News for hackers. Stuff that matters.
Re:Massachusetts Steamship Authority hit by ransomware attac... by MattGaiser on Wednesday June 02, 2021 @04:45PM (#27373803)
As an alternative question, how much is this worth stopping?

As how much is being spent on these payments overall each year? How would that compare to the massive IT fortification project people are demanding?

We don't meaningfully fight bike theft for this reason. The cost of doing so relative to the benefits is just too high. We can debate whether that is reasonable, but that is essentially what has been decided as a society. Most low level crime is not meaningfully investigated.

Re:Massachusetts Steamship Authority hit by ransomware attac... by nitrogen on Wednesday June 02, 2021 @04:46PM (#27373816)
We don't meaningfully fight bike theft for this reason.

And this erodes trust in society and rule of law, and gradually leads to vigilantism, privatization of security, and segregation due to middle-class flight from high-crime areas.

Re:Massachusetts Steamship Authority hit by ransomware attac... by MattGaiser on Wednesday June 02, 2021 @04:52PM (#27373878)
As I said, we can dislike it, but as a society we have basically decided that anything short of reasonably straightforward violent crime/extreme violent crime and high value property crime and easy to prosecute drug crime is not worth the effort.

I don't disagree, but I hear very little discussion about low solve rates for smaller crimes.

Re:Massachusetts Steamship Authority hit by ransomware attac... by rsj_hn on Wednesday June 02, 2021 @06:56PM (#27375042)
> As I said, we can dislike it, but as a society we have basically decided that anything short of reasonably straightforward violent crime/extreme violent crime and high value property crime and easy to prosecute drug crime is not worth the effort.

No, I would say that a few counties have decided this, but the majority of counties have not. In most places, you do get arrested for property crimes, you still serve prison time for this, police still do things like use bait cars and exert resources to catch those who steal, and the idea that property crime should not result in jail time is not widely accepted by the majority of the population.

Re:Massachusetts Steamship Authority hit by ransomware attac... by kwhitefoot on Thursday June 03, 2021 @06:07AM (#27379122)
counties -> countries ?
Re:Massachusetts Steamship Authority hit by ransomware attac... by rsj_hn on Thursday June 03, 2021 @12:03PM (#27383367)
I am talking about counties in the U.S. There are a handful of extremist district attorneys that follow the view that non-violent crime should not result in prosecution or prison. To my knowledege, there are no countries anywhere that have adopted this view, and only a few local district attorneys are advocating for it. There are differences in the severity of non-violent crime needed to get prison sentences, but that was always the case.
Re:Massachusetts Steamship Authority hit by ransomware attac... by mrhyyyyde on Wednesday June 02, 2021 @04:51PM (#27373864)
Source to support your statement?
Re:Massachusetts Steamship Authority hit by ransomware attac... by nitrogen on Wednesday June 02, 2021 @05:05PM (#27374016)
Historical precedent (e.g. white flight), personal experience with losses of thousands of dollars of my former startup's equipment to theft, and forward-looking projections from other HN threads about people who chose to leave the Bay Area.
Re:Massachusetts Steamship Authority hit by ransomware attac... by WalterBright on Wednesday June 02, 2021 @06:06PM (#27374615)
> how much is this worth stopping?

Having a physical write-enable switch on the backup devices costs about three cents.

Re:Massachusetts Steamship Authority hit by ransomware attac... by DangitBobby on Wednesday June 02, 2021 @09:01PM (#27375949)
How does a physical switch prevent you from writing backups of infested machines? Most organizations don't realize they are infected until they can't open any of their files.
Re:Massachusetts Steamship Authority hit by ransomware attac... by WalterBright on Wednesday June 02, 2021 @09:31PM (#27376162)
Presumably one has rolling backups. Something line N backup drives, and every day you back up to the next one in line. Then there are rolling monthly backups, etc. The idea is hopefully you notice the problem before all are corrupted.

With the way I understand ransomware works, merely connecting a backup to the system will corrupt it. This is where a write-enable switch really comes into play, it cannot corrupt the backup when you're trying to restore from it. And if you have online archival databases, they can't be corrupted, either. After all, how much of your company data really needs to be writable? Certainly not last week's payroll records.

With append-only incremental backup systems, enforced by hardware, it'll take a lot longer to need to recycle the backups and risk them. Tape backup already does this inherently.

Another thing you can do with a backup drive, is attempt to read it from a clean system that has never been connected to the network. If you can read it, it isn't corrupted. Then, have a process where once a week see if the backup can be read. Then your worst case is a week lost.

Re:Massachusetts Steamship Authority hit by ransomware attac... by Godel_unicode on Thursday June 03, 2021 @02:04AM (#27377723)
First, adding manual steps to backups is a terrible idea. People already don't do them (which, since you missed it, you should know is actually the problem), and you're suggesting making them error-prone and manual.

Second, where is this idea coming from that corrupted backups are the issue? You're solving a problem that doesn't exist and creating a real one.

Re:Massachusetts Steamship Authority hit by ransomware attac... by WalterBright on Thursday June 03, 2021 @02:21AM (#27377826)
> Second, where is this idea coming from that corrupted backups are the issue?

When I read about how ransomware encrypted every drive attached to it, and encrypted the backup drives when they were attached. This was why the ransomware waited some length of time before shutting off access to the user - they wanted to get the backup drives encrypted, too.

> You're solving a problem that doesn't exist

Now you know!

Re:Massachusetts Steamship Authority hit by ransomware attac... by Godel_unicode on Thursday June 03, 2021 @07:14PM (#27388646)
Ah, you're talking about home user backups, then sure. I was confused because I thought we were talking about corporate backups and no corporation which does backups does them anything like how you're describing them.
Re:Massachusetts Steamship Authority hit by ransomware attac... by MattGaiser on Wednesday June 02, 2021 @06:33PM (#27374876)
And the guy required to set that all up is 100K.
Re:Massachusetts Steamship Authority hit by ransomware attac... by WalterBright on Wednesday June 02, 2021 @07:55PM (#27375470)
I'm not sure what company you work for, but I'd be happy set up a button and run a wire to the case for them for only $99K.

If you meant write some software to activate the switch, that kinda misses the point!