4 ms·
Supposedly they paid it, but the provided decryption routine was so incredibly slow that they realized it was faster to restore from backup. Not sure how that
by BoiledCabbage 5y ago
Supposedly they paid it, but the provided decryption routine was so incredibly slow that they realized it was faster to restore from backup.
Not sure how that works, but is what I read.
- not2b 5y agoThat doesn't make much sense; if they had adequate backups and could restore from them without getting the decryption key or code, why would they pay?
- bluGill 5y agoTwo possibilities: They knew restoring from backups is slow, so they wanted a shortcut. They knew there was data (ie from the day of the attack) not in the backups. Take your pick - or not, I have no idea if the claim is even true.
- andrewla 5y ago(Caveat: I know absolutely nothing about this particular situation) Paying would make sense because if there was a vulnerability uncovered by the initial exploit (that is, account information compromised by the initial phishing attempt) then it is perfectly possible that the restored version will be easily exploitable by the same group. I remember this being the case back in SQL Slammer days -- you could restore from backup but your backup would be infected within minutes.
- shalmanese 5y agoModern ransomware teams also threaten to leak your data onto the public internet unless you pay.
- saagarjha 5y agoFree decryption, you mean ;)
- burnished 5y agoI'm not 100% on this, but my understanding is that it was worthwhile due to the vast amount of money involved in the oil industry and the projected time to restore from backup.