So you paid a ransom demand … and now the decryptor doesn't work

For C-suite execs and security leaders, discovering your organization has been breached by network intruders, your critical systems locked up, and your data stolen, and then receiving a ransom demand, is probably the worst day of your professional life. But it can get even worse, as some execs who had been infected with Hazard …

[Headley_Grange]

"For C-suite execs and security leaders, discovering your organization has been breached, your critical systems locked up and your data stolen, then receiving a ransom demand, is probably the worst day of your professional life."

Third worst, surely.

Second worst is finding out that your bonus is reduced because of it.

First worst is discovering that someone can prove that it's your fault.

[Anonymous Coward]

Isn’t this why these people - with to be frank a similar set of morals to the ransomware gangs - get paid the big bucks?

[Dr Gerard Bulger]

Paying the criminals is idiotic and high risk

I am still reeling and agitated that the Amateur Radio Relay League ARRL paid (or their insurers did) $1,000,000 to deal with their ransomware attack. It is utterly crazy and immoral to pay up, and of course great risk is they would not get the right keys.

This is a hobby, HAM radio. Amateur None of the data was that important. If asked, the amateur radio community could have recreated much of the data. ARRL claim that their most international project, Log Book of the World (LotW) was not affected but it was offline for weeks, so I am not so sure about that.

https://www.arrl.org/news/arrl-it-security-incident-report-to-members

How on earth does it still happen? I was caught out once by a feature on my Hyperoptic router that, despite clear pinhole rules, it opened up ALL my IPv6 ports to all my devices, so of course my idiotically set up guest account on my Raspberry Pi NAS was found and they encrypted all of 6TB. I learnt my lesson, secured my Pi better and disabled the router’s undocumented "feature". Wasted a few hours restoring everything from one of my other backups. The next day my Pi was back up and secured. So if I, as a non-IT trained individual can recover from such an attack there is no excuse for an organisation not to have backups, even if an old one to use. Don’t pay up.

[Wayland]

Re: Paying the criminals is idiotic and high risk

Paid a million dollars for a bunch of messed up routers? Just wipe the system and set it up again! HAM people would enjoy having to do that.

[Eclectic Man]

Backups!

Not sexy, not macho, but backups are the way forward. (Or, in a sense 'backwards' to a working system and happy / satisfied customers.)

Yes, they are tedious, and you hope that you will never need them, and you have to manage them, and administer them, and they cost money, but hey NOT HAVING A BUSINESS is even more expensive.

[Roland 2]

Re: Backups!

Having full backups is only the first step.

They also need to be tested regularly.

And you need to have at least yearly full restore to bare metal (to clean rootkits those guys will leave behind) drills.

Short of that, just running regular full backup will only increase you storage costs.

[Anonymous Coward]

Re: Backups!

"at least yearly full restore to bare metal"

Just yesterday in a meeting I had a project manager try to decline having a local copy of installation media, on the grounds that "we'd never rebuild the system from scratch, only ever restore a system backup instead". My reply of "never say never" was met with "well, we'd call in the 3rd-party vendor to do the rebuild". And what if that 3rd-party vendor can't get ahold of the (by-then) obsolete version of the software?

Keep known-clean copies of everything, including OS installer (with all required files), required software installers, and copies of critical settings. Everything needed to do an offline (non-internet-connected) total rebuild of the system. Yes, it's a terrible day when you ever need to pull them out. But it's orders of magnitude worse if you need them and don't have them.

[Pascal Monett]

Sounds like it is time to polish your CV.

A project manager who has already decided that backups are a nuisance is a danger to the company and will make it fail at the worst possible time (as if there were any other time).

[EricB123]

Increase Profits at any Cost...

"Sounds like it is time to polish your CV."

But the number of organizations with MBA mindsets are spreading faster than acne. I switched from studying medicine to engineering because I like coming up with solutions to problems. What i mostly got instead was trying to get needed resources from management only worried about the size of their next bonus.

Of course, if I was a doctor in America, I'd spend most of my time fighting health insurance companies.

[Dante Alighieri]

Re: Increase Profits at any Cost...

Sounds like biding your time and becoming a radiologist was an option. Just sayin'

--> best icon available.

DOI : FRCR

[UnknownUnknown]

Re: Backups!

I used to have this conversation with friends when fixing PC’s and Laptops in the past . ‘The stuff that came with your Laptop- Windows’

Most had just chucked it.

[ChrisC]

Re: Backups!

That's assuming they'd been given it in the first place as physical media, and not simply had it stuffed onto the HD as a recovery partition... Fine IF you can still access the HD in the first place AND the contents of said partition are then still intact, less fine if the reason for the fix is because said HD had spun its last spin and gone to join the bleedin' choir invisibule.

But then, even if they had physical reinstall media, there were still no guarantees of it actually working when you came to try a rebuild - I remember sorting out a Packard Bell PC which, despite there being nothing at all wrong with the hardware, was absolutely refusing to reinstall a clean copy of XP from the CD supplied with the PC. In the end I got the owner to pop down to the road to PC World and buy an off the shelf copy of XP, which not only worked exactly as expected, but as a nice bonus also revealed during the initial HD repartitioning stage that the PC had been fitted with a drive twice the size it'd been sold as having - the Packard Bell setup had simply partitioned the drive and left half of it completely unused...

Fortunately I think my silent (or not so silent at times) expressions of dismay at being asked to fix yet another system "because you know about this sort of thing, don't you..." have finally rubbed off on people, such that the last repair/reinstall I was talked into doing for someone outside my immediate family was many moons ago on a Macbook. This also turned out to be one of the most frustrating jobs I've done - I was dangerously close to throwing it out the adjacent window into the street below after the nth failed attempt to get it to recognise the "invoke the reinstall from the recovery partition" action that the Apple support FAQs had very clearly described as being the way to do it for this model of MB/version of MacOS, yet this *specific* one was having none of until I eventually gave up following the FAQs, started randomly poking the keyboard at different points during the powerup sequence in frustration, and somehow hit upon the magic sequence that got it into recovery mode.

[Mike007]

Re: Backups!

I was pleasantly surprised to find that Microsoft Surface devices are well supported in this regard - there is a download on their website to make recovery media that will restore the system to the factory image, including recovery system with all the built in drivers etc.

Of course the fact that the standard install media doesn't come with the required drivers for Microsoft hardware is a different matter...

[Doctor Syntax]

Re: Backups!

"They also need to be tested regularly."

If they aren't tested regularly they aren't backups, just comfort blankets.

[Claptrap314]

Re: Backups!

Regularly? Seriously?

Each backup has to be tested via a complete restore. If it fails, you try again in a few hours.

This isn't the eighties any more.

[alain williams]

Re: Backups!

You have said what I came here to write.

The trouble with backups is that they are a complete waste of time ... until you need them. Thus the C-suit can not do them (or not do them properly) and no one will notice - until that fateful day.

I fear that the only way of ensuring that they are done (& tested) is by use of a big stick: insurance companies demand proof that they are being done; or government legislation (which will lead to cries of "nanny state"). Anyone any better ideas ?

[elDog]

Re: Backups!

If you're working in the financial sector, many clients will demand proof of backups, off-site storage, penetration testing, etc. Large customers won't do business without due diligence and the ability to enforce compliance with best practices and fiduciary requirements.

[omz13]

Re: Backups!

And even then, there are no guarantees. Having worked in that sector, some of the stuff that happens behind the scenes would make your hair turn white in 10 seconds it is that bad.

Plus, even if a regulator catches somebody doing something they should not, one of the best defences is: we've been doing it for years, and you knew about it (because we did disclose it on our reports if you bothered to read them closely), and you only now raise a concern? Politics, FTW.

[Anonymous Coward]

Re: Backups!

Fine showing they are being done on paper, but the proof is the restoring or retrival of data. I know a large company who could show the former and satisfy whatever audits, but fell over badly during Wannacry and trying to recover

And be wary of those devices with test/dev/uat naming that are in fact, real live production boxes - that just so happen to be rather critical and never backed up

[Anonymous Coward]

Re: Backups!

Backups are just one part of a business resiliency plan. I was just in contact with an organization that got hit by ransomware, and the first thing that the attackers hit was the backup server, so recovery from backup would have meant reinstalling the backup software first, recovering the backup metadata (you DO know how to do that, right?), and then restoring from off-site media (you DO have off-site media, right?). At the point that I got involved in the problem, the technical staff had already been working for hours trying to determine the scope of the attack and were pretty desperate to get their production systems back up and online. Rather than recovering from conventional backups, we recovered their data from snapshots on their storage array, which, fortunately, were uninfected by the ransomware and were only a few hours old.

The sad fact is that there are lots of poorly-resourced IT organizations out there. Sometimes the problem is budgetary, but as part of my job role, I talk to IT staff across a swath of sectors and industries, and the technical ignorance I regularly encounter is somewhat shocking. Some people understand the scope of their shortfalls but many do not, and those are the organizations that are ripe for the picking.

[may_i]

Re: Backups!

The missing word here is "immutable".

A large service provider here in Sweden got owned recently. They didn't have immutable backups, so the first thing the crooks did was to encrypt the backups.

The biggest shame is that many of their customers were government authorities. None of these authorities could be bothered to check the security and recoverability of the cost saving outsourcing they had realised moving everything to "the cloud" and firing everyone who worked in their IT departments.

The only losers here are the taxpayers of course. To levy a fine against a government authority for incompetence is pointless.

[Doctor Syntax]

Re: Backups!

To add to my post above, if it isn't immutable, and preferably off-site, it isn't a backup, it's a comfort blanket.

[CountCadaver]

Re: Backups!

The only effective method would be personally hitting their pocket (say a 60% salary garnish) or loss of liberty

[CowHorseFrog]

Re: Backups!

Which is why we need laws that jail executives for fails such as what you describe.

[katrinab]

Re: Backups!

Also snapshots or volume shadow copies or whatever it is called on your operating system. Not as an alternative to a backup but as an additional line of defence.

You might find that the ransomware spends a few weeks interfering with the backups before it bricks your system.

[Richard 12]

Re: Backups!

Snapshots can also act as an early warning that something is amiss.

If the delta between snapshots starts to rise, find out why.

[Confucious2]

Re: Backups!

I worked for a small company and we did grandfather, father, son backups daily.

So when our server was stolen, no problem, right?

Well, no, the director who did the backups himself and was sup to take the tapes home to his fireproof safe, didn’t. He left the tapes on top of the server, so the thieves nicked them as well.

D’Oh!

[CowHorseFrog]

Re: Backups!

Yes but by keeping the backups at work, he saved the company the cost of buying a safe or whatever for his home. Smart guy.

[Eclectic Man]

Re: Backups!

One of my former customers did the same, backup tapes left on top the the server, in a room that got hot over the weekends when the air-conditioning was turned of (I don't know why, but that's customers for you).

I did persuade them to use one of the their secure cabinets outside the server room for storage.

[T. F. M. Reader]

Re: Backups!

Backups, of course... Fully agree. But a lot of (the same) execs who paid the ransom say they'd pay again if hit again, because they didn't expect how time-consuming restoration from backups would take. That's the executive approach to recovering from a breach: "Are we there yet?"

What they still don't get is that getting the data back is only a small part of recovery. Here are some other things their IT/security team must do: 1. clean up, 2. identify how the bad guys got in, 3. plug all the holes, 4. make sure no malware remains (including in backups), 5. do full backup (of the clean state) anew, 6. test restoration...

None of the above depends on whether you paid the ransom or restored from backups - it must be done anyway. Aside: decryptors may not work, restoration may fail, too.

Do all you can to prevent breaches (and regularly test restoring from backups!) - it'll be cheaper in the end.

[0laf]

Re: Backups!

Proper backups yes, proper tested backups.

Even back in the days of tape (which would be a godsend in a ransomware situation) we regularly had dud backups.

We regularly had multiple dud backups.

We on occasion had several generations of dud backups.

IT did not need to do test backups apparently because they were doing restores regularly.

We lost a month of data once upon a time because the tape drive was reporting a sucessful write, although it turned out it was writing 1Tb to the first 64kb of the tape. The compression was good, but not that good.

Then had a ransomware backup strategy meeting where IT proudly talked about their 'airgapped' backup solution. Which turned out to be a product named (something like) 'Air-gap' which wasn't actually air-gapped at all.

TBH they weren't a bad IT team at all but they did do these stupid things on occasion.

[Brad Ackerman]

Re: Backups!

Then had a ransomware backup strategy meeting where IT proudly talked about their 'airgapped' backup solution. Which turned out to be a product named (something like) 'Air-gap' which wasn't actually air-gapped at all.

An airgap is just a connection with unusually high latency (as Ed Skoudis said). The details matter, as Iran found out.

[Little Mouse]

Well "Hooray" for Ransomware Negotiators

And there was me thinking that perhaps encouraging these criminals to carry out their crimes by rewarding their efforts with cash might actually, I don't know, give them the idea to do it again. And again. And again.

And not a snarky journo comment in the entire article. Shame. Are we supposed to just accept that Ransomware Negotiation is a good thing? Totally normal? Totally OK?

[ThatOne]

Hope springs eternal

> pay the extortionists – for concerns about [obvious stuff]

...Except that you're placing all your hopes on the honesty of criminals!...

Once you've paid them, why would they bother decrypting your stuff? Why wouldn't they ask for even more money, later (or immediately)? Why wouldn't they refrain from gaining some free street cred by reselling all the data they have stolen from you?

Your only hope is that they are honest, trustworthy criminals, who will strive to make sure to repair any damage they've caused, and for whom your well-being is the most important thing in the world...

_{I think you would be better advised to avoid clicking on that mysterious-yet-oh-so-intriguing link, but that's me.}

[Cav]

Re: Hope springs eternal

Did you read the article? It tells you why they would decrypt your stuff: any group that had a reputation of not decrypting would fimd that no ome would pay them? Why would you?

[Natalie Gritpants Jr]

Re: Hope springs eternal

There's nothing to stop a ransomware gang having a different name per victim. They are not selling anything, so don't need branding. If they are worried that a victim won't pay an unknown gang, they can send a free decrypter that restores 10% of the files as proof of ability (a bit like a kidnapper sending a finger, but less damaging)

[Cav]

Re: Hope springs eternal

That isn't always the case though. Negotiators often know perfectly well who they are dealing with. The problem is catching the perps in hostile jurisdictions.

[ChrisC]

Re: Hope springs eternal

Doesn't matter whether they use the same name or a different one for each victim, the point is that if word gets around that *a* ransomware group is ripping off people who've paid up, then people are going to be increasingly unlikely to trust *any* ransomware group.

And at that point, there's a fairly good chance that at least one of the "trustworthy" groups may well decide to take whatever action is needed to deal with this threat to their business model - given the nature of such groups and the dark underbelly of society in which they operate, it's not unreasonable to consider that such action may well be rather permanent to the recipients...

[ThatOne]

Re: Hope springs eternal

> any group that had a reputation of not decrypting would find that no one would pay them

Victims are caught between a rock and a hard place: Can you really chose to get trapped by a criminal with a better reputation?

I have no actual data to support this, but knowing human nature I'm pretty sure the decision to pay or not to pay is only marginally affected by such abstruse things like criminal group reputation. It mostly depends on the decision makers' character, some will give in, some won't.

[HandlesMessiah]

Re: Hope springs eternal

What I'm hearing is that we need ransomware gangs to be organized like the Guild of Thieves, Cutpurses and Allied Trades in Ankh-Morpork.

[Patrician]

Re: Hope springs eternal

Have a beer for the Discworld reference

[UnknownUnknown]

Re: Hope springs eternal

I hear what you are saying … but it’s the same mentality as supplying counterfeit cigarettes/alcohol or badly cut drugs can kill you.

Most of these things are easy to make… and good return business by making good quality product would generate repeat business

A regular (illegal) income stream.

I don’t get it either.

[Little Mouse]

"So you paid a ransom demand ... And now the decryptor doesn't work"

Hey El-Reg, I've come up with a handful of shorter, snappier sub headings for the article for you. You can have them for free:

"Good"

"Serves you right"

"Fool me once, shame on you. Fool me twice..."

[Marty McFly]

Perfect, this is what we need!

This is the news story we need to see more of. When businesses figure out the decryption tools FAIL, then they will stop paying the ransom. And once the victims figure out paying the ransom is a fools errand, then they will stop paying. When ransomware no longer pays the bills....well you can see where this goes.

Every time a business chooses to pay a ransom they need to release a news article like this one, regardless of whether it is true or not.

[CountCadaver]

Re: Perfect, this is what we need!

I think there is also the empire wide fear of what might well be lurking on those systems and how much shit it might bring down on heads....

[Jamie Jones]

Re: Perfect, this is what we need!

"We don't negotiate with terrorists" is all fine and dandy until it's your loved one who's the hostage.

[VicMortimer]

Not quite what we need!

Not good enough.

What they need is a news story about how they paid, and then the CEO spent the next year in prison for the crime of paying.

The ONLY way to stop ransomware is to criminalize paying ransom. Lock up some CEOs and the payments will stop. The payments stop, the ransomware stops.

[Grunchy]

Ha

The company I worked for paid a $50k ransom and TONS of geometry models didn’t work anymore after recovery. I only found out about a month after I had started. I sorta had developed a feeling they were a bunch of amateurs, which was rapidly becoming a strong conviction. Interestingly, there had previously been an entire engineering and design department of whom there was one drafter left. I remember part of the job description was “solve differential equations,” I asked what they had in mind, because even Newton’s reaction equation F=m.A is a differential equation. They never asked me to solve any such equations (too bad!) but they did ask me to recreate a design from a bankrupt competitor’s blueprints… which they said they bought at the bankruptcy auction. Well, for the wrongful dismissal lawsuit I found out, no, it was the other guys had bought the intellectual property assets, and not only that, had paid almost $2 million for the works. Yeah, they elected to settle out of court.

(Personally, I found a discarded Netgear NAS for $20, 3D printed some caddy shells, loaded up with HDDs, and keep it as an offline backup. Yeah, I just shut off the power between backups. I’d like to see the hacker who can hijack my unplugged NAS backup!)

[Anonymous Coward]

Re: Ha

F=m*A is NOT a differential equation. Differential equations involve derivatives, not simple multiplication.

As for a hacker hijacking the NAS - some of them are nasty enough to infect a system but not do anything, have the malware wait 6+ months, then spring the attack. If you try to restore from your 5-month-old backups, you find they're infected too. The mostly-offline NAS is a good move, but nothing is foolproof.

[Uncle Slacky]

Re: Ha

F=mA is equivalent to F=dp/dt (rate of change of momentum (p) over time), in fact that was Newton's original formulation (imagine a dot over the p instead of Leibnitz's d/dt though), which would make it explicitly a differential equation. "A" can of course also be expressed as dv/dt, so F=mA is at least *implicitly* a differential equation.

See also https://math.stackexchange.com/questions/2890262/how-is-f-ma-a-differential-equation-confirmation

[Anonymous Coward]

Re: Ha

The acceleration does not depend on the force or vice versa, outside of the simple relationship of F=mA. A differential equation is something like dy/dt = y(t), where the derivative (possibly second- or third-) of the function is part of its own definition.

[mirachu]

Re: Ha

"A" is area. "a" is acceleration.

[Clausewitz4.0]

Re: Ha

Sounds like you know about the business.

[JulieM]

Re: Ha

Force does not necessarily equal mass times acceleration.

It is true that Newtons equals kilograms times metres per second squared; but that is sneakily baked into the definition of the Newton.

The acceleration due to Earth's gravity is about 10 m.s⁻² and a mass of 1 kg. has a weight on Earth of about 10 N. 10 m.s⁻² is about 30 ft.s⁻², and 1 kg. is about 2 lb.; but the weight on Earth of 2 lb.mass is not about 60lb.thrust!

[Boris the Cockroach]

Re: Ha

Do you work for one of our customers?

Yeah , been there , at that meeting, when all eyes look at you and you can see them thinking "oh god he's going to go on about backups and IT security, and who's been unblocking the USB hole in the spare laptop"(if I catch the bastard, they'll be dipped in the plating tank and used for a recreation of that scene in 'Goldfinger' where someone gets coated in gold.. although we use nickel)

But given how many hours are tied up in our models,geometry and programing, we cannot afford to take chances, ransomware yeah... wipe and restore.... but all that data. and we do test the backups... have to... all the pay data is on there and thats far more important ....

[lglethal]

Paying the Dane Geld

Pay the Geld, and you'll never get rid of the Dane...

What was true so many years ago, remains true to today...

[Clausewitz4.0]

Re: Paying the Dane Geld

Every important person needs protection. Be it political, police or the other more dark sides.

That's why there are armed forces and other services. That's why the Pope is protected.

Once no one have no enemies in earth, there will be no more wars.

Then humanity will have evolved spiritually. Till then, better carry a firearm.

[Mark Exclamation]

Re: Paying the Dane Geld

"Every important person needs protection."......"That's why the Pope is protected." - Actually, the pope is NOT important. He's the CEO of the largest pyramid-scheme-based company in the world. Oh, and he protects pedophiles.

[Bebu]

Re: Paying the Dane Geld

"Pay the Geld, and you'll never get rid of the Dane."

Better as Harold, in answer to Tostig's question at Stamford bridge, offered to Harald:

Six feet of ground or as much more as he needs

Perhaps more effective to substitute bounties for ransom without being too fastidious about how much of the offender's body is is required for payment.

The average Chechen gangster would likely offer the entirety while apologizing the tacky supermarket shopping bags.

[Doctor Syntax]

These guys are just getting ransomware a bad name.

[Anonymous Coward]

I *so* need more upvotes. Thanks for the laugh, and yet it is effectively the whole article's conclusion condensed into one line.

:)

[Anonymous Coward]

Some executives at the top of an organization didn't properly defend themselves for such an attack?

Oh no! Anyway, last week I made a delicious sandwich and it was amazing. You had to be there.

[Anonymous Coward]

Imagine that

Crooks are unreliable.

Criminals are untrustworthy.

Scammers are immoral..

[Anonymous Coward]

Re: Imagine that

C-suite are unreliable

C-suite are untrustworthy

C-suite are immoral

…. You want me to continue ?

[macaroo]

I was a repair tech that worked for both a zFotune 50 company and ran my own PC repair business. The hardest thing I had to do was tell a customer his data was lost because he did not back it up. I would refer him to several companies that specialized in recovering data from crashed hard drives. I could repair the device and reinstall the OS and that was it. I would tell him I wasn't responsible for his data. I seen grown men cry!!

[CowHorseFrog]

I wonder how many people falsely send anon emails to bosses asking for a ransom without actually holding the decrypt key etc when their company gets hit.

[Zibob]

Hahaha haha hahahaha

Sorry that was rude of me.

*clears throat*

HAHAHAHAHAHA Oh stop it hurts my sides and face, HAHAHAHAHAHAHA

[tyrfing]

This has an exact analogue in kidnapping for ransom.

The practice exists today in a number of countries.

To the extent it has been stamped out in some areas, it's because of a resolution that kidnappers get no rest, and *will* be caught, and *will* be punished.

I don't know how to do this for kidnapped data.

[TeeCee]

How this works:

"This mob have coughed up, send them the decrypter."

"There isn't a decrypter!"

"WHAT? Why the fuck not?".

"Well, I never thought that you'd find anyone so massively bloody stupid that they'd pay, so I never bothered writing it 'cos I couldn't be arsed.".

"Oh well, knock something together and chuck it at them..."