19 ms·
Up to 1,500 businesses affected by ransomware attack, Kaseya CEO says
- cmckn 5y agoI’m ignorant as to how these attacks are so successful. Seems like they always start with a phishing email, but how does some malware on one employee’s computer end up encrypting the “source of truth” for the entire company? Sure, some employees have a lot of access, so obtaining the right person’s credentials will get you a lot of the way there; but it seems like categorically preventing this type of attack should be possible with the right internal security approach. Even just the amount of time it takes to encrypt the data confuses me about this. Do the attackers just choose to launch this on a long weekend?
- deleted 5y ago[deleted]
- inetknght 5y ago> categorically preventing this type of attack should be possible with the right internal security approach Yeah. But many many small/medium businesses have been left behind in understanding how software works and how to be secure. A lot of that is because big businesses offload the cost of it onto others instead of leading the way like they should. Where before you'd have humans interacting which would prevent massive promulgation of bad actors... now a lot of that is automated. So all it takes is one weak link in the chain.
- jdavis703 5y agoWhy don’t small/medium businesses go all in on the cloud? Surely it must be easier for the non-technical SMB order/manager to use Google Drive than run their own file servers?
- everdrive 5y agoA lot of the time it's nothing more complex than owning one Windows box, and then moving around the network using regular SMB and metsploit tactics.
- miohtama 5y agoCould a solution be to remove Windows from the box?
- coldcode 5y agoPeople with 100% of any OS are likely to be more vulnerable than people with heterogeneous systems.
- vb6sp6 5y agoif your business doesn't rely on software that only works on windows, sure. But even companies like apple use windows: https://www.businessinsider.com/apple-uses-windows-xp-in-iphone-testing-facility-2014-9 https://www.businessinsider.com/apple-uses-windows-xp-in-iph...
- vkou 5y agoThat'll cost the typical business way more than the cost and headache of ransomware.
- rightbyte 5y agoKaseya seems to have prioritized support convience over safety. I.e. have a backdoor for all their customers. Who could have figured this could happen?
- deleted 5y ago[deleted]
- tonyb 5y agoThis wasn't a typical "someone clicked a link they shouldn't have" attack. There was a vulnerability in the RMM server software that allowed remote code execution. The attackers used the RCE to push the ransomware out to all of the endpoints connected to the RMM server. The attack is still being researched but it looks like there were two vulnerabilities. The first was an authentication bypass that allowed the attacker to authenticate as if it were an authorised client. That was used to upload the payload. There was as a RCE vulnerability that allowed the attacker to executed the uploaded file. The payload itself modified the SQL database of the RMM software to create a task on the remote endpoints that executed the ransomware.
- rightbyte 5y agoIsn't one of the main problems with ransomware centralised and locked down IT administration? I mean if the computers were not tied together so tightly the effects would be isolated. Instead there is a admin account encrypting all the machines HDs remotely.
- runeks 5y agoWhat’s the alternative given that most small/medium-sized companies know very little about IT security? Seems to me like a centralized system is fine, as long as it’s properly designed and implemented. The problem is how a business can know that an IT security system is properly designed and implemented. The only solution I see is to couple insurance with an IT security system. If you’re certain your system protects against IT threats you should be willing to compensate your customer in case it fails to do so. Otherwise your customer has a very hard time determining whether your IT security system actually works.
- throwawaygh 5y ago> What’s the alternative given that most small/medium-sized companies know very little about IT security? Removing the "remote" from "remote administration". It's more expensive but probably still not cost-prohibitive -- driving around to client sites and installing updates is not particularly skilled labor. Plus even the worst-case scenarios are far less worse because you already have a local workforce who can do site visits to manually recover systems locked down by ransomware attacks. Data might get stolen, but at least you have continuity of business.
- markzzerella 5y agoThey could even have a 'reverse shell' type button that the client has to explicitly click to enable temporary remote access.
- twistedpair 5y agoWhat if you could somehow rate limit it? e.g. you can access N remote offices per day, but not all of them. Like the time lock on a safe, to prevent these pervasive smash and grabs.
- afrcnc 5y agoSource: https://www.kaseya.com/press-release/kaseya-responds-swiftly-to-sophisticated-cyberattack-mitigating-global-disruption-to-customers/ https://www.kaseya.com/press-release/kaseya-responds-swiftly... Video: https://www.youtube.com/watch?v=XfAyutRfy2A https://www.youtube.com/watch?v=XfAyutRfy2A
- hadrien01 5y agoWow, that video is exactly how they shouldn't have responded. They assert their procedures worked as intended (they didn't), that only one part of their app was compromised thanks to their "oh-so-great" architecture (didn't matter), and that they were as fast as possible in their response (debatable). They don't do anything to reassure their customers, and they don't take any part of the blame.
- throwawaygh 5y ago> They don't do anything to reassure their customers, and they don't take any part of the blame. Is there any world where Kaseya isn't dead? This isn't Equifax, who have a monopoly and could just out-live the bad press. Kaseya is an IT security firm in a hyper competitive marketplace selling to unsophisticated clients. Reputation is everything. I imagine they're in "avoid lawsuits so we can return as much capital to ourselves/investors before closing up shop" mode.
- deleted 5y ago[deleted]
- nyghtly 5y agoI have to say, the PR guy at Kaseya deserves a pat on the back for this headline: "Kaseya Responds Swiftly to Sophisticated Cyberattack, Mitigating Global Disruption to Customers"
- adamrezich 5y agoI wonder how long these vulnerabilities have been exploited, with the attackers waiting for specific—possibly political—timing to actually execute the attack and demand ransom. there could be plenty more exploited systems out there, just waiting for the ransom attack to execute when the attacker sees fit.
- hn_throwaway_99 5y ago> with the attackers waiting for specific—possibly political—timing to actually execute the attack and demand ransom Your "possibly political" statement is conspiracy theory nonsense. It's entirely unsurprising that they launched the attack at the beginning of a long holiday weekend when there would be fewer eyes monitoring systems and able to pull plugs/remediate in the moment.
- adamrezich 5y ago> Your "possibly political" statement is conspiracy theory nonsense. what does this mean exactly? could you (or anyone else who shares this sentiment) elaborate?
- runeks 5y agoWhat makes you think this attack was politically motivated?
- adamrezich 5y agonothing, especially because I haven't looked into it at all, and there probably is no reported evidence anyway. hence, my comment referring broadly to this wave of attacks, and my use of the qualifying "possibly." why is everyone (mainstream news, etc.) so quick to refer to any attack originating from a Russian IP address as "Russian" (either implied or directly stated to mean "Russian government")—yet positing that these attacks might have political motivations behind them is a "conspiracy theory"?
- mc32 5y ago
- tolbish 5y agoIt's clear we need a full security audit of the companies that provide software tools to the companies that provide software tools to IT outsourcing shops. Of course that just leaves things open to the next security breach of companies that provide software tools to the companies that provide software tools to the companies that provide software tools to IT outsourcing shops.
- ElViajero 5y agoI say this quite often, or we get better as a profession or we are going to get related to death. No society will tolerate failures in major businesses including food providers to happen continuously. Or we do better, or the next generation of developers is going to have regulated programming languages, architectures, and tech stack. Or we show that we can deliver safely and resist business pressure to deliver fast and cut costs, or the government is going to do it for us.
- rapind 5y agoWho is “we” though. I think a lot of deva cut corners, a lot of managers insist on cutting corners (preferably without a paper trail pointing at them), and a lot of businesses hire inexperienced devs that wouldn’t even know where to start, because cheaper. I don’t know how you coordinate this without regulation and something like P.Eng type certification (which comes with it’s own problems).
- nine_k 5y agoI think you should certify systems in place, not engineers. People without credentials but with experience and care can produce a reasonably secure system. People with credentials but under time pressure and contradictory requirements, and willingness to cut corners, can produce an unsafe system. It's the system that fails. It can be inspected the way buildings are inspected.
- MrQuimico 5y agoI totally agree.
- aikah 5y agoThis is bad but it's going to force all these companies to overall their IT system, period. They can't keep on losing data or paying ransoms eternally, because at that point it cannot just be "the cost of doing business".
- iNane9000 5y agoThat’s very reassuring. I was worried they’d just keep “doing what the other guys do” and not try to invest in info sec as a specific business strategy. However I do wonder if average people won’t ultimately side with the small businesses, their dentist or local mom and pop, over rich young programmers, cyber gangs and their bitcoins.
- joe_the_user 5y agoCompanies in various parts of world deal with extortion as a cost of doing business. Ransomware companies are companies. They set their fees high but not so high they drive their "customers" out of business, at least not all their customers. I hope things will change. The most likely seems like more of the same thing, which clearly won't change the situation. Also, the government huffs and puffs about arresting people somewhere. The whole thing has "fall of the Roman Empire" vibes to it.
- nimbius 5y agopart of me suspects this dearth of attacks could have been prevented had information security not been captured by leadership as a purchasing decision constrained by magic quadrants and trade magazine articles and instead were returned to IT as a technical process with audits by leadership.
- runeks 5y agoMost small businesses probably don’t have an IT department at all.
- kube-system 5y agoI feel like people don't quite have a grasp at how many small businesses there are in the US. 99.9% of businesses in the US are small businesses. 4 out of 5 businesses in the US are so small, they don't have any employees at all.
- ttyprintk 5y agoThe flip side of this is that plenty of enterprises come and go without us noticing. You might have 222k enter and 249k exit in a quarter. My point is that ransomware at the b2b layer could shutter 100k businesses and it would be hard to distinguish from normal.
- lisper 5y agoJust FYI, "dearth" means the opposite of what you intended here. "Dearth" means "scarcity".
- Bobv65 5y agoHeadline should be US firms CEOs, want the tax payer to fix this too. Its hard work cutting budgets and outsourcing whatever possible to the jamaican bobsled team. So now the govt has to hire, train, feed and stable yet another army to protect these helpless overfed crybabies.
- Clubber 5y agoWhen I went to college decades ago, we always studied case studies on what not to do. This company did this and almost went out of business. Don't do this. When bailouts happen, the end result of an action is obscured, literally subsidized and I'm afraid people don't take it as seriously. Funny though, having gone through the Y2K fix, I'm aggravated that systems are now again storing dates in the 2 digit format.
- nyghtly 5y agoGiven that most people don't know that the Y2K bug was real, I feel that this is a category of bug that will plague us forever. And it's already happening more often than once per century. https://en.wikipedia.org/wiki/Year_2038_problem https://en.wikipedia.org/wiki/Year_2038_problem
- ArkanExplorer 5y agoThe simplest solution remains to ban the formal exchange of crytpo for fiat, across Western nations. Its a lot harder to justify giant ransomware campaigns when you're paid in Amazon gift cards instead of easily exchangeable cryptocoins.
- cyberlurker 5y agoSo you don’t actually want to ban the exchange of crypto for fiat, you want to ban companies from being able to pay the ransom (with crypto)? I don’t think yours is a simple solution or the right one (banning cryptocurrency). But I do think bans on payment of the ransom are interesting.
- ttyprintk 5y agoI can’t speak to the parent comment’s intent, but it’s becoming harder and harder to look like an innocent crypto whale. While some can prove that they originated their balance, what if the wallets used in certain transactions are (or must be) confiscatable, say at exploited tumblers?
- blondie9x 5y agoBrilliant.
- redisman 5y agoWhy improve overall cyber security which is at completely garbage levels at most companies when you can blame crypto instead? It just seems like the bill on security has come due and I recommend paying it. Otherwise you leave the economy open for much more serious attacks than asking a few million in crypto.
- __MatrixMan__ 5y agoI think you'd just get a new category of bad guy--the one who charges you $500 to help you circumvent whatever legal restrictions are preventing you from paying your $10000 ransom. Or I guess two new categories, because the victims are all criminals now too.
- jimbob45 5y agoRansomware isn’t always debilitating. We got hit by an attack a few years back and realized no one had anything relevant on that machine anymore so we just wiped it clean and moved on.
- CyberRage 5y agoThat's old school. targeted attacks today, hone in on critical infrastructure before striking. Many times data is exfiltrated beforehand, backups are deleted. If someone went the trouble of compromising a 3rd party software vendor, he knows what he is doing.
- silexia 5y agoStop blaming the victims, hunt down and kill these criminals.
- infamouscow 5y agoWhy? IT professionals raise concerns all the time and those concerns are virtually always dismissed by management because costs. Someone made that decision and they should be held to account for it. You're perpetuating the problem.
- AnIdiotOnTheNet 5y agoI've yet to see any IT person who says this kind of thing perform the actual risk assessment math that shows management made the wrong decision.
- x86_64Ubuntu 5y agoAre you implying that somewhere along the way, the math works out that management shouldn't listen to IT? I'm stretched trying to reach that viewpoint how the math works out when you company gets Colonial Pipeline'd
- AnIdiotOnTheNet 5y agoYes, I'm saying that it is completely possible that the risk assessment could say that the damages of an attack like this are ultimately less expensive than the cost of mitigating them when probabilities are accounted for. I don't know that that's true, but I don't know that it is untrue either, because nobody is talking about the risk assessment math, most especially people calling for massive infosec increases.
- encryptluks2 5y agoI often feel the same way about robocallers. It would only take a few to make anyone doing it question their choices
- 5y ago
- titzer 5y agoThe base mindset around software development, particularly at the lowest levels, needs to change to put security as the #1 priority. Far too many vulnerabilities are due to use of unsafe languages and features. While there are holes at all layers that lead to these types of attacks, as a runtime systems and language/compiler person, it's clear to me that unsafe languages should be abandoned, even if it costs a handful of percent of performance. The societal costs are just too great.
- thegagne 5y agoNot just software development, much more of the responsibility lays at the sysadmin/network/firewall layer, and even more at the management layer. Networks need to move to zero trust models, sure, but companies need to evaluate the risks of all the systems and processes that they rely on. The problem is it’s too easy to accept the risks or downplay them, while the work to get them addressed is costly.
- dijit 5y agoLots to unpack here, and I'm a huge fan of memory safe languages, but honestly it's quite misguided to assume that security can ever be number 1; Security isn't boolean, and the closer to "security = 1" you get the more non-functional the system. It's always going to be a tradeoff between doing useful things and being secure. I would agree that we need to shift the bar closer to 1, but absolute security is impossible without the world closing down. w.r.t unsafe languages: it's not even possible to instrument and operate hardware in a "safe" way, even rust which is rather low level needs to be wrapped in unsafe in order to interact with hardware. I believe we need to be better at: Detection, mitigation, response -- all things traditionally sysadmins dealt with. But our industry assumes that sysadmins need not apply.
- titzer 5y agoIt's still the case that two thirds of critical CVEs are due to memory safety errors. That ratio has held constant for several decades. Those CVEs aren't in hardware drivers, but in mundane things like JPEG decoders and mail processing programs. That is directly due to them being implemented in unsafe languages. > Security isn't boolean, and the closer to "security = 1" you get the more non-functional the system. Security isn't one-dimensional. Security can be phrased in functional requirements like "does not allow remote code execution attacks", which is of course a boolean requirement. You can slice that finer and finer such as "does not allow remote execution attacks through X, Y, or Z mechanisms" and start adding other, higher-level requirements such as "does not leak user data through APIs", etc. Security isn't boolean, but it is absolutely chock-full of boolean requirements one can pose. > I believe we need to be better at: Detection, mitigation, response -- all things traditionally sysadmins dealt with. I don't disagree with that, but this is the last-line-of-defense, the-horse-has-left-the-barn stage, which is basically admitting defeat because of how absolutely riddled with vulnerabilities existing software is.
- fredgrott 5y agosomething strange, No Iran firms, No N Korea firms, No Chinese firms no Russia firms under attack
- coldcode 5y agoNone of the firms in Russia dare target a Russian based company for fear of elimination the hard way. Easier to attack another country.
- redisman 5y agoSurely not all ransomwear hackers are Russian? At least not for long given how effective and visible they have been lately. Seems like a easy field to hop into and make millions
- pas 5y agoHow do we know that? Would we even know if they were?
- mullingitover 5y agoThe wild thing is that the ransomware operations are making so much money that they can afford to buy multi-million dollar zero day vulns that at one point were only available to nation states or fortune 500 companies. Every successful round of extortion just gives them more ammunition to purchase more of them, hire more engineers, etc. This kind of illicit capital flow totally makes a mockery of AML regulations. All the rules that were created after 9/11 are out the window - this time it's money to pay for zero days, but it's not a huge leap for this kind of illicit capital flow to end up paying for a huge terror op, paramilitary coup, etc. We'll be reading the next blue ribbon commission's retrospective findings for some horrific event in a few years and it'll be obvious what we failed at.
- whatshisface 5y agoIt's already obvious where we failed. Companies that don't care about sales won't sell, companies that don't care about R&D won't stay up to date, and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure.
- mcguire 5y ago"...and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure..." ...but won't see any particular repercussions until they get hit with a few million dollars ransom and some short-term bad PR.
- qorrect 5y ago> and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure. So glad to not be at that job anymore , this is 100% the approach my previous employer took ( who had 99 out of the fortune 100 companies as customers ).
- dogman144 5y agoThis is a significantly false generalization about the TTPs for rware operators. Vast majority of these attacks don't work with 0days. They work with malformed IAM policies, social engineering/phishing, and poor asset registries and cloud vis. Keseya being a 0day is an outlier in many ways.
- athenot 5y agoI wonder how many of these businesses were still able to pass their SOC audit, yet have these kinds of holes.
- bluedino 5y agoSo who’s next? ConnectWise? Atera? Ninja? I’d be shitting my pants if I were running any of those right now.
- dahfizz 5y agoIts interesting to me that the discussion around ransomware attacks on HN is full of victim blaming. When stores are forced to close in SF because of rampant theft, nobody suggests that Walgreens or Target should hire armed guards. If a mall were to be bombed, nobody would suggest that malls should just be built to resist bombing attacks. The entire point of a government is to provide security and protect the rights of citizens. It is the government's job to solve / prevent / deter crime. If we are willing to put the burden of security on the individual, then why would we organize into states at all? I think there could be "IT security codes" just as there are "building codes" to enforce security good practices. But "survive impact from a 747" is not part of our building codes, and similarly "be resilient to targeted, state sponsored cyberwarfare" should not the responsibility of the individual.
- neolog 5y ago> But "survive impact from a 747" is not part of our building codes It basically is for skyscrapers now. https://global.ctbuh.org/resources/papers/download/1017-evolution-of-building-code-requirements-in-a-post-911-world.pdf https://global.ctbuh.org/resources/papers/download/1017-evol...
- theandrewbailey 5y ago> Its interesting to me that the discussion around ransomware attacks on HN is full of victim blaming. This is HN. It's filled with people whose job is building secure systems, or at the very least are aware of best practices to prevent these attacks. Of course you're going to read that they should have done this or that. > When stores are forced to close in SF because of rampant theft, nobody suggests that Walgreens or Target should hire armed guards. If a mall were to be bombed, nobody would suggest that malls should just be built to resist bombing attacks. Have you tried asking that in different places?
- tgv 5y agoTrying to prevent crime in another country is typically not within a government's mandate. > victim blaming That's a frame that carries a negative connotation. Why? Shouldn't builders construct houses that are safe enough? Or are you telling me that the government should prosecute the people responsible for the hacked systems?
- gundmc 5y ago> One of those tools was subverted on Friday, allowing the hackers to paralyze hundreds of businesses on all five continents. Aren't there 7 continents? I get ignoring Antarctica in this context, but it's still wrong to say "All 5" here. What weird phrasing.
- joe_the_user 5y agoWhy is it not possible to create a storage solution that protects against ransomware? Of course, it is possible to do this but it requires considerable cost and diligence. External hardware that only takes data from the target machine, for example - long timeline + key transactions logged. "Backup can't protect against ransomware" statements seem to be just shorthand for "your piece of shit backup doesn't protect against ransomware", which is true but when shortened doesn't seem like the right message.
- dijit 5y agoIt’s actually a lot easier than that. Back in the day I was using these netapp filers which had read-only snapshot volumes which were mounted on .snapshot. It would be practically impossible to remove those snapshots as it would require root access to the filer head. ZFS, BTRFS and lvm has similar functionality.
- joe_the_user 5y agoGiven current circumstances, it seems like hardware guarantees for numerous things are going to be necessary. Remember, we're solutions for people don't know WTF they're doing.
- twistedpair 5y agoIt is; just move to the cloud. AWS S3 and Google Cloud Storage have Retention Policy Locks [1] and fuse bits in their buckets. e.g. set the retention policy on your backups bucket to 1 year and burn the fuse bit. Now files cannot be deleted or changed in that bucket for 1 year after their creation. Not even the account root owner contacting support can get it changed. No ransomware, short of breaking into the AWS or GCP control plane is going to compromise those backups. 1. https://cloud.google.com/storage/docs/bucket-lock#policy-locks https://cloud.google.com/storage/docs/bucket-lock#policy-loc... P.S. remember the write protect tab on old floppies/tapes ;)
- joe_the_user 5y agoYeah, how hard is that? For kicks, an algorithm that contacts you multiple ways if it hasn't gotten a backup OR if the backup has a suddenly has a high diff from the previous backup.
- justastory 5y agohere is a story heard recently on irc: this gentleman was working at SBG a media conglomerate in America. during a troubleshooting process while they were using the system internal tools specifically TCP View(https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview https://docs.microsoft.com/en-us/sysinternals/downloads/tcpv...). they noticed that a certain address/domain kept showing up regularly even though no code was set to talk to that address. this responsible engineer promptly told his manager only to never hear it mentioned again. 1-2 months later that was one of the addresses listed as part of the solarwinds fiasco. another episode was when this same engineer noticed that a fellow engineer was irresponsibly and probably due to inexperience unknowingly inserting a backdoor in a process via eval on unfiltered input coming in via a command line param, a no no. this engineer was notified by the other and provided with a simple exploit only to receive yelling and gaslighting in return and statements such as "we don't care about these things at this company." eventually the manager was notified and his response was: "i have told them so many times about this" yet that also never went anywhere security is a layered process but with stories such as these it's no wonder attacks are common, someone somewhere will behave like the characters in the stories and that is all it takes, amplify that across all the companies in business and the other side has a pretty easy time finding open doors as long as management creates an environment where disclosure is considered "rocking the boat" managers and employees will never do the right thing.
- 1970-01-01 5y agoWhat we are experiencing is the next wave of Russia vs USA. In this go-round, instead of atomic missiles we have (profitable) cyberattacks. While it seems non-critical infrastructure was compromised in this attack, I have coined the phrase "Cold War II" to explain the critical infrastructure situation. Feel free to use it. Hopefully the weight of a new cold war will help put cyberattacks into the correct perspective for the media.
- deleted 5y ago[deleted]
- twistedpair 5y agoOnly 1500? Phew. Please tell me that my most onerous and security conscious customers weathered this just fine. You know, the folks that lock down ports by jack number, MAC address, and user. The folks that MiTM everything and instantly cauterize a port if the traffic becomes suspect. Please tell me they made it through this OK and that all the security theater was for something.