Slashdot Mirror
Atlanta Still Struggles To Recover From Ransomware Attack (reuters.com)
An anonymous reader quotes Reuters:
Atlanta's top officials holed up in their offices on Saturday as they worked to restore critical systems knocked out by a nine-day-old cyber attack that plunged the Southeastern U.S. metropolis into technological chaos and forced some city workers to revert to paper... Police and other public servants have spent the past week trying to piece together their digital work lives, recreating audit spreadsheets and conducting business on mobile phones in response to one of the most devastating "ransomware" virus attacks to hit an American city. Three city council staffers have been sharing a single clunky personal laptop brought in after cyber extortionists attacked Atlanta's computer network with a virus that scrambled data and still prevents access to critical systems. "It's extraordinarily frustrating," said Councilman Howard Shook, whose office lost 16 years of digital records...
City officials have declined to discuss the extent of damage beyond disclosed outages that have shut down some services at municipal offices, including courts and the water department. Nearly 6 million people live in the Atlanta metropolitan area... Atlanta police returned to taking written case notes and have lost access to some investigative databases, department spokesman Carlos Campos told Reuters... Meanwhile, some city employees complained they have been left in the dark, unsure when it is safe to turn on their computers. "We don't know anything," said one frustrated employee as she left for a lunch break on Friday.
"Our data management teams are working diligently to restore normal operations and functionalities to these systems," said a spokesperson for the police department, adding that they "hope to be back online in the very near future."
City officials have declined to discuss the extent of damage beyond disclosed outages that have shut down some services at municipal offices, including courts and the water department. Nearly 6 million people live in the Atlanta metropolitan area... Atlanta police returned to taking written case notes and have lost access to some investigative databases, department spokesman Carlos Campos told Reuters... Meanwhile, some city employees complained they have been left in the dark, unsure when it is safe to turn on their computers. "We don't know anything," said one frustrated employee as she left for a lunch break on Friday.
"Our data management teams are working diligently to restore normal operations and functionalities to these systems," said a spokesperson for the police department, adding that they "hope to be back online in the very near future."
They should all be sacked.
Backups. Backups. Backups.
Simple. Known process.
Not done = sacked.
No - They where probably running outdated Java based web servers, that where hacked using an open source tool.
And those web servers can run on any OS, so it has nothing to do with Linux.
We complain bitterly about problems with industrial espionage and yet we still cheap out and use crapware swiss cheese .Net garbage that hackers in China and Russian can drive a truck through.
This message was not sent from an iPhone because Peter Sellers really was a deviated prevert without a dime for the call
Great post until you mentioned them. Lots of other possibilities - and unless it was government sanctioned, it's especially pointless to mention those particular nations.
It could be very convenient. No further audits are possible, since all documents are gone. All is to start from zero.
Oh, and JBoss: wasn't it SamSam or a near cousin?
Yes, they should all be sacked.
No, not the IT guys. The beancounters and managers who ignored their advice and failed to foresee the need for a proper backup management strategy for the city. IT knows this crap can happen, and IT tells Management about the need for proper backups, daily, weekly, monthly, on-site, off-site, and tape. We tell them RAID is not a backup strategy. WE tell them without backups their necks are in the noose when, not if, the shit hits the fan.
Well, 9 days ago, the fan got crushed under 16 tons of Grade-A manure. And a LOT of necks are about to get wrung. Sure, IT will get fired, they always do. But this time, everyone who was against backups is gonna go down with them. Cause its not IT's fault the city chose not to have solid backup strategies in place with the vulnerabilities of today, that fault lies solely with everyone who said it was too expensive for no return, too much time for something that didn't make money, or that "education" would be enough protection so we don't need other solutions.
Up out of the shithole it is!
Or maybe not.
Why is it when things go south, things get real stupid? Because it's a shithole, that's why!
throw the windows servers in the trash.
and do backups.
WannaCry on Linux, nice try troll.
Custom electronics and digital signage for your business: www.evcircuits.com
I have loads of mp3s/ data / code etc from the late 90s on CDR, they still work well.
Yes they are stored decently, but they all work, unless scratched.
Cant hurt to do multi format back ups, at least discs are EMP proof / water proof.
Who can expect anyone to believe they "lost 16 years" of data? 192 consecutive months without backups? Zero offline storage? Pull the other one: it's got bells on it!
And people think having these types of people that do business as the government regulating how businesses secure data would be so wonderful. Insane!
Why not? The first thing every Linux installation does is enable interoperability with Windows networking. Wanacry very quickly spreads to SMB shares. If they are writable then a remote client can happily encrypt your shit. Or if you want, https://www.samba.org/samba/se... gives you your own Linux special flavour of Wanacry.
Now yes the GP is a troll, and it most likely wasn't the case. But security is about dealing with the possible, and just running Linux doesn't make you immune from anything, especially not user stupidity.
And people think having these types of people that do business as the government regulating how businesses secure data would be so wonderful. Insane!
Atlanta is over 80% black. A black-run city is not representative of the rest of the US. Read up about Atlanta sometime. It really is an American shithole in every conceivable way. But don't visit there. It's an incredibly dangerous place to be. Violent crime everywhere. Just like every other black-run nation and black-run city.
I don't care if that's "offensive" I care about if it's true, and it is. Only overgrown children fail to deal with reality.
LOL. Rural white-dominated areas have far more crime per capita, which is why they all live scared and sleep with AR-15's under their beds. If you want to see a real shithole, go visit rural America sometime. Just be sure to wear full body armor because the murder rate is dozens of times higher in white dominated american rural areas than anywhere else. They will shoot you if you look at them wrong.
Atlanta is over 80% black.
not true, not even close.
http://www.city-data.com/races...
It isn't like the other 4.5M people are impacted by what the 500K people in Atlanta do or their incompetent city govt.
City of Atlanta is just 500K people. Hardly the entire metro area of 5+M people. Many of those non-Atlanta govts are efficient, capable, and smart. A few county govts merge their services to save money overall. These aren't tiny rural counties. Metro Atlanta has about 20 nearby counties. Fulton is where Atlanta is.
lol, this was an NSA exploit and they managed to screw themselves over with it.
So it finally happened that the computer has become a liability and not a time saver. Its not the computer that is at fault but rather the people who cut corners in protecting them from being hacked. Even the end users probably created their own security risks with lousy passwords or opening up suspicious emails or attachments. More of this to come as hackers see these soft targets as easy prey and too many incompetent people running the systems to do much about it.
Nonsense! 100% daily backups of systems, using a suite of tools kept offline except during backups activity is ALWAYS a solution....simply because an attack starts at a particular time; anything you've kept offline prior to that time is a resource to be used to recover. Yes, there is the problem of recapturing the lost data in that time interval, but it's a LOT better than having to start redesigning software from scratch AFTER the attack has occurred!
100% daily backups, with recycling of media over a period of a few weeks is a MANDATORY requirement for every computer under my management. Since I started doing that in 2001, I have never had (nor has any client had) an unrecoverable loss of data.
The other trick is keeping data separated from executables. My mantra is "C: is for Code, D: is for Data". The idea that everything should be on the same logical drive is simply WRONG.
There are no perfectly secure systems, and perfection is a fools game. But, simple strategies, unerringly repeated over time, can make recovery from assaults (or hard-disk failure) a straight-forward solution.
Stupid is as stupid does.
"Three city council staffers have been sharing a single clunky personal laptop brought in after cyber extortionists"
And no one sees this as an issue? Only in government could people exceed to this level of incompetence and still know they have jobs.
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
So has Georgia actually passed a law that will effectively make the investigation of this ransomware attack illegal? That would be both stupid and highly amusing.
My work windows machine keeps close to 100% immediate backups. As soon as I change a file, it's saved over the network and there are a few weeks of all file changes available for recovery.
An infection is identified pretty quickly, the affected machine(s) isolated and rolled back. Pretty much the only thing you can lose (unless you are really trying) is what you've just typed into the editor.
Real work is done on Linux machines we VNC into, where I understand things are more tightly backed up.
This is not hard. I'm sure they paid real money for the windows backup system and storage and I'm sure they used some good unix foo to set the Linux storage security up. But they did it, but in a large organization like a corporation or government, there is no excuse not to.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
I'm not gonna claim that Linux servers are inherently immune to this kind of attack, but properly rotated backups (in my case daily, weekly, monthly and yearly) limit any potential impact, for Linux or any other kind of server.
Nonaggression works!
but properly rotated backups (in my case daily, weekly, monthly and yearly) limit any potential impact, for Linux or any other kind of server.
Can we get a "Here! Here!" in here!
I always like to point to two examples of Wannacry which happened in the largest port of Europe:
DHL: Got hit by Wannacry: Completely ceased all delivery operations. The entire business went down for 3 days. Warehouses filled with undelivered packages.
Port of Rotterdam: Got hit by Wannacry: Picked up pen and paper and kept on processing containers at the same rate as before. IT in the background recovered and spent a bit of money on importing the paper trail back into the electrical systems, customers didn't even notice.
What you run rarely at all matters compared to how you run it.
Why not? The first thing every Linux installation does is enable interoperability with Windows networking. Wanacry very quickly spreads to SMB shares. If they are writable then a remote client can happily encrypt your shit. Or if you want, https://www.samba.org/samba/se... gives you your own Linux special flavour of Wanacry.
Now yes the GP is a troll, and it most likely wasn't the case. But security is about dealing with the possible, and just running Linux doesn't make you immune from anything, especially not user stupidity.
I've actually stopped setting up Windows networking by default on my Linux systems, especially my servers. It's easier to install FileZilla or WinSCP on Windows.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)