Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Government Crime Security

Should Local Governments Pay Ransomware Attackers? (phys.org) 129

Posted by EditorDavid from the damned-if-you-do dept.
At least 170 local or state government systems in America have been hit with ransomware, and the French Interior Ministry received reports of 560 incidents just in 2018, according to Phys.org. (Though the French ministry also notes that most incidents aren't reported.)

But when a government system is hit by ransomware, do they have a responsibility to pay the ransomware to restore their data -- or to not pay it? "You have to do what's right for your organization," said Gregory Falco, a researcher at Stanford University specializing in municipal network security. "It's not the FBI's call. You might have criminal justice information, you could have decades of evidence. You have to weigh this for yourself." Josh Zelonis at Forrester Research offered a similar view, saying in a blog post that victims need to consider paying the ransom as a valid option, alongside other recovery efforts.

But Randy Marchany, chief information security officer for Virginia Tech University, said the best answer is to take a hardline "don't pay" attitude. "I don't agree with any organization or city paying the ransom," Marchany said. "The victims will have to rebuild their infrastructure from scratch anyway. If you pay the ransom, the hackers give you the decryption key but you have no assurance the ransomware has been removed from all of your systems. So, you have to rebuild them anyway."

Victims often fail to take preventive measures such as software updates and data backups that would limit the impact of ransomware. But victims may not always be aware of potential remedies that don't involve paying up, said Brett Callow of Emsisoft, one of several security firms that offer free decryption tools. "If the encryption in ransomware is implemented properly, there is a zero chance of recovery unless you pay the ransom," Callow said. "Often it isn't implemented properly, and we find weaknesses in the encryption and undo it."

Callow also points to coordinated efforts of security firms including the No More Ransom Project, which partners with Europol, and ID Ransomware, which can identify some malware and sometimes unlock data.
This discussion has been archived. No new comments can be posted.

Should Local Governments Pay Ransomware Attackers? More

Should Local Governments Pay Ransomware Attackers?

Comments Filter:

  • Stupid question. Of course they shouldn't pay (Score:5, Informative)

    by fustakrakich ( 1673220 ) on Sunday July 14, 2019 @01:45PM (#58925064) Journal

    They are supposed to make proper backups instead.

    Payments to criminals shouldn't even be considered.

    • Go back to wanted bounties on at large criminal gangs.
      As much as a deplore vigilantism as it undermines civil society, people who ruin public goods don't deserve the protections of civil society.

    • Re: (Score:1)

      by Anonymous Coward

      This! Strategies for this kind of situation should be in place before they happen.

    • They are supposed to make proper backups instead.

      Yes but if you are too stupid to backup essential data then you are probably stupid enough to pay the ransom which is what the criminals are counting on.

    • Re: (Score:1)

      by Anonymous Coward

      They are supposed to make proper backups instead.

      Most organizations don't have an unlimited amount of backup storage and in any case they're only willing to go back so far in most cases. It should also be understand that at least some of the recent ransomware gangs have been sophisticated enough to lurk in the network for some time before triggering the ransomware. The purpose of this is to plant backdoors, trojans and other malware in such a way that they will be included in backups and allow rapid re-infection on restores. If you restore a backup infect

    • Of course paying ransom should be considered. In the end, one might not do it, but if you don't at least *consider* it, you're being completely and utterly irresponsible when it comes to due diligence.

      • Nah, you gotta prove that someone's life is in danger before even considering paying. These people just do whatever is cheapest. That will only help the criminal's business. You can't give them one penny, or a second's thought. You were supposed to have backups. Carelessness should be considered complicit.

  • Absolutely not!!! (Score:4, Interesting)

    by sentiblue ( 3535839 ) on Sunday July 14, 2019 @01:46PM (#58925068)
    Law enforcements having to bow down to the criminals should not be allowed in any manners.

    States should have laws mandating local governments to have shielded copies of backups that are not exposed to hacks such as an offsite hosted backup site, tapes, etc... I worked the field for nearly 20 years, I can't imagine why local governments cannot afford to design and maintain such a solution. Not only I'll implement it, but I will mandate regular testing of the recovery and gauge the amount of time it takes to perform a total bare metal restore.

    • Re: (Score:1)

      by Anonymous Coward

      " I can't imagine why local governments cannot afford to design and maintain such a solution"

      Local gov't budgets are tiny. Before ransomware outbreaks it was impossible to get funds for a solution that was hoped to never even be needed or used. Even with the publicity these cases are getting its still difficult. Local govts are funded by local taxes. People expect local govt to pick up the trash, deliver clean water, make sure toilets flush, maintain drainage, keep streets clear, etc. The majority of lo

      • A 128 gig Kingston USB 3.1 key is $30 at Staples. If I were ever to get hit, I have multiple keys with backups on them - plus my laptop is only connected for updates.

        You'd be surprised how little you need your computer on the net if you use your phone as your main net device and don't do social media shit.

  • The cost of recovery >> the ransom => you're paying.

    And then, if you're lucky and the decryption key you get allows you to recover your data, then you make sure you have regular backups in at least two locations (one of them must be off-site whilst you only have access to upload preferably encrypted backups, not erase or rotate them - that must be done remotely with a completely different set of credentials).

    • Re:Simple! (Score:4, Interesting)

      by vux984 ( 928602 ) on Sunday July 14, 2019 @03:27PM (#58925500)

      I said this in another thread just recently too.

      "The cost of recovery >> the ransom => you're paying. "

      Pretty much.

      "And then, if you're lucky and the decryption key you get allows you to recover your data, then you make sure you have regular backups in at least two locations (one of them must be off-site whilst you only have access to upload preferably encrypted backups, not erase or rotate them - that must be done remotely with a completely different set of credentials)."

      Exactly this. Backups are absolutely critical.

      However, and this applies, EVEN if you have triply redundant air-gapped offsite backups:

      Having backups doesn't make the "cost of recovery" zero, and paying the ransom may still lead to less downtime and speedier recovery than using just the backups.

      I've seen a couple companies decide to pay the ransom DESPITE having perfectly good backups simply because restoring everything from backups would TAKE LONGER. Factor in insurance policies, and they are just paying a deductible not the full ransom.

  • It's the tragedy of the commons. (Score:1)

    by Anonymous Coward

    An individual city may be better off paying the ransom, but it poisons the community well and makes everyone worse off in the end.

  • You can't trust anything important anymore. (Score:5, Interesting)

    by Kernel Kurtz ( 182424 ) on Sunday July 14, 2019 @02:31PM (#58925274)

    It's not the FBI's call. You might have criminal justice information, you could have decades of evidence. You have to weigh this for yourself.

    Once hackers have shown an ability to mess with your "evidence" at will, any half competent lawyer should be able to challenge it's provenance in court.

    "We got hacked and the evidence all got encrypted, but no worries, we paid the ransom and got them back. See, we even have chain of custody and checksums. They got encrypted too but it's all back good as new."

    • There is CJIS compliance as well. The FBI does not suffer fools gladly when people don't abide by their rules.

  • No, but not quite yet. (Score:2, Informative)

    by thedarb ( 181754 )

    No, ideally you don't want your government entities paying ransomware attackers. But you can't just make that decision in a vacuum, it takes preparedness. There are things you can do to help make your systems resistant to these attacks.

    1) Backups. Do them. Test them. And know your recovery times if you need to restore from them.
    2) Automate your re-installation procedures for servers, desktops, and cloud.
    3) Get a NAS with with read-only snapshot support, and snapshot often. This could be your fastest r

  • It is sad that this question was even asked. This is not acceptable. The LAST line of defense should be restoring from a recent, good backup. Other strategies should be in place to prevent needing to implement this. Most of us pay large fractions of their income (both personal and corporate) to fund the many layers of government. It is the government's responsibility and obligation to do things correctly and with care. Anything else is UNACCEPTABLE and there should be severe penalties (even criminal) f

  • I tend to lean towards the " Buy once, cry once " philosophy.

    Doing it the right way the first time might cost you a bit more up front, but it saves you a whole lot of headache and cost later on down the road.

    So, don't design your networks around the cheapest solution you can find ( hardware, personnel or practices ) because it can ( and usually does ) come back to haunt you later on.

  • Should the government invest in hardwood to make the gibbets to hang the ransomeware culprits on, or use cheaper softwood? If an effective example would be made with one or two uses, the cheaper pine gibbit should suffice.

  • Sysadmins should take backups. If backups are done correct, ransomware is not a problem and sysadmin can just laugh at the ransom demands.

  • "You have to do what's right for your organization," said Gregory Falco, a researcher at Stanford University specializing in municipal network security. "It's not the FBI's call.

    That's the same argument made by people/companies who want to pollute willy-nilly. That the government doesn't have the right to interfere how a private individual or corporation behaves.

    The resolution is the same as pollution as well. In both cases, the benefits are concentrated in the individual/corporation, while the costs

  • By that, I mean one should assume an attack IS COMING, your countermeasures WILL FAIL, and the attack WILL BE SUCCESSFUL once it happens. That means having a business continuity management system in place that includes off-site/off-line backups, a disaster recovery plan to rebuild the infrastructure, and a business continuity plan which explains how you're going to operate while the DRP is being executed. Also, and this is critical, these things have to be fully exercised. You don't want to find out your ba

    • Re: (Score:3)

      by vux984 ( 928602 )

      Even if you have a continuity plan, and triply redundant offline air-gapped backups, documented and practiced, restore procedures, ... even if you have everything you think you should have:

      It may still be cheaper to pay the ransom than to execute that recovery plan. It may be faster and it may reduce down time. It may get your most recent not-yet-backedup data back...

      If the building burned to the ground, you'd just accept the loss, and execute on the total-loss DRP It was specified in the risk assessments a

      • Comment removed based on user account deletion

        • Re: (Score:2)

          by vux984 ( 928602 )

          "If A pays, you have created a market and they will go after B, C and D."

          Ah but B, C, and D are my competitors. :p

          In all seriousness I agree with you, but there's always going to be people who pay. Everything from bicycle theft to knock off goods to kidnapping would go away if people would just stop paying for it... pissing into the wind.

  • Sabotage future efforts by blackmailers by paying their ransom, but then proclaim that the blackmailers didn't give you the key and you'll have to recreate the data at great expense anyway. Fewer and fewer agencies will pay blackmailers off in the future if they think they'll get screwed.
    • A government entity may have done just that recently. I seem to recall a story from the last couple months of a government entity that paid the ransom. Afterwards they claimed that the keys unlocked the computers and they were back up and running, but that their data was lost.

  • That's game theory at work.

    Let's first assume that the cost of recovery is much higher than the ransom. If it isn't, the answer is obvious so let's get it out of the way.
    If the loss of data doesn't affect you personally, for your best interest, the ones affected shouldn't pay the ransom. As a general rule, it is better if crime does not pay.
    But if you are the victim, then you should pay, because the cost is lower, even when we take the possibility of criminals altering the deal into account.
    Sometimes, there

  • Not so easy for organizations to fund IT depth, limited career growth, but given criticality seems they should be pooling efforts. Insurance as well. Next up cloud risk mitigation.
  • Let's see...there are two options here. Train every 55 year old secretary what a fake email attachment is OR they can make it illegal throughout the entire US to pay ransoms. Which one do you think would work better, guys?

  • Paying ransoms just encourages future extortion.

    "Millions for defense but not one cent for tribute"

    Another thing, damage from ransomware is completely preventable with proper backups.

    Also, paying ransom to get your data back is a self serving move that harms others by exposing them to the risk of future attacks since now they'll be emboldened to keep launching attacks.

    Finally, what's to stop the hacker from coding their malware to only unencrypt the data temporarily, but plant more logic bombs to have it re

  • Local governments should be running on Chromebooks. Most businesses should be running on Chromebooks or iPads, really.

    Windows and Mac are overkill for most people. Unless you're an IT outfit, you should only run stuff that's been locked down. If you don't have an IT department to lock your stuff down, let Google and Apple do it and ignore the people who dis you for doing so but don't offer a real solution.

  • do they have any plans in place for when criminals take government personel hostage for money?
    almost the same thing, and going by movies the rules probably is to not make deals with them.
    but for a ransomware attack they would very much like to pay them off.
    shows the value of human live(s).

  • Is Microsoft software different from Ransomware?

Slashdot Top Deals

Don't tell me how hard you work. Tell me how much you get done. -- James J. Ling

Close