Slashdot Mirror
Ransomware Thieves Cost Canada University C$20,000 In Bitcoin (itworldcanada.com)
dkatana writes: The University of Calgary paid C$20,000 ransom this week after an attack on May 28 targeted computers used by staff and faculty members, crippling multiple systems and encrypting data files and email accounts. After determining that they were unable to recover the data the ransom was paid to "protect the quality and nature of the information we generate at the university," said an official in a press release.
The fact that higher education institutions are now being targeted by ransomware is raising serious questions about their ability to protect their data and critical information systems.
IT World Canada has more details, noting that the university has reported the incident to the police, and that Trend Micro "has seen a 20% uptick in malicious requests to command and control infrastructure from infected machines over the last three months" -- several thousand requests a day.
The fact that higher education institutions are now being targeted by ransomware is raising serious questions about their ability to protect their data and critical information systems.
IT World Canada has more details, noting that the university has reported the incident to the police, and that Trend Micro "has seen a 20% uptick in malicious requests to command and control infrastructure from infected machines over the last three months" -- several thousand requests a day.
How much would an automated (offsite) backup cost them?
Sig ?
I bet they're sorry now.
Sorry.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
It's just oee students semester of tution fees.
This keeps up they're gonna start inconveniencing people who matter. There's a reason they use bit coin for this. It's harder to trace and easier to launder.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I'm not the douchebag AC you replied to. Slashdot was once exactly the place for news like this. It was just about the only site that stayed up on 9/11. Slashdot was up and providing updates while even CNN was basically offline. It's a strange decision to not post a story about the Orlando shooting in the context of other mass shooting ls that Slashdot has posted about. The relevance to the site is debatable, though. And not posting a story is hardly disrespectful, despite the troll who keeps spamming about it.
If the data worth more than what the ransom is why not? Even the FBI recommend paying in bitcoin if you really want the data back. It's sound terrible but that's cheap to get a lesson and secure or backup your data properly!
Find these fuckers and execute them live on PPV. Maybe that would put a damper on this shit.
I have a musical suggestion for you.
Military are there to kill and to die. it's just their job.
aaaaaaa
Stop. Using. Computers.
Sent from my telegraph.
Whoops, should be $20k.
The real "Libtards" are the Libertarians!
Maybe because we get pissed about idiots who post their bullshit in stories that have nothing to do with them. For some odd reason such twits didn't exist 10 years ago.
Maybe 'cause the relevant people didn't know how to use a keyboard yet.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
...and the stupid morons paid up so they will just encourage them more.
Depending on the amount of bitcoins you have that would actually affect the market price of the remaining bitcoins.
Hmm... what does happen to bitcoins that are "lost" somehow, anyway?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I doubt, 20K for a large organisation is nothing. The only thing they probably don't want is too much publicity but when you are a publicly funded institution you have to be transparent.
And there you go.
Remember the IT member who told you, "Hey, this is insecure, we should change this" And you blew him off because you didn't want the expense or didn't care, or thought it would never happen, or thought you knew better? Congratulations, your red face and excuses you're making now to hide the fact that you were told and warned about this are priceless.
Not that expected behavior is going to change.
Canada should outlaw paying ransoms. In any case, outlaw paying for government institutions! I am a Canadian taxpayer and I do not want a university to support criminals. Let them just eat the loss if they haven't had backups.
17779 eligible voters in a district, 17779 'vote' as one. This is Russia.
I don't understand - why pay the ransom when you can just restore from backups? At most, it's less than a single day's worth of userdata lost.
It is always a temptation to an armed and agile nation
To call upon a neighbour and to say: --
"We invaded you last night--we are quite prepared to fight,
Unless you pay us cash to go away."
And that is called asking for Dane-geld,
And the people who ask it explain
That you've only to pay 'em the Dane-geld
And then you'll get rid of the Dane!
It is always a temptation for a rich and lazy nation,
To puff and look important and to say: --
"Though we know we should defeat you, we have not the time to meet you.
We will therefore pay you cash to go away."
And that is called paying the Dane-geld;
But we've proved it again and again,
That if once you have paid him the Dane-geld
You never get rid of the Dane.
It is wrong to put temptation in the path of any nation,
For fear they should succumb and go astray;
So when you are requested to pay up or be molested,
You will find it better policy to say: --
"We never pay any-one Dane-geld,
No matter how trifling the cost;
For the end of that game is oppression and shame,
And the nation that pays it is lost!"
~~Rudyard Kipling
It isn't just backup software. It is implementation, and the 3-2-1 system, with inherent resistance to malware. Even if one doesn't use tape or cloud, devices like Isilons offer functionality like SmartLock which gives WORM functionality to a directory to ensure that snapshots remain around for a period of time, even if mayhem ensures everywhere else but a physical console.
With cloud backups, S3 isn't cheap, but it is decent for offsite storage, especially with so many client side encryption APIs available. Even Glacier can be useful for archived data, where it can be encrypted, shoved over, and forgotten about. Yes, it will be expensive to retrieve, but at least it is offsite.
The problem is that security and backups have no visible ROI in the eyes of most managers, so it always gets the hind teat. Until something breaks, that is.
I think you answered your own question. You pay out if it's cheaper than the amount of lost data (plus any extra downtime that restoring from backup would cause over decrypting all the files, I guess). I assume that UofC officials are competent to make that call.
... serious questions about their ability to protect their data and critical information systems.
What a stupid thing to say. It isn't lack of ability - universities, of all places would have the experts or easy access to experts in other places to handle security. It is a question of taking the risk serious enough to spend the time and poney. I suspect many universities, or certainly their management, still don't think they have much worth stealing; after all, ideas and research are traditionally shared openly by the scientific community, and that is the real treasure owned and produced by universities. What they need is a rethink - after all, being able to handle "unimportant stuff" like administrative accounts, staff records etc is important too, at least if you hope to get paid.
Oh Donald...you silly.
There are unix, linux, android, mac OS X, and Chrome ransomware variants. Are you suggesting we all switch back to DOS?