4 ms·

An insurance fund that requires periodic air gapped backups. So you roll back to the last snapshot and get money to cover losses incurred.

pc86 3y ago
There are a handful of problems with this approach, which is part of why these types of insurance policies are incredibly expensive. The entire MO of these operations is to infect a company's systems, and wait until most or all of the backups are affects before locking the system down. They will wait months or for bigger targets, years.
- Workaccount2 3y ago
  Sorry, by air-gapped I was envisioning things like tapes or disconnected disk drives.
  - pc86 3y ago
    That doesn't help. The system is already infected when the backups are taken, therefore the backups are infected. That's why these criminal organizations wait months until actually locking your system down, so that your oldest backups are deleted by retention policy. If they have access to your system and can figure out what your backup retention policy is, they'll set it to go off at the point when all your backups are infected.
    - zmgsabst 3y ago
      Infected how? Our backups were the data, not code or systems (which were IaC and rebuilt as needed).
      - pixl97 3y ago
        Are user accounts data or systems? Compromise of AD is a very common means. This said this can still be fixed before putting it back where it could reach the internet and cause trouble.
      - xur17 3y ago
        For a concrete example, someone could infect an image storing service with code that encrypts (and silently decrypts) the data when it's stored / retrieved. When the hacker removes the decryption key from the running service, the backups will also be inaccessible because they are also encrypted.
        Workaccount2 3y ago
        Wouldn't this be a bright red flag that is trivial to check for?
    - jowea 3y ago
      Can't they check their backups once every few months from an isolated infrastructure?
      - vkou 3y ago
        If they could check the backups for evidence of an intrusion, they would be able to check production for evidence of an intrusion.
        jowea 3y ago
        I meant check for evidence of corruption not an intrusion itself. How do you hide the fact that the data is unreadable?
        jabroni_salad 3y ago
        Ransomware is often not triggered quickly. They will compromise a box, install a back door, and hang onto it for months. You also have to consider that once they pop it, they can check other vulns that are available and will still be present after the restore. When I do remediation I usually recommend restoring only business state but installing and configuring all OSes and applications from scratch with latest freshly downloaded versions. You can't trust any executable or dll that has been laying around. That is not the restore dream that the backup provider sold them but reinfection is common. Once the bad guy has a privileged credential it is trivial for them to investigate for other vulns to use in the reinfection phase and nobody has just one critical vuln. If a business is susceptible to ntlm relay it's also going to have unsigned smb and non encrypted ldap traffic for the same root cause -- it was the default in 2005 and never got modernized.
raverbashing 3y ago
The dumbest take of companies was assuming insurance companies would keep paying their ransom because they were thinking fixing their networks was less important Oh well turns out it is not like that
mcpackieh 3y ago
No reason such an insurance company couldn't be run in the early/mid 20th century manner, entirely with paper records. Send carbon copies of all documents to two remote locations to eliminate the threat of a fire wiping out the records. This is easy. It requires you to hire a lot of human clerks, but since the customers are large businesses that means there aren't a whole lot of customers in the first place. And if you can't get enough typewriters, there's no reason the clerk work couldn't be done on computers connected to printers, with all document storage still being done on paper. If the computers get pwned, throw them out and buy new ones; it doesn't matter because the documents weren't being stored on those computers.

pc86 3y ago

There are a handful of problems with this approach, which is part of why these types of insurance policies are incredibly expensive. The entire MO of these operations is to infect a company's systems, and wait until most or all of the backups are affects before locking the system down. They will wait months or for bigger targets, years.

Workaccount2 3y ago
Sorry, by air-gapped I was envisioning things like tapes or disconnected disk drives.
- pc86 3y ago
  That doesn't help. The system is already infected when the backups are taken, therefore the backups are infected. That's why these criminal organizations wait months until actually locking your system down, so that your oldest backups are deleted by retention policy. If they have access to your system and can figure out what your backup retention policy is, they'll set it to go off at the point when all your backups are infected.
  - zmgsabst 3y ago
    Infected how? Our backups were the data, not code or systems (which were IaC and rebuilt as needed).
    - pixl97 3y ago
      Are user accounts data or systems? Compromise of AD is a very common means. This said this can still be fixed before putting it back where it could reach the internet and cause trouble.
    - xur17 3y ago
      For a concrete example, someone could infect an image storing service with code that encrypts (and silently decrypts) the data when it's stored / retrieved. When the hacker removes the decryption key from the running service, the backups will also be inaccessible because they are also encrypted.
      - Workaccount2 3y ago
        Wouldn't this be a bright red flag that is trivial to check for?
  - jowea 3y ago
    Can't they check their backups once every few months from an isolated infrastructure?
    - vkou 3y ago
      If they could check the backups for evidence of an intrusion, they would be able to check production for evidence of an intrusion.
      - jowea 3y ago
        I meant check for evidence of corruption not an intrusion itself. How do you hide the fact that the data is unreadable?
        jabroni_salad 3y ago
        Ransomware is often not triggered quickly. They will compromise a box, install a back door, and hang onto it for months. You also have to consider that once they pop it, they can check other vulns that are available and will still be present after the restore. When I do remediation I usually recommend restoring only business state but installing and configuring all OSes and applications from scratch with latest freshly downloaded versions. You can't trust any executable or dll that has been laying around. That is not the restore dream that the backup provider sold them but reinfection is common. Once the bad guy has a privileged credential it is trivial for them to investigate for other vulns to use in the reinfection phase and nobody has just one critical vuln. If a business is susceptible to ntlm relay it's also going to have unsigned smb and non encrypted ldap traffic for the same root cause -- it was the default in 2005 and never got modernized.

raverbashing 3y ago

The dumbest take of companies was assuming insurance companies would keep paying their ransom because they were thinking fixing their networks was less important Oh well turns out it is not like that

mcpackieh 3y ago

No reason such an insurance company couldn't be run in the early/mid 20th century manner, entirely with paper records. Send carbon copies of all documents to two remote locations to eliminate the threat of a fire wiping out the records. This is easy. It requires you to hire a lot of human clerks, but since the customers are large businesses that means there aren't a whole lot of customers in the first place. And if you can't get enough typewriters, there's no reason the clerk work couldn't be done on computers connected to printers, with all document storage still being done on paper. If the computers get pwned, throw them out and buy new ones; it doesn't matter because the documents weren't being stored on those computers.