Schneier on Security

Clive Robinson • July 9, 2019 8:42 AM

@ All,

From the article,

Wosar said. “There is also no shame for a data recovery company in paying the ransom, as long as they are open and transparent about it.”

That is very bad advise, and there could ba a lot of shame as people go to jail for making paymrnt.

Two points can hit you,

1, Aiding in a criminal enterprise.
2, Making payment to terrorist organisations.

Both of which carry considerable tarrifs. In fact the legislation about the paying of “ransoms” are not specific to “humans” or “pets” because of the taking of ships around Somalia and other areas of the globe…

Make no mistake if you pay a ransom you are committing a crime for which you can be prosecuted in quite a number of different ways.

If you are not convinced look at the legislation for receiving stolen goods. The “theft”[1] creates the stolen item making payment to obtain something that you have reason to believe has been obtained by theft is “receiving”.

So there is plenty of legislation to stop this behaviour dead, if the authorities wanted to fill jails with victims of crime. Which as it only creates bad press they generally try to avoid.

@ 65535, Rachel,

To anyone in the UK or Clive R., do you know of this Firm and of its reputation?

I’ve not come across them they are obviously not in the same league as Kroll for instance.

That said I’ve been expecting such companies to appear.

Due to the failings of financial institutions and regulation there have been one heck of a load of “middle men” companies taking hugh sums of money for effectively doing nothing. Search for “PPI Scams” if you want to see them.

It’s in line with the UK’s knew economy paradigm where the only growth sector is “rent seeking”.

I would also expect a few of these “faux Microsoft Support Call” operators to start moving into the “Ransomware Market” to play both sides. That is under their phoney support the “drop a RAT” into your system, and at a later time assess which way to extract further money out of you as you are clearly gulable (think behaviour of Nigerian Prince letters, Pump and Dump stocks etc etc). After all they can probably get further info to attach on to your credit card info so making that data more valuable, as just a start, going through a series of steps milking you bit by bit untill they hit you with a ransomware attack.

Thus if you do get hit by ransomware the first questions you should be asking companies is not “Can you recover my data?” but “How did they get in?” and “How do I stop it from happening again?”. If they can answer those questions for a nominal price, then they might just be reputable.

Thr usuall “guru advice” that’s all to often given out in a glib fashion is “backup your data”. It’s actually not an easy thing to do for a whole heap of reasons you might have found out when upgrading a PC to a new one that has different hardware and OS, as it’s not just data it’s data in propriatary formates specific to an application that may nolonger be available or won’t run on a newer hardware or OS.

In short it takes a lot of planning and preperation and only a very lucky few ever get it totally right without actually doing a few dry runs.

Which is why “backup and backup often” is glib, because there is no “test it works reliably” statment in there.

But there is another aspect, backups are only even remotely of use if they are still under your control and have been tested properly…

As I’ve mentioned in the past if I was going to commit a crime it would be large and then I would disapear to a prearanged new life and live quietly and very very law abidingly from then on. Thus if I was going to do it by ransomware I would think it through carefully and almost my first thought would be “how to deal with the backup issue”.

And actually in oversight it’s easy (practice is another thing all together). First you work out what the backup cycle time depth is. That is how often do they do a full “grandfather backup” and when you thus are looking at starting the process two or three times befor that. So you would then “get at” their backup software in some way so that it transparrntly encrypts all the backups. As the backup software is almost certainly going to get updated at some point, you would be unwise to attack that. Thus you would attack at a lower level such as the device drivers for the backup tape device[2]. You would then start encrypting all the backups. Provided they tested them on the same system then the driver would transparently encrypt/decrypt on the fly. For other reasons you would also only encrypt the older files untill just before “Doom-Day” when you switch to encrypt everything. Come D-Day you deleate the encryption keys for the backup system then compleatly barf the file systems with “one way algorithms”.

Thus the file systems can not be recovered in any way, so that’s a dead end, and those carefully kept and even tested backups are now effectively just random magnetic domains and of no use without the keys only you have and have done for half a year or more… That way the carefully selected victim has to pay or go under.

Which brings up a couple of questions, the first is how as a potential victim you avoid this fate. The second is how you as an attacker select your target so you have “surviability”.

The first question of how you avoid such a fate is a little subtle, and the answer is not “test backups” but rather “how” you test backups, which is where the “consultant money is”.

The second is more interesting. Obviously the target has to be able to pay the money you are going to need for a very comftable but quite life for the next fifty years or so without having to negotiate you down (they will try so build that into the plan). But also they must not be so large that they will have sufficient spare capital to employ twenty or thirty people to hunt you down and dispose of you in some way… Because you don’t want to feel the pin prick of a fine rhodium needle going in your backside to drop a dose of Suxamethonium chloride in to take your breath away[3] for good… Or some other drug so they can “crate you up as aircraft freight” for no passport or extradition paper travel.

[1] Remember theft like fraud is covered by “The denying the owner or their agent the rights and privileges pertaining to ownership”. Encrypting or just destroying files are both “denying the owner” thus theft. Even saying you have encrypted files is again “denying the owner” thus a form of fraud.

[2] Yes I’m aware that few large organisations actually use tape drives any longer for daily or even weakly backups, hence it’s the “grandfather” backup that’s held off site you are going for as the prime target.

[3] Often just called “sux” it’s a short action muscle relaxant, which does not effect consciousness. It would not be found in an ordinary postmortem tox screen and unless the examiner was very thorough, finding such a fine needle mark in your posterior not very likely. You would die excruciatingly painfully as you effectively have a full blown fatal heart attack. It’s a widely available drug on the UN’s list of most important “essential drugs”. It’s frequently used in operations, where I know from experience this little note on the Wikipedia page is correct,

Suxamethonium does not produce unconsciousness or anesthesia, and its effects may cause considerable psychological distress while simultaneously making it impossible for a patient to communicate.

Due to my deceptively large size I’m very much on the fatality risk border line for general anaesthetics, and also for other reasons an asphyxiation risk not a good combination, and they had not given quite enough anesthesia or it had not kicked in for some reason. So there I was tracheal intubated and awake and paralysed. Not in any real danger, but a good enough reason to have full on nightmares from time to time. Oh and it was not my first “wake on the operating table” experience. It’s why I talk to anesthesiologists about “spinal taps” and “adrenaline free local anesthetics”… So yeh I’ve had some operations where I’ve chatted to the anesthesiologists or the surgeon or nurses whilst they are doing their thing. It’s funny but when it’s your choice to be awake, you don’t get nightmares, nor the crappy recovery times where you are sluggish for days.