Baltimore City Government Computers Taken Over by Ransomware Hackers

[lpetrich]

Baltimore’s ransomware attack, explained - Vox
Baltimore City Ransomware Attack Knocks City Services Offline : NPR
Baltimore city government computer network hit by ransomware attack - Baltimore Sun

From the first link:

Thirteen bitcoins are standing between the city of Baltimore and many of the services and processes its citizens rely on after hackers seized thousands of government computers at the start of the month. The ordeal has been going on for two weeks, and there’s no clear end in sight.

Here’s what’s happening: On May 7, hackers digitally seized about 10,000 Baltimore government computers and demanded around $100,000 worth in bitcoins to free them back up. It’s a so-called “ransomware” attack, where hackers deploy malicious software to block access to or take over a computer system until the owner of that system pays a ransom.

Baltimore, like several other cities that have been hit by such attacks over the past two years, is refusing to pay up. As a result, for two weeks, city employees have been locked out of their email accounts and citizens have been unable to access essential services, including websites where they pay their water bills, property taxes, and parking tickets. This is Baltimore’s second ransomware attack in about 15 months: Last year, a separate attack shut down the city’s 911 system for about a day. Baltimore has come under scrutiny for its handling of both attacks.

The ransomware attacks in Baltimore and other local governments across the US demonstrate that as ransomware attacks spread, and as common targets such as hospitals and schools beef up their online systems’ security, there are still plenty targets vulnerable to this kind of hack. It also exemplifies the conundrum that ransomware victims face: pay up and get your access back, or refuse — potentially costing much more in the long run.

From the third link, “We won’t talk more, all we know is MONEY!” the note said. “Hurry up! Tik Tak, Tik Tak, Tik Tak!”

 

[bilby]

Baltimore’s ransomware attack, explained - Vox
Baltimore City Ransomware Attack Knocks City Services Offline : NPR
Baltimore city government computer network hit by ransomware attack - Baltimore Sun

From the first link:

Thirteen bitcoins are standing between the city of Baltimore and many of the services and processes its citizens rely on after hackers seized thousands of government computers at the start of the month. The ordeal has been going on for two weeks, and there’s no clear end in sight.

Here’s what’s happening: On May 7, hackers digitally seized about 10,000 Baltimore government computers and demanded around $100,000 worth in bitcoins to free them back up. It’s a so-called “ransomware” attack, where hackers deploy malicious software to block access to or take over a computer system until the owner of that system pays a ransom.

Baltimore, like several other cities that have been hit by such attacks over the past two years, is refusing to pay up. As a result, for two weeks, city employees have been locked out of their email accounts and citizens have been unable to access essential services, including websites where they pay their water bills, property taxes, and parking tickets. This is Baltimore’s second ransomware attack in about 15 months: Last year, a separate attack shut down the city’s 911 system for about a day. Baltimore has come under scrutiny for its handling of both attacks.

The ransomware attacks in Baltimore and other local governments across the US demonstrate that as ransomware attacks spread, and as common targets such as hospitals and schools beef up their online systems’ security, there are still plenty targets vulnerable to this kind of hack. It also exemplifies the conundrum that ransomware victims face: pay up and get your access back, or refuse — potentially costing much more in the long run.

From the third link, “We won’t talk more, all we know is MONEY!” the note said. “Hurry up! Tik Tak, Tik Tak, Tik Tak!”

There are no circumstances in which it is better to pay.

If you pay, you only have the criminals' word that they will in fact unlock your systems - and criminals are not noted for their trustworthiness.

Even if they do unlock your systems once you have paid up, there's no reason to expect that they won't come back and repeat the successful extortion; And there's no reason to believe that your system hasn't been infected with other malware - so you STILL have to go to the expense of scrubbing your system clean.

And of course, there's the moral aspect - if you acquiesce, then you increase the risk of future attacks on others, which is indefensible.

The immediate term solution is to treat any locked data as lost. Wipe the affected systems, and restore to a known good backup, then re-build. The sooner you start that process, the better. If you don't have a backup stored securely and offline, preferably in a different city, for disaster recovery purposes, then sack your CIO and hire one who has moved out of the 1980s.

The long term answer is decent security - which is still a rarity. Bizarrely, people STILL click links in unsolicited emails. People still tell their passwords to others, once convinced that they are in authority. People still use simple passwords, and re-use them on multiple systems (something that is exacerbated by the counterproductive implementation of short password life, and overly simplistic rules for complexity).

Governments and NGOs should mandate the use of password managers, rather than requiring staff to remember complex passwords for multiple systems. And staff need to be aware that divulging their passwords to anyone - including the boss, or the IT department, or the state password inspector - is grounds for instant dismissal.

 

[steve_bank]

It is endlessly puzzling that organizations by this time do not protect themselves.

 

[lpetrich]

The long term answer is decent security - which is still a rarity. Bizarrely, people STILL click links in unsolicited emails. ...

I don't see why that has to be a security hole. I think that good security involves a lot of idiot-proofing.

Another thing that's a problem: operating-system design. It seems to me that Windows has some fundamental flaws, some fundamental vulnerabilities that are very difficult to correct. Linux or OSX would be a better choice. OSX comes with Apple hardware, so a company with lots of PeeCees might not be willing to replace them. But Linux can run on those PeeCees, and one can even get a nice GUI shell for it that is roughly comparable with what Windows and OSX come with. KDE and Gnome are the two major ones, but several others have been written for Linux.

A further virtue of Linux is that it is open source. This makes it easier to vet it for security holes. Strictly speaking, Linux is an OS kernel, but Linux users have created numerous Linux distributions, typically containing Unix utilities, GUI shells, and ordinary-user-ish software like web browsers -- mostly or all open-source.

Of the other two of the Big Three, OSX is partially open-source, and Windows is all closed-source. Though the OSX GUI shell is closed-source, its kernel is open-source, as are its Unix utilities and C compiler.

 

[steve_bank]

It goes back to the 60s when people loaded their own software on company computers. When I worked for Loclheed there was a software police checking HD.

The obvious seems to be to isolate data storage and processing from the net. The Sony hacking for example. To move files from the isolated system somewhere else requiring a hardware and software process.

If I had a company I'd have two systems. A server for internal use only and a server for outside communications.

The 386 protected mode was supposed to take care of a lot of hacking.

What made Windows powerful was the ease of downloading third party apps and running without creating problems with other software.

There needs to be an OS dedicated to one task without all the frills of Windows. Windows is far beyond an OS. I doubt anyone at MS knows the whole system and all the interactions in detail.

 

[rousseau]

Security is a money/people problem. First, people who are good with security barely exist, and secondly if you can find them you need to be able to pay them. And before that you have to know that you need heightened security in the first place.

You'd think these would be trivial problems, but they're absolutely not.

 

[TSwizzle]

It is endlessly puzzling that organizations by this time do not protect themselves.

It's very difficult to prevent this sort of thing. What puzzles me more is that it is actually so easy to render the servers useless. I would assume these are some sort Microsoft Windows servers, I really don't know how MS get away with their stuff being so easily fucked up.

 

[lpetrich]

The 386 protected mode was supposed to take care of a lot of hacking.

That's only for a computer's internal operations. It doesn't affect such things and files or network access. It is also a heck of a lot older than the Intel-386 chip architecture -- it's at least as old as the IBM System/360 line, and that came out in 1964.

What made Windows powerful was the ease of downloading third party apps and running without creating problems with other software.

Was it not possible before? That's news to me. It was a case of desktop computers getting more and more capacious, so that one could run more than one app at once.

There needs to be an OS dedicated to one task without all the frills of Windows. Windows is far beyond an OS. I doubt anyone at MS knows the whole system and all the interactions in detail.

There already is one: Linux. There are plenty of other open-source OSes, but that's the best-known one.

 

[lpetrich]

A Closer Look at the RobbinHood Ransomware

The RobbinHood Ransomware is the latest player in the ransomware scene that is targeting companies and the computers on their network. This ransomware is not being distributed through spam but rather through other methods, which could include hacked remote desktop services or other Trojans that provide access to the attackers.

...
Security researcher Vitali Kremez, who reverse engineered the sample, told BleepingComputer that on execution it will stop 181 Windows services associated with antivirus, database, mail server, and other software that could keep files open and prevent their encryption. It does this by issuing the "sc.exe stop" command as shown below.

Windows. I don't feel very surprised.

Baltimore Ransomware Attack Update: RobbinHood Malware's Lasting Impact - MSSP Alert

Will Linux protect you from ransomware attacks? | InfoWorld

Windows has a 20 year history of leaving its users vulnerable on the internet. Frequent major vulnerabilities too. We had MSBlast which easily could have been ransomware too if it had been invented / famous then. MSBlast basically made any new Windows 2000 or XP version that you would connect directly (i.e. not behind a router) to the internet useless within a minute. I don’t see that much has changed.

Seeing which Windows version patches were released for the last couple of days you see how extremely old (XP era) vulnerabilities carry over from version to version seemingly. That’s Microsoft for you and has always been.

However, Linux is not absolutely invulnerable, though it may be easier to secure.
B0r0nt0K Ransomware Wants $75,000 Ransom, Infects Linux Servers

 

[bilby]

The long term answer is decent security - which is still a rarity. Bizarrely, people STILL click links in unsolicited emails. ...

I don't see why that has to be a security hole. I think that good security involves a lot of idiot-proofing.

Another thing that's a problem: operating-system design. It seems to me that Windows has some fundamental flaws, some fundamental vulnerabilities that are very difficult to correct. Linux or OSX would be a better choice. OSX comes with Apple hardware, so a company with lots of PeeCees might not be willing to replace them. But Linux can run on those PeeCees, and one can even get a nice GUI shell for it that is roughly comparable with what Windows and OSX come with. KDE and Gnome are the two major ones, but several others have been written for Linux.

A further virtue of Linux is that it is open source. This makes it easier to vet it for security holes. Strictly speaking, Linux is an OS kernel, but Linux users have created numerous Linux distributions, typically containing Unix utilities, GUI shells, and ordinary-user-ish software like web browsers -- mostly or all open-source.

Of the other two of the Big Three, OSX is partially open-source, and Windows is all closed-source. Though the OSX GUI shell is closed-source, its kernel is open-source, as are its Unix utilities and C compiler.

I agree - using Windows seems to be an example of Stockholm Syndrome in many cases.

In my most recent job, I was issued a laptop that ran RHEL; It did everything I needed, and was certainly easier to use than Windows 8 or 10, for anyone coming from a Win XP or 7 background.

There's some specialist software that only runs on Windows, but that gap is closing.

 

[Gun Nut]

I don't see why [being presented with mysterious links] has to be a security hole. I think that good security involves a lot of idiot-proofing.

... and that is the problem... that people think this. Do you get in your car, close your eyes, and then jam your foot down on the peddle to find out later where your car took you? If you kill a dozen people doing that, is it "bad car security"? People need to take responsibility for their own actions... like even a little fucking bit.

Do you know what the "spam email" success rate is (success = they clicked the link you sent them)? It's 1:12. For every 12 people you send ANY email to, one will blindly follow along. You know why there is a spam problem? Because of that 12th person... who, it seems, is this friggin guy.

Do me a favor, would ya... stop being the sole cause of the biggest problem with computing today by, you know, not being a fucking moron. pretty please with sugar on top (there, I was nice about it).

Otherwise, the government will need to start regulating computers like guns... you know... they are either perfectly safe to use in any imaginable way, or completely banned.

 

[bigfield]

I don't see why [being presented with mysterious links] has to be a security hole. I think that good security involves a lot of idiot-proofing.

... and that is the problem... that people think this. Do you get in your car, close your eyes, and then jam your foot down on the peddle to find out later where your car took you? If you kill a dozen people doing that, is it "bad car security"? People need to take responsibility for their own actions... like even a little fucking bit.

Yes, it is "bad car security". Humans are incurably prone to making mistakes. Fortunately engineers have found a solution--autonomous vehicles--and are in the process of making them.

Do you know what the "spam email" success rate is (success = they clicked the link you sent them)? It's 1:12. For every 12 people you send ANY email to, one will blindly follow along. You know why there is a spam problem? Because of that 12th person... who, it seems, is this friggin guy.

Do me a favor, would ya... stop being the sole cause of the biggest problem with computing today by, you know, not being a fucking moron. pretty please with sugar on top (there, I was nice about it).

Designers and engineers need to make better systems.

Users are often expected to take on a very large amount of knowledge just to safety use a computer. That's fine if the user base is limited to IT professionals, because computers are their speciality, but it's just plain old stupid to expect everyone else to safely use insecure computers.

Calling people morons because they make mistakes on badly-designed IT systems. That's moronic.

The long term answer is decent security - which is still a rarity. Bizarrely, people STILL click links in unsolicited emails. People still tell their passwords to others, once convinced that they are in authority. People still use simple passwords, and re-use them on multiple systems (something that is exacerbated by the counterproductive implementation of short password life, and overly simplistic rules for complexity).

Governments and NGOs should mandate the use of password managers, rather than requiring staff to remember complex passwords for multiple systems. And staff need to be aware that divulging their passwords to anyone - including the boss, or the IT department, or the state password inspector - is grounds for instant dismissal.

Username and password authentication is easy for engineers to build, but totally unsuitable for users who aren't up to the task of managing their credentials over the long term and across multiple services.

Businesses will always have people who will click links in unsolicited emails, because that is just the kind of mistake humans make. It's up to designers and engineers to come up with systems that are better suited to humans.

Rather than fixing glaring design problems, the IT industry has shifted the burden to users. That's just lazy design for the sake of expediency.

 

[Gun Nut]

Yes, it is "bad car security". Humans are incurably prone to making mistakes. Fortunately engineers have found a solution--autonomous vehicles--and are in the process of making them.

So if I run a red light and get someone killed, I can sue the car manufacturer for not having a security system in place on the vehicle to automatically stop it at red lights... ok, got it.

Do you know what the "spam email" success rate is (success = they clicked the link you sent them)? It's 1:12. For every 12 people you send ANY email to, one will blindly follow along. You know why there is a spam problem? Because of that 12th person... who, it seems, is this friggin guy.

Do me a favor, would ya... stop being the sole cause of the biggest problem with computing today by, you know, not being a fucking moron. pretty please with sugar on top (there, I was nice about it).

Designers and engineers need to make better systems.

yea, that's what they do for a living. mission accomplished. Apparently, though, users do not need to do a "better job" using products... everything must be idiot proof (Because they stopped making better idiots, right)?

Users are often expected to take on a very large amount of knowledge just to safety use a computer. That's fine if the user base is limited to IT professionals, because computers are their speciality, but it's just plain old stupid to expect everyone else to safely use insecure computers.

Calling people morons because they make mistakes on badly-designed IT systems. That's moronic.

I am afraid for your family. Because if someone in a ski mask shows up at your door at 3:00 AM, and you ask who it is, and they say "girlscout cookies", apparently you would just open the door. because door security is there.... it shouldn't open when you tell it to when you "made a mistake" by beleiving the man in the ski mask holding a bloody ax wanted to sell you girlscout cookies... I mean, it's not like you are an expert crime detective! how could you possibly know he was lying. Your family should be made safe by the door manufacturer.

There are not that many types of cons in spam.. and they are in no way any different at all than they were when they were invented hundreds of years ago...

The advanced payment scam - Look, knock on the door, letter in the mail, email, text... whatever the communication method, the fact of the matter is that you DID NOT WIN THE FIRST PRIZE IN THE CONTEST YOU DIDN'T ENTER!!!!!! for fucks sake! He is NOT A PRINCE WITH A MILLION DOLLARS FOR YOU.
That "girl" that "found you on facebook" a) does not want to marry you - they just want your money for that plane ticket they are never buying and b) IT'S NOT A GIRL and HE IS JUST NOT THAT INTO YOU - just your money.
Lastly, the IRS, Social Security Office, or any other government agency DOES NOT SEND EMAILS ABOUT "SUING YOU"...

There, those four otherwise totally mysterious pieces of information will now save you from 99% of those oh-so-too-technical problems to solve. Thank god no one showed up in a ski mask at your house before today.

I have been an investigator into crime for many years... #1 reason that someone clicks a link from an unsolicited email is, "I wanted to see what would happen".
not, "I really thought there was a million dollars in it for me" Not, "I thought it was the right thing to do"...

The perception is that they should simply not be help accountable for their actions... "It let me" is all they think about.... and that is the problem, because no technology in the world is going to stop you from going to your bank and wiring money to someone that convinced you to because they ran into you on the street; mailed a letter; made a phone call, texted you, IMed you, messaged you in facebook, or sent an email.

 

[Gun Nut]

Hi BigField. Great talking to you... here are some references about what we were talking about: http://bfy.tw/GCf1 Let me know what you think...

 

[bigfield]

[a bunch of braindead non-sequiturs

Yeah nah.

 

[Gun Nut]

It's your choice to continue funding terrorism, human trafficking, and money laundering... be that way if you want to... its a free world, even for evil people.

 

[lpetrich]

I don't see why [being presented with mysterious links] has to be a security hole. I think that good security involves a lot of idiot-proofing.

... and that is the problem... that people think this. Do you get in your car, close your eyes, and then jam your foot down on the peddle to find out later where your car took you? If you kill a dozen people doing that, is it "bad car security"? People need to take responsibility for their own actions... like even a little fucking bit.

An absurd extreme. I'd recommend watching out for phishing and requests for installation of software and other such things, but letting clicking on links be a security hole is a dangerous strategy. Seems to me that Windows has some bad designs in it. OSX is much better. I've set my home computer to its most permissive installation settings, and that amounts to warning me that I'd downloaded something from the Internet and giving me a chance to back out.

Are safety features evil because they protect people from the consequences of their actions? That's like someone who claimed that lightning rods are bad because they keep God from punishing people for their sins.

Should roads lack guardrails so that bad drivers can be appropriately punished for their bad driving?

Preemptive multitasking and protected memory are very common features of operating systems. Are those features bad because they keep software from hogging the system or trampling on other software's memory areas?

 

[Gun Nut]

I don't see why [being presented with mysterious links] has to be a security hole. I think that good security involves a lot of idiot-proofing.

... and that is the problem... that people think this. Do you get in your car, close your eyes, and then jam your foot down on the peddle to find out later where your car took you? If you kill a dozen people doing that, is it "bad car security"? People need to take responsibility for their own actions... like even a little fucking bit.

An absurd extreme. I'd recommend watching out for phishing and requests for installation of software and other such things, but letting clicking on links be a security hole is a dangerous strategy. Seems to me that Windows has some bad designs in it. OSX is much better. I've set my home computer to its most permissive installation settings, and that amounts to warning me that I'd downloaded something from the Internet and giving me a chance to back out.

Are safety features evil because they protect people from the consequences of their actions? That's like someone who claimed that lightning rods are bad because they keep God from punishing people for their sins.

Should roads lack guardrails so that bad drivers can be appropriately punished for their bad driving?

Preemptive multitasking and protected memory are very common features of operating systems. Are those features bad because they keep software from hogging the system or trampling on other software's memory areas?

There are three general categories of threat vectors... User exploitation, vulnerability exploitation, and zero-day exploitation.

The last two are addressed by your software vendor, and as long as you patch your software and operating systems as per vendor recommendations (which usually is a matter of NOT blocking the updates, but simply allowing them by default) you have done everything you can do to be a responsible computer operator. Zero day events are rare and far between... and very impacting to many people. these are exploits of a vulnerability for which no patch or workaround exists. This is the golden gun of the hacker... the weapon with no defense. Vulnerabilities that have been fixed should never ever be exploitable, as long as the users don't stop the vendors from updating their systems with patches.

The first category (user exploitation) is the real problem... things like phishing spam emails that offer a link that either asks for information (and the information is what they want - like your google password, or online banking password), or attempts to deploy an exploit to a vulnerability they hope you failed to patch (that is, actively stopped from patching, probably).

bottom line is don't be a fucking idiot, because there is no fix for stupidity. Nothing on your ATM card or within your bank is going to stop someone from taking your money if you go and tell them your PIN and hand them your card. At some point you have to take personal responsibility for your own actions... like stopping at traffic lights, looking both ways before crossing streets, allowing your systems to patch, and not falling for the stupidest attempts to get your information... ANY attempts to steal your information, for that matter.

If you didn't order a package, don't click the so-called "track your package" link (with a crazy address).
If you didn't enter a sweepstakes, you didn't win it, so you don't have to wire money to India to collect it.
If your friend is suddenly writing in broken English and is asking you for money from a "new email address"... maybe that's not really your friend... ya think? maybe pick up the phone and make a call.

oh ya... and don't eat the daisies either... they are not food.

 

[bilby]

https://www.smbc-comics.com/comic/2012-02-20

 

[lpetrich]

That's  Social engineering (security) - ways to trick people into revealing passwords and other such info for accessing computer systems. Sometimes being rather threatening, like saying that one's target's account is about to expire or that one's target's account has been broken into and it's necessary to log into it about that.