4 ms·
I am not able to follow the reasoning of this part of the write-up: The most important bit of information the above chart shows us is what a full database tran
by solidsnack9000 4y ago
I am not able to follow the reasoning of this part of the write-up:
The most important bit of information the above chart shows us is what a full database transfer looks like in terms of bandwidth. From 6p to 9:30p, the amount of data was the expected amount from a working primary server with multiple secondaries syncing to it. At 3a, you’ll see an enormous amount of data transfered.
This tells us that the hacker was an automated digital vandal rather than a concerted hacking attempt. And if we were to pay the ransom, it wouldn’t do anything because the vandals don’t have the data and have nothing to release.
- jacquesm 4y agoIf this is what a backup looks like in terms of traffic and around the time of the hack there is no corresponding amount of traffic then the hacker never made the backup that they claim they made.
- dmurray 4y agoI think he's saying, at 3am his own database replication kicked off, and you can see a spike in the bandwidth usage. There's no similarly-sized unexplained spike that could correspond to the hacker exfiltrating the data.
- sthatipamala 4y agoThey know what the bandwidth graph looks like when a full DB replication/dump is in progress. Since that level of data transfer only occurred once (when they did it), they know the attacker did not actually transfer any data.