Negotiating with terrorists - cyber security

[Zavala 1384]

https://www.cbsnews.com/news/riviera-beach-florida-ransomware-attack-city-council-pays-600000-to-hackers-who-seized-its-computer-system/

https://apnews.com/0762caec21874fc09741abbdec0f78ab

Quote

Fort Lauderdale Fla. — A Florida city agreed to pay $600,000 in ransom to hackers who took over its computer system, the latest in thousands of attacks worldwide aimed at extorting money from governments and businesses.

The Riviera Beach City Council voted unanimously this week to pay the hackers' demands, believing the Palm Beach suburb had no choice if it wanted to retrieve its records, which the hackers encrypted. The council already voted to spend almost $1 million on new computers and hardware after hackers captured the city's system three weeks ago.

The hackers apparently got into the city's system when an employee clicked on an email link that allowed them to upload malware. The city had numerous problems, including losing its email system and 911 dispatchers not being able to enter calls into the computer.

Started as just a phishing scheme. Pretty pathetic.

Where's the feds?

Why don't they have a back-up system?

 

[F250 28682]

Not terrorism, so not negotiating with terrorists.

 

44 minutes ago, Zavala said:

Where's the feds? 

The article says that DHS, FBI and the Secret Service are involved. Did you not read the article?

[Zavala 1384]

Just now, F250 said:

Not terrorism, so not negotiating with terrorists.

 

The article says that DHS, FBI and the Secret Service are involved. Did you not read the article?

I get it, they are "involved", but I'm curious how the city still pays $600k ransom. 

Are these federal agencies advising to pay the blackmail?

My thought would be that if the normal city services couldn't be performed, the feds take over and provide assistance, instead of allowing the city to pay criminals to get back into their computer systems.

[F250 28682]

6 minutes ago, Zavala said:

I get it, they are "involved", but I'm curious how the city still pays $600k ransom. 

Are these federal agencies advising to pay the blackmail?

My thought would be that if the normal city services couldn't be performed, the feds take over and provide assistance, instead of allowing the city to pay criminals to get back into their computer systems.

The Feds are involved in the forensic investigation not the incident response side of things. The feds don't have the ability to get involved at the response level. In reality they are pretty useless in these situations.

If the ransomware has encrypted an organization's data with ransomware they often will do the same to the backups making restoration impossible. Either you build from scratch or pay the ransom.

 

[Zavala 1384]

7 hours ago, F250 said:

The Feds are involved in the forensic investigation not the incident response side of things. The feds don't have the ability to get involved at the response level. In reality they are pretty useless in these situations.

If the ransomware has encrypted an organization's data with ransomware they often will do the same to the backups making restoration impossible. Either you build from scratch or pay the ransom.

 

Hm. Seems like it's a horribly setup system if the backup data was also vulnerable. I don't understand how it's legal for them to pay criminals ransom. 

What an easy inside job setup for someone to accidentally type their info into a phishing email then squeeze the tax payers for $600k. If this is the new normal I'd be curious how close attention the investigators are paying to the people in charge there.

[Horn Under a Bad Sign 20344]

If there's one man I want as President when it comes to understanding the technical complexities of these situations as well as the moral overtones and then to initiate and follow through with a Federal response, it's Donald Trump. 

Edited June 21, 2019 by Horn Under a Bad Sign

[F250 28682]

10 minutes ago, Zavala said:

Hm. Seems like it's a horribly setup system if the backup data was also vulnerable. I don't understand how it's legal for them to pay criminals ransom.  

How would it be illegal?

 

11 minutes ago, Zavala said:

What an easy inside job setup for someone to accidentally type their info into a phishing email then squeeze the tax payers for $600k. If this is the new normal I'd be curious how close attention the investigators are paying to the people in charge there. 

It's a bit more complicated than someone engaging in a phishing scam. There also must be a series of technical fuck ups along the way before a critical system can fall victim to ransomware. Its SOP to determine why all layers of security failed or didn't exist, usually it's simple incompetence.

 

[Pescado_Rojo 19331]

They probably failed to deploy a patch that's been available for 6 months and would have prevented this. 

[Zavala 1384]

9 hours ago, F250 said:

How would it be illegal?

 

It's a bit more complicated than someone engaging in a phishing scam. There also must be a series of technical fuck ups along the way before a critical system can fall victim to ransomware. Its SOP to determine why all layers of security failed or didn't exist, usually it's simple incompetence.

 

Well I'm not a lawyer, but using taxpayer dollars to pay off criminals that are holding your data hostage doesn't seem like a very legit move.

The story says it started off as a phishing scam, I agree there was some technical fuck ups letting the people in charge have access to the systems. Thing is, aren't they supposed to be, you know, competent? If they are incompetent, how are the tax payers on the hook for their major fuck ups?

I don't think paying them was the right move. That sets a horrible precedent for paying off criminals who hold data ransom. It funds their work. It encourages more of the same. Finally, how are they so sure they are going to get a legit decrypt code after flushing 600k down the crypto toilet to these people? Are they foreign actors or domestic? Could the city be held liable for funding them? Say they take that 600k and do something more horrible than data theft.. 

[SquishMitten 10400]

^^ I don’t disagree with your premise, but that hasn’t been the MO for these types of attacks. If they don’t remove their encryption, nobody will ever pay again. If this was something like the CIA database, then that might be worth it to a foreign entity. But Riviera Beach City? They ain’t killing the cash cow for that.

[F250 28682]

1 hour ago, Zavala said:

Well I'm not a lawyer, but using taxpayer dollars to pay off criminals that are holding your data hostage doesn't seem like a very legit move.

The city council voted on the matter and the payment was covered by insurance, it's legit.

1 hour ago, Zavala said:

Thing is, aren't they supposed to be, you know, competent? If they are incompetent, how are the tax payers on the hook for their major fuck ups? 

City employees are paid pennies. You get what you pay for when you pay below market rates.

 

1 hour ago, Zavala said:

I don't think paying them was the right move. That sets a horrible precedent for paying off criminals who hold data ransom. It funds their work. It encourages more of the same. Finally, how are they so sure they are going to get a legit decrypt code after flushing 600k down the crypto toilet to these people? Are they foreign actors or domestic? Could the city be held liable for funding them? Say they take that 600k and do something more horrible than data theft..  

The precedent was set years ago when organizations started paying the ransom. The situation is a very complicated prisoners dilemma, everyone would win if no one paid the ransom but everyone's data has various degrees of value and the ransom is less than the cost of not paying.

If the keys didn't work then people would stop paying ransom so the perpetrators have a big incentive to ensure the decryption keys will work.

These are usually foreign actors outside of the reach of U.S. law enforcement. These are criminal organizations of course they will do bad stuff with the money.