5 ms·
ARRL IT Security Incident – $1M ransom
- SoftTalker 2y agoGood excuse to start over. I lost a hard drive once due to a failure. It was actually liberating. A lot of old stuff I didn't have to worry about anymore.
- deleted 2y ago[deleted]
- jrexilius 2y agoWhy did they agree to pay the ransom? Such a small org it seems like they could rebuild the systems they needed for less than $1mil?..
- rexreed 2y agoThat's also my question. In general, can someone explain why offsite, offline, multi-timescale backups don't help in these cases? Yes I get that insurance paid the extortion, but besides just capitulating, why doesn't restoring from backup work, assuming you can spot the vulnerability that caused the ransomware attack?
- loandbehold 2y agoTheir insurance covered ransom. Why on the earth does insurance cover ransom? Doesn't it encourage such attacks? Ideally paying ransom should be illegal as it just funds further attacks.
- selectodude 2y agoInsurance companies will see if it was a novel targeted hack that really couldn’t have been stopped vs laziness and poor security hygiene in which case they will cover less.
- II2II 2y agoWould it stop ransomware attacks, or is it another one of those situations where the cost of launching an attack is so low that you only need an insignificant number of desperate victims to pay in order to profit? I am also left to wonder if paying helps the investigation.
- loandbehold 2y agoI'm sure it would reduce ransomware attacks by an order of magnitude. These are not simple attacks and the cost to launch them isn't that low. It requires large effort from groups of smart people to penetrate these corporate networks and it's time-consuming for attackers. The opportunity cost for these smart people is high, most of them can get a high paying job. The reason these attacks persist is because it's so lucrative. These's definitely a break even point for attackers. If 80% of ransom payments are stopped the attacks will stop because it will no longer be profitable for attackers.
- BobbyTables2 2y agoWhy wouldn’t an insurance company want to keep 20% of premiums covering ransom payments ? They stand to loose future premiums if paying ransoms is NOT broadly seen as a viable option. Sure, in the short term, they hate customers that make a lot of claims. But those claims, in aggregate, are the fuel for their 20% skimming… If nobody paid ransom, why would they want insurance coverage? And if no insurance covered it, they wouldn’t be able to skim off the corresponding premiums…
- jrexilius 2y agoYou are touching on my thoughts exactly. It seems everyone would come out better if the insurance company just paid for them to rebuild. I suspect that'd come out cheaper and it would maybe deter the attacks by making them worth less..
- firesteelrain 2y agoIt’s light on details but perhaps there was data that was not easy to recover. We also have to consider the rebuild labor and if entire systems are corrupted then repurchasing new systems.
- batch12 2y agoThe only way to make ransomware go away is to make the penalties for paying higher than the ransom.
- smegsicle 2y agodecimate the it security team
- SnorkelTan 2y agoor the liability for the fault with the software maker. Like a defective car that kills ppl reners the manufacturer of the car responsible.
- Eduard 2y agoamateur radio lives in a different IT world. A significant amount of popular software is shared as archived source files with ambiguous licensing, hosted on personal homepages, and served via unencrypted HTTP.
- ronsor 2y agoYou're lucky if you get source files.
- rincebrain 2y agoIt lives in the late 80s, if you're lucky, and earlier than that if you're not.
- gustavus 2y ago> Sometime in early May 2024, ARRL’s systems network was compromised by threat actors (TAs) using information they had purchased on the dark web. The TAs accessed headquarters on-site systems and most cloud-based systems So someone was using the same password for the work and personal stuff and no one has ever bothered prioritizing 2FA got it.
- underlogic 2y agoprobably some kids in a basement. most security admins I've met are total frauds. sophisticated for $1m? no they're just trying to keep their jobs after being revealed as totally incompetent.
- hi-v-rocknroll 2y agoThe failed at having backups and DR/BCP. Also, paying ransomware demands should have civil and criminal penalties because all it does is cause more of it. Ransomware insurance should also be illegal.
- tonymet 2y agothe threat actors also compromised the cloud accounts. it's likely the backups were also captured
- fortran77 2y agoThey should have just rebuilt it. (I've been an ARRL member since 1977). I suppose they didn't want to lose LOTW.