Slashdot Mirror
Ransomware Infects All St Louis Public Library Computers (theguardian.com)
An anonymous reader quotes a report from The Guardian: Libraries in St Louis have been bought to a standstill after computers in all the city's libraries were infected with ransomware, a particularly virulent form of computer virus used to extort money from victims. Hackers are demanding $35,000 (£28,000) to restore the system after the cyberattack, which affected 700 computers across the Missouri city's 16 public libraries. The hackers demanded the money in electronic currency bitcoin, but, as CNN reports, the authority has refused to pay for a code that would unlock the machines. As a result, the library authority has said it will wipe its entire computer system and rebuild it from scratch, a solution that may take weeks. On Friday, St Louis public library announced it had managed to regain control of its servers, with tech staff continuing to work to restore borrowing services. The 16 libraries have all remained open, but computers continue to be off limits to the public. Spokeswoman Jen Hatton told CNN that the attack had hit the city's schoolchildren and its poor worst, as many do not have access to the internet at home. "For many [...] we're their only access to the internet," she said. "Some of them have a smartphone, but they don't have a data plan. They come in and use the wifi." As well as causing the loans system to seize up, preventing borrowers from checking out or returning books, the attack froze all computers, leaving no one able to access the four million items that should be available through the service. The system is believed to have been infected through a centralized computer server, and staff emails have also been frozen by the virus. The FBI has been called in to investigate.
After two decades of this crap, you'd think they would learn.
Just boot into snapshot and roll it back... oh wait. STL is probably too cheap to pay for snapshot managers for public terminals...
Probably not.
...sounds like they have valid backups, so this should be considered a "success" story more than anything else.
Still, I do wonder if the admins were practicing valid security, how anything could have infected the entire system.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
As a St. Louisan, I'm glad they're not paying. It sounds like there are some serious issues while they restore their systems, but it sounds like they do have backups. It will take awhile to clean up the mess, but I applaud them for not giving in to the criminals responsible for this. Although many articles aren't clear about this, the library did have backups to restore from, so despite the security breach, someone knew what they were doing well enough to avoid paying the ransom demands. Good for St. Louis not giving into these demands.
Where the hobos beat off to Internet porn and illegal aliens drop off their anchor babies.
Make America Great Again
Deport all H1-B indo-chimp STREET SHITTERS.
Give American IT jobs back to Americans!
Fuck all you libtard SJWs
8====D~~~ ~. -1 THAT cock suckers!
What will the library dwelling hobos do to occupy their time without computers? Masturbate in the washrooms? It's already filthy enough in there. I hope someone is planning on paying overtime for janitorial service.
Come on, you clowns. Apply some critical thinking.
St Louis ... libraries. Pull the other one, it plays a tune.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
If they are just machines for public web browsing, there i3s no data to ransom. Just reinitialize them. Firefox works great on Linux BTW and you have a much smaller attack surface.
Nobody reads at the library anymore.
It takes a special kind of asshole to attack a library; a place where people go to learn and access the internet. Why go after one of the poorest resources and attack those that have the least to give? Go after the fucking fortune 500 companies but not a fucking library. One only hopes that anonymous could turn the tables on these slimy thieves.
Mostly reminds me of my experiences as a volunteer trying to support the public-use computers in the Austin Public Library. That was almost 30 years ago, way before we had anything like network access problems. Basically I wound up just wiping the systems every time I visited and restoring them as well as I could to their "legal" condition. The big problem in those days was just pirated software, especially an expensive CAD package, but the big threats these days are keyloggers intercepting passwords used for email and data stored in the network...
That reminds me of a much more recent fiasco involving Amazon and a public library in Indiana. Someone created a fake Amazon account in my name and validated the email address using some kind of bug in the Android app. Amazon never volunteered any meaningful details, but I'm believing the name and email address were just a dictionary attack. However, this thing went on for a year and a half before Amazon finally stopped it. One aspect of the scam obviously involved borrowing electronic books from a public library. If that was the only thing going on, then I'm only offended by the association of my name with some rather execrable books, but I think there must have been a money trail, too, or it wouldn't have gone on for so long... (Did you know you can escalate to jeff@ when you get desperate enough? At least it seemed to work in my LONG case, though the two-step solution was obvious in my FIRST contact with Amazon's customer so-called service.)
Historical trivia. Always want to close with a constructive suggestion, but it's hard to come up with one... Follow the money and break the criminals' economic models is kind of obvious, isn't it? Easy to say, but hard to do, even if the criminals are just ingenious fools.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
It's mostly used for illegal stuff anyway, and we have plenty of ways to transfer money that are traceable. We don't need bitcoin, or any cryptocurrency.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Oh No, they did not use Linux !
aaaaaaa
Second - St. Louis' libraries almost certainly can't afford to pay even one of these mutts. Libraries were once magnificent places where people went to read and borrow dead-tree media (a.k.a., books, although periodicals and reference works were also available there). While libraries have become the one publicly available free-as-in-beer places to get internet access, their core mission of providing free access to reference, literary and other materials was not directly impacted by this. One could still walk into a library, look up a desired text in the card catalog and physically access a nearly exploit-proof repository of knowledge and information. They don't have budgets for IT security which would prove to be exceedingly difficult to provide on hundreds of publicly accessible computers, nor do they have a mandate to provide electronic services.
Third - and this ties back to second - libraries in general don't have a budget for public IT. They can't afford the expertise to implement FOSS when the vast majority of the people who will maintain and use the provided services are not trained to use it. Even on their web presence, ease of implementation (which probably contributed to this problem) equals lower TCO for them.
Perhaps, but it seems many hack at the library !
aaaaaaa
Do I need to say it again? A good back up strategy would get them back on line pretty soon - a few hours if not less.
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
Sounds like a perfect opportunity for some teenagers to set up a wifi mesh network inside the library and connect the mesh to the internet using burner phones. I hope someone did this! I would donate equipment to help build it if I were anywhere near St Louis.
These nazis will block the account of any kid who takes a screenshot of a page of their books. They monitor them with keystroke loggers, just like any criminal hacker group. Good thng for them americans are too yellow to complain. But they can't control offshore whistleblowers.
Ransomware Thieves Cost Canada University C$20,000 In Bitcoin
Isn't it interesting how this works?
When you see a phrase like "a particularly virulent form of computer virus", that usually means "We don't even have basic protection on our systems, so we will make it sound as if the virus is really really mean".
Of all places libraries should be adopting Free Software and rolling out systems that make it easy to surf anonymously / maintain them. For instance network booting may have helped this situation, alongside proper backups, and similar.
I did a quick count, and the city of 1.4 million people I live in has 59 libraries. St. Louis has 2.9 million people. Very few of them read apparently.
Sharing copyrighted material, eh?
If a user can install any software (intentionally or unknowingly) then that system was not properly locked down. It is easy to whitelist binaries in Windows systems. There are Linux distro which is booth only versions, which means nobody can modify the filesystem. Users who want to save or create documents should bring their own USB sticks or blank CD/DVD because there's no write permission on the system drive.
This is not an actual life-form. Why not just call it clever software written by thugs and thieves?
"Libraries in St Louis have been bought to a standstill after computers in all the city's libraries were infected with ransomware, a particularly virulent form of computer virus used to extort money from victims".
Do you mean a Windows Word Macro virus?
Blacks do not like to read.
"The system is believed to have been infected through a centralized computer server."
Not exactly sure what that means, but it seems to indicate that the problem didn't originate with an end user. I expect that they were smart enough to lock down the clients which are accessible to the public.
STILL WORK!
The only danger to them is the occasional termite
My local library runs a Linux server with thin clients. The browser is the publicly facing interface. Even the high school assistants know how to restart X. I am not aware of the system ever failing, even though the admin has redundant systems in place.
In that library, everything just works.