Paying ransomware doesn't pay

[rslade]

OK, I have, elsewhere, expressed my opinion that paying the ransom for ransomware is a bad idea.  First off, you are funding crime.  Secondly, you are encouraging crime.  (If nobody paid the ransoms, they'd stop doing ransomware, wouldn't they?)

Then there are the various reasons why paying the ransomware isn't a good idea in simply practical terms.  Some of the ransomware was never intended to allow you to recover.  Some is badly coded, and doesn't work when decrypting.  Some of the ransomware families are simply based on symmetric encryption, and one key decrypts all.  (You can find lists of those, and the ways to recover, at various places on the net.)  Some of the ransomware groups are just disorganized, and lose their keys.

(Then there are those who confuse ransomware with breachstortion, and are talking about people who actually do steal your data, and then threaten to publish it unless you pay up.  Most of the same reasons why paying ransom to them is a bad idea hold, with the addition of the fact that, if you pay the ransom, you are relying on the promises and integrity of a bunch of thieves, liars, and extortionists.)

(Oh, and that argument about the "business model" of ransomware and breachstortion being based on them doing what they promise?  That business model only works if you are talking about return or repeat business.  Are you telling me that you are going to go through ransom or extortion with the same group all over again?  How stupid are you?)

Now some research from Sophos backs that up.  If you pay, you've got a less than 10% chance of getting all your data back.

I figured I'd collect some of the previous discussions about ransomware here ...

[rslade]

> Steve-Wilme (Advocate I) posted a new reply in Industry News on 05-06-2021 09:25

> I'm referring to an actual ransomware incident, which was recovered by deleting
> all the VDIs on which the infection was believed to be in memory, logging off
> all staff, recreating everything affected from a clean off line image and then
> restoring the encrypted files from the latest backups.  The systems were on
> premise.  No ransom was paid.

That's the ticket!

====================== (quote inserted randomly by Pegasus Mailer)
rslade@gmail.com rmslade@outlook.com rslade@computercrime.org
I like long walks, especially when they are taken by people who
annoy me. - Fred Allen
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://community.isc2.org/t5/forums/recentpostspage/user-id/1324864413

[Steve-Wilme]

But the trick is to keep the ransomware out, which in the case of the incident concerned meant changing the received wisdom.  No you can't rely on your AV product to keep it out.  You can't rely on your web filtering either, as it's often simply not smart enough.  We had to move to weekly patch cycles, as attackers were reverse engineering the patches released by vendors to craft exploits, so actually targeting organisations with a longer patch delay time.  So if you go back to your old NIST SP800-40 there's a reason they cite patch delay time as a key metric to capture!

[Caute_cautim]

@Steve-WilmeThen what about ensuring your vulnerability management system is directly aligned with what is really going on in the world, and ensuring your patch management regime is prioritised in terms of urgency or criticality?

Regards

Caute_Cautim

[denbesten]

---

@Steve-Wilme wrote:

But the trick is to keep the ransomware out, ....  We had to move to weekly patch cycles

---

Without question, prompt preventative maintenance is important, but it is also important to realize that patching will not protect you from a  Zero-day (been there; had to recover a company from one). 

One really wants a multi-layered defense strategy that includes both preventative and recovery measures.

[Caute_cautim]

@denbesten   It would also be a good idea to replace human beings (radical approach) with Robotic Process Automation (RPA) especially in repetitive roles, especially those who do not think or are multi-tasking - talking to their mates on mobile phones etc etc or distracted. 

https://www.ibm.com/au-en/automation/rpa?p1=Search&p4=43700054672209358&p5=e&gclid=Cj0KCQjwytOEBhD5A...

However, a good endpoint prevention regime is also required, with automatic policies to reduce the likelihood of a zero day occurring especially with Augmented Intelligence (AI) to reduce the impact and therefore the resultant cost of compromise.

Regards

Caute_cautim

[Caute_cautim]

Hi All

An here is another gloat of Ransomware attacks in Australia:

https://www.csoonline.com/article/3617498/ransomware-has-put-australia-s-hospital-cybersecurity-on-l...

Look at the impact on people and hospitals.

Regards

Caute_cautim

[rslade]

> Caute_cautim (Community Champion) posted a new reply in Industry News on

>   An here is another gloat of Ransomware attacks in Australia

Hmmmmm.

A "gloat" of ransomware attacks. As a collective noun, that seems oddly
appropriate ...

======================
rslade@gmail.com rmslade@outlook.com rslade@computercrime.org
"If you do buy a computer, don't turn it on." - Richards' 2nd Law
"Robert Slade's Guide to Computer Viruses" 0-387-94663-2
"Viruses Revealed" 0-07-213090-3
"Software Forensics" 0-07-142804-6
"Dictionary of Information Security" Syngress 1-59749-115-2
"Cybersecurity Lessons from CoVID-19" CRC Press 978-0-367-68269-9
============= for back issues:
[Base URL] site http://victoria.tc.ca/techrev/
CISSP refs: [Base URL]mnbksccd.htm
PC Security: [Base URL]mnvrrvsc.htm
Security Dict.: [Base URL]secgloss.htm
Security Educ.: [Base URL]comseced.htm
Book reviews: [Base URL]mnbk.htm
[Base URL]review.htm
Partial/recent: http://groups.yahoo.com/group/techbooks/
http://en.wikipedia.org/wiki/Robert_Slade
https://is.gd/RotlWB http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/