happen. Over a slow network link (like a VPN to a remote NAS), I could totally imagine it taking days/weeks/months to scan every file though...

Nextgrid 5y ago

> If some kind of software was provided by the attackers, and Colonial installed it, this could be far from over. To be fair, malicious code has already ran on the affected machines, so if the ransomware authors wanted to do further damage they wouldn't need a malicious decryptor to do that. So you'd either: 1) not trust the ransomware authors, rebuild everything from scratch (potentially paying the ransom and reverse-engineering the decryptor or running it isolated from the internet) and make sure to not carry over any executable code that could allow potential malware to persist 2) trust the ransomware authors and not rebuild everything, in which case you may as well run their decryptor

booleandilemma 5y ago

I don’t think the hacking group would want to show future targets that paying the ransom won’t get them un-hacked. People would stop paying them. It would be bad for business. If anything they’re working on speeding up their decrypting tool for the next release :)

ben509 5y ago

Don't rely on technical details from Bloomberg.

Neil44 5y ago

I’ve only helped people pay a couple of times but they always provided a shoddy .exe decryptor. Consider that most victims are small fry who would not know what to do with just a key.

yodelshady 5y ago

> I thought the protocol for these attacks was to send the decryption keys, not provide a "decrypting tool." Fair, but anyone who pays me $5M and wants a powershell script gets one, and an air freshener of their choice.

EthOptimist 5y ago

It could be something as simple as decrypting some files with PGP or some open source tool