Re:US travel firm $4.5M ransom negotiation open chat
by DangitBobby on Monday August 03, 2020 @01:58AM
(#24034618)
There was a post on here a few days back about why it's not that simple. Basically, by the time your stuff is ransomed, they've potentially been in your network for a long time. There's no telling how far you have to go in your backups to make sure they are gone. Who knows, maybe they wait on your computers for several months just so restoring from backups isn't a realistic option, and punish you for trying.
[ Parent
| on HN ]
Re:US travel firm $4.5M ransom negotiation open chat
by limomium on Monday August 03, 2020 @11:49AM
(#24039236)
What? I mean back up your data. Not your whole... computer, or whatever. Install latest software, import data from back up, back in business.
It's trivial to tell intact data from ransomed data - the latter looks like random noise, as it's encrypted.
If your backup process "isn't that simple", then you should make it that simple. Otherwise failure looms.
Re:US travel firm $4.5M ransom negotiation open chat
by DangitBobby on Tuesday August 04, 2020 @01:47AM
(#24047025)
You misunderstand. I'm saying the network has potentially been infiltrated for months, and there's no telling what configuration and files have been altered to facilitate future infiltration. See further discussion here: https://news.ycombinator.com/item?id=23929344
Particularly this conversation: https://news.ycombinator.com/item?id=23951941
Re:US travel firm $4.5M ransom negotiation open chat
by limomium on Tuesday August 04, 2020 @09:47AM
(#24049890)
Disconnect entire network. Factory reset all devices. Reinstall latest everything.
Re:US travel firm $4.5M ransom negotiation open chat
by DangitBobby on Wednesday August 05, 2020 @01:06AM
(#24057440)
Clearly you know best