Ransomware Completely Shuts Down Ohio Town Government (techcrunch.com) 106
An anonymous reader quotes a report from TechCrunch: In another interesting example of what happens when you don't manage your backups correctly, the Licking County government offices, including the police force, have been shut down by ransomware. Although details are sparse, it's clear that someone in the office caught a bug in a phishing scam or by downloading it and now their servers are locked up. Wrote Kent Mallett of the Newark Advocate: "The virus, accompanied by a financial demand, is labeled ransomware, which has hit several local governments in Ohio and was the subject of a warning from the state auditor last summer. All county offices remain open, but online access and landline telephones are not available for those on the county system. The shutdown is expected to continue at least the rest of the week." The county government offices, including 911 dispatch, currently must work without computers or office phones. "The public can still call 911 for emergency police, fire or medical response," wrote Mallett.
Automatically fired (Score:1)
Re: (Score:2)
Wait--so you're saying that being beaten with clue sticks too much could even be hazardous to your health when done in excess? I swear, is *anything* fucking safe these days?!?
Re:Automatically fired (Score:4, Informative)
Treason is vacuous in this context (and all others right now).
Article III, Section 3 [cornell.edu]:
Treason against the United States, shall consist only in levying war against them, or in adhering to their enemies, giving them aid and comfort. No person shall be convicted of treason unless on the testimony of two witnesses to the same overt act, or on confession in open court.
The Congress shall have power to declare the punishment of treason, but no attainder of treason shall work corruption of blood, or forfeiture except during the life of the person attainted.
No one in this matter is a United States citizen who has declared war against the United States. The last time that happened was the Civil War.
The United States does not have any enemies. There is no list of enemies. The last time the United States had an enemies list was World War II.
This also explains why Snowden could not be charged with treason.
Re: (Score:2)
You're absolutely right. It's not treason. It's an act of war.
But you know the old saying, In Soviet USA, you ransom government.
Re: (Score:2)
Nah.
It's other stuff like money laundering, extortion, illegally accessing a computer and "other," but not an act of war.
This is an act of war [uslegal.com]:
Act of War Law and Legal Definition
An act of war is an action by one country against another with an intention to provoke a war or an action that occurs during a declared war or armed conflict between military forces of any origin. The loss or damage caused due to such conflicts are excluded from insurance coverage except for life assurances.
I'm certain you'll be interested to know that the state of California has just taken steps to make ransomeware illegal [slashdot.org].
Re: (Score:2)
The United States does not have any enemies. There is no list of enemies. The last time the United States had an enemies list was World War II.
This also explains why Snowden could not be charged with treason.
Of course they do, now the list just reads muslims in scrawny handwriting and a squiggle that looks like it might say gays. Also did you forget about Russians, Korea, Vietnam, Desert Storm 1 & 2 and all the other jaunts the US military have been on since ww2?
Re: (Score:2)
Yeah, but those weren't actually declared wars. They were 'police actions' or 'armed conflicts' or some other trite bullshit.
Calling something what it actually is brings forth a whole new section of laws and regulations that nobody involved wants to deal with. So they skip it.
Re: (Score:2)
This.
Again, the last declaration of war was World War II - related. (There have been 11 total declarations of war in US history.)
There are also diplomatic reasons for a dislike of "declaring war [lawguru.com]" on a country, as it can often be perceived as holding an entire nation responsible for the actions of a few of its citizens. In the case of the most recent public opposition, those who support such actions have noted that, in the case of the wars in Afghanistan and Iraq, there was no 'target' for a legal declaration of war, rather political groups or individuals. On the other hand many argue that since an invading army seeks to occupy and cause havoc to a target country and its population and not just a political group or individual, the aforementioned justification is tenuous at best.
Re: (Score:2)
Re: (Score:2)
I would argue ...
Not in court.
Re: (Score:2)
I see what you did there, but this [state.gov] is probably a bit closer to the real list.
Re: (Score:2, Informative)
No. Only everyone working in IT should be fired.
How about whomever overrode the IT department with regards to security?
"Nah, that makes it too hard to do our jobs. Just use one shared admin account that is always logged in on all machines, so we can just do whatever we need to..."
Re:Automatically fired (Score:5, Insightful)
Re: (Score:2)
Yeah, so this is why you put in place policies to restrict the amount of damage that can be done by ignorance, or a bad actor.
Step 1: Nobody should be logging in interactively as an administrative user. UNIX / Linux / OS X has sudo, Windows has 'run as administrator...'
Step 2: Everything should be running a firewall that has everything closed by default, and only things that need to receive traffic whitelisted. This firewall and it's rules should be actively monitored and maintained by some kind of auto
Re:Automatically fired (Score:4, Informative)
most of these same commenters also want to "shrink government", "cut taxes", etc. NONE of which is going to: improve training and testing; expand, fund and enforce standards across municipalities; enhance LEO capabilities to track and prosecute attackers. But - Hey! - we get to sound awful tough!!
Actually, it is not difficult to accomplish both. For example, you could shrink government substantially by implementing a national retail sales tax (lots of conservative lawmakers have proposals, so there plenty of choices) and replacing the entire IRS with something like a 10-20 person office responsible for processing sales tax receipts (this would actually be super easy since sales tax is already collected in something like 99.9% of the US). You could also eliminate entire executive departments that don't actually do anything productive (like education; seriously, the more money the federal government spends on education, the worse it gets, so we should try something different). Those two changes alone would free up considerable funding to apply to the items you list and would result in a net smaller federal government that is also leaner (as defined by doing more of what government should do, like LEO, and less of what it shouldn't, like anything not specifically listed in the constitution). And that is without even touching the sacred cows of social security and medicare.
Re: (Score:2)
Ok, looking at the other poster's Wiki link, what I got on that report:
1/3 of tax revenues are wasted by govt ops
1/3 aren't collected because people don't pay what they owe
1/3 are used to pay interest on the national debt
It predicted that our debt will be 13Trillion by 2000 but that didn't occur till the Housing bubble burst in 2008. For a 15 year forecast, 8 years off ... is kind of bad. Nor does the report take into consideration or provide recommendations to the impact of Congress varying tax rates or
Re: (Score:3)
The problem with a sales tax is that it's inherently regressive. If you live paycheck-to-paycheck, something like 50% of your money gets taxed. (Assuming the other 50% is rent, debt payments, utilities, etc.) If you make upper middle-class or higher income, and you can bank or invest half of that, with the same ratio for the rest of it, you're getting taxed on 25% of your money.
The more you make, the less you're proportionally taxed. So someone making $20k/year may be taxed on $10k of it, while someone maki
Re: (Score:2)
Under the fair tax, the government would send everyone a check at the beginning of the year in the amount that a person with $X of income would pay in consumption taxes over the course of the year. If the tax was 8%, and the income threshold was $20k, every household would get a $1,600 check. Thus, a household at that exact income level
Re:Automatically fired (Score:4, Insightful)
Wrong, town would be without protection is all that would happen with your stupid juvenile solution. Most those people can't be expected to be IT experts, and in fact this situation proves that services can exist without a computer in sight.
Wrong to say backups are a solution, you could the malware nicely backed up too.
Re: (Score:2)
Wrong to say backups are a solution, you could the malware nicely backed up too.
Not if you do it in a way that is safe from ransomware.
1) Make your backup system safe from ransomware by limiting the software run on it and have only skilled IT people operate it.
2) Give the backup system the privilege to pull the backup data from the machines being backed up and to push the restore data.
3) Don't give the machines being backed up the privilege to push data to the backup system to ransomware can't corrupt the backups.
4) Restore every night so you know the restore will work. Have the backup
Re: (Score:2)
Not if you do it in a way that is safe from ransomware.
If your going to do ransomware, you set it up so it infects the network well before it encrypts the file systems. The ransomware will then be on all of your backups so even if you rebuild from bare metal, as soon as you restore from backups your reinfected.
Re: (Score:2)
The clean image should help with that.
Re: (Score:2)
you are funny, you fail at the step one. That would be the step applied to normal production system but those STILL can get malware
Re: (Score:2)
That's why you need a rolling offline backup. You might lose the day before yesterday's backup, but you'll still have yesterday's.
Re: (Score:2)
And someday find the malware infected you on day n+y where n is the number of days you have backed up
Re: (Score:2)
You can play that game forever, ending with what happens if the quantum vacuum collapses to a lower state, what will you do then, Huh!, HUH!
Of course, would you rather restore to a state where you had your data but there's a virus about to wipe it again, then try to kill the virus or would you rather just lose it all with no chance?
Risk will NEVER be zero. The objective is to take a few steps that can reduce the risk by orders of magnitude. With N=2 backups, you greatly reduce your risks. Add in less archiv
Re: (Score:2)
Everyone there should be replaced automatically when this happens.
In theory, yes. But they probably don't have backups for them. ;)
Imagine all the cowards (Score:1)
A government made up entirely of ACs. What a glorious immolation...
"This smouldering cinder patch was the result of the Great Social Experiment."
Bless your little souls
So in Licking.... (Score:3)
...things are not still Ticking!
Re: (Score:3)
Actually technically speaking they are, this is really a high risk game, across international boundaries, it is extremely problematic. They will find a while bunch of agencies from around the world go after them and the penalties could be quite dramatic. Really, really, not a good idea, there will be a severe price to pay.
Actually, the article states that... (Score:4, Interesting)
Ransomware Insurance (Score:1)
The capitalist response is to sell ransomware insurance, because techy solutions are all eggheaded and faggy.
Good idea for progressing on secessionist movement (Score:2)
If all it takes is a bit of ransomware to shut down government then the secessionist movement of New Hampshire has been doing it all wrong. For those who don't know about the migration of principled libertarians (ie no violence, theft, fraud, or coercion then there is no crime, and government shouldn't be using these things against peaceful people either) to New Hampshire and want more freedom and liberty in our life time then you need to check into this movement. Those who have moved to New Hampshire have
Don't blame all employees (Score:3)
If it's hitting central servers and shutting everything down, it's probably a weak RDP password with port 3389 wide open. That's what the last ransomware I saw involved.
Re: (Score:2)
If it's hitting central servers and shutting everything down, it's probably a weak RDP password with port 3389 wide open.
And it's probably Windows. Backup strategy is just a contributing problem here. The central problem is using Microsoft products in inappropriate ways, like running servers.
Re: (Score:2)
Have one Windows server to run AD and provide SMB shares, and move everything critical to Linux. Then get rid of the Windows laptops to improve the perimeter defence.
Re: (Score:2)
You know the red stapler guy in Office Space? That would be the resident Windows sysadmins.
Re: (Score:2)
Yes RDP open on 3389 is stupid, but believe it or not we have clients with legacy software that requires it. Only solution is to reduce attack surface. Frequently check accounts, change passwords etc. Oh, and the last successful RDP breaches I saw
Re: (Score:2)
Your sample size sucks.
My research included the wider Internet - it's a lot more common than you think. If it's hitting an entire server, and not just network shares, and the computer isn't used for web browsing - you're not going to get it from a drive-by download.
believe it or not we have clients with legacy software that requires it. Only solution is to reduce attack surface.
Yeah, like with a VPN. Is there really any software that requires a remote RDP server but couldn't handle it through a VPN connection?
Re: (Score:3)
When do the staff who failed to create an adequate backup strategy, or the brass who shut down the staff who wanted to do that, be similarly fired for gross incompetence?
this hits home. I had a remote site with critical data that had no backups. for 3 years I kept telling the CFO we need this budgeted to add backups. Always put off "till next quarter". Not even a small budget for a CD-R and manual backups. nada.
Then it happened. Failed system, data lost. No way to recover. Somehow, all my fault. I was fire
Re: (Score:2)
Somehow, all my fault. I was fired for it. Presenting my emails and disaster recovery plan requests fell on deaf ears. I was IT, it was my responsibility to prevent.
Oh man - you were set up from the beginning. The bright side is that company isn't going to be around too long.
Re: (Score:1)
Yeah, but the bad news is that the CEO is now president of the United States.
Re: (Score:2)
Yeah, but the bad news is that the CEO is now president of the United States.
But he had a good friend putin a good word for him.
Oh, for fork's sake (Score:1)
We need to start having MASSIVE fines and petty jail time for this. training, phising warnings, attachment warnings- these things happen daily. Someone that still does this needs to be made to suffer. Then, maybe, people will take the warnings seriously.
Is there a malicious negligence or depraved negligence charge we can level at them?
Re:Oh, for fork's sake (Score:4, Insightful)
We need to start having MASSIVE fines and petty jail time for this. training, phising warnings, attachment warnings- these things happen daily. Someone that still does this needs to be made to suffer. Then, maybe, people will take the warnings seriously. Is there a malicious negligence or depraved negligence charge we can level at them?
Because getting caught in a phishing scheme is not necessarily depraved indifference. Having to turn off an adblocker so you can get into Forbes.com is plenty enough to get you owned.
I've seen plenty of competent people get owned. Would you make a vow to commit suicide if you ever in your life got malware on your computer? I sure wouldn't.
That presumably all-seeing NSA (Score:5, Interesting)
Can a new administration with no concern for political correctness finally turn the NSA loose on finding ransomware perpetrators? Since we in here have decided that their Internet surveillance efforts are omnipotent, they should be able to trace a surveilled Bitcoin payment back to them. Then we hire local talent for "wet work" in killing them off in some eye-catching manner, dissuading others from entering the business.
Re: (Score:2)
Re: (Score:3)
Say the NSA finds a server in Australia, Canada, NZ or the UK? Lots of support over decades so information is passed and kept very secure.
A request is created by another US law enforcement agency to hide the NSA origins of the data found.
Another nation creates a 12 person police team to look at the people using the server. Say 3 person police team on duty, a few s
Re: (Score:2)
But....but...but doesn't the NSA have infinite powers to surveil the Internet without us even being aware of it?
In any case, we keep being told that those no-go neighborhoods don't exist. The refugee communities in Paris, Malmö and Calais will gladly throw open their doors to any authority needing to look into what they might be doing on the Internet, won't they?
Re: (Score:2)
The problem for the USA is the methods have to be hidden and requests to local police just alert criminal groups.
The local police in other nations are corrupt or even members of the same criminal groups, faiths been watched.
Local police also sell information to the press who then alert criminals.
Mil, national or federal police in many other nations just cant do undercover work in closed communities or are
Re: (Score:2)
Re: (Score:2)
"Now I can't be sure, but my buddy heard some ransomware dude that hit some town in New Jersey got renditioned to Gitmo as a terrorist by that fascist prick Trump. The week after, his mother's house blew up in a freak gas explosion while she was out grocery shopping and his sister got kidnapped and gang-raped by Muslim Refugees."
Now we'll just leak that narrative to "Slate" and next week we'll make sure that is trending on Facebook and Twitter.
Re: (Score:2)
Fast forward a week later and the new prosecutor want to know where the files are, so I told him and he was "not happy at all." I exp
Backup/Backup/Backup/Backup/Backup (Score:4, Insightful)
Re: (Score:2)
I've moved to adding additional backups of servers at greater risk of ransomware encryption, every 2-4 hours depending on what the site's environment can handle in terms of capacity and added disk load, usually retaining these backups for 2-3 days.
This way if ransomware hits, I've got both an additional backup to the daily backup and a very recent backup in case key files were affected.
Re: (Score:2)
Re: (Score:1)
Did you follow up with education for the users? Should be done once a year. Set up an external site. I'm often very obvious with the site name. Password checker, health insurance discount site. Social the women too. Women are often really easy to social if you get the right bait.
sadly (Score:2)
nothing will be learned from this, and things continue as they were, only matter of time before it happens again. sick & tired of seeing this kind of story almost every day.
how many ransomware incidents would have happened if these orgs/govs/companies had their things in order?
Re: (Score:1)
Admin is handed out way too easy. Are you sure nobody else has admin rights? I manage a few thousand WIn boxes. Every one had to be audited recently and I found users had admin access that never even knew about the machine nor logged in. Application accounts too. Then if you also use group policies sometimes audit check policies have security changes, that gives someone admin rights. I've said a few times - here's a Windows box, guess how it's configured. I could say guess who has admin access.
I hope you're