Ransomware cyber attacks - last week US this week Ireland
Discussion
Following on from the cyber attack on the US pipeline, overnight there was a significant and serious attack on the HSE in Ireland ( Ireland’s NHS ) which has caused a shutdown of most non urgent healthcare in the country today
It’s being described as a ransom attack
We hear that a ransom was paid in the US attack, is this going to be the new “thing”
Is it state sponsored or criminal ?
Surely an attack on a country’s infrastructure should be classed as an act of terrorism or at the least a hostile act ?
Should ransom’s be paid ?
https://www.rte.ie/news/health/2021/0514/1221519-h...
https://www.rte.ie/news/health/2021/0514/1221537-h...
It’s being described as a ransom attack
We hear that a ransom was paid in the US attack, is this going to be the new “thing”
Is it state sponsored or criminal ?
Surely an attack on a country’s infrastructure should be classed as an act of terrorism or at the least a hostile act ?
Should ransom’s be paid ?
https://www.rte.ie/news/health/2021/0514/1221519-h...
https://www.rte.ie/news/health/2021/0514/1221537-h...
It has been a "thing" for a long time. Often because of poor IT security or investment in IT. Sometimes it is targeted, but more often than not, opportunistic.
We should not pay them... It's like someone stealing your car and then you paying to get it back. But they keep a copy of the key they used to steel it with. You get it back, it's not quite right. And gets stolen again next week. Do you pay up again?
What we should be doing is keeping the keys locked up, and then finding and kicking the crap out of people who steal stuff.
Unfortunately, the powers that be are 1, not interested and 2, don't really understand what a computer is.
We should not pay them... It's like someone stealing your car and then you paying to get it back. But they keep a copy of the key they used to steel it with. You get it back, it's not quite right. And gets stolen again next week. Do you pay up again?
What we should be doing is keeping the keys locked up, and then finding and kicking the crap out of people who steal stuff.
Unfortunately, the powers that be are 1, not interested and 2, don't really understand what a computer is.
Prizam said:
<snip>
Unfortunately, the powers that be are 1, not interested and 2, don't really understand what a computer is.
The reality of it is that these hackers are based out of Russia and other 'untouchable' countries.Unfortunately, the powers that be are 1, not interested and 2, don't really understand what a computer is.
The powers that be are interested, but this ^^^ prevents them from taking any action.
Looks like the pipeline company have coughed up 5 million dollars..
https://www.bbc.co.uk/news/business-57112371
https://www.bbc.co.uk/news/business-57112371
Hedobot said:
Looks like the pipeline company have coughed up 5 million dollars..
https://www.bbc.co.uk/news/business-57112371
Sounds like a cheap punishment for not patching antique Exchange systems https://www.bbc.co.uk/news/business-57112371
Ransomware isn't especially difficult to protect against. Stay on top of patching and scan for vulnerabilities. Have an effective back-up structure. Typically, large organisations are more vulnerable, either due to lack of investment, poor on boarding of acquisitions or just failures of process.
Earthdweller said:
Following on from the cyber attack on the US pipeline, overnight there was a significant and serious attack on the HSE in Ireland ( Ireland’s NHS ) which has caused a shutdown of most non urgent healthcare in the country today
It’s being described as a ransom attack
We hear that a ransom was paid in the US attack, is this going to be the new “thing”
Is it state sponsored or criminal ?
Surely an attack on a country’s infrastructure should be classed as an act of terrorism or at the least a hostile act ?
Should ransom’s be paid ?
https://www.rte.ie/news/health/2021/0514/1221519-h...
https://www.rte.ie/news/health/2021/0514/1221537-h...
Criminal and state sponsored are oft interchangeable in some areas.It’s being described as a ransom attack
We hear that a ransom was paid in the US attack, is this going to be the new “thing”
Is it state sponsored or criminal ?
Surely an attack on a country’s infrastructure should be classed as an act of terrorism or at the least a hostile act ?
Should ransom’s be paid ?
https://www.rte.ie/news/health/2021/0514/1221519-h...
https://www.rte.ie/news/health/2021/0514/1221537-h...
Edited by Previous on Monday 17th May 07:53
Ronstein said:
Ransomware isn't especially difficult to protect against. Stay on top of patching and scan for vulnerabilities. Have an effective back-up structure. Typically, large organisations are more vulnerable, either due to lack of investment, poor on boarding of acquisitions or just failures of process.
This is quite a simplistic answer to a complex issue.Ronstein said:
Ransomware isn't especially difficult to protect against. Stay on top of patching and scan for vulnerabilities. Have an effective back-up structure. Typically, large organisations are more vulnerable, either due to lack of investment, poor on boarding of acquisitions or just failures of process.
Easier said than done for all but the simplest organisations and IT estates. That approach might protect you from script kiddies and opportunist attacks, but if an organised team want to access your networks they likely will. Few businesses want to invest in properly architecting and securing their IT estate because it's really, really expensive, reduces agility and is difficult to do properly.
tangerine_sedge said:
Easier said than done for all but the simplest organisations and IT estates. That approach might protect you from script kiddies and opportunist attacks, but if an organised team want to access your networks they likely will.
Few businesses want to invest in properly architecting and securing their IT estate because it's really, really expensive, reduces agility and is difficult to do properly.
That $5 million would have purchased a review of their current systems and vulnerabilities. Maybe the hackers would have selected a differennt easier victim, perhaps..Few businesses want to invest in properly architecting and securing their IT estate because it's really, really expensive, reduces agility and is difficult to do properly.
Hedobot said:
That $5 million would have purchased a review of their current systems and vulnerabilities. Maybe the hackers would have selected a differennt easier victim, perhaps..
I reckon the way this sort of attack works is the culprits scan the whole Internet looking for vulnerable servers - i.e. they don't think "Ooh, let's attack this company."So, in effect, the victims self-select by failing to keep their software updated.
MadCaptainJack said:
reckon the way this sort of attack works is the culprits scan the whole Internet looking for vulnerable servers - i.e. they don't think "Ooh, let's attack this company."
So, in effect, the victims self-select by failing to keep their software updated.
It's not always out of date software that's the issue. More often than not it's badly configured firewalls, web servers, VPNs etc.So, in effect, the victims self-select by failing to keep their software updated.
I've worked with people that think they know how to maintain a secure network, until we've had a penetration test and suddenly they discover they weren't such the hotshot after all.
It can also be 'social engineering' in some cases.
Brian Krebs has an interesting article if you want to know more about the attackers and some of the negotiations that take place post-attack:
https://krebsonsecurity.com/2021/05/a-closer-look-...
https://krebsonsecurity.com/2021/05/a-closer-look-...
Hedobot said:
Looks like the pipeline company have coughed up 5 million dollars..
https://www.bbc.co.uk/news/business-57112371
According to this: https://www.bloomberg.com/news/articles/2021-05-13...https://www.bbc.co.uk/news/business-57112371
The unlock tool was so slow that they ended up recovering from their own backups anyway!
Although it is a tech story on Bloomberg so big pinch of salt needed.
The Irish Health service has been hit by another attack with reports of the attackers demanding $20m dollars to cease
Messages and links to the dark web have apparently been left on the computer systems
700GB of “unencrypted” files, including patient and employee information, are also alleged to have been stolen.
The HSE have confirmed a ransom demand but are saying the matter is now in the hands of the cyber crime unit and Interpol
Messages and links to the dark web have apparently been left on the computer systems
700GB of “unencrypted” files, including patient and employee information, are also alleged to have been stolen.
The HSE have confirmed a ransom demand but are saying the matter is now in the hands of the cyber crime unit and Interpol
TonyRPH said:
It's not always out of date software that's the issue. More often than not it's badly configured firewalls, web servers, VPNs etc.
I've worked with people that think they know how to maintain a secure network, until we've had a penetration test and suddenly they discover they weren't such the hotshot after all.
It can also be 'social engineering' in some cases.
Management too often see proper security as hard, expensive, complex and a potential waste of money. Thus try and do it as cheaply as possible. Even after they've been bitten once.I've worked with people that think they know how to maintain a secure network, until we've had a penetration test and suddenly they discover they weren't such the hotshot after all.
It can also be 'social engineering' in some cases.
Some governments employ some incredibly talented hackers.
Taita said:
Ronstein said:
Ransomware isn't especially difficult to protect against. Stay on top of patching and scan for vulnerabilities. Have an effective back-up structure. Typically, large organisations are more vulnerable, either due to lack of investment, poor on boarding of acquisitions or just failures of process.
This is quite a simplistic answer to a complex issue.I have seen large insurance and legal companies solely using storage snapshots for protection and recovery. I have spoken to public sector organisations who have suffered devastating attacks, talked to vendors about how to prevent future attacks and carried on regardless.
There has been a long held policy in the majority of IT departments to starve backup of resources. Chickens are coming home to roost.
On the flip side, the company I work for has a customer who suffered a bad attack - recovered their backups successfully over a weekend. When they suffered a second attack, they refused to pay the ransom. So the ransomware gang informed them they were going after the backups. They were so assured by their first experience they told the ransomware gang to go for it. I believe their frontline security is now stronger, but they're still confident of recovery if they go down again.
Friend of mine lost his job to this a while back.
Hackers shut down and locked out his company’s systems. They (a manufacturing company) carried on with paper instead of using a computer for a while. His company paid the hackers, but they locked them out again.
After that it became clear the company was no longer viable and shut its doors.
Hackers shut down and locked out his company’s systems. They (a manufacturing company) carried on with paper instead of using a computer for a while. His company paid the hackers, but they locked them out again.
After that it became clear the company was no longer viable and shut its doors.
Gassing Station | News, Politics & Economics | Top of Page | What's New | My Stuff