Slashdot Mirror
South Korean Web Hosting Provider Pays $1 Million In Ransomware Demand (bleepingcomputer.com)
An anonymous reader writes: Nayana, a web hosting provider based in South Korea, announced it is in the process of paying a three-tier ransom demand of nearly $1 million worth of Bitcoin, following a ransomware infection that encrypted data on customer' servers. The ransomware infection appears has taken place on June 10, but Nayana admitted to the incident two days later, in a statement on its website.
Attackers asked for an initial ransom payment of 550 Bitcoin, which was worth nearly $1.62 million at the time of the request. After two days of negotiations, Nayana staff said they managed to reduce the ransom demand to 397.6 Bitcoin, or nearly $1 million. In a subsequent announcement, Nayana officials stated that they negotiated with the attackers to pay the ransom demand in three installments, due to the company's inability to produce such a large amount of cash in a short period of time.
On Saturday, June 17, the company said it already paid two of the three payment tranches. In subsequent announcements, Nayana updated clients on the server decryption process, saying the entire operation would take up to ten days due to the vast amount of encrypted data. The company said 153 Linux servers were affected, servers which stored the information of more than 3,400 customers.
Attackers asked for an initial ransom payment of 550 Bitcoin, which was worth nearly $1.62 million at the time of the request. After two days of negotiations, Nayana staff said they managed to reduce the ransom demand to 397.6 Bitcoin, or nearly $1 million. In a subsequent announcement, Nayana officials stated that they negotiated with the attackers to pay the ransom demand in three installments, due to the company's inability to produce such a large amount of cash in a short period of time.
On Saturday, June 17, the company said it already paid two of the three payment tranches. In subsequent announcements, Nayana updated clients on the server decryption process, saying the entire operation would take up to ten days due to the vast amount of encrypted data. The company said 153 Linux servers were affected, servers which stored the information of more than 3,400 customers.
So, outside of the question of where are all your backups, dB logging, aux-copy, snapshots, etc... How did this happen?? (reads bottom part of article)..
Nevermind....
While this is new from the concept of internet transfer, the same kind of story happened every for debt payment regarding drugs or gambling. Don't start blame Bitcoin on that... bad guys just use the best technology around as usual.
What, you thought it was the Chinese?
Lol.
-- Tigger warning: This post may contain tiggers! --
"It's a lot cheaper for us to hire some really awful people to find you and get the money back, so why don't you just hand over the encryption keys right now?
Always pay the ransom folks.
Is there any reason why the actual ransomware payment shouldn't be a couple of tomahawk cruise missiles fired on the location of the attackers? These criminals are the scum of the Earth, so why shouldn't governments be taking them out when they get the chance? While businesses and individuals should keep backups to protect against hardware failures, these criminals are leaches on society and serve no useful purpose. Even if you have backups, these ransomware infections cause completely unnecessary downtime that, in and of itself, is harmful to individuals and businesses. Why not take the bastards out? Nothing of value would be lost.
Once again, a company is managed by sales guys not tech guys. What could possibly go wrong?
IT Guy: "We need to upgrade our servers."
Business guy: "That costs too much. Don't bring suggestions like that to a meeting again!"
IT Guy: {{okay.png}}
Oh wait. Maybe it was an inside job?
The gnuplot thickens!
The dangers of knowledge trigger emotional distress in human beings.
The take-away line for me was at the end where it mentions the affected machines are 153 Linux servers that got encrypted. Linux. Let that sink in. Unless these were VM's running on a Windows hosting base, Linuxland has a large threat to face.
You would think that Bitcoin would be able to come up with a "poison pill" or something similar that allows companies to "pay" their ransom, but the coins dissolve (or send out a tracking beacon!) after some time has passed.
If you pay the ransom in secret, then the guys who set you up this time now know a three of useful things:
1) You are stupid enough to pay ransoms.
2) You are stupid enough to run vulnerable systems which make setting up the demand possible.
3) You have the money to pay these ransoms.
In short, you just lit up an enormous great SUCKER sign right up above your heads, but only for the criminal group that ran the fiddle.
These utter idiots have however publicly said that they paid the ransom. Now every script kiddie on the planet knows those three facts, and they are ALL going to be gunning for the known-rich suckers.
This company can be counted as dead and gone right now. If you own stock in it, get rid soonest, before it becomes worthless.
They're funding this by making the decision to give so much money to criminals. Now the criminals can afford to break the law even more. This is just like how Republicans like Trump give guns to criminals so that they can use them to steal money so they can afford even more guns to steal even more. The feedback loop means that all thinking people are slaves to the gun owners.
Embezzlers at corporations as well as government agencies walk away with stuff like this every day.
If it takes 10 days to decrypt the data, wouldn't it have taken at least that long to encrypt it? So :
1. Didn't any of the Nayana admins notice any unusual activity? I'm guessing not, given the breadth and depth of their other server configuration shortcomings.
2. Didn't any of the customers notice their data disappearing?
3. If a new file is added to the system at this point will it be encrypted? If an existing encrypted PDF file is renamed with an extension/type NOT in the encryption type list, will it get decrypted?
The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.
... probably would've cost them more.
Then, lost customers.
Well played, ransomers, well played
charge them for conspiring with and funding criminals
I remember these dates were similar to some banks going offline because of database errors.
According to some tech sites the ransomware which attacked Nayana is Erebus.
pay the ransom demand in three installments, due to the company's inability to produce such a large amount of cash in a short period of time.
Any company stupid enough that they have to pay ransom in the hope of getting their data back (there's a good chance they won't) deserve to go broke. BACKUPS. CONTINGENCY PLANS. Yeah it takes time and money but it's a lot fucking cheaper than sending random criminals millions of dollars and then listening to the sound of them laughing at you when they simply disappear with the money.
Seven puppies were harmed during the making of this post.
What, they had no DR strategy? This type of incident is just what DR is for. Your data is a smoking hole in the ground. Now, rebuild. You have 24 hours.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Headline should say, "Company would rather pay million dollar ransom than pay for competent help"
Who cares? Why is this is on Slashdot? We all already know. The situation is predictable and happens all the time. Water is wet, news at 11.
"Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen
So how do you pay $1M (or any amount) of bitcoin to a the ransomware owners without getting some sort of guarantee from them that they will actually deliver the decrypt key? You just send the transaction and hope they hold up their end of the bargain?
If they were in communication with the bad guys, that means there is some communication trail back to them. I can't see savvy malware people exposing themselves that way.
The ransomware writers allowed them to pay the rest later, so they had to tell the ransomware to postpone the deletion of files.
lets assume there is some honour amongst theives and eventually everything is given back somehow. Who would remain with these hosts ?
Nobody, with half a brain will, and who would think any data is now accurate and not modified.?
NSA, CIA, the spying and sabotaging of foreign countries infrastructure, and the leaking of purposely made security holes allowing others to do the same, are all symptoms of America and the American citizen's attitude to the outside world.
The sooner you kick the Americans out, the better, and you should always assume they are doing everything to break in.
Word needs te get out, that secret service organizations have started to see this behavior of criminals as a threat to national security / national interests.
When MI5 / CIA / FSB people start making people wake up with their testicles in a glass on the nightstand, the willingness of talented hackers to go for the "easy" money will decrease. Till then, every talented guy living in a shithole in eastern Uzbekistan will see this method as a way out of his shitty live.
Why are other peoples sig's always more witty ???
Great job guys. You just fed an organised crime group. They'll spend it wisely on weapons, kidnappings, murders, and other abuse that will make them even more money. And what for? A bunch of websites?
They would have been safe! because you know, Linux!
And who cares if a windows server got infected because it was never patched - still all windows fault!
I'm just a small video game developer, and maybe I'm neurotic/not in vogue, but I only feel good when I have 2 offline backups of assets and important builds in addition to whatever online backups I have.
The hardware costs and effort are trivial compared to a catastrophe. (Plus I just like having more computer hardware.)
In my mind, "an ounce of prevention is worth a pound of the cure" is an understatement.