7 ms·
Brooks County TX pays off hacker with tax dollars after ransomware attack
- fortran77 4y agoIt doesn't seem right that the incompetent people who didn't have backups and got themselves infected don't have to pay the consequences.
- metadat 4y agoInstead the citizens will pay for their fuckup. Sucks, doesn't it? Maybe /this/ is the real web3.
- Nathanael_M 4y agoWho else would be paying for it…? Genuinely, if a government entity has costs (even costs incurred by their own foolishness), who else should pay for it? Are you suggesting the councillors/admin staff should pay for it out of pocket? What other entity works like that?
- metadat 4y agoFor gov jobs, the incompetents deserve to be ousted and replaced with new people who are only potentially incompetent.
- speed_spread 4y agoWhat if the workers get more competent as the result of the attack? What if the worker competence's effectiveness was limited by the organizational structure?
- metadat 4y agoThat would be amazing. It's also asking a lot of a government employee.
- jltsiren 4y agoIncompetence is just a fact of life, not a moral failure. If you hire incompetent people, you can't reasonably expect them to do their jobs properly. You may save some money and avoid some inconvenience that way, but you may also have to face crises that would have been avoidable. Alternatively, you can spend more money proactively and hire more competent people. Either way, taxpayers will pay the price.
- drc500free 4y agoAt $37,000 a shot, it seems much cheaper to pay the ransom unless this happens multiple times a year.
- MandieD 4y agoYes, a county in the south Texas desert with fewer residents than a mid-size office park should just up and fire the one person in the county who could kind of do the job and was willing to do so each year for probably what a FAANG senior staff engineer makes each month. This county, by the way, was bankrupted from having to deal with the corpses of dead migrants who were desperate enough to try to sneak in through it.
- ab_testing 4y agoIf it takes you 6 months to get your software back up and running, is it really a good backup solution ?
- toomuchtodo 4y agoWhen you pay the hacker with your tax base funds, there is no accountability. Incentives matter, and the county was incompetent. > “The only data that we had that wasn’t backed up was in our auditor's office, where we have our financial software,” Ramos said. Seems like it should’ve been a priority. (a component of my work in risk mgmt is business continuity and disaster recovery, excuse my saltiness)
- verandaguy 4y agoI empathize with the instinct to point out a correct solution in a space you specialize in, but as another commenter pointed out, this is a county of about 5000 adults, with a likely very small government. It's very possible that they were under-resourced for this kind of incident, and under-resourced to have a rock-solid backup solution in place. Given the usual IT chops of a small local government, I give them points for having backups at all. Funding from higher levels of government (either state/provincial or federal depending on the region) earmarked for anti-ransomware initiatives, could help mitigate this sort of disaster in the future.
- deleted 4y ago[deleted]
- verve_rat 4y agoIt seems that state level governments should be providing the setup needed to run a county. These small places have no hope of operating a government software stack on their own.
- verandaguy 4y agoYup, that's my current opinion. Counties can be extremely well-funded if they encompass a city, and may have almost no funding at all if they're rural. The needs of each county government are obviously different as well, but there's still a bunch of fixed costs that take up a disproportionately large part of smaller counties' budgets.
- deleted 4y ago[deleted]
- 908B64B197 4y agoWhy didn't they just restore from back-up?
- kevin_thibedeau 4y agoBackups are a cost center...
- bluedevil2k 4y agoBackups get encrypted too
- WalterBright 4y agoThat's why one uses rolling backups.
- danachow 4y agoRead the article it’s right in there, I assure you. It was even quoted in the HN comments.
- saxonww 4y agoI worked for a company that got crypto-locked. We had backups. We had tested that representative backups and restores worked; do you test restore every backup you take? We did not test that restores worked across all affected machines concurrently in a reasonable amount of time. We did end up restoring some large percentage of machines from backup, eventually, then after retrieving/reviewing data we trashed those machines and rebuilt them. We also ended up paying - some of the backups didn't work, and some were taking so long to restore it didn't make sense to wait for them - and we rebuilt those as well. At least for us, we probably could have done a better job with testing backups. The behavior we saw with individual test restores was not the same as the what happened with mass restores, and we were surprised by that. Also, beyond just restoring from backup, we spent a lot of time rebuilding machines; if you get compromised, your backup might be clean, but the restored state is probably ready to be compromised again. I don't remember how long it was before our security people said they figured out how we got compromised in the first place.
- toma_caliente 4y agoHeadline seems unnecessarily inflammatory. Putting aside the decision of whether or not they should've paid, what else were they going to pay with?
- MarioMan 4y agoPayment via an insurance policy is more typical in these cases.
- InitialLastName 4y agoWhat are the insurance premiums paid from, if not taxes?
- ntoskrnl 4y ago> A recent ransomware attack on Brooks County’s Justice of the Peace and district courts, and finance department, cost it more than $37,000. > “We had determined if we didn’t, then it would take us anywhere from six months to a year to reconstruct our software program,” Ramos said. How much would it have cost for 6-12 months of engineer time plus the court system slowing to a crawl in the meantime? Thank god these hackers don't know how to negotiate.
- deleted 4y ago[deleted]
- _fs 4y ago> Thank god these hackers don't know how to negotiate. I think that's a feature, not a bug. They have exemplified that if they get paid, you get your data back. No negotiating, no games, just a hard time limit with consequences and a relatively low payout cost to avoid them.
- sour-taste 4y agobut... they did negotiate, from 93,000 to 37,000
- jxramos 4y agothis is interesting, the cost of doing business ala a black hat bug bounty effectively.
- dmix 4y agoThis is some tiny town, not surprised it was that low really. Someone here could have an idea how much it might cost. They said it was their financial software and it was the only one boy backed up. Which means it’s probably ancient. Idk much about municipal software. Buying new software is one thing you could price out. Losing historical financial data is the one that’s tricky to price.
- SOLAR_FIELDS 4y agoKnowing the state of municipalities in Texas, it was probably some legacy Tyler Technologies database. Maybe even one of the versions that still used COBOL for backend storage. Source: worked for a Texas municipality in a previous career life, but definitely not Brooks County
- boomboomsubban 4y ago>There are several different platforms out there that can shut a machine off if it becomes infected, and then keep all the other machines safe from the machine that is infected... Ramos said this is the type of software the county purchased after the attack, to protect the county’s server So I'm not an expert by any means, but I can't picture how that is an effective protection. Either the detection can catch it before infection, in which case why shut down? Or it catches it after infection when it could have already spread. Setting up that last backup sounds like a better use of money.
- dmix 4y agoYeah it sounds like a glorified manual kill switch, I doubt it’s automated in a meaningful way. If it was it’d be easy to bypass unless they figured out phishing AV and are keeping it a secret. But I guess they thought it was worth buying to appease the public.
- bpodgursky 4y agoEvery time a hospital system pays off hackers (which happens all the time)... I assure you the ransom payment is also mostly coming out of your tax dollars.
- swatcoder 4y agoFor all of us shocked shocked about the county’s preparation and response, it’s worth noting that this is a county of population ~7000 and only about 5000 adults. The number of people involved in government, and the resources available for professional support staff (and solution products) are probably modest to say the least. A lot of you probably went to high schools that were bigger and more funded.
- deleted 4y ago[deleted]
- kshacker 4y agoDoes it mean that like a corporate M&A, maybe some cities/counties could also indulge in M&A for better value to citizens? Because with bigger base you can afford more employees dedicated to specific tasks.
- formerkrogemp 4y agoUnfortunately, municipal entities only merge like that in metropolises, not rural areas.
- JumpCrisscross 4y agoIt’s not uncommon for smaller municipalities to pool resources under a county.
- mariojv 4y agoYes, this is a small operation, population wise and financially. The Brooks County most recent fiscal year budget has around $6M in revenue: https://www.co.brooks.tx.us/upload/page/5141/docs/20210922120105985.pdf https://www.co.brooks.tx.us/upload/page/5141/docs/2021092212... Really the federal government should be publishing and distributing guidance to local governments about how to run IT. I am wondering about how the ransom payout is going to show up in next year's budget. "Miscellaneous"? Off topic, but there is a documentary about migration through Brooks County and the perils faced by people trying to migrate: https://en.wikipedia.org/wiki/Missing_in_Brooks_County https://en.wikipedia.org/wiki/Missing_in_Brooks_County
- roody15 4y ago37,000$ really is not a huge amount.. surprised how low this amount is. Securing the systems and hiring more IT support services .. would have cost way more money honestly . Perhaps ransomware is evolving to fine just right price point niche?
- saxonww 4y agoI've felt like they aren't asking for just under the repair cost, they're asking for just under the "governments get serious about stopping this" cost.
- zach_garwood 4y agoYeah, I think it was a "stealing candy from a baby" type situation.
- 1970-01-01 4y agoSlow Wednesday? There is nothing newsworthy here. Here is a neat interactive map showing this trend. Make this newsworthy instead? https://statescoop.com/ransomware-map/ https://statescoop.com/ransomware-map/
- pevey 4y agoShould add to headline... "with bitcoin" And that is 90% of the actual demand for bitcoin. The rest was speculation, and that is going away as prices fall. So imagine how bitcoin would crash if people stopped paying these ransoms.
- gjs278 4y ago
- rudyfink 4y agoThis may be a very dumb crypto / ransomware question, but if someone knows the answer, I'd appreciate it. Why don't businesses (or systems) seed their drives with files with known text / content and then use those files to reverse the method used to encrypt? It seems like having an adversary encrypt a set of known "canary" files should provide information to reverse the encryption? Again, there may be a good reason (or many many good reasons) why this would not be a good solution, especially since I'd expect most OS installations have enough standard files to do this if it worked, but I am curious if someone knows. Edit: From the helpful comments, this is a known class of attack on a cryptosystem called a plaintext attack. Using that information, I looked into how ransomware systems address this attack, and several, apparently, use per-file keys as, in part, a defense against this type of attack.
- dmitrygr 4y agoBecause any sane encryption setup would not be weak against a simple known-plaintext attack
- AlotOfReading 4y agoWhat you're suggesting is known as a known-plaintext attack. All modern and properly implemented cryptosystems are designed to be highly resistant to it.
- rudyfink 4y agoThank you. And I guess those protections apply even at the volumes of data subject to these ransomware attacks?
- thehappypm 4y agoYes. Encryption produces a functionally random stream of encrypted data no matter what your input is.
- danachow 4y agoYour edit is still a bit confused. Any halfway decent encryption algorithm and mode can encrypt terabytes of data and still be resistant to known plaintext attacks. You can pretty safely use a single key to encrypt an entire hard-drive after all - that's how Bitlocker and LUKS, etc work. You don't need per file keys for encryption security or defense against known plaintext - it gives more flexibility in selectively decrypting though -- ie pay me a little money and I can prove I can return some of your shit, pay more if you want the rest.
- thehappypm 4y agoA few bucks per taxpayer is no big deal IMO
- WalterBright 4y ago“The only data that we had that wasn’t backed up was in our auditor's office, where we have our financial software,” Seems to me that in modern times failing to back things up is incompetence and dereliction of duty. The auditor should be billed for at least part of the payment.