Georgia Department of Public Safety Hit By Ransomware Attack. (news4jax.com) 88
"A ransomware attack late last week left the Georgia Department of Public Safety and Georgia State Patrol computers offline," reports a local news station.
Lt. Stephanie Stallings, GSP spokesperson, said a message popped up on an employee's computer, prompting preventative measures to shut all server networks down. The servers have been offline since [July 26th]. The Georgia State Patrol's tech division, the Georgia Tech Authority, which handles network and serves, is now checking every device in all 52 state patrol post locations across the state to see if more devices are affected.... The state said Georgia Tech Authority is downloading new protective software on all devices, which are purposely offline until further notice.
Stallings said it's still business as usual. Staff and officers are doing their jobs in the traditional way using paper that they used in the days before having laptops in patrol cars...
News4Jax found there were 184 million ransomware attacks worldwide in 2018
ZDNet reports the attack has crippled laptops installed in police cars across the state. And long-time Slashdot reader McFortner shares their own story: When I went in to get a copy of an accident report this Friday, the officer at the Henry County, GA, police department told me that at least 7 counties in the Atlanta area were hit at the same time and they had no way of knowing when their computers would be back up. They suggest to anybody needing a report to call them first to see if by any chance the system is back up and the report is finished and can be picked up.
Stallings said it's still business as usual. Staff and officers are doing their jobs in the traditional way using paper that they used in the days before having laptops in patrol cars...
News4Jax found there were 184 million ransomware attacks worldwide in 2018
ZDNet reports the attack has crippled laptops installed in police cars across the state. And long-time Slashdot reader McFortner shares their own story: When I went in to get a copy of an accident report this Friday, the officer at the Henry County, GA, police department told me that at least 7 counties in the Atlanta area were hit at the same time and they had no way of knowing when their computers would be back up. They suggest to anybody needing a report to call them first to see if by any chance the system is back up and the report is finished and can be picked up.
Wipe and reinstall (Score:2)
Certainly they must have backups, right?
Re: (Score:2)
Certainly they must have backups, right?
Yes, do not fear for the ransomware . . . the ransomware has been successfully backed up.
I remember an IRS scandal a few years back, where all the employees claimed to have suffered disk crashes which lost their email.
The IRS then claimed that the backups had already been recycled.
It wouldn't surprise me if that story gets recycled here.
Re: (Score:1)
Do you make regular backups of the laptops in your environment? Those in the field? Even if you did how long do you think it takes to reimage all the laptops in police cars?
It's very easy to say such things in hindsight from your lofty anonymous internet account. In the real world these things are much harder. Admins with little budget have to secure an almost infinite number of holes, the attackers need only find one.
Re: (Score:2)
You never store work documents and important data locally. Only to cloud storage or network storage. The physical box can burn and you'll just grab a new one and get back to work. If you're storing locally you are an idiot. Full stop.
Re: (Score:1)
..and when the ransomware clobbers the 'cloud' shares?
Re: (Score:2)
Re: (Score:2)
... except during backup windows, and even then, only to an authorized process that knows the appropriate password for that share .
From TFA:
"It's a criminal attack somebody gained access and the proper access to one of their computers that had privileged network presence and they were able to put a piece of malicious software on it," Christopher Hamer, a security consultant, told News4Jax.
Re: (Score:3)
Another way in Unix is to set a directory to write-only (deny read permission). Users can write files to the directory, but they can't read from it so can't get a listing of files in the folder. They can still change/delete the file if they can guess its n
Re: Wipe and reinstall (Score:2)
Cloud shares and raid ARE NOT backups! They are rundancies. I seriously hope no one on this chain is a system administrator.
I am not and even I know anything that is live and online is not backup as that too can be encrypted or deleted by accident.
Re: (Score:2)
Wipe the Evidence (Score:2, Interesting)
They have a responsibility to maintain custody of the chain of evidence. If they wipe the computer with the evidence of your DUI, it's pretty straightforward to argue that all of their evidence is recreated and then the conviction gets very challenging. This is the responsible approach. They'll probably lose a bunch of computers, but that's a lot better than all.
Re: (Score:2)
What's a backup? [grin] :P
Re: (Score:2)
TFA implies but does not state that they do. Of course, they first have to wipe and re-install every computer they own so the malware doesn't just encrypt everything again. Then it will take some time to get all the data back in place from the backups.
Then, of course they will have a lot of new data to transcribe from paper and catching up on information requests that have gone unfulfilled during the outage.
Re: Papers are better anyway (Score:2)
I developed systems for public safety for nearly a decade in the early 2Ks. Our systems enforced daily backups to removable media and verified those backups. Iâ(TM)m sure some recycled backup media, but most kept a months worth of backups if not more.
Our systems employed an audit trail that is akin to blockchain - forgery would have been very difficult back then. Stronger, more modern crypto is no utilized.
Every field level change was logged in the audit records. And, if they were part of the cert
Personality over brains (Score:1)
I can't speak to this specific situation, but I can speak to the problem in general; organizations are putting social skills and political skills ahead of technical skills. It's part of the everyone deserves a trophy world that was created for the kids.
We have people in charge, that have no idea what they are doing, and really smart people that are excluded when they should be followed.
This will keep happening, until the world cleans up it's act and prioritizes skill again.
Re: (Score:3)
I'd argue that technical, social and political skills are possessed by all people, and that those whose dominant skills are political or social have simply out-competed people whose dominant skills are technical.
They've largely co-opted technical skills from "technology" people. The secretary of 1990 can barely operate the copier, the "coordinator" of today can use the copier and her computer to produce a booklet in less than a day that would have taken a half-dozen people to produce 30 years ago.
The prob
Re: (Score:1)
and that those whose dominant skills are political or social have simply out-competed people whose dominant skills are technical.
Yes - its always easier to win if you don't have to play by the established rules - you simply invent your own rules and later claim 'your superior "social" skills made you winner', while useful subordinate idiots did all the actual work.
What are those 'social' skills you talk about anyway? Everyone knows that Trump has best 'social' skills, period. Various swindlers and conmen have excellent 'social' skills as well. Perhaps better name would be antisocial skills, describes it better.
Re: Personality over brains (Score:2)
Welcome to real world 101. Desktop support where all entry level IT jobs start is 75% social and customer service and 25% technical. If you can't ever master ass kissing you never get promoted up to system administrator.
Who wins the interview? The social guy who can whoaa HR and management with awesome resumes and likeability. Not the most competent for the job.
Here's an idea... (Score:1)
Re: (Score:2)
Re: (Score:1)
It certainly is when you have to start from scratch to implement it. When I first started 18 months ago there were over 90 PC's with RDP open to the world on different ports, some still running WinXP. There isn't even a line-item 'IT Budget' for the municipality I manage. All IT expenses come out of each department's budget, all already underfunded to perform their basic functions as it is. For example I have to designate a user and have it approved by their management chain for every single PC I order
Re: (Score:2)
No it won't, executives at that level just cycle around the system.
Every ransomware attack is also a data breach (Score:1)
Rather peculiar corporations and governments hit with ransomware attacks are viewed as "victims" losing access to their shit when in fact there is no reason not to assume data was stolen via very same channel ransomware is controlled.
Anyone hit by ransomware affecting data related to third parties needs to be sued and fined for the consequences in addition to losing all of their data. If you can't be bothered to keep backups of your shit imagine where else these jokers are fucking up.
Possibly stupid question here (Score:2)
Given that this ransomware thing has been going on for years now, why aren't more IT departments using copy on write filesystems?
Re: (Score:1)
Given that this ransomware thing has been going on for years now, why aren't more IT departments using copy on write filesystems?
Local governments lack the resources. And with the last round of tax cuts, subsidies to states have been cut. And this being a solid Republican controlled state, we won't see local income taxes raised.
Although, my local taxes have doubled since last year. What little I saved from the TCJA was more than eaten up by my local tax increase.
My standard of living keeps going down and down - for the last 20 years. And when I look at my representation from local to state to federal all the way up to POTUS, all I
Re: (Score:2)
Windows 7 end of support will make things worse (Score:2, Insightful)
Re: (Score:2)
I think you're probably onto something here, especially on the server side where there's a lot of legacy applications still running on Server 2008R2 that are more expensive than just a bunch of new Win10 desktops to migrate.
Is there some crazy idea that Trump, in some kind of anti-big-tech rage, decides to force Microsoft to continue supporting the Win7/2008R2 platform for a few more years?
We switched to Linux (Score:1)
Once again, the media reports fail to report that the ransomware affected Windows computers. Platform is the first piece of information collected in a security incident.
Meanwhile, our organization switched to Linux based Chromebooks. If we have need of a legacy app, we fire up a ESXI hosted VM of Windows. It has been our policy to use only platform agnostic software for over a decade. I can not think of one program that I personally use that requires Windows.
We also backup between two sites, saving the
Re: Windows 7 end of support will make things wors (Score:2)
Who wants to make a bet these systems still ran WindowsXP?
what if these ramsomware attacks (Score:3)
Windoze (Score:3)
Re: (Score:1)
The bar is higher to get a back door into Linux, Open BSD, etc. There are multiple folks who have to sign off on changes who feel very strongly about the integrity their projects.
For microsoft products, the NSA just has to get the MS executives on board, and as "_NSAKEY" seems to suggest, that bar wasn't much of a hurdle.
https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: (Score:2)
Ransomware doesn't need a backdoor. Ransomware works completely at the social engineering level.
And all it takes is a user to run the ransomware, and it'll encrypt every file the user has access to, including file server shares. Be a little crafty and you can spread that way too.
Malware doesn't need root, system or other access the