US city rejects $5.3M ransom demand and restores encrypted files from backup

Unless you've given them "destroy" that is.

> Now, if only there were a cloud backup platform that included zfs snapshots ...

I see what you did there...

Most likely they don't know english and only have pre-written formats to talk to the victim.

"Backup is lets says weekly and someone high up the chain really wants the power point he put together on Tuesday." is probably what happened in my experience.

Because that's what they had an insurance policy for.

Backup software has been touted as protection from malware and cyberattacks for a very long time.

I would put a delay in ransomware so it sneaks in weekly and monthly backups, and only then trigger it. If stuff gets restored, sneaked warez will activate again. I bet backups are overwritten after several months.

People pay ransoms because they want back whatever is being ransomed. Making it illegal to pay the ransom isn't going to stop that. It will just push everything underground and make it harder to catch the ransomers.

Also notice that this won't necessary ransom payments. It will raise the cost to: 1. The victim who pays with jail time. 2. Society who spends time investigating and jailing victims.

Notice that ransomware authors are not on that list.

Maybe the worst use of "simply" ever.

I'm not so sure. We're nearing an interesting equilibrium where insurance companies pay ransoms, thereby taking an interest in the security of their pool, while attackers probe for vulnerabilities.

Put another way, we have a pen testing group being paid by a digital security group. If the net result is better security in exchange for the insurance "tax," that could be a modest improvement.

Why not enact into law a limited immunity for any such ransomware that (a) only charges a modest amount for decryption; (b) never exfiltrates private data to elsewhere; (c) after payment, reveals all security lapses that allowed penetration?

From a certain perspective, ransomware identifies & forces correction upon institutions that have been careless with their security or backups. Truly nasty attackers could do even worse: stealing & reselling data, or leaving silent long-term compromises in place to bleed targets more extensively.

So, carving out an safe harbor for "uncontracted vulnerability discovery & remediation" via the payment of modest ransoms could be a socially-efficient policy, aligning incentives of many participants: targets, the customers of targets, and grayware authors.

Perhaps, the whole process could be automated even without explicit support from lawmakers: leave an appropriate crypto balance, on the systems at risk, in a conventional place. It'd mean: "If you can see this, we know we've screwed up – but we're OK with you taking this amount, and no more, if you close the hole behind you & leave us a note of what we did wrong." Viewing the movement of that bounty on a blockchain would be a public disclosure of the compromise, and gray-hat actors that confined their activity to the collection of such bounties wouldn't need to fear criminal prosecution.

(Hmm, maybe we should just put private-keys controlling small bitcoin-balances into any free-form fiels of our records with typically-careless institutions – so we can independently sense when our private data has been accessed by dishonest actors – whether institution insiders or hackers.)

If the policy were responsive and funded to the point where individuals outperforming them by putting in some effort was a rare thing then it might be reasonable to impose a fine for giving in (as it encourages more crime). Right now ransomware is thriving on the fact that LEOs are too disorganized, underfunded and unmotivated (since this is way outside the domain knowledge of their personnel) but if some serious efforts were made to provide secure recovery snapshots as a public service then maybe we could look at taking this route.

As it is right now ransomware attacks are incredibly common and usually conceded to, you'd be fining pretty much everyone.

Now the attacker can extort twice.

Of course, at the start a few hostages were sent back to families piece by piece. But word did get around after that.

So instead of straight out crime, contracts if implemented globally, nationally or even statewide, might be a solution. I'm probably overlooking something :)

It wouldn't stop any attacks because the ransomers are already willing to break the law, the only thing that would change is that you'd end up punishing a few victims that get caught paying.

Probably after reporting the crime in the first place, which means victims will be less likely to report it. That hardly sounds like a sensible solution, or any solution at all because it wouldn't affect the actual criminals at all.

It's sort of the same as the "We don't negotiate with hostage-takers" policy. Once you negotiate, it's now a strategy known to work and you'll signal how good of a tactic it is.

Let's say they instead of doing this week's work, they do last week's, next week they're still a week behind and you have to start paying 100+ government employees overtime in order to regain the catch up on the remaining week. This could take a while to catch up and be incredibly expensive.

The $400,000 wasn't taxpayer money it was their insurance companies offer to make this go away.

It also assumes no one but the employees would have to put time into recreating the repeatable work.

For example, people turning in documents in order to get permits. Now they'd have to figure out which ones were lost and regenerate them. It adds up.

For a small city, then yeah outsourcing might make sense. For a large one? Probably not.

The maths for cost is very simple: every person the contractor brings in is being paid for by the government, but now in addition to paying those employees, you also have to pay for a separate set of managers, and executives, and finally the business markup for profit.

If your org is large enough there is no way outsourcing is cheaper - it may be “easier”, but it inherently must cost more.

My current company is much smaller in size and had 2 ransom attacks that I saw happening (in ~2 years). We use nimble as a backup and it is quite expensive (hundreds of thousands actually, depending on infrastructure) but worked flawlessly to restore all our systems in a short time. You will loose a few hours of work though. Attack vectors are the usual: mail with infected attachment and users with too many rights on documents. The attackers even know names of people working at the company and use correct mail signatures (not actual mail signatures, just the colorful stuff you put at the end of every business mail).

If production stopped for a week, the contractual penalties alone would probably eat up sums like that.

the first rule of laws and regulations should be, government must adhere to the letter if they are to be enforced upon others seeking penalties if compliance is not met.

it is really difficult to hold government agencies responsible, it doesn't even have to be computer security, just look at the number of cities in the US who violate lead levels in water. even better, in the US, a lot of what happens can be protected from suits by sovereign immunity.

So keep it simple, what is required of private organizations and people is the minimum standard that a government agency must meet