Slashdot Mirror
Ransomware Insurance Is Coming (onthewire.io)
Trailrunner7 quotes a report from On the Wire: As bad as the ransomware problem is right now -- and it's plenty bad -- we're likely only at the beginning of what could become a crisis, experts say. "Lots of people are being infected and lots of people are paying. The bottom line its it's getting worse and it's going to continue to do so," Jeremiah Grossman, chief of security strategy at SentinelOne, said during a talk on the ransomware epidemic at the RSA Conference here Monday. "Seven-figure ransoms have already been paid. When you're out of business, you'll pay whatever you have to in order to stay in business. You're dealing with an active, sentient adversary." The ransomware market seems to be headed in the same direction as real-world kidnapping, where high-profile targets take out insurance policies to pay ransoms. Grossman said it probably won't be long before the insurance companies latch onto the ransomware game, too. "The insurance companies are going to see a large profit potential in this. Kidnapping and ransom insurance is still very boutique. This economic model will probably apply equally well to ransomware," he said. According to The FindLaw Corporate Counsel Blog, "Ransomware attacks fall under your cyber insurance policy's 'cyber extortion' coverage and can generally be considered "first-party" or "third-party" coverage, according to Christine Marciano, president of Cyber Data Risk Managers. Third-party coverage would likely leave a company uninsured when they are the victims of a ransomware attack. Even if your insurance policy covers ransomware attacks made against your company, the deductible may be so high that the company will be stuck paying any ransomware demands out of pocket (should the company decide to pay to decrypt its data). And your coverage may be sub-limited to relatively small amounts, according Kevin Kalinich, the global cyber risk practice leader for Aon Risk Solutions. A $10 million policy may only provide $500,000 for cyber extortion claims, he explains."
...probably from the same people writing the ransomware.
BACKUP YOUR SHIT
As long as the insurance companies put in a mandatory security training course to qualify for this, I'm okay with it. Why do people still open unknown executables in emails?
Problem solved.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Insurance companies are experts in mitigating and evaluating risk - It's literally their job.
In order to get insurance, insurance providers will require their customers to educate their staff and ensure they have a minimum baseline of security.
The very basic, most bare of security practices reduce ransomware's impact to an annoyance. Separation of privileges, backup, software updates, email attachment filtering - You know stuff you should be doing already.
What guarantees does anyone paying a ransom get that they will be able to unlock their data? If you are dealing with ransomware, you are dealing with crooks who don't have any morals whatsoever. Once they get payment, why wouldn't they just let you twist in the wind? Many kidnappings are the same. You pay the ransom and you still get a dead or missing relative.
This will just drive up the costs of ransomware, because once anything becomes subsidized with "someone else's money" (see: healthcare, college education) a vicious cycle ensues. Soon everyone will require ransomware insurance, with annually increasing premiums.
Come on, ANY company should have backups. THIS is your insurance. FFS, servers offer previous version rollback and snapshots for the fast recovery, it's not rocket science anymore.
I know the best insurance is having competent IT pros that can make ransomware no more than a minor inconvenience, but I suspect there are many small/medium businesses that would find this a cheaper alternative than staffing such a department.
Idiot insurance
love is just extroverted narcissism
Ransonware should be included FREE with Windows.
Windows is the most secure windows EVER. Microsoft should put it's money behind this. I can see nothing wrong with this.
After all, it's a product with NO WARRANTY, or even FITNESS FOR A PARTICULAR PURPOSE, and CONTAINS KNOWN DEFECTS. But hey, its the most secure version of windows ever!
All MSFT marketing data about you is transmitted very securely to a very secure microsoft server.
Your actual data on the other hand...
1. Back up your data
2. Install the ransomware yourself on the computers.
3. Cash in on insurance policy
4. Reinstall data from backups.
Seven puppies were harmed during the making of this post.
The problem with this is, while it may help out a clueless company in the short term, the incentive for the insurance company is to pay the ransom, because it rewards the evil-doers, which, in turn creates more need for the insurance.
That was the turning point of my life--I went from negative zero to positive zero.
Nobody likes paying for IT. Outside of nerds (the neckbeard kind, not the modern "nerd") people hate computers. They hate how they make them feel weak and dumb. They hate that they can't seen them working because so much goes on behind the scenes. And above all they hate that they put power in the hands of the sorta twerps they used to see bully (or bully themselves) in grade school.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
You're guaranteeing the bad guys a paycheck.
HOSTs does not protect against attacks on the network infrastructure, which is the real future of attacks, not shit ransomware.
Smart security-minded people look towards the future, and don't desperately hang onto a fuckup from the past like you do.
That is its purpose.
Have a friend who works for a mid-sized insurance firm that provides Cyber Insurance, it's actually exclusively what he does now. So what they do is get you to agree that you'll take all these preventative measures to avoid it (ie making backups) and when you get ransomwared they find some particular provision you violated to not pay your claim. Like any insurance of course.
Now we see why this was happening in the first place. setting up for 'insurance' plans.. ...yet another scam to fleece even more people....
> the incentive for the insurance company is to pay the ransom
What insurance companies actually do is set conditions that *reduce* risk for their customers, so They don't have to pay anyone. They also create organizations such as Underwriters Laboratories and the National Fire Protection Association (who write the fire code).
In this case, the insurance company will require that in order to get converage, you'll need to have *proper* backups, with a checklist of requirements for *proper* backup. Then they never have to pay out, and collect (small) premiums basically in exchange for forcing companies to test their backups quarterly.
Some pretty important data you have there. It would be a pity if something were to happen to it. You can't be too careful these days. By the way, how are the wife and kids doing.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Use Linux and use separate partitions as follows: /boot ext2
/ ext4
Swap /home ext 4 encrypted
Then, install Clamav and Lynis to check for viruses (more like passing on prevention for Window$ than for actual Linux) and rootkits.
And if you find anything, you can reinstall Linux and leave the /home partition alone in most cases so you don't lose anything. Keep a list of installed packages and just drag and drop after apt-get install, yum, or zypper in the terminal.
There have been actual cases when people try to get access to computers by lying about detecting malware on their computer over the phone. The user says he uses Linux and not Windows. They hang up immediately. I wouldn't pass these "insurance" companies to be any different.
While I mislike running such software in what I still think of as kernelspace (ring-0, I think?), I recognize why this has to run there under Windows, unless you like answering UAC requests all day. I'm going to give it a shot - this time, on physical hardware in daily use instead of sandboxed in a carefully managed VM (having already confirmed in the VM that it doesn't do anything schiesty). I have no intention of endangering my system (for example, by intentionally permitting a ransomware attack on my machine). Since I've never fallen prey to any exploits I'm aware of, I doubt that I'll have anything to report on that score.
If it lives up to all you've claimed for it by itself, I'll be shocked. If it lives up to expectations, I'll be content. Suffice it to say I'll relate my experience with it here. I've seen what I consider a distinct improvement in your online comportment of late - let me go ahead and give your host lookup tool a shake. You'll hear back from me.
Testing . . .
I'm fairly certain insurance companies will require protection against that before they issue a policy.
I've been hoping we could get something like Underwriters Laboratories (UL) or the National Fire Protection Association (who authors the fire code) for security, and someone to get companies to follow the standards. Insurance companies created UL and NFPA and require corporate clients to mitigate risks that could result in a payout. I have hope they will be a very good thing for security. Insurance companies evaluate and manage risk for a living, and they are good at it.
I'd not be opposed to a team of spec-ops style enforcers who hunt down and find ransomware operators, drag them out of their apartments by their testicles, and then beat the shit out of them with baseball bats while filming them. Imagine those delicious wet "smacks" of their heads caving in and posting them to various sites to show what future wanna-bes have in store.
A.P.K. most of these come through email attachments you numb nuts. How the fuck is a host file going to make any difference in that case? If you have the mail server in the hosts file the fucking mail server is still going to serve up the tainted email. For fucks sake please go be autistic somewhere else.
See subject: I do say hosts do MORE than ANY other single solution does more efficiently/for less using what you already have natively. I also do say that "layered security"/"defense in depth" is THE strategy to employ in security guides I wrote 11++ yrs. ago that got me PAID http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&src=IE-SearchBox&FORM=IESR02&pc=EUPP_/ for their content (using the highly esteemed easy to use CIS Tool which took fixes from "yours truly" too, no less).
As far as HOW/WHY hosts work for security? Read more here (stops enslavement into botnets) https://news.slashdot.org/comments.pl?sid=10240595&cid=53862609/
* NEWEST BUILD WAS JUST UPLOADED Monday 02/13/2017 @ 10 p.m. EST USA SO IF YOU TRY IT? Get the latest/greatest (redownload to be sure) a few minutes ago.
APK
P.S.=> 8 security pros also feel hosts = good security! See here https://it.slashdot.org/comments.pl?sid=10205115&cid=53815959/ ... apk
Links to malicious payloads downloads are nullified in email & if done by attachments hosts cut off botnet C&C communication, effectively paralyzing it as I said, that does the rest (nullifes the malware communicating back to its handler/controller for coordination).
APK
P.S.=> Hosts are good security, again, see here if MY word's not good enough https://it.slashdot.org/comments.pl?sid=10205115&cid=53815959/ ... apk
... only after having the company agree to a regular audit of its backup systems, and ensuring automated redundant backups of crucial data...
It's called "Time Machine". Also it's called periodically burning things to optical media just in case of catastrophic loss. It's also called not using Misrofuck Shitblows. I have yet to have this problem. One, I use UNIX, two, I back things up automatically and routinely, and three, I back things up manually to a different device. Also, I don't run programs or open random shit I find laying around on the intertyubes.
This insurance costs exactly the same as the insurance I pay against disc crashes, power surges, break-ins, (not all backups are stored in the same place,) so not that I want to invite someone to try, because why invite that kind of annoyance, that's all it would be. Annoyance.
(changes all passwords...)
Now if something would happen to it...;) I have already insurance against malware, got a Mac, a GhostBSD and a Linux at home, and at work all my servers are Linux and FreeBSD, thank you.
(and keep the cryptographic keys, just in case backups fail)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
This isn't a new thing. It's been around for a while.
And it's not just about paying the ransom. The ransom is usually a very small amount of money in the whole scheme of things. It's about being able to conduct business like paying your vendors and employees while your system is down.
"A plan fiendishly clever in its intricacies"- Homer Simpson
"I'm going to give it a shot - this time, on physical hardware in daily use instead of sandboxed in a carefully managed VM (having already confirmed in the VM that it doesn't do anything schiesty) - by mmell (832646) on Monday February 13, 2017 @09:22PM (#53862413)
As you see, APK Hosts File Engine IS completely safe & performs as I stated:
"So far it's done what I would want. So far, no downside. Page load times are predictably much better. Seems to be installed and running correctly" - by mmell (832646) on Tuesday February 14, 2017 @12:02AM (#53863115)
Thanks for testing. Enjoy the program & faster/safer online experiences.
APK
P.S.=> Onwards & UPWARDS... apk
See my subject: Proof you substantiated testing my program is safe 1st in a VM & then that it works w/out it https://news.slashdot.org/comments.pl?sid=10240595&cid=53865387/
Your opinion on its intuitiveness is purely arbitrary. Other /.ers disagree https://it.slashdot.org/comments.pl?sid=10221475&cid=53831639/ & https://it.slashdot.org/comments.pl?sid=10221475&cid=53831653/
As far as how it works, it comes FULLY DOCUMENTED in its readme tab & .txt files it ships with.
* Your DNS issues in Windows MAY be the faulty w/ hosts files slower usermode clientside dnscache service (it's broken in a few ways & remote DNS is LOADED w/ security & inefficiency issues galore https://news.slashdot.org/comments.pl?sid=9007355&threshold=-1&commentsort=0&mode=thread&pid=51969075/ ).
APK
P.S.=> I imply nothing. I merely state facts. It's all any product needs to be successful so I stick by it & it's yet to do me wrong... apk
See my subject & a conversation w/ mmell here (ask hairyfeet or BarbaraHudson - they tried what you are now & failed (years ago))!
Show me where I have said i.e. "hosts do everything under the sun" (I never once have - I only say they do far more for far less on many levels, natively, vs. ANY other SINGLE "so-called 'competitor'" does, & minus their bloating ineffieciency & security issues (dns/antivirus/addons that are paid off to NOT work fully by default)).
Just know spamming Slashdot isn't going to win you any favor with it
Many /.ers disagree w/ you (including mmell now) https://it.slashdot.org/comments.pl?sid=10221475&cid=53831639/ & https://it.slashdot.org/comments.pl?sid=10221475&cid=53831653/
APK
P.S.=> It's excellent in LAN/WAN settings too (a domainwide admin can easily migrate hosts to any Server or PC endpoint using scripts he runs manually, or on timed chronjobs/windows scheduled tasks, or logon/startup scripts)... apk
I think you can expect that the insurance carrier will require certain measures to be in place, especially reliable and tested backups. They aren't going to insure you against ransomware per se, they will only cover any losses incurred while restoring, or something similar. And it will have to be direct, quantifiable losses, such as cost of recalling tapes from storage. If you somehow found a carrier willing to insure you against enormous undefined losses due to your own failures, you can bet the premiums will be far higher than the cost of the backups.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
The worst ransomware is what has euphemistically come to be called "medical care."
Prevention = best medicine (& what you can't touch can't hurt you) via NEW APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/
Ads & malware rob speed/security/privacy
Hosts add speed (via hardcodes/adblocks), security (vs. bad sites/malware/poisoned dns), reliability (vs. dns down), & anonymity (vs. dns requestlogs/trackers).
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity & faster vs. addons/routers/remote dns!
Avoids DNSChangers in routers/IP settings & dns redirects (99.999% of ISP DNS != patched vs. it) + lightens DNS load & resolves faster from local system RAM!
* Via what you NATIVELY have built into the TCP/IP stack in FASTER kernelmode!
APK
P.S. - Safe https://www.virustotal.com/en/file/e01211ca36aa02e923f20adee0a3c4f5d5187dc65bdf1c997b3da3c2b0745425/analysis/1433430542/
See my subject: By stopping it inside of networks by preventing users becoming accomplices enslaved in a botnet for DDoS attacks for example by blocking out the ability to obtain client malware that makes them enslaved 'zombie' system.
Hosts also prevents the same malwares for enslavement from talking back to their Command & Control/C&C servers as well, making said malware a 'zombie' itself.
APK
P.S.=> Small minded people like these security experts who say hosts = good security? See here https://it.slashdot.org/commen... 5959/ there's 8 of them right there, well-known security pros, who say COMPLETELY the opposite of what you do... apk
Yes, backup is good, but Ransomware should not be able to operate on a good Linux OS : so, how to foolproof one's Linux distro? /home partition?
NoScript is good for preventing webexploits, but if one wants to surf the Net, at least some javascript must be allowed: what happens if one of these supposedly benign script is in fact malicious?
They shouldn't be able to touch the root files IIUC, nor to install a ransomware, but what prevents them to encrypt the
I've heard of an escalation exploit in X, but don't know much more about it: is it something that one should fret about? Is there a way to protect one's system against it?
KillDisk apparently targets Linux now, but I couldn't find an explanation on HOW he manages to do that; the best I could find was an allusion to the fact that it cannot infect a Linux by itself but runs on already infected linuxes... Is that true?