7 ms·

Sinclair TV stations disrupted across the US in apparent ransomware attack

165 points by arkadiyt 5y ago

jprd 5y ago
This morning, flipped on the London Foosball game to run in the background. When no local commercials aired, I assumed someone was just gonna get fired. All that showed was a fancy placeholder graphic with a local affiliate code. One less itch for my brain to scratch - thanks!
- ehPReth 5y ago
  Do you have a picture of this anywhere?
- sverhagen 5y ago
  What makes you think no one is gonna get fired now then?
  - Reubachi 5y ago
    Well, we now know it won't be the "commercial manager" or whoever that gets the axe, rather an IT Admin.
- LocalH 5y ago
  Speaking from a US perspective here, although these basics would likely be true everywhere. Stations have a process when this type of thing happens. There's usually a range of time when the commercials are "good", and there's often times enough non-commercial content in the breaks that things could be shuffled around and all spots can still be made good during the relevant program. At the very least, I'm sure they'd bump a lesser-paying commercial if it absolutely came down do it, to get paid by a more expensive commercial. In this case, being live, the operator would be firing the break themselves. If they missed the break due to gross negligence, they'll probably lose their job (or at least be reprimanded). But, if the fault happened due to technical malfunction, or if they happened to be dragged away from the console by their supervisor, then they'll just make the spots good and move on.
afrcnc 5y ago
Hacker News need a "the world's smallest violin" emoji.
- RNCTX 5y ago
  yeah these are the ones who sent out all of their local station managers years ago to try to convince us that OTA broadcasts needed a fee on cable. hope they get clipped for tens of millions, hundreds of millions even better.
- gumby 5y ago
  Given the target, I expect the explanation to be space lasers controlled by a Venezuelan company’s Italian servers under orders from China.
boomboomsubban 5y ago
Given they're known for their strong ideological stance, it'll be interesting to see their coverage of this and future ransomware attacks.
- kevin_thibedeau 5y ago
  Those liberal hackers are at it again, trying to suppress faith based truth.
  - boomboomsubban 5y ago
    That would be sort of cute compared to my guess, which is something like "Biden is soft on Russia to censor small local stations."
thamer 5y ago
In case the name doesn't ring a bell: Sinclair is the group that was widely reported on a few years ago in a series of viral videos that showed dozens of their anchors reciting the same exact line about fake news.[1] They control a large segment of the "local news" market, and viewers are frequently unaware that they are watching a Sinclair station. [1] https://youtu.be/_fHfgU8oMSo?t=34 https://youtu.be/_fHfgU8oMSo?t=34
- echelon 5y ago
  John Oliver has done several hilarious and informative segments on them, https://youtu.be/GvtNyOzGogc https://youtu.be/GvtNyOzGogc https://youtu.be/cb468kPBGUk https://youtu.be/cb468kPBGUk
- TeMPOraL 5y ago
  Ah, the Borg news, as I call them. (For those unfamiliar: because of the voice of the Collective - https://youtu.be/c5rlAjuwdLQ?t=106 https://youtu.be/c5rlAjuwdLQ?t=106 )
thelibrarian 5y ago
…and nothing of value was lost.
xbuzz 5y ago
I mean… I kind of love this.
post_break 5y ago
Glad I'm not the only one here who does not like this company. When thinking about companies I wish I could easily boycott, Nestle comes to mind, and then there is Sinclair. The fact that the stations are down is pretty huge though. That's really bad opsec, unless they were all tied together with some 3rd party service.
- setpatchaddress 5y ago
  Sinclair is bad, but Facebook and News Corp are much, much worse.
  - spacemanmatt 5y ago
    Which still leaves this event somewhere near "good praxis" and "weekend larfs"
  - joe_the_user 5y ago
    Sinclair is more or less a smaller version of News Corp (Sinclair is largest owner of Fox affiliated stations in the US, notably). Facebook is a fairly different company with different reasons to be hated. https://en.wikipedia.org/wiki/Sinclair_Broadcast_Group https://en.wikipedia.org/wiki/Sinclair_Broadcast_Group
    - brewdad 5y ago
      To me, where Sinclair is most insidious is where they own non-Fox stations. It would be easy if I only had to avoid anything with Fox branding top to bottom. In my city, they own the ABC affiliate, which adds to difficulty in knowing which sources are trustworthy.
  - deleted 5y ago
    [deleted]
- arkadiyt 5y ago
  > That's really bad opsec, unless they were all tied together with some 3rd party service. The article addresses this: > The attack could have been isolated, but many sections of the Sinclair IT network were interconnected through the same Active Directory domain, allowing the attackers to reach broadcasting systems for local TV stations.
mrweasel 5y ago
Having your corporate network with clients, email and file server hit is something I can understand, but the broadcasting system? Maersk had the same problem, for some unknown reason the computers running their most critical infrastructure was/is allowed to run pretty any application. Why is the broadcasting system on a network connected to anything else and if it most be: Why are those computers allowed to run anything but a few whitelisted application?
- HideousKojima 5y ago
  Worked IT at a Sinclair owned affiliate about 8 years ago. The teleprompter computer for the nightly news was connected to the internet, and was running Windows 2000.
  - mrweasel 5y ago
    Security of so many things is an absolute joke. The teleprompter only needs to be connected to the writers network, and could easily be a read-only system that just pull the script from the network. There is so much room for improvement in pretty much any field using computers.
- pjc50 5y ago
  > Why is the broadcasting system on a network connected to anything else .. because that's how the programmes come in, over the internet? > Why are those computers allowed to run anything but a few whitelisted application? This is almost impossible to achieve, and doesn't help when the malware is running in the address space of the target process.
  - mrweasel 5y ago
    Even if we accept that programs need to come in directly from the internet, then at least do that via a VPN. The broadcasting software isn’t going to be an attack vector for a drive-by malware attack, so limiting the broadcast system to only preapproved software would still help a great deal. Companies keep behaving like their critical systems isn’t that important and then they’re suprised when it goes wrong. At the same time they keep paying for useless audits done by accountants who will happily sign off on the security because there’s a firewall and anti-virus software installed.
HideousKojima 5y ago
Used to do IT (helpdesk) for one of the many local networks that got acquired by Sinclair around 2013. Company I worked for owned about a dozen stations across the region, when Sinclair bought us they owned around 200 at the time. In spite of this, our IT operations were way more advanced. For example, Sinclair had only started using AD and Exchange less than a year before acquiring us, they had been on some ancient Novell installation before that. Most entertaining memory I have of their incompetence: after the acquisition my boss no longer had permission to approve payment of bills, it had to go through corporate. So my boss called and emailed for months to get payments approved for our internet, phone service, etc., keeping a thorough record of all of the times he had asked to get our bills paid. Fast foward to about 4 months after the aquisition and suddenly our long distance phone service stops working. We contact the phone computer and find it's because of non-payment (we already suspected as much thanks to all the late notices we received). Corporate flips their lid, attempts to blame my boss for it, and he just sends them the dozens of emails and refers them to the dozens of calls he made record of. No idea who (if anyone) took the heat for it at corporate after that. Second story, we hired a new senior network engineer. Turns out he knew even less about networking than me and the other guy on the helpdesk. But the technical competency part of the interview process was administered by, you guessed it, someone in corporate IT. At least we were able to get the guy fired within a few weeks of him starting, and the guy at corporate who passed him had some major egg on his face. This was shortly before I left though so I don't know if anything more came of it. I only stayed for about a year after the merger.
- q1w2 5y ago
  I'm sure all of this is true, but I feel as though if a gang of thieves ran through your neighborhood and robbed everyone who didn't have a home alarm system, and/or leaving doors/windows unlocked. Would we all be talking about how incompetent all these home owners are for not having basic home security. Particularly for HN, I feel like we should be discussing how to attack the attackers - and less victim blaming.

165 points by arkadiyt 5y ago

jprd 5y ago

This morning, flipped on the London Foosball game to run in the background. When no local commercials aired, I assumed someone was just gonna get fired. All that showed was a fancy placeholder graphic with a local affiliate code. One less itch for my brain to scratch - thanks!

ehPReth 5y ago
Do you have a picture of this anywhere?
sverhagen 5y ago
What makes you think no one is gonna get fired now then?
- Reubachi 5y ago
  Well, we now know it won't be the "commercial manager" or whoever that gets the axe, rather an IT Admin.
LocalH 5y ago
Speaking from a US perspective here, although these basics would likely be true everywhere. Stations have a process when this type of thing happens. There's usually a range of time when the commercials are "good", and there's often times enough non-commercial content in the breaks that things could be shuffled around and all spots can still be made good during the relevant program. At the very least, I'm sure they'd bump a lesser-paying commercial if it absolutely came down do it, to get paid by a more expensive commercial. In this case, being live, the operator would be firing the break themselves. If they missed the break due to gross negligence, they'll probably lose their job (or at least be reprimanded). But, if the fault happened due to technical malfunction, or if they happened to be dragged away from the console by their supervisor, then they'll just make the spots good and move on.

afrcnc 5y ago

Hacker News need a "the world's smallest violin" emoji.

RNCTX 5y ago
yeah these are the ones who sent out all of their local station managers years ago to try to convince us that OTA broadcasts needed a fee on cable. hope they get clipped for tens of millions, hundreds of millions even better.
gumby 5y ago
Given the target, I expect the explanation to be space lasers controlled by a Venezuelan company’s Italian servers under orders from China.

boomboomsubban 5y ago

Given they're known for their strong ideological stance, it'll be interesting to see their coverage of this and future ransomware attacks.

kevin_thibedeau 5y ago
Those liberal hackers are at it again, trying to suppress faith based truth.
- boomboomsubban 5y ago
  That would be sort of cute compared to my guess, which is something like "Biden is soft on Russia to censor small local stations."

thamer 5y ago

In case the name doesn't ring a bell: Sinclair is the group that was widely reported on a few years ago in a series of viral videos that showed dozens of their anchors reciting the same exact line about fake news.[1] They control a large segment of the "local news" market, and viewers are frequently unaware that they are watching a Sinclair station. [1] https://youtu.be/_fHfgU8oMSo?t=34 https://youtu.be/_fHfgU8oMSo?t=34

echelon 5y ago
John Oliver has done several hilarious and informative segments on them, https://youtu.be/GvtNyOzGogc https://youtu.be/GvtNyOzGogc https://youtu.be/cb468kPBGUk https://youtu.be/cb468kPBGUk
TeMPOraL 5y ago
Ah, the Borg news, as I call them. (For those unfamiliar: because of the voice of the Collective - https://youtu.be/c5rlAjuwdLQ?t=106 https://youtu.be/c5rlAjuwdLQ?t=106 )

thelibrarian 5y ago

…and nothing of value was lost.

xbuzz 5y ago

I mean… I kind of love this.

post_break 5y ago

Glad I'm not the only one here who does not like this company. When thinking about companies I wish I could easily boycott, Nestle comes to mind, and then there is Sinclair. The fact that the stations are down is pretty huge though. That's really bad opsec, unless they were all tied together with some 3rd party service.

setpatchaddress 5y ago
Sinclair is bad, but Facebook and News Corp are much, much worse.
- spacemanmatt 5y ago
  Which still leaves this event somewhere near "good praxis" and "weekend larfs"
- joe_the_user 5y ago
  Sinclair is more or less a smaller version of News Corp (Sinclair is largest owner of Fox affiliated stations in the US, notably). Facebook is a fairly different company with different reasons to be hated. https://en.wikipedia.org/wiki/Sinclair_Broadcast_Group https://en.wikipedia.org/wiki/Sinclair_Broadcast_Group
  - brewdad 5y ago
    To me, where Sinclair is most insidious is where they own non-Fox stations. It would be easy if I only had to avoid anything with Fox branding top to bottom. In my city, they own the ABC affiliate, which adds to difficulty in knowing which sources are trustworthy.
- deleted 5y ago
  [deleted]
arkadiyt 5y ago
> That's really bad opsec, unless they were all tied together with some 3rd party service. The article addresses this: > The attack could have been isolated, but many sections of the Sinclair IT network were interconnected through the same Active Directory domain, allowing the attackers to reach broadcasting systems for local TV stations.

mrweasel 5y ago

Having your corporate network with clients, email and file server hit is something I can understand, but the broadcasting system? Maersk had the same problem, for some unknown reason the computers running their most critical infrastructure was/is allowed to run pretty any application. Why is the broadcasting system on a network connected to anything else and if it most be: Why are those computers allowed to run anything but a few whitelisted application?

HideousKojima 5y ago
Worked IT at a Sinclair owned affiliate about 8 years ago. The teleprompter computer for the nightly news was connected to the internet, and was running Windows 2000.
- mrweasel 5y ago
  Security of so many things is an absolute joke. The teleprompter only needs to be connected to the writers network, and could easily be a read-only system that just pull the script from the network. There is so much room for improvement in pretty much any field using computers.
pjc50 5y ago
> Why is the broadcasting system on a network connected to anything else .. because that's how the programmes come in, over the internet? > Why are those computers allowed to run anything but a few whitelisted application? This is almost impossible to achieve, and doesn't help when the malware is running in the address space of the target process.
- mrweasel 5y ago
  Even if we accept that programs need to come in directly from the internet, then at least do that via a VPN. The broadcasting software isn’t going to be an attack vector for a drive-by malware attack, so limiting the broadcast system to only preapproved software would still help a great deal. Companies keep behaving like their critical systems isn’t that important and then they’re suprised when it goes wrong. At the same time they keep paying for useless audits done by accountants who will happily sign off on the security because there’s a firewall and anti-virus software installed.

HideousKojima 5y ago

Used to do IT (helpdesk) for one of the many local networks that got acquired by Sinclair around 2013. Company I worked for owned about a dozen stations across the region, when Sinclair bought us they owned around 200 at the time. In spite of this, our IT operations were way more advanced. For example, Sinclair had only started using AD and Exchange less than a year before acquiring us, they had been on some ancient Novell installation before that. Most entertaining memory I have of their incompetence: after the acquisition my boss no longer had permission to approve payment of bills, it had to go through corporate. So my boss called and emailed for months to get payments approved for our internet, phone service, etc., keeping a thorough record of all of the times he had asked to get our bills paid. Fast foward to about 4 months after the aquisition and suddenly our long distance phone service stops working. We contact the phone computer and find it's because of non-payment (we already suspected as much thanks to all the late notices we received). Corporate flips their lid, attempts to blame my boss for it, and he just sends them the dozens of emails and refers them to the dozens of calls he made record of. No idea who (if anyone) took the heat for it at corporate after that. Second story, we hired a new senior network engineer. Turns out he knew even less about networking than me and the other guy on the helpdesk. But the technical competency part of the interview process was administered by, you guessed it, someone in corporate IT. At least we were able to get the guy fired within a few weeks of him starting, and the guy at corporate who passed him had some major egg on his face. This was shortly before I left though so I don't know if anything more came of it. I only stayed for about a year after the merger.

q1w2 5y ago
I'm sure all of this is true, but I feel as though if a gang of thieves ran through your neighborhood and robbed everyone who didn't have a home alarm system, and/or leaving doors/windows unlocked. Would we all be talking about how incompetent all these home owners are for not having basic home security. Particularly for HN, I feel like we should be discussing how to attack the attackers - and less victim blaming.