University pays $20,000 to ransomware hackers

http://www.bbc.co.uk/news/technology-36478650

by andygambles • 10 years ago

51 79 10 years ago

bbc.co.uk

desdiv• 10 years ago

Why openly announce that you're paying the ransom?

Here's some major disadvantages that I can think of:

1. Announces to world that you have poor security/backup practices which encourages more attacks against you

2. Announces to world that making and distributing ransomware is good business which encourages more attacks against everyone

I understand that public institutions needs financial transparency in order to be accountable to the public. But the nature of this isn't any different from, for example, a basement flooded due to poor design and required $20,000 to fix. Someone screwed up, and it cost the university $20,000. Let's just pay the money, fix the problem, and take steps to make sure it doesn't happen again. No need to call up the local paper about it and make it a story.

wisechengyi• 10 years ago

Raise public awareness?

mtgx• 10 years ago

That can do some good in the long term. It will eventually get operating system vendors to enforce much stricter security measures by default that perhaps they wouldn't have considered otherwise or anytime soon, because they would "break legacy code" or whatever.

It's also good that this is coming at a time before the rise of self-driving cars. Because the vast majority of car makers seem to know nothing about security, yet are eagerly jumping head first into always-connected, self-updating and digital-first self-driving cars. I'm guessing people are going to raise hell when ransomware arrives for their cars. And I think the car makers will be "shocked" (shocked, I tell you), that this will be happening, and will say something dumb like "Nobody could have ever predicted this! - it's why we never implemented good security in the first place."

However, because the OS/hardware vendors are only going to be dragged kicking and screaming into implementing stricter security measures, it's going to be a while before stricter security arrives.

In the meantime, beyond alerting criminals that ransomware is big business, it will probably also be used as an excuse to pass more CISA-like surveillance laws (which will do absolutely nothing to stop the rise of ransomware).

It could also be used as yet another excuse to end strong crypto (because obviously ransomware uses crypo). But of course, it's not like the Russian or Chinese criminals doing this are going to care that the US has a ban on strong crypto. So yet again a solution that does nothing to stop the rise of ransomware, but would still make it much worse for all of us, and it could even be a step back in the fight against ransomware.

cantrevealname3• 10 years ago

Why openly announce that you're paying the ransom?

An effective thing they could have done is to announce that they paid the ransom, but that the decryption did not work (even though it did).

That has the advantage of discouraging other people from paying up, and therefore reduces the incentive to create more ransomware attacks.

Hell, the government could step in and recruit people and companies to falsely claim that they were ransomware victims who paid up, but never got decryption keys and were screwed over. That could put a damper on ransomware psychology.

Thinking about it further however, this will probably lead to better "customer service" by the ransomware makers. They'll adapt their software to selectively decrypt part of your data for free, so they can offer you proof that that they can and will give your working keys once you pay up.

deciplex• 10 years ago

Hell, the government could step in and recruit people and companies to falsely claim that they were ransomware victims who paid up, but never got decryption keys and were screwed over. That could put a damper on ransomware psychology.

This actually did happen to me. Paid the money, got the key, couldn't unlock my files. Damn shame.

skoczymroczny• 10 years ago

Or review sites of ransomware. "5/5, would get encrypted again"

mrb• 10 years ago

The school’s vice-president of finance and services said why they openly disclosed it:

As for why the U of C admitted it paid the ransom, as well as releasing the cost, Dalgetty said it’s an effort to be transparent. “We’re a public sector organization and we pride ourselves on our openness,” she said. Source: http://calgaryherald.com/news/local-news/university-of-calga...

Personally, I am glad they disclosed it. For example this incident raises the awareness that having a solid backup policy is important. Maybe this very story will help IT staff from other universities convince upper management to invest funds into developing a more solid backup policy.

csydas3• 10 years ago

I'm not really sure these threat scenarios apply when it comes to ransomware. Often ransomware attacks are not targeted but instead just the result of your standard drive-by attack or the classic shotgun e-mail approach, since usually university email listings are pretty easily scrape-able, especially if they're a Google Apps for Education (GAFE) university, as GAFE has pretty generous in-domain sending policies on email and there's an implicit trust in most people when they get something from an in-domain email.

So the initial point, while it may be true to some extent, is not really the common method of attack; the truth is that for the most part there is no need to really "craft" an attack against most users within a large enough organization. Just compromising one or two accounts or using one of many means to impersonate an official sounding account is often enough to get access to a few in-domain accounts. Once you have that, you can easily get past the majority of people's mistrust and get them to run just about anything you send them. When I did support for a small private university in the US, our GAFE accounts were constantly plagued by phishing and spam emails, and despite our best efforts to educate our user base, people just kept on clicking and giving out information. The entire process was basically automated from the attacker's side, as when we compared notes with other universities suffering the same issue, the emails sent out were verbatim copies, save that the university names were swapped out and a different logo.jpg was added to the emails for authenticity. Attacking a major organization really doesn't require a careful eye and dedication, just changing a few entries in some program and starting the process.

As for why to disclose? There's probably some degree of a necessary public accountability - I actually doubt that the university itself called up a paper and said "man have we got a story for you" so much as someone at the publication got wind of the information and plugged the university for a brief interview. Honestly, reading through the article, it's incredibly terse as far as actual details from the University as to what happened. Since it's a Canadian University, I'm not sure on their responsible disclosure requirements, but if it was in the US, I believe they have a timeframe in which they have to admit that student data has potentially been leaked.

Really, these sorts of impersonal attacks do need a lot more attention, since as recently as just a year ago, I found myself talking with somewhat major institutions around the US who had no real good idea how to deal with ransomware, (spear) phishing emails, and so on within their organization. Creating effective user awareness is really tough, since rather frustratingly, getting "phished" seems to be one of those lessons everyone wants to learn the hard way, or arrogantly thinks will never happen to them. We used a Twitter account in combination with a threat blog to try to notify our users, as well as warnings on our log-in page, but even after doing that for 4ish years we still had people giving out their information, and we had an okay-ish following on both.

I'm not saying that it was "good" of them to release that they decided to pay, but I also do question, given how easy ransomware is to deploy, whether or not more discretion would actually have a larger impact. Schools in particular are kind of over a barrel if/when they get hit by ransomware, and a lot of it has to do with poor data retention practices by both the University IT and by offices across the organization. Often times it's not just a mild inconvenience if someone's computer gets locked up by ransomware, you can potentially be irreparably damaging hundreds or more students' academic careers. Should this data be in a position that it can happen like this? Absolutely not, but that doesn't change the fact that it often is.

jiqiren2• 10 years ago

I guess no backup strategy means no other option but to pay. Likely goes hand in hand with weak or missing security strategy.

GP5Aloy• 10 years ago

people who backup their stuff laugh at ransomware

joosters3• 10 years ago

...until they find the ransomware is in the backups too?

Gustomaximus2• 10 years ago

Unless they are worried about the publicly sharing of files vs. the loss of them.

SHFT1012• 10 years ago

With 20,000$ could get a nice backup system.

SHFT1012• 10 years ago

With $20,000 one could get a really nice backup system.

dutchbrit• 10 years ago

yeah, well, I guess they were a little late..

barking• 10 years ago

I see you backed up your comment

aphextron• 10 years ago

With $20,000 one could get a really nice backup system.

You must not know much about software development...

dagw3• 10 years ago

I take it you have never tried to buy and set up a really nice backup system in a large heterogeneous university or office environment. $20,000 is nothing.

whatsamattayou• 10 years ago

If you're a Windows programmer, might be a good idea to write a Windows Service that watches for drive encryption. Then you could stop it before it does anything. For now, I think most of the methods are known, so they are easy to watch for.

cantrevealname3• 10 years ago

That's the sort of thing that should already exist in anti-virus software or host intrusion detection systems. I presume that the university wasn't running such software, or that it didn't work correctly, or that the ransomware was smart enough to bypass it.

webtechgal2• 10 years ago

IMO, Micro$oft can gain a huge amount of positive press/PR as well as user-love by integrating a defense/protection mechanism right into the OS.

simonswords82• 10 years ago

The moment Microsoft try to be proactive and integrate a defence mechanism I would suspect people would then try to hold them liable if another ransomware attack succeeded.

Microsoft could do without the overhead, or the headache, and so despite the PR upside it's probably not worth their effort.

Might be an opportunity for an ISV to make a utility though?

hannob• 10 years ago

The headline could also be "University willingly supports criminals with $20.000" - and it would be more honest.

That's really something that bothers me with the whole ransomware thing: People seem to be completely ignorant to the fact that by paying they're not only getting back their data - they're paying the bills for the people who will launch more attacks against other people. And thus they're themselve guilty of supporting the same crime that just hit them.

mapt• 10 years ago

... under duress.

That's why it's termed 'ransom'. Because people who don't pay, have things taken from them. You don't really get to condemn ransom payers on ethical grounds without being an asshole.

kwhitefoot• 10 years ago

Of course one does!

Paying a ransom encourages the criminal behaviour; it therefore negatively affects all potential victims by making them more likely to become actual victims.

Also, in some jurisdictions paying a ransom is actually a criminal offence so one could end up causing further negative consequences for your family, friend, colleagues, or the institution you work for.

Bromskloss• 10 years ago

That's how every type of ransom works.

csydas3• 10 years ago

But with how easy it is to deploy ransomware and how frequently you can get a major hit, it's a pretty pyrrhic victory to not pay. Right now there's no reason to not keep on shooting out ransomware - it's an impersonal, easy to deploy, low cost, scalable form of malware which has a very high and noticeable impact on end-users, who often have little to no recourse or means of mitigating the damage. It's of virtually no risk to the persons deploying the ransomware to deploy the software or collect the money. With other ransom scenarios, the cost and risk to the attacker is far greater for every part of the ransom act; refusal to pay has a greater cost to the attacker in every which way. There is no such cost with ransomware at the moment, aside from the initial financial venture to get/make the software.

Knowing that the ransomware folk are just going to keep on spamming their software against institution after institution, is it really worth the potential cost of the lost data? If it's student data, is it worth ruining students' academic careers over a principled stand? Is it worth losing a novel you've been working on for 8+ years? Is it worth losing business documents that could cripple your business?

It's not as clear cut with ransomware as it is with other forms of ransom and extortion just because of how stinking' easy it is to do ransomware.

oolongCat2• 10 years ago

Ranked 151-200 in the QS rankings for CS. I bet if they handed this problem over to the CS people in the university they would have willingly helped them out to fix it.

Information security is even listed as one of their main research areas.

http://www.cpsc.ucalgary.ca/cpsc_research

they even have some labs that does infosec

http://icis.cpsc.ucalgary.ca/ http://ispia.cpsc.ucalgary.ca/

I bet the people at the CS dept must be pissed.

jiqiren2• 10 years ago

Perhaps a student saw an opportunity to get a quick $20,000 discount on their tuition?

21• 10 years ago

You missed this quote under the picture: "University IT workers tried to crack the ransomware for more than a week before the payment".

BTW, are you implying that a strong CS university can break asymmetric encryption? Why is everybody assuming that hackers are stupid all the time, and only they are smart...

oolongCat2• 10 years ago

Actually I am implying it is possible for some types of ransomware. Here's an example.

https://github.com/leo-stone/hack-petya

(the hn thread https://news.ycombinator.com/item?id=11474613 )

ewams• 10 years ago

RSA has some tools to assist with decryption from a few ransomware flavors. I would assume a few of the other big security firms do as well. We did this for a hospital that got hacked. It is not 100% successful and depends on the variant but is possible.

shultays• 10 years ago

Even if they were ranked first, I doubt that they can do anything against properly encrypted files. As the article states, they already tried and couldn't find a mistake in the encryption

tomjen3• 10 years ago

The most interesting part of the article was that some ransomware sites have threatened to publish their files if they don't pay - no backup strategy will save you there.

skoocda• 10 years ago

But consider the University of Calgary's actions in response... they publicly announced the outcome of these events in the interest of transparency.

Wouldn't it be more transparent to just allow their files to be published?

Surely there are damages that could be caused, but as a public institution, I feel like this is the way they should operate by default.

downandout• 10 years ago

Microsoft really needs to build ransomware behavior detection directly into Windows. The behavior of these programs is quite distinctive. The advent of cryptocurrency was the missing link to enable all manner of anonymous extortion schemes, and this one in particular seems to now be a mainstream threat. Microsoft should be all over this.

microtonal• 10 years ago

Ransomware detection is just a (perhaps necessary) band-aid.

By default all applications should be sandboxed. Why should a random application be able to read/write to every user directory? We enforce process separation in memory, we should do the same on disk.

gambiting2• 10 years ago

That's exactly what UWP(universal windows platform) is - it sandboxes every app. But I am sure you will agree that having this as default behavior on windows would be disastrous, breaking compatibility with every app written before Windows 10, not to mention that the reason why we use PCs is to have low-level access to hardware, many applications require it and sandboxing isn't going to be a good option here. I guess MacOS way of doing things is a good in-between - by default, every app not from the app store is blocked, and you have to go through a slightly cumbersome process of unblocking it manually in security settings. I'm sure it beats the default windows permission popup, which I imagine 99% of users just accept without looking at, or disable outright.

digler9992• 10 years ago

all applications should be sandboxed.

not a bad plan, but also, all data should be backed up. In this 'cloud age' of computing, there's no reason, and no excuse. I certainly don't want to blame the victims of ransomware, but if that data was so important that they paid ransom to get it back, why didn't they back it up ?

webtechgal2• 10 years ago

Exactly what I was thinking too.

Gustomaximus2• 10 years ago

Easy solution - the government writes into law it's illegal to pay ransomware hackers. Sure hackers might get the occasional payee after this but the likelihood goes down dramatically removing much incentive, especially for larger organisations to be targeted.

mavhc• 10 years ago

Just classify them as terrorists.

It's immoral to pay criminals.

brador• 10 years ago

Or let nature take its course and let this lead to improved data and security practices.

tim3332• 10 years ago

The ransomware would still be about. Even if the US banned paying, there are other countries.

VeejayRampay• 10 years ago

People asking for ransoms are shady to begin with, but to target a university? That's past gangster, that's just wrong.

nefitty• 10 years ago

Universities? Try all the hospitals being targeted.

digler9992• 10 years ago

universities charge fees that are tantamount to "ransom" in order to get your degree. They aren't much better (at least US ones ) than the thieves.

markdown• 10 years ago

US universities charge fees...

FTFY.

The University that this story is about is Canadian.

antihero• 10 years ago

Since this exploits user level privileges, perhaps a good idea would be to have a privileged version control system for user data. In that, you need admin/root access to actually DELETE anything, and any file system changes by users are simply versioned away. This means if you had ransomware that fucked up your files (since this software typically runs at user level), you could just instruct said versioning system to roll everything back as an admin?

pfg2• 10 years ago

I think that's what many enterprise deployments do with shadow copies, mostly for file shares. It would probably make sense for Microsoft to push this feature for personal usage/smaller networks as well (not sure if you can currently use it in that scenario).

Cheyana• 10 years ago

They reference another article that contains a quote from an Intel employee...

"Ransomware and crypto malware are rising at an alarming rate and show no signs of stopping," said Raj Samani, European technology head for Intel Security.

That statement instills a confidence in me that makes me so glad Intel bought McAfee six years ago.

dsfyu404ed• 10 years ago

Sorry but it was probably cheaper than implementing backups all along, eh?

otempomores2• 10 years ago

Security audits..im sorry Sir we don t have that kind of money..

otempomores2• 10 years ago

Could one mimic the human imune system when it comes to security? All shared data is blockchained and if one producer shows lacking response all his contact partners get quarantined. Infections.. Yes on a large scale (even local) no

tim3332• 10 years ago

Someone should make a usb hard disk that doesn't allow existing files to be modified on it unless you flip a physical switch. Then you could back your data to that and not worry about it being wiped / encrypted.

University pays $20,000 to ransomware hackers

Related Stories