Slashdot Mirror
US School Agrees To Pay $8,500 To Get Rid Of Ransomware (softpedia.com)
An anonymous reader writes: Earlier this week, the media was abuzz with the case of the Hollywood hospital that almost shut down its operations because of a ransomware infection, which it eventually paid. Something similar happened around the same time in a South Carolina school district when ransomware shut down an elementary school's servers. The school had to pay $8,500.
something tells me this is become the norm you're going to have public institutions putting $100K per year aside for ransomware if they leave normal users alone, ransomware creeps can sabotage as many schools as they want
Exactly. They hate us so they want this to continue. It's the same reason Reoublicans force corporations and governments to buy Microsift garbage.
Because this is the future Republicans want for us all.
older server running outdated equipment. Well the Republicans failed to fund the IT newer hardware and software.
There's a reason those pukianz force so many agencies to use that SharePoint shit.
You start paying, they find more targets, make their scam more professional, etc. At the moment, these are still common criminals, as can be seen by the low sums demanded (completely out of proportion compared to the damage done), but that will now change.
The good thing is that Bitcoin is not really anonymous, unlike the common wisdom. With a bit of lick these people will be identified. The bad thing is that it will take some time and by then others will have copied the scam.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
"The school's IT staff said the ransomware penetrated their network through an older server running outdated equipment."
And proceeded to propagate through their network through newer servers running outdated equipment...
Don't step on the baby.
Do we really want to be teaching children to negotiate with terrorists?
Minimum threshold fixed. Thanks!
It should be illegal to pay ransomware criminals.
The school did not have to pay.
Horry County school district (South Carolina, US). Got it! Thanks for the tip ;-)
At least banks and other victim institutions keep the whole thing secret. Great idea to render it public.
Another funny part in TFA:
Coincidentally, when the ransomware incident happened, the school's administration was looking into hiring an outside security provider.
What if it wasn't coincidental?
Everything I write is lies, read between the lines.
So when are we going to start including ransomware into the total cost of ownership?
Have any technical articles been posted on what all of these 'servers' were running?
There's a reason those pukianz force so many agencies to use that SharePoint shit.
My brother died because of SharePoint. The Republican mayor forced the city to buy it, and my brother was IT director and had to support it. Most of the city's employees quit because they couldn't do their jobs which made my brother's job even harder since he had even more people angry at him because SharePoint doesn't work. It got to the point where the police chief pulled his gun on my brother and threatened to have him raped in jail that my brother finally just gave-up on life.
They live it since the version tracking is broken which helps them hide evidence.
For me to do my offline backups.
They hate us cause they anus.
What is the typical attack vector for something like this? I understand how it might affect a home users own computers either by visiting malicious websites, or being unconcerned with what one runs that was downloaded from ithe Internet, but how does a place like a school get hit?
File under 'M' for 'Manic ranting'
So many useless, off-topic posts in this thread by political trolls; what's up with that? You shits have an issue with political candidates or parties, take it up at the polls, not by shitposting on Slashdot. Anyway..
Is anyone going to learn from these unfortunate incidents? There is no excuse for there not being decent security precautions and procedures in the IT department of any organization, and there likewise is no excuse for there not being adequate incremental backups of critical systems. Basically this school and the hospital in Hollywood were sloppy, and criminals capitalized (literally) on their sloppiness.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
I've got good backups... So I'd rather spend the $8500 on an airplane ticket and a pipe wrench. At least then I could have a little fun while I beat the life out of that little hacker faggot.
Perhaps people will start to take computer security seriously, if they see that it has an immediate impact on their budgets.
The real "Libtards" are the Libertarians!
God dammit, when I heard my elementary school got hacked I thought I was finally going to be able to get out from under the pernicious shadow of my Permanent Record!
... someone stole my slide rule. I had to pay them 1s and 6d to get it back. How times have changed!
Seriously, as long as groups/companies insist on running windows and offshoring the work, they will continue to be hit by ransomware and others.
Several decades ago, America used to be concerned about Security. Now, it is a joke.
I prefer the "u" in honour as it seems to be missing these days.
Anyone else read that as Horny County?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
You could fit a typical student record on a 3x5 card ... suck it up and just tell the crooks to go pound sand.
Based on the number of phishing emails I see weekly I doubt people are ever going to learn. Stuff like this is done because it works and has been working for decades.
Perl Programmer for hire
As someone who has worked in public edu IT for years - I have always maintained that eventually schools will be subject to the same security regs as major corporations - but with nowhere near the pay. I think that practically no one outside public edu has even the faintest idea just how lax public edu security typically is, because public edu cannot and does not pay enough to attract real IT expertise - especially security expertise.
the bitcoin chain lost the ransom! extortion attempt traced back to 16 year old kid who wanted his grades hidden
What kind of evil immoral f-ing asshole steals from a U.S public school... well, I mean, other than congress failing to fund education...
so these criminals can fund more attacks.
Sorry to read about your mental illness. Please seek professional care.
My guess is that everyone did.
... what about good backups?!
Just last week, one of my co-workers attended a Cisco seminar where they were peddling an "all inclusive" system to try to stop malware, and especially ransomware. It involved software you had to load on all of the clients, server-side software and special firewall type gear, all to try to "proactively stop ransomware from phoning home or uploading content anyplace". The price tag, obviously, was pretty steep as well.
Pulling his buddy, who worked at Cisco, aside for a minute, he asked, "If you have good backups, wouldn't all of this be pretty much unnecessary?" His friend smiled and nodded in agreement.
We use CrashPlan ProE where I work, backing up all of the client PC and Mac desktop folder contents in pretty much real-time, to the backup servers we designated for them based on the offices they operate out of. The servers themselves replicate to other servers at our other locations, for off-site backup copies, as well as a big chunk of the content we actively used getting stored on DropBox (where it's also possible to restore backups of deleted files or folders, or to go back to earlier versions if needed, using the backup and restore capabilities they provide business users).
As a general rule, if anyone was infected with ransomwarre that encrypted their data, we'd just wipe it and go to the latest good backup, and be back up and running with very little lost data (if any). Absolutely no reason to pay one of these hackers to unlock the stuff for us.
It seems to me that if you've got $8,500 to pay the ransom, then you had $8,500 to invest in some backup infrastructure instead....
Let's say you're a small business with ~30 employees. There are a handful of directories available with write access. Is good backups and blocking executable access the best way to protect yourself?
Once you add in benefits, pensions, overhead, and management, $50k is $100k. Burdened employment costs tend to be higher for governments, and even higher for public schools.
Software As A Service ?
Not me, I first thought it was a misspelling of "Whory".
Everything I write is lies, read between the lines.
Link?
Any time an effective virus or scam occurs, the news media never mentions the operating system.
The way to get infected is to let idiots run WINDOWS desktops with WINDOWS servers without backing anything up. Windows domains are standard operating procedure for most school districts.
The solution is to offload your sysadmin tasks to a third-party by moving everything to the cloud. The cost of running the sysadmin department can then be spread among many businesses.
What was the name of the computer Operating system this ransomware ran on?
i fap to trillions of pornography online and never seen one of these ransomware things and im fine
well my penis is a little sore, but im beggining to wonder if ransomware is real or its just as fake as fake bewbs