Massachusetts city tells ransomware scumbags to RYUK off, our IT staff will handle this easily
Massachusetts city tells ransomware scumbags to RYUK off, our IT
staff will handle this easily
Oh, so you can just do that? That's possible?
Restoring from clean, good backups after an infection? Who knew?
By Thomas Claburn in
San Francisco 6 Sep 2019 at 02:06
The City of New Bedford, in
Massachusetts, has found a way to deal with ransomware without paying: shoring
up defenses, restoring from backups, and rebuilding systems.
The attack on the American city's systems was identified on July
5, after employees noticed unusual network activity upon returning from the
July 4th holiday, Mayor Jon Mitchell explained in a press conference on Wednesday.
"We haven't seen any interruption in municipal services at
all," said Mitchell.
The city's Management Information Systems (MIS) staff identified
the presence of the file-scrambling RYUK nasty, a sophisticated form of
ransomware, and through prompt action managed to limit its impact.
Supposedly named for a character in the manga series Death Note,
RYUK can find and encrypt network drives, and
delete volume snapshots to prevent the use of Windows System Restore in the
absence of external backups.
The malware locks up data on target systems and presents a demand
for payment in Bitcoin as a condition for receiving a decryption key that, perhaps,
will unlock the captured data.
Those behind the infection demanded $5.3m in Bitcoin to release
New Bedford's files, according to Mitchell, who said ransomware outbreaks
against government, education and private sector organizations have become more
common
and more costly – at least in terms of demand, though not necessarily in
terms of payment.
In Texas last month, 23 towns were hit by a coordinated ransomware attack. More than
half are said to be back to business as
usual and Texas officials insist they're unaware of any ransom being paid.
Unwilling to pay $5.3m, Mitchel said he made a counter-offer of
$400,000, based on cyber-insurance proceeds available to the city. The
cyber-crim declined and the city continued negotiating, buying the IT staff the
time needed to bolster defenses and restore files from backups, to the extent
possible.
It doesn't always go so well. Atlanta, Georgia, Mitchell said,
rejected a $50,000 ransom and ended up spending $18m to restore service. For
Ne
w Bedford, no ransom was paid but Mitchell said he expects further costs in
terms of MIS staffing.
Mitchell attributes the relatively minor impact of the infection
to luck, skill and the city's IT architecture.
The luck element has to do with the fact that the malware
intrusion began over the July 4th holiday. Holidays and weekends are apparently
a common time to launch ransomware attacks because IT staff tends to be scarce
and less vigilant then; but in this case the holiday also ensured that many of
the city's desktop PCs were powered down, which limited the ransomware's
ability to spread.
The prompt action of the MIS staff on the morning of July 5th to
defensively disconnect systems, according to Mitchell, helped reduce the impact
of the infection.
In terms of IT architecture, systems compartmentalization further
limited the reach of the software nasty.
Police, emergency services, school
systems, water and wastewater treatment plants, and trash/recycling services
were unaffected. According to Mitchell, only 158 computers, or 4 per cent of
the more than 3,500 machines used by city employees were compromised.
Mitchell however made clear that security concerns of this sort
will continue. "The reality is that municipalities, corporations and
private individuals are in an arms race with cyber criminals who operate in
far-flung places around the globe," he said, noting that over the weekend,
Charlton, Mass., had been hit by a cyber assault. "Every
advance in antivirus technology is effective until criminals figure out a way
around it." ®
Comments
Post a Comment