4 ms·

Probably a reporter/reporting issue. No company that just have been hacked would run a binary received from the hackers in order to restore the systems, they ca

Probably a reporter/reporting issue. No company that just have been hacked would run a binary received from the hackers in order to restore the systems, they cannot be that stupid. But then again, they did pay the ransom and also seemingly can't restore their systems from backups, so who knows how stupid they really are? More charitable reading is that the encryption key was sent over, and they started restoring with that but using standard OSS tooling.

hangonhn 6y ago
> More charitable reading is that the encryption key was sent over, and they started restoring with that but using standard OSS tooling. That would make a lot more sense but I also bet there's a non-zero chance that in a day some dumb media outlet will conflate those tools as "hacker tools" and the headline will be "Hacker tools used in Colonial pipeline hack available freely on Internet. News at 10."
- Red_Leaves_Flyy 6y ago
  These inane arguments didn't kill GTA, or virtually anything else. How are they going to kill OSS that hasn't needed mainstream appeal and still doesn't? So, maybe some high school kids end up on the github pages and become 1337 hackers? Quite a stretch..
stefan_ 6y ago
What? No, the ransomware people truly do send a decryption tool, or the decryption functionality is built into the ransomware. Do you think they are sending people some AES key and then everyone goes off and builds some python tool to decrypt his data? This is a fundamental misunderstanding of the ransomware business. The whole reason people pay up is because the hackers don't run and leave you hanging; if you pay they will decrypt your data. Trust and convenience are essential to making this work.
- deleted 6y ago
  [deleted]
- axiosgunnar 6y ago
  Great, we should get the word out then that some don't. Perhaps a few cases of high-profile companies falsly claiming „wow, what a load of shit! we got ransommed and after paying up the hackers disappeared! we had to restore from backup, AND the money is gone“. What are the hackers gonna do, sue those companies? :-)
  - abrawill 6y ago
    Oh I don't know. Maybe the hackers will hold their operation hostage for ransom? Get the money and get some nice PR all at the same time!
- superjan 5y ago
  I would also fear retribution by colleagues: one bad actor that does not keep his end of the bargain is bad for business for the rest.
solarkraft 6y ago
> No company that just have been hacked would run a binary received from the hackers in order to restore the systems, they cannot be that stupid. Uh, why? The system is already compromised. They’re already in.
- bellyfullofbac 6y ago
  Well if the company is already that messed up to not have backups and desperate that they paid criminals... One would hope they'd just run the decryption program on each computer, not connected to the network. Or maybe hire some experts to extract the decryption key.
smsm42 6y ago
> they cannot be that stupid Oh yes they can. Also, assume you have the key - what you do with it? You don't know how the files were encrypted, in which way they were stored afterwards, etc. There are many ways one can encrypt and write data, even with the same key - you obviously need the algorithm, but also there are often parameters (e.g. block sizes), storage formats etc. The easiest way to deliver all that is to provide a program. Otherwise, what a random "press any key" IT person would do with an encryption key? They probably don't even have any tools that can do encryption on any of the systems. Do they have to write those themselves? Use OSS tools - which ones? With which parameters? What if it doesn't work?
megablast 6y ago
How do they decrypt it then?? Just show the key to the computer??
whimsicalism 5y ago
Pretty hilarious to see all these comments from people who have no idea what they are talking about. Thinking $5m is a "high" ransom, thinking that there is no way they would send a decryption binary rather than a key. Why don't you just actually research how these schemes function before commenting? The team that did this has a pretty consistent MO and five million was a massive discount.

hangonhn 6y ago

> More charitable reading is that the encryption key was sent over, and they started restoring with that but using standard OSS tooling. That would make a lot more sense but I also bet there's a non-zero chance that in a day some dumb media outlet will conflate those tools as "hacker tools" and the headline will be "Hacker tools used in Colonial pipeline hack available freely on Internet. News at 10."

Red_Leaves_Flyy 6y ago
These inane arguments didn't kill GTA, or virtually anything else. How are they going to kill OSS that hasn't needed mainstream appeal and still doesn't? So, maybe some high school kids end up on the github pages and become 1337 hackers? Quite a stretch..

stefan_ 6y ago

What? No, the ransomware people truly do send a decryption tool, or the decryption functionality is built into the ransomware. Do you think they are sending people some AES key and then everyone goes off and builds some python tool to decrypt his data? This is a fundamental misunderstanding of the ransomware business. The whole reason people pay up is because the hackers don't run and leave you hanging; if you pay they will decrypt your data. Trust and convenience are essential to making this work.

deleted 6y ago
[deleted]
axiosgunnar 6y ago
Great, we should get the word out then that some don't. Perhaps a few cases of high-profile companies falsly claiming „wow, what a load of shit! we got ransommed and after paying up the hackers disappeared! we had to restore from backup, AND the money is gone“. What are the hackers gonna do, sue those companies? :-)
- abrawill 6y ago
  Oh I don't know. Maybe the hackers will hold their operation hostage for ransom? Get the money and get some nice PR all at the same time!
superjan 5y ago
I would also fear retribution by colleagues: one bad actor that does not keep his end of the bargain is bad for business for the rest.

solarkraft 6y ago

> No company that just have been hacked would run a binary received from the hackers in order to restore the systems, they cannot be that stupid. Uh, why? The system is already compromised. They’re already in.

bellyfullofbac 6y ago
Well if the company is already that messed up to not have backups and desperate that they paid criminals... One would hope they'd just run the decryption program on each computer, not connected to the network. Or maybe hire some experts to extract the decryption key.

smsm42 6y ago

> they cannot be that stupid Oh yes they can. Also, assume you have the key - what you do with it? You don't know how the files were encrypted, in which way they were stored afterwards, etc. There are many ways one can encrypt and write data, even with the same key - you obviously need the algorithm, but also there are often parameters (e.g. block sizes), storage formats etc. The easiest way to deliver all that is to provide a program. Otherwise, what a random "press any key" IT person would do with an encryption key? They probably don't even have any tools that can do encryption on any of the systems. Do they have to write those themselves? Use OSS tools - which ones? With which parameters? What if it doesn't work?

megablast 6y ago

How do they decrypt it then?? Just show the key to the computer??

whimsicalism 5y ago

Pretty hilarious to see all these comments from people who have no idea what they are talking about. Thinking $5m is a "high" ransom, thinking that there is no way they would send a decryption binary rather than a key. Why don't you just actually research how these schemes function before commenting? The team that did this has a pretty consistent MO and five million was a massive discount.