7 ms·

Instructure pays ransom to Canvas hackers

• Cider9986 6mo ago
  Got to scroll down to see the update. (https://www.instructure.com/incident_update#:~:text=STATUS%20UPDATE%205/11/26 https://www.instructure.com/incident_update#:~:text=STATUS%2...)
  • dang 6mo ago
    Thanks, we've put that in the toptext.
• Cider9986 6mo ago
  >The data was returned to us. It was my understanding that the data was copied[1]. You wouldn't "return" data unless it was encrypted or the originals were deleted. I am confused on this phrasing but maybe it is standard idk. This is bullish on Monero[2]. The January pump may have been from a hack as well[3]. Here is Shinyhunters website. Canvas was listed on it[4] and then removed[5]. [1] https://www.youtube.com/watch?v=IeTybKL1pM4 https://www.youtube.com/watch?v=IeTybKL1pM4 [2] https://search.brave.com/search?q=monero+price&rh_type=cc&range=1m https://search.brave.com/search?q=monero+price&rh_type=cc&ra... [3] https://xcancel.com/zachxbt/status/2012212936735912351 https://xcancel.com/zachxbt/status/2012212936735912351 [4] https://archive.ph/4zD7f https://archive.ph/4zD7f [5] https://archive.ph/NYWbJ https://archive.ph/NYWbJ
  • avaer 6mo ago
    I guess the incentive is for the hackers to not leak, so they can get away with the next ransom.
  • embedding-shape 6mo ago
    > You wouldn't "return" data unless it was encrypted or the originals were deleted The very next line from what you quoted: > We received digital confirmation of data destruction (shred logs). Now, color me surprised if they didn't delete it, but I'm guessing this is why they call it "returned", since from their beliefs, the data was deleted after it was "returned".
  • mbesto 6mo ago
    This is a good time to point out that when there is a data breach, data is rarely stolen. The real threat and harm is when data that is stolen is used against you.
• SilverElfin 6mo ago
  Given they were hacked multiple times, couldn’t they just be targeted again by the same or different group? Why would it stop here?
  • somenameforme 6mo ago
    Simple economic motivations from the hackers. They've hacked a lot of different companies. [1] If they didn't keep their word then companies would have no incentive to pay, and vice versa when they do keep their word. [1] - https://en.wikipedia.org/wiki/ShinyHunters https://en.wikipedia.org/wiki/ShinyHunters
  • Freak_NL 6mo ago
    The same group has a reputation to uphold (i.e., that of 'honourable' criminals), so they just move on to the next target, who will, incidentally, know that they are absolutely true to their word. (This is why paying off ransomware hackers is being made illegal in a number of countries.) A different group? Certainly. I wouldn't want to be in the shoes of the infosec guys at Canvas right now.
    • felooboolooomba 6mo ago
      So they hacker group could create an unregistered subsidiary and hack some more?
      • OneDeuxTriSeiGo 6mo ago
        They could but also why would they? They can always just hack them again but with a different method this time. The ransom doesn't bind them from hacking the company multiple times. It just obligates them to destroy the data they collected from this attack. As a matter of kindness and good business they'll probably wait a few months or a year or so before poking around again but they'll almost certainly continue poking at Instructure's systems. Data exfil ransom attacks are a business first and foremost. They don't permanently halt or destroy the original infra and their goal is to get a payout for their labor and move on. Maybe the come back around in the future with another, different attack, maybe they don't. They made their money and made it big in the news as having complied with the ransom payout, no reason to hurt their reputation trying to double dip. Plenty of other soft targets to poke.
• ookblah 6mo ago
  LOL that's some super heavy duty optics framing on what basically amounts to "we paid out a ransom but don't worry the bad guys assured us things were okay"
  • layman51 6mo ago
    I thought it was illegal to pay ransom to hackers. I guess it is legal or maybe it isn't very clear? I thought that there were certain conditions that the company had to check together with law enforcement so that at least the ransom money doesn't go to a hacker group that is on a government payments sanctions list. Also, does anyone know the root cause of the attack? I read a rumor online (but it's not really confirmed anywhere) that it may have had to do with the common pattern of ShinyHunters where they use a vulnerability in a Salesforce Experience Cloud site. What is confirmed for sure is that the vulnterability involved the feature of Canvas called "Free-For-Teacher accounts".
    • deleted 6mo ago
      [deleted]
    • JohnMakin 6mo ago
      Not only is it not illegal, there are insurance policies set up to take care of this very scenario. It's almost always handled by a third party, not the company themselves, that would deal with any such concerns.
      • dylan604 6mo ago
        It is illegal to pay terrorists. As bad and annoying as hackers are, I'm not familiar with any government recognizing any hacking group as a terrorist group. If they did, would they be able to send in SEAL Team 6 to handle the hackers?
        • junofan 6mo ago
          Search “cyber jihad” and “cyber islamic state” if you’re curious for answers.
• john_strinlai 6mo ago
  on one hand, every ransom paid encourages like-minded individuals to start or ramp up their ransomware game , which is not great. on the other hand, the ransomware groups that want to stay in business need to be honest (with respect to not releasing/deleting data) or they wont be 'credible' ransomware operators, which is kind of funny to think about. and in many cases, the victims would rather the ransomware operator be paid (so their data is not leaked) vs. having their data leaked. so paying is the best for current victims (but increases the potential for future victims). the dynamics/economics around ransomware is fascinating.
  • cortesoft 6mo ago
    This is always the game theory of ransoms, and it is a classic example of a collective action problem (and is a form of a prisoner's dilemma). Each individual company is probably better off paying the ransom, but everyone would be better off if no one paid a ransom. This is why the United States, for example, has an official no-ransom policy, and why other no-ransom policies exist. You have to have something forcing the individual victim to not pay, otherwise they will always be incentivized to pay and ransoms will continue to be profitable. https://en.wikipedia.org/wiki/Collective_action_problem https://en.wikipedia.org/wiki/Collective_action_problem https://en.wikipedia.org/wiki/Prisoner%27s_dilemma https://en.wikipedia.org/wiki/Prisoner%27s_dilemma
    • Hizonner 6mo ago
      ... except that "policies" don't cut it. Criminal penalties for paying are what you need, and not just for payments to specific designated entities, either. The executive making the decision to pay has to have a real fear of personally spending time in actual prison.
      • gnopgnip 6mo ago
        US law has criminal penalties for paying a ransom to a designated criminal terrorist organization or under treasury sanctions.
• wingdingst 6mo ago
  [flagged]
• doublerabbit 6mo ago
  It would be amusing to discover it turned out that the hackers were 14 year old teenagers, bored with school.
  • cheschire 6mo ago
    The defendant, who calls himself “zero cool”, has repeatedly committed criminal acts of a malicious nature.
• Freak_NL 6mo ago
  How is Instructure getting away with paying off the ransomware hackers? Is that still legal in Utah or something?
  • ibejoeb 6mo ago
    This happens every day, and there doesn't seem to be anything interesting about this case. It's how most situations are resolved. There are money transmitters that specialize in ransoms. They "do" sanctions checks that are about as good as you suspect they are. Like other commenters have pointed out, it's literally a business. Most trade on reputation, so there actually is an incentive for them to take their money and abide by their agreements. Otherwise, they would have to start from scratch with a fresh identity and rebuild the rep to command their prices.
• delichon 6mo ago
  A good infotech public service project would be to maintain a public list of organizations that have succumbed to ransom demands, so that we can choose to take our business elsewhere. It would also be an act of bravery though in the face of potential liability for libel. I doubt disclaimers would evade much of that.
  • pretzel5297 6mo ago
    So you would rather take your business to somewhere that got hacked, didn't pay the ransom, and got customer data leaked?
    • delichon 6mo ago
      Yes, particularly if they are transparent about it.
      • pretzel5297 6mo ago
        Yeah, sorry. I don't believe you :)
    • jsLavaGoat 6mo ago
      Both of them got hacked so... yes.
    • tadfisher 6mo ago
      The customer data is already leaked, unless your threat model somehow includes trusting threat actors to keep said data confidential in perpetuity.
      • applfanboysbgon 6mo ago
        ShinyHunters has a vested financial stake in not leaking the customer data. If they did, nobody would ever pay a ransom to them again. I trust ShinyHunters to look out for themselves continuing to get paid.
• xvxvx 6mo ago
  Michael Jackson paid the ransom and look what happened to him.
• rottencupcakes 6mo ago
  What on earth does "returned the hacked personal data" mean?
  • yakkomajuri 6mo ago
    I believe attacks like this often include copying data and then deleting it from the victim's servers. Although of course returning is a weird term in the sense that the attackers will almost certainly keep the data as well.
• terminalbraid 6mo ago
  > We received digital confirmation of data destruction (shred logs). This is shockingly naive
  • corvad 6mo ago
    What's to say they didn't copy the data then shred a copy, or hell even just fabricate some shred logs.
    • latexr 6mo ago
      In the abstract, it’s hilarious to imagine the hackers keeping the data, then some time from now leaking it accidentally (or another hacker group hacks them) then them having to issue a public apology for not having kept the stolen data secure and having lied about shredding it.
      • eaf7e281 6mo ago
        However, they could use it as a last resort or as a final "gift" before getting arrested or switching identities. They might be considered "trustworthy" right now to get companies to pay them money, but no one will know what will happen in a few years when this strategy won't work anymore. Anyway, I hope this doesn't come at all, or as late as possible.
        • latexr 6mo ago
          > but no one will know what will happen in a few years when this strategy won't work anymore. Good point. > Anyway, I hope this doesn't come at all, or as late as possible. Same. As I said, I find the idea funny in the abstract, if it didn’t affect anyone or if it were a TV show, for example. But since it does affect real people…
  • Groxx 6mo ago
    Gotta hope that's just a PR attempt to try to save face. Though I wish companies would stop claiming it.
• corvad 6mo ago
  I suspected as much as it disappeared from the ShinnyHunters page and it recovered so fast. The main thing I'm interested in knowing was how much was paid. Also I don't really like their statement that the data is safe or destroyed, those promises seem a little questionable with regards to these incidents.
  • fakename 6mo ago
    I'm interested in this, too. I found a tweet[1] listing a wallet address for shinyhunters, but there's only a small transaction from last week: https://www.blockonomics.co/#/search?q=bc1q5530apqz86eywm2f84mpcyuux3dv9mmztsdxt2 https://www.blockonomics.co/#/search?q=bc1q5530apqz86eywm2f8... [1] https://xcancel.com/search?f=tweets&q=1968412640398430555 https://xcancel.com/search?f=tweets&q=1968412640398430555
• corvad 6mo ago
  > Has law enforcement been engaged? Yes. We've notified law enforcement, including the FBI, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), and international law enforcement partners. Hmm. I thought all these agencies say NOT to pay a ransom.
  • biesnecker 6mo ago
    Engaged != listened to.
  • bluGill 6mo ago
    Not always. They have been known to give "marked bills" to pay with in the past. A lot can be learned by watching how ransom money moves around (bit coin is very traceable this way). Sometimes paying a ransom is an important part of finding and arresting the guilty.
• archpulse 6mo ago
  [flagged]
• Zigurd 6mo ago
  There shouldn't have been a need to give into hackers, even highly successful hackers. If they're not doing air-gapped backups weekly, that's malpractice and hints at a substandard architecture and/or operations. On a short enough full backup schedule all of Canvas's customers should've been able to recover based on their own copies of assignments and test results. And a policy like that should've been in the SLAs. In an education environment, there shouldn't be a need to trust software like Canvas for anything mission critical. In fact, if there's anything mission critical in a system like canvas it's an artificial need. IOW Canvas had to have made themselves vulnerable to a ransom demand in the way that they designed their own product.
  • applfanboysbgon 6mo ago
    Backups do nothing to protect your customers from getting extorted to avoid their data being leaked.
    • Zigurd 6mo ago
      What extortable content should schools be creating? And if they are it's crazy that they are trusting it to school SaaS.
      • applfanboysbgon 6mo ago
        I mean, something as simple as name + grades is extortable. There are plenty of students who would not want their bad grades to be public information, and who would be upset with their school if the school allowed that to be leaked, or who may personally pay an extortion if contacted directly. I certainly do think it's crazy that schools are selling out education to SaaSification, but that is normal in the world we live in.
      • joseda-hg 6mo ago
        Enrollment or courses might not be generally super sensible, but financing/financial data, personal identification like phone numbers and emails, chat logs and such
• jawiggins 6mo ago
  Years ago I attended a conference that had a "fireside chat" with a DoJ official on the topic of these types of ransom payments. He framed the issue as being similar to kidnapping ransoms: When an American is taken hostage each family is inclined to make payment but it fosters an industry around kidnapping Americans. Congress put a stop to it by making it illegal to pay the kidnappers. The industry shifted by ceasing the non-profitable American kidnapping and instead began targeting Europeans. His proposal was to begin warning cybersecurity consultants and insurers who were often brought into these situations that payments to sanctioned countries were already likely illegal and could face scrutiny. The first people to suffer this might be burned, but eventually he believed the industry would move on and stop targeting US firms. Not sure if anything ever came of his plans, but I always thought it was an interesting framing of the issue.
  • nathanmills 6mo ago
    Thank goodness that no kidnapping of an American has ever happened since.
    • eviks 6mo ago
      That's the magic of Laws!
    • Geof25 6mo ago
      It is illegal to commit a crime. So no crimes will be committed. Duh.
    • JumpCrisscross 6mo ago
      Hmm, there was once fraud so I guess we should repeal any prohibitions on fraud, huh? Same for murder.
      • nathanmills 6mo ago
        Calm down, extremist. There's a difference between someone doing something vs someone paying someone else to stop doing something. If the latter were truly bad then the same should be applied to people handing over their wallet to muggers. The only difference in that scenario and the above is saving yourself vs saving a family member. Would you really deny people the ability to save their loved ones?
• Waterluvian 6mo ago
  I wonder if, longer term, we're better off if a company like this were in some way destroyed as a result of getting hacked and paying a bribe. I think the stakes for getting hacked are far too low, especially at higher levels of management/executive where it's this abstract thing that has concrete time/resource costs.
  • cube00 6mo ago
    I've never seen a company blame a data breach as the point where they started going bankrupt. Customers never migrate on mass after a breach, 7000 underfunded and overworked education institutions are not migrating on mass. So I feel safe to say there's no lasting impact to a company when a data breach occurs. This will all be forgotten in a few months.
    • Ancapistani 6mo ago
      To be fair, I don't think I've ever seen a company identify the inflection point after bankruptcy, accurately or not.
  • LadyCailin 6mo ago
    Probably, but without government regulation to make ruinous fines for allowing your data to be breached, the thought experiment is moot.
• evantahler 6mo ago
  Being that this is HN, do we know how they got hacked? Can we learn something about protecting our services?
  • cube00 6mo ago
    We’re currently working to identify a robust list of Indicators of Compromise (IOCs) and will make those available to our customers. https://www.instructure.com/incident_update https://www.instructure.com/incident_update It worries me they've only committed to making it available to their customers and not the public.
  • layman51 6mo ago
    I read online that it has to do with their "Free-For-Teachers accounts" which I assume is a way for teachers to get access to Canvas services for free when their school doesn't subscribe to it. I don't know for sure, but I think it probably had to do with some kind of misconfiguration on an Salesforce Experience Cloud site. I have heard that ShinyHunters often exploits this type of service and that it is very easy for companies to forget to set the right permissions to data and they end up throwing a bunch of different data into Salesforce.
  • sheept 6mo ago
    This blog post[0] suggests that, based on their changelog after the incident, the hackers may have extracted session tokens using XSS in a support ticket. Then the ransom note was displayed using a custom theme. [0]: https://cyber.acmucsd.com/canvas https://cyber.acmucsd.com/canvas (disclosure: I was involved with this org when I was a student)
    • bawolff 6mo ago
      Surely if they are demanding a ransome they somehow got server access to delete data. Would seem kind of insane to pay a ransome solely for an XSS.
• sans_souse 6mo ago
  I would love to know the amount of ransoms paid by large companies who've been compromised without the public being informed. How much that undisclosed amount impacts inflation and the economy today is not talked about nearly enough, imo.
  • deleted 6mo ago
    [deleted]
• yoavm 6mo ago
  How does things like this work in terms of bookkeeping? How do they label the expense? Can a company send huge amounts of money to an unknown crypto account without needing to explain anything to the tax authorities?
  • mewse-hn 6mo ago
    It's the insurance company paying the ransom and I assume they tie the payment to the insurance policy they are fulfilling, I don't know what the tax implications would be, I am not in finance or an accountant
  • acomjean 6mo ago
    “Data recovery”?
• applfanboysbgon 6mo ago
  I've seen half a dozen comments in this thread suggesting that paying hacking ransoms should be illegal, but I strongly disagree, for multiple reasons. I'll just make this a top-level comment rather than picking one to reply to. (1a) Multiple have suggested that the US made it illegal to pay kidnapping ransoms. This is a misconception. The US adopted a policy that the government itself would not pay ransoms, but explicitly noted this did not apply to the victims. "The U.S. Department of Justice does not intend to add to families’ pain in such cases by suggesting that they could face criminal prosecution." (1b) Despite this policy, the US pays ransoms anyways. Usually in the form of prisoner swaps, but in 2023 it released $6 billion in frozen Iranian funds in exchange for the release of 5 hostages[1]. (2) The belief that paying ransoms should be illegal is predicated on the belief that criminals will be less likely to commit the crime if there is no money to be made. This may be true for kidnapping, but that does not mean it would be true for hacking. Kidnapping is a high-stakes, high-commitment crime that requires physical presence and exposes the criminal to significant danger. If the criminal anticipates no reward, the risk-reward calculus skews them away from kidnapping. However, hacking is a low-risk crime. Even if the chance of reward is low, the risk is also low, so hackers are unlikely to be deterred from hacking. Many hackers will do it just for fun or to prove that they can. Moreover, hackers can profit in other ways, for example by selling the data on the black market, or by making use of the data themselves as a nation-state or corporate espionage actor. Hacking will undoubtedly continue as long as things can be hacked, regardless of whether ransoms are ilegal. (3) Making ransoms illegal pushes the burden onto people who have no real ability to do anything about it. When a company fails to pay ransom, it is the customers who suffer. It does not materially affect the company in any way to have customer data leaked. The market has already shown, overwhelmingly, that it will not punish companies that leak user data. That a company pays a ransom to begin with indicates that they don't actually understand the market and/or have some small shred of a conscience. Rather than making it illegal to pay ransoms, I would rather see penalties for having a data breach in the first place, but once a data breach is assured, companies should be paying ransoms to try to mitigate the damage to their customers. (4) The idea of trying to solve hacking by making it illegal to pay ransoms is ridiculous on its face. As long as systems are insecure, hackers will exist, so the legal emphasis should be on consequences for data security. The collection of PII that is not essential to providing a service to customers should be discouraged, and there should be real consequences for negligent security. There should be an investigative board similar to those for airline crashes and infrastructure collapse, which examines the circumstances in depth and identifies whether the company is at fault for negligent handling of PII. [1]https://2021-2025.state.gov/briefings/department-press-briefing-september-12-2023/ https://2021-2025.state.gov/briefings/department-press-brief...
• __MatrixMan__ 6mo ago
  I'm curious about the open source competition (https://github.com/moodle/moodle https://github.com/moodle/moodle is my first find, there are likely others) and what they could've made happen with that money if they had received it instead as an investment re: not worrying about future ransomware attacks.
  • skywhopper 6mo ago
    Canvas itself is also open source (https://github.com/instructure/canvas-lms https://github.com/instructure/canvas-lms), which was the big appeal of it originally in a world where Blackboard had a stranglehold on the LMS market.
    • __MatrixMan__ 6mo ago
      Huh, neat! I had just assumed otherwise because everything else my university uses is nine kinds of proprietary. Like, they recently tried to sell me to McMillian who then tried to sell me the "submit homework" button for $20. I complained and got exempted from having to submit homework, but that's par for the course in edtech right now.
• vachina 6mo ago
  What data held by Instructure is so critical it warrants a ransom payment?
  • HDBaseT 6mo ago
    Tons of stuff, usernames, first name, last name, email addresses. - Most of this stuff isn't "private" per se, but its also not publicly index-able for a reason. Conversations between students, conversations between teachers and other students/staff or teachers. Course content, etc.
• kryogen1c 6mo ago
  Everyone's making a lot of good points about game theory and economic motivations, but there is a much more important and self-serving point: when you pay a ransom, hackers come after your shit x10. Paying a ransom signals 3 things: 1) you are vulnerable to attack 2) you cannot recover from an attack 3) you've got cash The result is that you get attacked much, much more. You could ask me how I know, but I wouldn't tell you :)
• TruffleLabs 6mo ago
  "The deal with the hackers included the return of stolen data and digital evidence that copies had been deleted, Instructure said." does "yes, I deleted the data" in an email count as digital evidence?
• pmarreck 6mo ago
  Dumb move. You cannot trust that they won't leak it anyway to make additional profit, since they're not accountable except to their made-up name.
• mrkramer 6mo ago
  Stop funding cyberterrorism. >the deal means that the hackers have returned the compromised data of some 275 million users across more than 8,800 institutions. Yea sure, they didn't keep the copy of stolen database. You know, criminals are very trustworthy people.
• Giorgi 6mo ago
  Problem with blackmail is that you never know if they made copies. Unless this is a well elaborated sting operation.