Re: Can somebody explain these ransomwear attacks?

[Mike Meredith via NANOG]

Hi!

On Fri, 25 Jun 2021 18:56:36 +0300, "Alex K."  may
have written:
> Ah ... and one more thing. Gladly, it is not our (network folks) life's
> complicated. It's system/DBA/and security folks, lifes. But I don't want
> to get cocky. We got SDN :-)

Yet. Probably.

Ransomware gangs /do/ target infrastructure - currently known to be DNS
servers (Microsoft), hypervisors, backups, etc. I wouldn't assume that they
wouldn't try attacking the network itself today or in the future.

-- 
Mike Meredith, University of Portsmouth
Hostmaster, Security, and Chief Systems Engineer
 


pgpLeSJFo9IJ9.pgp
Description: OpenPGP digital signature

Re: Can somebody explain these ransomwear attacks?

[Alex K.]

In my humble opinion, the hidden assumption beneath this question seems to
be incorrect. Ransomware is not a single event, with assumed similarity to
the kind of failures, we regulary see at our network world.

The key abstruct differences, might be summed up as follows:

A. First and foremost, ransomware attack is not a single failure, such as
failing NAS or power outage might be. In fact, it takes enormous amount of
time, just to be remotely sure, how this thing got into your network, in
the first place. Cause simply bringing your backup network (i.e. your
backup solution and its' storage) online, otherwise presents not only you
with the ability to revert all files to their saved backups - but more
importantly, may allow the ransomware to encrypt your backups, too. It's
not a single event. First, you must be sure you plugged the holes and
eliminated the threat, before you can even bigin considering, connecting
your backups. Think of it this way: ransomware is a program, running on
some computer, just looking for more files to encrypt. Without properly
removing this threat first (how do you find, which computers have it in the
first place?), every new disk connected somewhere at the network, with
chances of 99%, will be promptly encrypted.


B. Usually (and you may suspect it as much), another hacking initiatiatives
are also involved. Recently, we see data theft accompanying ransoware
efforts. Mainly with high stakes events (i.e. not that random phishing
email that your neighbor clicked on, believing he has relatives stuck in
Nigeria without money, since 1985). Simply bringing your backups online, is
rushing to action without fully evaluating the threat and hackers/ATPs
"just love" rushed and not fully thought thru actions. Once again, it is
far-far more complecated question, than just bringing the backups online
and starting copying the files over. Without proper *security* (not
network!) action, you more likely allowing the bad guys access to more
stuff, than simply recovering your operation.

C. High stakes ransomware events (i.e. not the same neighbor from above)
are complex security events, not just loosing some data. To gain initial
access, not the ransomware tools are the tools which used. Moreover, some
ATPs deploy surveilance/hacking tools, also during the peak events  (such
as discovery, your IT/Security folks initial response, ransom negotiations
themselves, hiring outside specialists etc.) to (a) maximize their profit
from the operation and (b) try and avoid law enforcement. Those might be
(and usually are) completely silent tools (such as diskless viruses) whose
whole purpose is monitoring your response and give the bad guys as much
surveilance power, for their advantage, as they can possibly use.

In short, serious ransomware events, are multy faceted, nothing like we at
the  network level are accostumed too, outages. Sure, there are many
similarities and in some cases, may even be complete likeness, but those
are usually smaller events. Adittional difference, might be that our
outages at 99.% are lacking malice while ransomware events are - and
you may think to yourself, ah ... it's simply a so small, theoretical
question, but it isn't - the most important practical consideration, is
that network outage is not *actively* trying to hide it tracks (remember
the question, how you find the PC running his software and clean it up?). I
never met power outage, which constantly deleting log files.  Especially
not after everything presumably went up.

So, yes - we should never pay the crooks, but's unfortunatelly, a very
simplified outlook. I wish, we could allways follow that simple solution
but our life, is unfortunatelly much more complicated.

Ah ... and one more thing. Gladly, it is not our (network folks) life's
complicated. It's system/DBA/and security folks, lifes. But I don't want to
get cocky. We got SDN :-)

Alex.

בתאריך יום ה׳, 24 ביוני 2021, 17:44, מאת Michael Thomas ‏:

>
> Not exactly network but maybe, but certainly operational. Shouldn't this
> just be handled like disaster recovery? I haven't looked into this much,
> but it sounds like the only way to stop it is to stop paying the crooks.
> There is also the obvious problem that if they got in, something (or
> someone) is compromised that needs to be cleaned which sounds sort of
> like DR again to me.
>
> Mike
>
>

Re: Can somebody explain these ransomwear attacks?

[Randy Bush]

> Finding vulnerabilities and how to exploit them to run malware
> in closed source code is nigh on impossible. 

which explains why it never happens 

randy

---
ra...@psg.com
`gpg --locate-external-keys --auto-key-locate wkd ra...@psg.com`
signatures are back, thanks to dmarc header butchery

Re: Can somebody explain these ransomwear attacks?

[Saku Ytti]

On Sun, 27 Jun 2021 at 08:53, Jakob Heitz (jheitz) via NANOG
 wrote:

> Finding vulnerabilities and how to exploit them to run malware
> in closed source code is nigh on impossible.

I'm not entirely sure if I understood this statement right.

Of course you are aware that every closed source project is breached
by bored hobbyists given the slightest motivation. Ref: pwn2own or
entirety of infosec history.
We have no historic knowledge of how to build software that is robust
enough to withstand an attack from someone motivated by boredom. We
have a lot of finger pointing about 'code it right' and a lot of
religious rituals which somehow are needed for infosec to succeed, and
it still never does.

Now let's assume there are some better motivations than boredom, and
we must assume the quality of attacks is higher than what we see in
things like pwn2own.

How many dollars must the defender use per dollar used by the
attacker? And is this leverage difference higher than the cost of
realised risk?

-- 
  ++ytti

Re: Can somebody explain these ransomwear attacks?

[Jakob Heitz (jheitz) via NANOG]

Finding vulnerabilities and how to exploit them to run malware
in closed source code is nigh on impossible. 
Anyone can read open source code.

What is possible is to analyze patches to figure out what was fixed
and then to attack those that didn't apply the patches.

Even easier is old releases. Patches often have more than one fix,
but a patch for an old release is almost guaranteed to be a fix
for a single vulnerability. That makes it easier to analyze.

Regards,
Jakob.

Re: Can somebody explain these ransomwear attacks?

[Michael Thomas]

On 6/25/21 11:59 PM, Valdis Klētnieks wrote:

On Thu, 24 Jun 2021 14:55:12 -0700, JoeSox said:


It gets tricky when 'your' company will lose money $$$ while you wait a
month to restore from your cloud backups.

If that's a concern, you've *already* totally screwed the pooch regarding DR 
planning.

So what is the industry standard if there is one for DR recovery? 
Shouldn't this just be considered another hit by the Chaos Monkey?


Mike

Re: Can somebody explain these ransomwear attacks?

[Valdis Klētnieks]

On Thu, 24 Jun 2021 14:55:12 -0700, JoeSox said:

> It gets tricky when 'your' company will lose money $$$ while you wait a
> month to restore from your cloud backups.

If that's a concern, you've *already* totally screwed the pooch regarding DR 
planning.



pgphow4jPrnvf.pgp
Description: PGP signature

Re: Can somebody explain these ransomwear attacks?

[Karl Auer]

On Fri, 2021-06-25 at 15:18 -0700, Michael Thomas wrote:
> On 6/25/21 8:39 AM, Karl Auer wrote:
> > We need to start building systems that are not seamless, that are
> > not highly interchangeable, that are not fully interconnected, and
> > we have to include our human systems in that approach.
> How does one go about that in real life?

I don't know. I'm trying to figure it out too.

I just know that the less diverse an ecosystem, the more vulnerable it
is to destruction. Heterogeneity (and change, by the way, i.e being a
moving target) mitigates against the risks of a monoculture.

Homogenous, centrally managed, massively networked systems bring many
benefits, but we are now seeing the sorts of weaknesses it brings, too.

Regards, K.

-- 
~~~
Karl Auer (ka...@biplane.com.au)
http://www.biplane.com.au/kauer

Re: Can somebody explain these ransomwear attacks?

[Michael Thomas]

On 6/25/21 8:39 AM, Karl Auer wrote:

On Fri, 2021-06-25 at 10:05 -0400, Tom Beecher wrote:

Everything can be broken, and nothing will ever be 100% secure. If
you strive to make sure the cost to break in is massively larger than
the value of what could be extracted, you'll generally be ahead of
the game.

Easy to say.

IMHO the only workable long-term defence is heterogeneity - supported
by distribution, redundancy and just taking the simple things
seriously.

Business has spent the last few decades discarding heterogeneity and
the bigger they are, the more comprehensively they have discarded it.
Companies that are floor to ceiling and wall to wall Windows.
Centralised updates, centralised networking, centralised storage,
centralised ops teams, and (typically) a culture of sharing. A
relentless prioritising of convenience over security. For goodness
sake, even the NSA had the attitude that "if you are this side of the
drawbridge you must be OK"!

We need to start building systems that are not seamless, that are not
highly interchangeable, that are not fully interconnected, and we have
to include our human systems in that approach.

How does one go about that in real life? You certainly want your servers 
patched with the latest security updates. For all intents and purposes 
there is just Windows and Linux. I suppose you could throw in some 
hardware diversity with ARM or MIPS.


Routers are definitely in better shape on that front as there are lots 
of choices and at least Cisco has tons of different BU's that compete 
with each other with different software and hardware.


Mike

Re: Can somebody explain these ransomwear attacks?

[Baldur Norddahl]

fre. 25. jun. 2021 21.33 skrev Aaron C. de Bruyn via NANOG :

> On Fri, Jun 25, 2021 at 10:43 AM Tom Beecher  wrote:
>
>> Incompetent insurance companies combined with incompetent IT staff and
>>> under-funded IT departments are the nexus of the problem.
>>>
>>
>> Nah, it's even simpler. It's just dollars all around. Always is.
>>
>
> Agreed.
>
>
>> From this company's point of view, the cost to RECOVER from the problems
>> is so much smaller than it would be to prevent the problems from happening
>> to begin with, so they are happy to let you guys handle it. From the
>> insurance company's point of view, they are collecting premiums, but no
>> claims are being filed, so they have no incentive to do anything
>> differently.
>>
>
> I'm sure that'll change drastically if either of these conditions are true:
> * A claim is filed
> * An audit is required
> * Ransomware surges throughout 2021 and payouts go through the roof
>
> I think it's reasonable to expect at least one of those things will happen
> in the next year.
>
> -A
>

Or they do business in the EU where huge fines are becoming the norm. The
ransomware does not matter but the implied data breach does.

Re: Can somebody explain these ransomwear attacks?

[Aaron C. de Bruyn via NANOG]

On Fri, Jun 25, 2021 at 10:43 AM Tom Beecher  wrote:

> Incompetent insurance companies combined with incompetent IT staff and
>> under-funded IT departments are the nexus of the problem.
>>
>
> Nah, it's even simpler. It's just dollars all around. Always is.
>

Agreed.


> From this company's point of view, the cost to RECOVER from the problems
> is so much smaller than it would be to prevent the problems from happening
> to begin with, so they are happy to let you guys handle it. From the
> insurance company's point of view, they are collecting premiums, but no
> claims are being filed, so they have no incentive to do anything
> differently.
>

I'm sure that'll change drastically if either of these conditions are true:
* A claim is filed
* An audit is required
* Ransomware surges throughout 2021 and payouts go through the roof

I think it's reasonable to expect at least one of those things will happen
in the next year.

-A

>

Re: Can somebody explain these ransomwear attacks?

[Tom Beecher]

>
> Incompetent insurance companies combined with incompetent IT staff and
> under-funded IT departments are the nexus of the problem.
>

Nah, it's even simpler. It's just dollars all around. Always is.

>From this company's point of view, the cost to RECOVER from the problems is
so much smaller than it would be to prevent the problems from happening to
begin with, so they are happy to let you guys handle it. From the insurance
company's point of view, they are collecting premiums, but no claims are
being filed, so they have no incentive to do anything differently.

Sometimes those of us who know stuff and can fix things are just too darn
good at it for anyone's good. :)


On Fri, Jun 25, 2021 at 11:03 AM Aaron C. de Bruyn via NANOG <
nanog@nanog.org> wrote:

> On Fri, Jun 25, 2021 at 5:28 AM Jim  wrote:
>
>> Big problem that with organizations' existing Disaster Recovery DR
>> methods --
>> the time and cost to recovery from any event including downtime will
>> be some amount.. likely a high one,
>> and criminals' ransom demands will presumably be set as high a price
>> as they think they can get --
>> but still orders of magnitudes less than cost to recover / repair /
>> restore, and the downtime may be less.
>>
>
> I think you're right.  DR methods are a *huge* part of the problem.
> I manage DR systems for a number of companies including a large unnamed
> healthcare provider.
> A year ago they were still running Exchange 2007.  No, that's not a typo.
> Cryptolocker strolled right into the network via file attachment and
> somehow made it past the non-existent 3rd-party AV software that totally
> wasn't integrated into Exchange because it cost too much.
> It spread across the network and started encrypting around 1 AM on a
> Friday morning.
> Due to the way this particular strain worked, it missed several of the
> monitoring tools that would have alerted my company to the massive file
> encryption that was happening and it managed to completely encrypt 21
> offices and all their patient data.
> At 6 AM my monitoring system alerted me to a problem.  By about 6:30 I
> realized the scope of the problem, disabled all the site-to-site VPNs,
> dropped the 1 or 2 infected workstations off the network and the encryption
> stopped.
> We do local snapshots every 15 minutes, local backups twice daily, local
> disconnected backups several times per week, and off-site write-only
> backups multiple times per day.
> After I figured out when cryptolocker launched, I ran a few commands from
> our config management server and had every office restored and running in
> about 28 minutes and the internal techs for the company were dispatched to
> swap out the infected workstations.
>
> The first rule I follow is: Windows *never* touches bare metal.
> I amended that last year to: Windows *never* touches bare metal, including
> workstations.
>
> People *really* need to work on their backups and DR plans.  You don't
> need some expensive 3rd-party cloud solution coupled with expensive VMWare
> licenses to do it.
>
> The other part of the problem is the insurance companies.
> It might surprise you to learn that particular company has been
> cryptolocker'd 8 times in the last 15 years.  They've never lost more than
> a few minutes of data and recovery times are measured in minutes.
> This line has literally been thrown around a few times: "We don't need to
> spend $xxx,xxx to upgrade to current software versions.  We have a
> $5,000,000 cyber insurance policy."
>
> The insurance company issued the policy after *port scanning* their public
> IPs and finding no ports open.  Our only 'ding' we got was that the routers
> responded to pings and the insurance company thought they shouldn't.
> Insurance failed to do any sort of competent audit (i.e. NIST 800-171).  If
> they did, they would have found the techs "solve" problems by making people
> local admins or domain admins and that their primary line-of-business app
> actually requires 'local admin' to run 'properly'.
>
> While they finally replaced Exchange 2007 in 2020 by switching to GMail
> (not for security, but because it made work-from-home easier), they still
> run about 1/3 of their systems on Windows 7 with a few Windows 8 and 8.1
> machines here and there.  They even still have 2 Windows XP machines.
> Their upgrade policy is currently "If the machine dies, you can replace it
> with something newer".  Their oldest machine is around 15 years old.
>
> Incompetent insurance companies combined with incompetent IT staff and
> under-funded IT departments are the nexus of the problem.
>
> -A
>

Re: Can somebody explain these ransomwear attacks?

[Michael Thomas]

On 6/25/21 5:25 AM, Jim wrote:

On Thu, Jun 24, 2021 at 5:41 PM Brandon Svec via NANOG  wrote:

I think a big problem may be that the ransom is actually very cost effective 
and probably the lowest line item cost in many of these situations where large 
revenue streams are interrupted and time=money (and maybe also health or life).

Big problem that with organizations' existing Disaster Recovery DR methods --
the time and cost to recovery from any event including downtime will
be some amount.. likely a high one,
and criminals' ransom demands will presumably be set as high a price
as they think they can get --
but still orders of magnitudes less than cost to recover / repair /
restore, and the downtime may be less.

The  ransom price becomes the perceived cost of paying from the
perspective of the
organizations faced with the decision,  But the actual cost to the
whole world of them paying
a ransom is much higher and will be borne by others (And/or themselves
if they are unlucky)
in the future, when their having paid the criminals encourages and
causes more and more of that nefarious activity.


Well, the cost of the DR fire drill is proportionate to how automated, 
etc, it is. If you think that the odds of a DR event are really low you 
want to make it possible but not necessarily cheap. If it happens all of 
the time, you want to optimize for speed and efficiency.


The object here is to break their business model, at least for you. Even 
if you go through one DR they aren't likely to go back again rather than 
finding another sucker.


Mike

Re: Can somebody explain these ransomwear attacks?

[Karl Auer]

On Fri, 2021-06-25 at 10:05 -0400, Tom Beecher wrote:
> Everything can be broken, and nothing will ever be 100% secure. If
> you strive to make sure the cost to break in is massively larger than
> the value of what could be extracted, you'll generally be ahead of
> the game.

Easy to say.

IMHO the only workable long-term defence is heterogeneity - supported
by distribution, redundancy and just taking the simple things
seriously.

Business has spent the last few decades discarding heterogeneity and
the bigger they are, the more comprehensively they have discarded it.
Companies that are floor to ceiling and wall to wall Windows.
Centralised updates, centralised networking, centralised storage,
centralised ops teams, and (typically) a culture of sharing. A
relentless prioritising of convenience over security. For goodness
sake, even the NSA had the attitude that "if you are this side of the
drawbridge you must be OK"!

We need to start building systems that are not seamless, that are not
highly interchangeable, that are not fully interconnected, and we have
to include our human systems in that approach.

Regards, K.

-- 
~~~
Karl Auer (ka...@biplane.com.au)
http://www.biplane.com.au/kauer

Re: Can somebody explain these ransomwear attacks?

[Anne P. Mitchell, Esq.]

>  The goal is to make your business very difficult to hack that it is no 
> longer economically viable for terrorists to attack it in the first place.
>  
> That’s the best insurance you can give to your business.

And yet, so often their system is vulnerable owing to ineptness, cluelessness, 
or laziness.  For example, when the City of Baltimore's system got locked up, 
the attacker exploited a vulnerability for which MS had issued a patch *2 years 
earlier* (if memory serves).

Anne

--
Anne P. Mitchell,  Attorney at Law
CEO Get to the Inbox by SuretyMail, GetToTheInbox.com 
Dean of Cyberlaw and Cyber Security, Lincoln Law School
Email Marketing Deliverability and Best Practices Expert
Board of Directors, Denver Internet Exchange
Former Counsel: MAPS Anti-Spam Blacklist
Chair Emeritus, Asilomar Microcomputer Workshop

Re: Can somebody explain these ransomwear attacks?

[Aaron C. de Bruyn via NANOG]

On Fri, Jun 25, 2021 at 5:28 AM Jim  wrote:

> Big problem that with organizations' existing Disaster Recovery DR methods
> --
> the time and cost to recovery from any event including downtime will
> be some amount.. likely a high one,
> and criminals' ransom demands will presumably be set as high a price
> as they think they can get --
> but still orders of magnitudes less than cost to recover / repair /
> restore, and the downtime may be less.
>

I think you're right.  DR methods are a *huge* part of the problem.
I manage DR systems for a number of companies including a large unnamed
healthcare provider.
A year ago they were still running Exchange 2007.  No, that's not a typo.
Cryptolocker strolled right into the network via file attachment and
somehow made it past the non-existent 3rd-party AV software that totally
wasn't integrated into Exchange because it cost too much.
It spread across the network and started encrypting around 1 AM on a Friday
morning.
Due to the way this particular strain worked, it missed several of the
monitoring tools that would have alerted my company to the massive file
encryption that was happening and it managed to completely encrypt 21
offices and all their patient data.
At 6 AM my monitoring system alerted me to a problem.  By about 6:30 I
realized the scope of the problem, disabled all the site-to-site VPNs,
dropped the 1 or 2 infected workstations off the network and the encryption
stopped.
We do local snapshots every 15 minutes, local backups twice daily, local
disconnected backups several times per week, and off-site write-only
backups multiple times per day.
After I figured out when cryptolocker launched, I ran a few commands from
our config management server and had every office restored and running in
about 28 minutes and the internal techs for the company were dispatched to
swap out the infected workstations.

The first rule I follow is: Windows *never* touches bare metal.
I amended that last year to: Windows *never* touches bare metal, including
workstations.

People *really* need to work on their backups and DR plans.  You don't need
some expensive 3rd-party cloud solution coupled with expensive VMWare
licenses to do it.

The other part of the problem is the insurance companies.
It might surprise you to learn that particular company has been
cryptolocker'd 8 times in the last 15 years.  They've never lost more than
a few minutes of data and recovery times are measured in minutes.
This line has literally been thrown around a few times: "We don't need to
spend $xxx,xxx to upgrade to current software versions.  We have a
$5,000,000 cyber insurance policy."

The insurance company issued the policy after *port scanning* their public
IPs and finding no ports open.  Our only 'ding' we got was that the routers
responded to pings and the insurance company thought they shouldn't.
Insurance failed to do any sort of competent audit (i.e. NIST 800-171).  If
they did, they would have found the techs "solve" problems by making people
local admins or domain admins and that their primary line-of-business app
actually requires 'local admin' to run 'properly'.

While they finally replaced Exchange 2007 in 2020 by switching to GMail
(not for security, but because it made work-from-home easier), they still
run about 1/3 of their systems on Windows 7 with a few Windows 8 and 8.1
machines here and there.  They even still have 2 Windows XP machines.
Their upgrade policy is currently "If the machine dies, you can replace it
with something newer".  Their oldest machine is around 15 years old.

Incompetent insurance companies combined with incompetent IT staff and
under-funded IT departments are the nexus of the problem.

-A

RE: Can somebody explain these ransomwear attacks?

[Jean St-Laurent via NANOG]

I agree with you that 100% secure is not achievable. 

 

The goal is to make your business very difficult to hack that it is no longer 
economically viable for terrorists to attack it in the first place.

 

That’s the best insurance you can give to your business.

 

Jean

Re: Can somebody explain these ransomwear attacks?

[Tom Beecher]

>
> The payment to ransomware gangs is now tax-deductible.
>

It's not new. In the US, losses due to theft have been at least partly
deductible for a very long time. By IRS definitions (
https://www.irs.gov/publications/p547), blackmail and extortion both
qualify as theft, and it's fairly safe to say those apply to all ransomware
attacks.

Everything can be broken, and nothing will ever be 100% secure. If you
strive to make sure the cost to break in is massively larger than the value
of what could be extracted, you'll generally be ahead of the game.




On Fri, Jun 25, 2021 at 8:39 AM Jean St-Laurent via NANOG 
wrote:

> Hi Jim,
>
> Very nice text from you and you seem to offer good hints on how to stop it
> long term.
>
> The reality is that USA is going in the direct opposing direction that you
> express.
>
> The payment to ransomware gangs is now tax-deductible.
>
> "Extorted by ransomware gangs? The payments may be tax-deductible".
> Published June 21st.
> https://www.cbsnews.com/news/ransomware-payments-may-be-tax-deductible/
>
> Again from cbsnews. Not sure if we can rely on them to report accurate
> news?
>
> Jean
>
> -Original Message-
> From: NANOG  On Behalf Of Jim
> Sent: June 25, 2021 8:26 AM
> To: Brandon Svec 
> Cc: nanog@nanog.org
> Subject: Re: Can somebody explain these ransomwear attacks?
>
> On Thu, Jun 24, 2021 at 5:41 PM Brandon Svec via NANOG 
> wrote:
> >
> > I think a big problem may be that the ransom is actually very cost
> effective and probably the lowest line item cost in many of these
> situations where large revenue streams are interrupted and time=money (and
> maybe also health or life).
>
> Big problem that with organizations' existing Disaster Recovery DR methods
> -- the time and cost to recovery from any event including downtime will be
> some amount.. likely a high one, and criminals' ransom demands will
> presumably be set as high a price as they think they can get -- but still
> orders of magnitudes less than cost to recover / repair / restore, and the
> downtime may be less.
>
> The  ransom price becomes the perceived cost of paying from the
> perspective of the organizations faced with the decision,  But the actual
> cost to the whole world of them paying a ransom is much higher and will be
> borne by others (And/or themselves if they are unlucky) in the future, when
> their having paid the criminals encourages and causes more and more of that
> nefarious activity.
>
> I would call that a regulatory issue regarding commerce and payments not
> able to be addressed by technology.
>
> No matter how much companies can improve your DR process to cost less for
> a recovery and take less time -- a recovery is bound to still involve some
> downtime and cost a large enough amount  where it will then be possible for
> motivated criminals to come up with a dollars cost improvement for a ransom
> that will be less than it.
>
> I do wonder for a moment.. about companies paying ransoms: Do they somehow
> manage to get the crooks' W-9 and verify their identity, as required when
> an organization makes a payment to any 3rd party -- or do those paying
> ransoms somehow circumvent the mandatory tax reporting and witholdings,
> B/c it seems like making a payment to an Unnamed / unidentified /
> unverifiable party ought to be a crime  or make the payor be considered an
> accomplice in the crooks' evasion of the taxing authority?
>
> I always think.. have the governments impose penalties, eg.
> "If you make a payment for a ransom, then a penalty of  $10k plus 1%
> the ransom will be due."
> / Have it be a more-severely penalized crime to send any digital payment
> for a transaction above X say $1000 without the Proof of Identity and
> Physical location of all Payees -- make sure it gets enforced strictly
> against anyone paying a ransom.
> Make the ransoms not payable without larger repurcussions, and perhaps the
> crooks will have to find a new profession.
>
> >
> > The original thought that it should be handled like standard DR and
> tighten up security may apply to very small businesses though where they
> could afford to try to ignore the ransom request and rebuild more securely
> hoping the criminals will move on and not come back for revenge.
> >
> --
> -Jim
>
>

RE: Can somebody explain these ransomwear attacks?

[Jean St-Laurent via NANOG]

Hi Jim,

Very nice text from you and you seem to offer good hints on how to stop it long 
term.

The reality is that USA is going in the direct opposing direction that you 
express.

The payment to ransomware gangs is now tax-deductible.

"Extorted by ransomware gangs? The payments may be tax-deductible". 
Published June 21st.
https://www.cbsnews.com/news/ransomware-payments-may-be-tax-deductible/

Again from cbsnews. Not sure if we can rely on them to report accurate news?

Jean

-Original Message-
From: NANOG  On Behalf Of Jim
Sent: June 25, 2021 8:26 AM
To: Brandon Svec 
Cc: nanog@nanog.org
Subject: Re: Can somebody explain these ransomwear attacks?

On Thu, Jun 24, 2021 at 5:41 PM Brandon Svec via NANOG  wrote:
>
> I think a big problem may be that the ransom is actually very cost effective 
> and probably the lowest line item cost in many of these situations where 
> large revenue streams are interrupted and time=money (and maybe also health 
> or life).

Big problem that with organizations' existing Disaster Recovery DR methods -- 
the time and cost to recovery from any event including downtime will be some 
amount.. likely a high one, and criminals' ransom demands will presumably be 
set as high a price as they think they can get -- but still orders of 
magnitudes less than cost to recover / repair / restore, and the downtime may 
be less.

The  ransom price becomes the perceived cost of paying from the perspective of 
the organizations faced with the decision,  But the actual cost to the whole 
world of them paying a ransom is much higher and will be borne by others 
(And/or themselves if they are unlucky) in the future, when their having paid 
the criminals encourages and causes more and more of that nefarious activity.

I would call that a regulatory issue regarding commerce and payments not able 
to be addressed by technology.

No matter how much companies can improve your DR process to cost less for a 
recovery and take less time -- a recovery is bound to still involve some 
downtime and cost a large enough amount  where it will then be possible for 
motivated criminals to come up with a dollars cost improvement for a ransom 
that will be less than it.

I do wonder for a moment.. about companies paying ransoms: Do they somehow 
manage to get the crooks' W-9 and verify their identity, as required when an 
organization makes a payment to any 3rd party -- or do those paying ransoms 
somehow circumvent the mandatory tax reporting and witholdings,  B/c it seems 
like making a payment to an Unnamed / unidentified / unverifiable party ought 
to be a crime  or make the payor be considered an accomplice in the crooks' 
evasion of the taxing authority?

I always think.. have the governments impose penalties, eg.
"If you make a payment for a ransom, then a penalty of  $10k plus 1% the 
ransom will be due."
/ Have it be a more-severely penalized crime to send any digital payment for a 
transaction above X say $1000 without the Proof of Identity and Physical 
location of all Payees -- make sure it gets enforced strictly against anyone 
paying a ransom.
Make the ransoms not payable without larger repurcussions, and perhaps the 
crooks will have to find a new profession.

>
> The original thought that it should be handled like standard DR and tighten 
> up security may apply to very small businesses though where they could afford 
> to try to ignore the ransom request and rebuild more securely hoping the 
> criminals will move on and not come back for revenge.
>
--
-Jim

Re: Can somebody explain these ransomwear attacks?

[Jim]

On Thu, Jun 24, 2021 at 5:41 PM Brandon Svec via NANOG  wrote:
>
> I think a big problem may be that the ransom is actually very cost effective 
> and probably the lowest line item cost in many of these situations where 
> large revenue streams are interrupted and time=money (and maybe also health 
> or life).

Big problem that with organizations' existing Disaster Recovery DR methods --
the time and cost to recovery from any event including downtime will
be some amount.. likely a high one,
and criminals' ransom demands will presumably be set as high a price
as they think they can get --
but still orders of magnitudes less than cost to recover / repair /
restore, and the downtime may be less.

The  ransom price becomes the perceived cost of paying from the
perspective of the
organizations faced with the decision,  But the actual cost to the
whole world of them paying
a ransom is much higher and will be borne by others (And/or themselves
if they are unlucky)
in the future, when their having paid the criminals encourages and
causes more and more of that nefarious activity.

I would call that a regulatory issue regarding commerce and payments
not able to be addressed by technology.

No matter how much companies can improve your DR process to cost less
for a recovery
and take less time -- a recovery is bound to still involve some
downtime and cost a large enough amount  where it
will then be possible for motivated criminals to come up with a
dollars cost improvement for a ransom that will be less than it.

I do wonder for a moment.. about companies paying ransoms: Do they
somehow manage to get
the crooks' W-9 and verify their identity, as required when an
organization makes a payment to
any 3rd party -- or do those paying ransoms somehow circumvent the
mandatory tax reporting and
witholdings,  B/c it seems like making a payment to an Unnamed /
unidentified / unverifiable party
ought to be a crime  or make the payor be considered an accomplice in
the crooks' evasion of the taxing authority?

I always think.. have the governments impose penalties, eg.
"If you make a payment for a ransom, then a penalty of  $10k plus
1% the ransom will be due."
/ Have it be a more-severely penalized crime to send any digital
payment for a transaction above X say $1000 without the Proof of
Identity
and Physical location of all Payees -- make sure it gets enforced
strictly against anyone paying a ransom.
Make the ransoms not payable without larger repurcussions, and perhaps
the crooks will have to find a new profession.

>
> The original thought that it should be handled like standard DR and tighten 
> up security may apply to very small businesses though where they could afford 
> to try to ignore the ransom request and rebuild more securely hoping the 
> criminals will move on and not come back for revenge.
>
--
-Jim

Re: Can somebody explain these ransomwear attacks?

[Don Gould]

NEW ZEALAND HEALTH EXPERIENCE AND DISCUSSION

Some of you may be aware that one of our major hospitals was taken off 
line with 680 compromised servers.


Discussion on one local list is that the systems have been open for some 
time and the rnasom hackers didn't open the systems, they have just 
caused them to be cleaned up and locked.


I was in one of our other hospitals this week.  I was presented with 
Windows 2000 systems.  These people don't seem to understand the 
concepts of a dated DLL stack, combined with inter system networking.  
They don't leave me with the impression that we've been presenting 
object level compromise data for decades now.  They don't seem to 
understand that we've made that public facing for, what I would have 
thought, fairly obvious reasons.  By 'we', I don't mean any special, 
crazy, conspiracy theory, tin foil hat wearing groups, I mean just plain 
old every day computer geeks who write software.


In the NZ hospital case, it looks to me, and I don't know, this is just 
pure speculation, like someone is going around global hospitals and 
making them clean up stuff that they should have been upgrading.


I personally accept that there are groups around the world with vested 
interests to have access to our hospital systems, if for no other reason 
that just to see who's coming and going... you never know when that 
might make a cool media story ea?


I keep reading how this is a training issue of staff in hospitals who 
shouldn't be clicking on email attachments.  It's a comment that just 
strikes me as bonkers.  It's not a training issue at all, other than 
training management that systems have to be patched, updated, and 
upgraded.


Call me crazy, but you can't go around telling kids that IT has great 
jobs, ask them (make them) pay for education, and then not actually give 
them jobs to do the work that clearly has to be done.


Yes, you can call this a conspiracy theory, but I venture that when old 
people cry out for young people to learn IT so they can make better 
health systems, and then 'investors' don't actually upgrade to those 
'new systems' and just leave the doors wide open to personal 
information, at some point some folk are going to get their noses out of 
joint a fairly obvious theory that to many in management are just 
discounting as conspiracy until things get broken then they blame 
the user for using email.


Going back a number of years our whole social services system was found 
to be wide open because a vendor couldn't make their software work 
without giving it a 'few more permissions'.  Couple that kind of 
thinking with decades old, compromised, DLL stacks...  interests who 
like to just quietly watch... and a lack of good, reasonably paid IT 
work... and I have one question



" Can somebody explain these ransomwear attacks?"  ...I don't know... 
can I?


HTH

D

On 2021-06-25 22:39, Jean St-Laurent via NANOG wrote:

Here are some facts that it’s important to not pay them.

80% OF RANSOMWARE VICTIMS SUFFER REPEAT ATTACKS, ACCORDING TO NEW
REPORT

https://www.cbsnews.com/news/ransomware-victims-suffer-repeat-attacks-new-report/

published June 17th 2021

Don’t pay them. Just clean your mess. 

Jean

FROM: NANOG  ON BEHALF OF
Michael Thomas
SENT: June 24, 2021 5:59 PM
TO: JoeSox 
CC: nanog@nanog.org
SUBJECT: Re: Can somebody explain these ransomwear attacks?

On 6/24/21 2:55 PM, JoeSox wrote:


It gets tricky when 'your' company will lose money $$$ while you
wait a month to restore from your cloud backups.

So Executives roll the dice to see if service can be restored
quickly as possible keeping shareholders and customers happy as
possible.


But if you pay without finding how they got in, they could turn around
and do it again, or sell it on the dark web, right?

Mike


On Thu, Jun 24, 2021 at 2:44 PM Michael Thomas 
wrote:


Not exactly network but maybe, but certainly operational.
Shouldn't this
just be handled like disaster recovery? I haven't looked into this
much,
but it sounds like the only way to stop it is to stop paying the
crooks.
There is also the obvious problem that if they got in, something
(or
someone) is compromised that needs to be cleaned which sounds sort
of
like DR again to me.

Mike


--
Don Gould
5 Cargill Place
Richmond 8013
Christchurch, New Zealand
Mobile/Telegram: + 64 21 114 0699
www.bowenvale.co.nz

RE: Can somebody explain these ransomwear attacks?

[Jean St-Laurent via NANOG]

Here are some facts that it’s important to not pay them.

 

80% of ransomware victims suffer repeat attacks, according to new report

 

 

https://www.cbsnews.com/news/ransomware-victims-suffer-repeat-attacks-new-report/

 

published June 17th 2021

 

Don’t pay them. Just clean your mess. 

 

Jean

 

From: NANOG  On Behalf Of Michael 
Thomas
Sent: June 24, 2021 5:59 PM
To: JoeSox 
Cc: nanog@nanog.org
Subject: Re: Can somebody explain these ransomwear attacks?

 

 

On 6/24/21 2:55 PM, JoeSox wrote:




It gets tricky when 'your' company will lose money $$$ while you wait a month 
to restore from your cloud backups.

So Executives roll the dice to see if service can be restored quickly as 
possible keeping shareholders and customers happy as possible.

 

But if you pay without finding how they got in, they could turn around and do 
it again, or sell it on the dark web, right?

Mike





 

On Thu, Jun 24, 2021 at 2:44 PM Michael Thomas mailto:m...@mtcc.com> > wrote:


Not exactly network but maybe, but certainly operational. Shouldn't this 
just be handled like disaster recovery? I haven't looked into this much, 
but it sounds like the only way to stop it is to stop paying the crooks. 
There is also the obvious problem that if they got in, something (or 
someone) is compromised that needs to be cleaned which sounds sort of 
like DR again to me.

Mike

Re: OT: Re: Can somebody explain these ransomwear attacks?

[scott]

On 6/25/21 12:15 AM, Michael Thomas wrote:


On 6/24/21 4:57 PM, Karl Auer wrote:

Ransomwear - the latest fashion idea.

"Pay me money or I will continue to wear these clothes"

I reckon I could make a killing just by stepping out in a knee-length
macrame skirt...

Lol. Thanks, I knew that didn't look right. Maybe with a crop top to 
complete the ensemble.





No, no, no...  Some things can't be unthought! ;)

scott

Re: OT: Re: Can somebody explain these ransomwear attacks?

[Michael Thomas]

On 6/24/21 4:57 PM, Karl Auer wrote:

Ransomwear - the latest fashion idea.

"Pay me money or I will continue to wear these clothes"

I reckon I could make a killing just by stepping out in a knee-length
macrame skirt...

Lol. Thanks, I knew that didn't look right. Maybe with a crop top to 
complete the ensemble.


Mike

OT: Re: Can somebody explain these ransomwear attacks?

[Karl Auer]

Ransomwear - the latest fashion idea.

"Pay me money or I will continue to wear these clothes"

I reckon I could make a killing just by stepping out in a knee-length
macrame skirt...

Regards, K.

-- 
~~~
Karl Auer (ka...@biplane.com.au)
http://www.biplane.com.au/kauer

Re: Can somebody explain these ransomwear attacks?

[Michael Thomas]

On 6/24/21 3:08 PM, Shane Ronan wrote:
A lot of the payments for Ransomware come from Insurance Companies 
under "Business Interruption Insurance". It in fact may be more cost 
effective to pay the ransom, than to pay for continued business 
interruption.


Of course along with paying the ransom, a full forensic audit of the 
systems/network is conducted. The vector for many of these attacks is 
via a worm triggered by someone opening an attachment on an email or 
downloading compromised software from the Internet. Short of not 
allowing email attachments or blocking Internet access, the best 
method is to properly train users to not click on attachments or visit 
"untrusted" sites, but nothing is perfect.



I wonder if this is preying off the firewall 
hard-on-the-outside-soft-on-the-inside? At this point I'm not sure how 
you can justify that because so many people are using their own 
equipment. It's not just the operational side of the business they can 
target, after all.


Mike

Re: Can somebody explain these ransomwear attacks?

[Brandon Svec via NANOG]

I think a big problem may be that the ransom is actually very cost effective 
and probably the lowest line item cost in many of these situations where large 
revenue streams are interrupted and time=money (and maybe also health or life). 
 

The original thought that it should be handled like standard DR and tighten up 
security may apply to very small businesses though where they could afford to 
try to ignore the ransom request and rebuild more securely hoping the criminals 
will move on and not come back for revenge.

> On Jun 24, 2021, at 3:08 PM, Shane Ronan  wrote:
> 
> A lot of the payments for Ransomware come from Insurance Companies under 
> "Business Interruption Insurance". It in fact may be more cost effective to 
> pay the ransom, than to pay for continued business interruption. 
> 
> Of course along with paying the ransom, a full forensic audit of the 
> systems/network is conducted. The vector for many of these attacks is via a 
> worm triggered by someone opening an attachment on an email or downloading 
> compromised software from the Internet. Short of not allowing email 
> attachments or blocking Internet access, the best method is to properly train 
> users to not click on attachments or visit "untrusted" sites, but nothing is 
> perfect.
> 
> Shane
> 
> 
> 
> 
> On Thu, Jun 24, 2021 at 6:01 PM Michael Thomas  > wrote:
> 
> 
> On 6/24/21 2:55 PM, JoeSox wrote:
>> 
>> It gets tricky when 'your' company will lose money $$$ while you wait a 
>> month to restore from your cloud backups.
>> So Executives roll the dice to see if service can be restored quickly as 
>> possible keeping shareholders and customers happy as possible.
>> 
> But if you pay without finding how they got in, they could turn around and do 
> it again, or sell it on the dark web, right?
> 
> Mike
> 
> 
>> 
>> On Thu, Jun 24, 2021 at 2:44 PM Michael Thomas > > wrote:
>> 
>> Not exactly network but maybe, but certainly operational. Shouldn't this 
>> just be handled like disaster recovery? I haven't looked into this much, 
>> but it sounds like the only way to stop it is to stop paying the crooks. 
>> There is also the obvious problem that if they got in, something (or 
>> someone) is compromised that needs to be cleaned which sounds sort of 
>> like DR again to me.
>> 
>> Mike
>> 

Re: Can somebody explain these ransomwear attacks?

[Shane Ronan]

A lot of the payments for Ransomware come from Insurance Companies under
"Business Interruption Insurance". It in fact may be more cost effective to
pay the ransom, than to pay for continued business interruption.

Of course along with paying the ransom, a full forensic audit of the
systems/network is conducted. The vector for many of these attacks is via a
worm triggered by someone opening an attachment on an email or downloading
compromised software from the Internet. Short of not allowing email
attachments or blocking Internet access, the best method is to properly
train users to not click on attachments or visit "untrusted" sites, but
nothing is perfect.

Shane




On Thu, Jun 24, 2021 at 6:01 PM Michael Thomas  wrote:

>
> On 6/24/21 2:55 PM, JoeSox wrote:
>
>
> It gets tricky when 'your' company will lose money $$$ while you wait a
> month to restore from your cloud backups.
> So Executives roll the dice to see if service can be restored quickly as
> possible keeping shareholders and customers happy as possible.
>
> But if you pay without finding how they got in, they could turn around and
> do it again, or sell it on the dark web, right?
>
> Mike
>
>
> On Thu, Jun 24, 2021 at 2:44 PM Michael Thomas  wrote:
>
>>
>> Not exactly network but maybe, but certainly operational. Shouldn't this
>> just be handled like disaster recovery? I haven't looked into this much,
>> but it sounds like the only way to stop it is to stop paying the crooks.
>> There is also the obvious problem that if they got in, something (or
>> someone) is compromised that needs to be cleaned which sounds sort of
>> like DR again to me.
>>
>> Mike
>>
>>

Re: Can somebody explain these ransomwear attacks?

[Michael Thomas]

On 6/24/21 2:55 PM, JoeSox wrote:


It gets tricky when 'your' company will lose money $$$ while you wait 
a month to restore from your cloud backups.
So Executives roll the dice to see if service can be restored quickly 
as possible keeping shareholders and customers happy as possible.


But if you pay without finding how they got in, they could turn around 
and do it again, or sell it on the dark web, right?


Mike




On Thu, Jun 24, 2021 at 2:44 PM Michael Thomas > wrote:



Not exactly network but maybe, but certainly operational.
Shouldn't this
just be handled like disaster recovery? I haven't looked into this
much,
but it sounds like the only way to stop it is to stop paying the
crooks.
There is also the obvious problem that if they got in, something (or
someone) is compromised that needs to be cleaned which sounds sort of
like DR again to me.

Mike

Re: Can somebody explain these ransomwear attacks?

[JoeSox]

It gets tricky when 'your' company will lose money $$$ while you wait a
month to restore from your cloud backups.
So Executives roll the dice to see if service can be restored quickly as
possible keeping shareholders and customers happy as possible.


On Thu, Jun 24, 2021 at 2:44 PM Michael Thomas  wrote:

>
> Not exactly network but maybe, but certainly operational. Shouldn't this
> just be handled like disaster recovery? I haven't looked into this much,
> but it sounds like the only way to stop it is to stop paying the crooks.
> There is also the obvious problem that if they got in, something (or
> someone) is compromised that needs to be cleaned which sounds sort of
> like DR again to me.
>
> Mike
>
>