3 ms·

Ransomware attack forces Dallas to shut down courts, disrupts some 911 services

40 points by impish9208 4y ago

JoeAltmaier 4y ago
Time to treat ransomware originators as the terrorists they are?
- InCityDreams 4y ago
  Isn't everyone a terrorist these days?
- delecti 4y ago
  Terrorism requires a political objective. This is some combination of theft, ransom, extortion, or sabotage, unless there's reason to think Dallas in particular was targeted for political reasons.
  - bell-cot 4y ago
    True. But the actual meaning of "terrorist" doesn't count for much these days. Like "heathen", "witch", "Jew", "Nazi", etc. in earlier eras, "terrorist" is mostly a "maximal pejorative" - used to label people who don't get "until proven guilty" legal rights, nor human rights, and who it is socially sanctioned for ~anyone to hate, torture, murder, etc.
    - mr_00ff00 4y ago
      generally this is correct, but this kinda misses the point as to why terrorists are treated as they are. Not saying it is correct, but usually when they are overseas they are treated as enemy combatants (not to mention, if they aren’t US citizens then US rights don’t technically apply). You wouldn’t hold your fire in a battle because you need to have a judge determine whether an enemy army is guilty. That’s sort of the idea with foreign terrorist organizations.
      - bell-cot 4y ago
        > ...hold your fire in a battle... Admitting that the modern Laws of War are too-often broken, or twisted far beyond their intent...but shooting at a uniformed enemy soldier, during an actual battle, while making reasonable efforts to avoid hitting civilians, Medics, etc. - that is a very narrow set of criteria. 99.999% of humanity is neither on nor near that battlefield, to plausibly be targeted, nor be victims of errors and shell fragments. Vs. "use live ammo" against ransomware crooks? That sounds like a recipe for yet more "a week after our missiles obliterated his house, we realized that the real ransomware crooks had been using his hacked old cablemodem as an extra relay" lethal screw-ups.
        mr_00ff00 4y ago
        I wasn’t advocating for using this against ransomware hackers. Just that the idea that it’s not so black and white about terrorists and rights like innocent until proven guilty.
  - JoeAltmaier 4y ago
    Government institutions were targeted. Isn't that enough? Does the perpetrator's purpose have to be intuited to make it a heinous crime? It's hard to distinguish between this act and a 'legitimate' terrorist act. Same result for you and me.
    - delecti 4y ago
      You're moving the goalpost to include severity or terribleness. It doesn't make it more or less heinous, but part of the definition of terrorism includes motive. It's just like how a world leader's jilted ex-lover killing them for personal reasons doesn't make it an assassination just because they're a world leader.
- bell-cot 4y ago
  Beyond the PR exercise, what would that actually change? I'd guess that ransomware operators generally don't use their real names. Nor physical addresses. Nor operate out of countries willing to extradite to $Victims_Country. Nor ...
  - polski-g 4y ago
    You send in a covert team to the country and assassinate them. Not extradite. This is equivalent to blowing up a court house with a suitcase bomb.
  - dragonwriter 4y ago
    > Nor operate out of countries willing to extradite to $Victims_Country. Even from countries with an extradition treaty, the US has simply had people kidnapped to face trial in the US before.
- bdcravens 4y ago
  Then what? We launch drone strikes against some random city overseas? Honestly, the only hope is to attack the revenue model, and unfortunately, there's too much money tied up in cryptocurrency to do it without substantial collateral damage.
- hulitu 4y ago
  Why not write better software ?
MollyRealized 4y ago
I remember spotting a ransomware attack halfway through my first week of employment at a job, and I wasn't even in an IT job. It felt like a scene out of an action movie. <ahnold>"UNPLUG DA SEHVERS, NOWWWWWW!"</ahnold>
bdcravens 4y ago
Happened to the small suburb in North Houston I live in. Police computer were off-line for a few weeks, and it took them 3 months to even bill for water/gas/garbage.
mr_00ff00 4y ago
The big question get raised again, how do we get the non-tech savvy to be safe from cyber threats? Banks and tech companies have high security because they know what they are dealing with, pipelines/schools/hospitals/emergency services continue to be easy targets and things we need to pay money quickly for to get back.
- Veserv 4y ago
  Banks and tech companies do not have high security. There are exactly zero deployed commercial IT systems that can prevent a targeted attack by a financially motivated threat actor who stands to gain $11M from a successful attack. In fact, even at the $1M, low end of the ransom demanded in this case, is very unlikely you would find any company who could prevent complete compromise of their critical systems. The problem is that every single cybersecurity solution in the standard commercial IT space is snake oil. Microsoft, Mandiant, Google, etc. do not know how to make a system secure against this level of threat actor. Despite that, they insinuate that their systems are effective so that they can swindle the non-tech savvy to purchase their solutions. So, the actual big question is, how do we get the non-tech savvy to be safe from the cybersecurity companies? Until then they will keep flushing money down the drain and be unable to find real solutions in a sea of bullshit.
  - mr_00ff00 4y ago
    Maybe true, but I meant good security practices. It’s way easier to find a school or government agency that keeps passwords in plain text in code comments or emails than it would be at Meta.
    - Veserv 4y ago
      "Good" security practices mean very little when you are subject to attacks with a financial incentive of $1M. It matters only in the sense that you are the bottom fish in the barrel which is only relevant when dealing with opportunistic attacks sprayed indiscriminately for low upside and if people are not going to eat every fish in the barrel. That was the threat landscape 15 years ago when the hackers were kids asking for $300 to get startup funds. Now the hackers are grownups running mature industrial farming operations seeking to maximize absolute profit and are attacking everybody who is profitable. Increasing the cost to hack from $10K to $100K does not stop them from wanting to profitably harvest you for $1M. Yes, you may have decreased their ROI by a factor of 10, but you only decreased their absolute profit by 10%. That only matters if the hacking market is not saturated the market which is no longer true. More than 80% of the firms report they have been hacked [1], and as the director of the FBI has said [2] "I am convinced that there are only two types of companies: those that have been hacked and those that will be. And even they are converging into one category: companies that have been hacked and will be hacked again." As it turns out, only being able to outrun your friend instead of the bear only helps when there are 2 of you and 1 hungry bear instead of 2 of you and 50 hungry bears. [1] https://cfosurvey.fuqua.duke.edu/press-release/more-than-80-percent-of-firms-say-they-have-been-hacked/ https://cfosurvey.fuqua.duke.edu/press-release/more-than-80-... [2] https://archives.fbi.gov/archives/news/speeches/combating-threats-in-the-cyber-world-outsmarting-terrorists-hackers-and-spies https://archives.fbi.gov/archives/news/speeches/combating-th...
1659447091 4y ago
> Printers on the City of Dallas network reportedly began printing out ransom notes on Wednesday morning. This makes the "Tech enthusiast vs. engineers"[0] meme much more funny. On a more curious note, what prevents companies hit with these from wiping computers and restoring data from a clean backup and fresh system installs for workstations? Is there something in the attack that prevents this? or is the issue about the data being publicly released? [0] https://www.reddit.com/r/homeassistant/comments/alru1y/tech_enthousiasts_vs_engineers/ https://www.reddit.com/r/homeassistant/comments/alru1y/tech_...
- fatfingerd 4y ago
  I think it keeps getting easier to make stay resident attacks but from a game theory PoV it doesn't make sense to a ransomware maker to be known for charging over and over until people refuse to pay.
- boston_clone 4y ago
  > what prevents companies hit with these from wiping computers and restoring data from a clean backup and fresh system installs for workstations? honestly, it's probably that they simply don't have any clean backups and / or a good restore process; most organizations don't, and ransomeware recoveries for local governments over the years reinforces this.
- mr_mitm 4y ago
  In general, nothing. But before you restore backups (if you have any that weren't encrypted) you may want to determine the exact time at which you were compromised, or else you'll be restoring potentially tainted backups. Depending on how well you're organized that alone will take weeks, especially considering that your logs may be encrypted as well. Sometimes you don't even know how to contact everyone, because your comms are down, too.

40 points by impish9208 4y ago

JoeAltmaier 4y ago

Time to treat ransomware originators as the terrorists they are?

InCityDreams 4y ago
Isn't everyone a terrorist these days?
delecti 4y ago
Terrorism requires a political objective. This is some combination of theft, ransom, extortion, or sabotage, unless there's reason to think Dallas in particular was targeted for political reasons.
- bell-cot 4y ago
  True. But the actual meaning of "terrorist" doesn't count for much these days. Like "heathen", "witch", "Jew", "Nazi", etc. in earlier eras, "terrorist" is mostly a "maximal pejorative" - used to label people who don't get "until proven guilty" legal rights, nor human rights, and who it is socially sanctioned for ~anyone to hate, torture, murder, etc.
  - mr_00ff00 4y ago
    generally this is correct, but this kinda misses the point as to why terrorists are treated as they are. Not saying it is correct, but usually when they are overseas they are treated as enemy combatants (not to mention, if they aren’t US citizens then US rights don’t technically apply). You wouldn’t hold your fire in a battle because you need to have a judge determine whether an enemy army is guilty. That’s sort of the idea with foreign terrorist organizations.
    - bell-cot 4y ago
      > ...hold your fire in a battle... Admitting that the modern Laws of War are too-often broken, or twisted far beyond their intent...but shooting at a uniformed enemy soldier, during an actual battle, while making reasonable efforts to avoid hitting civilians, Medics, etc. - that is a very narrow set of criteria. 99.999% of humanity is neither on nor near that battlefield, to plausibly be targeted, nor be victims of errors and shell fragments. Vs. "use live ammo" against ransomware crooks? That sounds like a recipe for yet more "a week after our missiles obliterated his house, we realized that the real ransomware crooks had been using his hacked old cablemodem as an extra relay" lethal screw-ups.
      - mr_00ff00 4y ago
        I wasn’t advocating for using this against ransomware hackers. Just that the idea that it’s not so black and white about terrorists and rights like innocent until proven guilty.
- JoeAltmaier 4y ago
  Government institutions were targeted. Isn't that enough? Does the perpetrator's purpose have to be intuited to make it a heinous crime? It's hard to distinguish between this act and a 'legitimate' terrorist act. Same result for you and me.
  - delecti 4y ago
    You're moving the goalpost to include severity or terribleness. It doesn't make it more or less heinous, but part of the definition of terrorism includes motive. It's just like how a world leader's jilted ex-lover killing them for personal reasons doesn't make it an assassination just because they're a world leader.
bell-cot 4y ago
Beyond the PR exercise, what would that actually change? I'd guess that ransomware operators generally don't use their real names. Nor physical addresses. Nor operate out of countries willing to extradite to $Victims_Country. Nor ...
- polski-g 4y ago
  You send in a covert team to the country and assassinate them. Not extradite. This is equivalent to blowing up a court house with a suitcase bomb.
- dragonwriter 4y ago
  > Nor operate out of countries willing to extradite to $Victims_Country. Even from countries with an extradition treaty, the US has simply had people kidnapped to face trial in the US before.
bdcravens 4y ago
Then what? We launch drone strikes against some random city overseas? Honestly, the only hope is to attack the revenue model, and unfortunately, there's too much money tied up in cryptocurrency to do it without substantial collateral damage.
hulitu 4y ago
Why not write better software ?

MollyRealized 4y ago

I remember spotting a ransomware attack halfway through my first week of employment at a job, and I wasn't even in an IT job. It felt like a scene out of an action movie. <ahnold>"UNPLUG DA SEHVERS, NOWWWWWW!"</ahnold>

bdcravens 4y ago

Happened to the small suburb in North Houston I live in. Police computer were off-line for a few weeks, and it took them 3 months to even bill for water/gas/garbage.

mr_00ff00 4y ago

The big question get raised again, how do we get the non-tech savvy to be safe from cyber threats? Banks and tech companies have high security because they know what they are dealing with, pipelines/schools/hospitals/emergency services continue to be easy targets and things we need to pay money quickly for to get back.

Veserv 4y ago
Banks and tech companies do not have high security. There are exactly zero deployed commercial IT systems that can prevent a targeted attack by a financially motivated threat actor who stands to gain $11M from a successful attack. In fact, even at the $1M, low end of the ransom demanded in this case, is very unlikely you would find any company who could prevent complete compromise of their critical systems. The problem is that every single cybersecurity solution in the standard commercial IT space is snake oil. Microsoft, Mandiant, Google, etc. do not know how to make a system secure against this level of threat actor. Despite that, they insinuate that their systems are effective so that they can swindle the non-tech savvy to purchase their solutions. So, the actual big question is, how do we get the non-tech savvy to be safe from the cybersecurity companies? Until then they will keep flushing money down the drain and be unable to find real solutions in a sea of bullshit.
- mr_00ff00 4y ago
  Maybe true, but I meant good security practices. It’s way easier to find a school or government agency that keeps passwords in plain text in code comments or emails than it would be at Meta.
  - Veserv 4y ago
    "Good" security practices mean very little when you are subject to attacks with a financial incentive of $1M. It matters only in the sense that you are the bottom fish in the barrel which is only relevant when dealing with opportunistic attacks sprayed indiscriminately for low upside and if people are not going to eat every fish in the barrel. That was the threat landscape 15 years ago when the hackers were kids asking for $300 to get startup funds. Now the hackers are grownups running mature industrial farming operations seeking to maximize absolute profit and are attacking everybody who is profitable. Increasing the cost to hack from $10K to $100K does not stop them from wanting to profitably harvest you for $1M. Yes, you may have decreased their ROI by a factor of 10, but you only decreased their absolute profit by 10%. That only matters if the hacking market is not saturated the market which is no longer true. More than 80% of the firms report they have been hacked [1], and as the director of the FBI has said [2] "I am convinced that there are only two types of companies: those that have been hacked and those that will be. And even they are converging into one category: companies that have been hacked and will be hacked again." As it turns out, only being able to outrun your friend instead of the bear only helps when there are 2 of you and 1 hungry bear instead of 2 of you and 50 hungry bears. [1] https://cfosurvey.fuqua.duke.edu/press-release/more-than-80-percent-of-firms-say-they-have-been-hacked/ https://cfosurvey.fuqua.duke.edu/press-release/more-than-80-... [2] https://archives.fbi.gov/archives/news/speeches/combating-threats-in-the-cyber-world-outsmarting-terrorists-hackers-and-spies https://archives.fbi.gov/archives/news/speeches/combating-th...

1659447091 4y ago

> Printers on the City of Dallas network reportedly began printing out ransom notes on Wednesday morning. This makes the "Tech enthusiast vs. engineers"[0] meme much more funny. On a more curious note, what prevents companies hit with these from wiping computers and restoring data from a clean backup and fresh system installs for workstations? Is there something in the attack that prevents this? or is the issue about the data being publicly released? [0] https://www.reddit.com/r/homeassistant/comments/alru1y/tech_enthousiasts_vs_engineers/ https://www.reddit.com/r/homeassistant/comments/alru1y/tech_...

fatfingerd 4y ago
I think it keeps getting easier to make stay resident attacks but from a game theory PoV it doesn't make sense to a ransomware maker to be known for charging over and over until people refuse to pay.
boston_clone 4y ago
> what prevents companies hit with these from wiping computers and restoring data from a clean backup and fresh system installs for workstations? honestly, it's probably that they simply don't have any clean backups and / or a good restore process; most organizations don't, and ransomeware recoveries for local governments over the years reinforces this.
mr_mitm 4y ago
In general, nothing. But before you restore backups (if you have any that weren't encrypted) you may want to determine the exact time at which you were compromised, or else you'll be restoring potentially tainted backups. Depending on how well you're organized that alone will take weeks, especially considering that your logs may be encrypted as well. Sometimes you don't even know how to contact everyone, because your comms are down, too.