Washington DC police force confirms data breach after ransomware upstart Babuk posts trophies to Tor blog
- Reference: 1619526315
- News link: https://www.theregister.co.uk/2021/04/27/washington_dc_police_ransomware/
- Source link:
The Metropolitan Police Department said it was "aware of unauthorised access on our server" and had engaged the FBI to investigate, [1]according to BleepingComputer.
[2]
Babuk, a relatively new ransomware gang, claimed credit for the attack and claimed to have stolen 250GB of files from the force. The Register had a look at their blog and found screenshots of folder names suggesting personal data was available to the criminals, as well as details of ongoing investigations.
There was no mention on the Metropolitan Police Department's website or social media channels of the ransomware attack. We have asked them to comment further.
Apple supplier Quanta Computer confirms it's fallen victim to ransomware attack [3]READ MORE
Calvin Gan, a senior manager with F-Secure's Tactical Defence Unit, commented: "Babuk ransomware is relatively new and is likely trying to make a name for themselves. They have been demanding a relatively low ransom amount and researchers from Emsisoft have even discovered severe bugs in their decryptor. Releasing a bold statement such as this to challenge the authorities could be seen as an amateur move, but it now gives them added credibility especially when the breach has been confirmed by the organization themselves."
Ransomware gangs have realised that news media attention is a method for amplifying the impact of their attacks. It appeared that REvil timed the revelation of [4]their recent attack against Apple supplier Quanta Computer to coincide with the latest Apple product launch, in the hope of diverting the news cycle onto their extortion tactics.
[5]
Double-extortion ransomware consists of deploying malware onto a target network that encrypts everything it can reach and exfiltrating copies of the files. The victim is then menaced into paying two ransoms; one to regain access to their files and another for preventing their publication or onward sale. The ransoms are usually five or six figures.
Email security firm Mimecast's head of e-crime, Carl Wearn, opined: "Ransomware really has become the pre-eminent threat of our time, with this being the latest attack in a number of recent incidents. The head of GCHQ, Jeremy Fleming, was [6]absolutely right to recently say that ransomware presents a significant danger for organisations of all kinds ."
He added that Mimecast research showed around half of all ransomware victims paid up.
[7]
Earlier this month infosec biz Emisoft warned that a publicly available decryptor for Babuk was corrupt. The utility, which is claimed to unscramble a ransomware strain that targets VMware ESXi virtualization platform servers, fails to check that files are indeed encrypted before running the decryption algorithm on them – meaning formerly OK files end up being scrambled.
"This wouldn't be a huge issue if it wasn't for the fact that the decryptor provided by the Babuk threat actors has no precautions in place to detect whether a file with the *.babyk extension is actually encrypted or not. It will blindly 'decrypt' these unencrypted files, trashing them in the process," [8]said Emisoft CTO Fabian Wosar. ®
Get our [9]Tech Resources
[1] https://www.bleepingcomputer.com/news/security/dc-police-confirms-cyberattack-after-ransomware-gang-leaks-data/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YIg1JFDIVOGy9Eypeemk-QAAAFI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2021/04/21/quanta_confirms_ransomware/
[4] https://www.theregister.com/2021/04/21/quanta_confirms_ransomware/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YIg1JFDIVOGy9Eypeemk-QAAAFI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2021/04/26/jeremy_fleming_gchq_china_warning/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YIg1JFDIVOGy9Eypeemk-QAAAFI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://blog.emsisoft.com/en/38378/psa-severe-bug-in-babuk-ransomware-decryptor-leads-to-data-loss/
[9] https://whitepapers.theregister.com/
Move along, nothing to see here
Just another case of an organisation enjoying the fruits of modern technology without paying for its cost of ownership
I'm almost getting bored of this ransomware nugget.
You know, cars are dangerous. We force people to pass a test and have a license before allowing them into the public domain
You know, computers are dangerous too, yet we allow any old cunt with podgy fingers use them, where their ignorance and stupidity can cause harm
A bit like someone in a car killing someone else, because they didnt know what the brake pedal was for
A bit like someone using an email client and responding to people in their spam folder, because they didn't understand the spam folder
What's the answer here? Pay CEO's or similar more money perhaps? They're ultimatey the ones leading here. Let these talented individuals on silly money, sort it out.
I don't know about many other IT peeps here, but how often do you have your authority overridden by some cunt upstairs?
Re: Move along, nothing to see here
>> I don't know about many other IT peeps here, but how often do you have your authority overridden by some cunt upstairs?
Just, ALL THE FUCKING TIME. Am I happy to be not in that position anymore!
"He added that Mimecast research showed around half of all ransomware victims paid up."
We shouldn't be surprised by this
Organisations, or more precisely, the lumps of flesh shaped like humans who lead these organisations, they like money.
They simply see it as an operational cost that "might" occur, whereas paying for cyber compliancy training and or a sufficiently staffed IT ship, is a cost that is guaranteed.
Business people are the worst people to be making these kinds of decisions
Half of all victims
It would be interesting to know the size of the ransoms paid. If an individual with one PC pays up to preserve the photos of their loved ones, personal accounts etc. with say US$100 that is one thing. If a corporation with 5k PCs and mainframe etc pays up US$100 per machine (or however it works) that is quite another. I would expect that the larger corporations would have better backup restore management, but for the ones that don't the ransom would be quite a lot.
Police computers that hold information about active investigations should be air gapped and never be connected to the internet. I hope whoever allowed that to happen is immediately suspended from their job and is should charged with criminal negligence. As it could potentially put witnesses or investigating offices in risk of their lives and allow serious criminals to evade prosecution.
Theory vs Practice
Air gaped? But... but... but... everything runs in the clouds nowadays.
I could get behind ransomware groups if they stick to targeting the piggies. Charge them the ransom, then destroy their files forever anyway.
Might even save a few Black lives.
Probably not many, those murdering swine don't need computers to kill.
In 2018 52% of Metropolitan police officers were black.
Nope, they're blue.
Whatever human ethnicity a cop had before, they lose it when they become cops. The humanity is trained right out of them.
Ransomware
Would this problem exist without cryptocurrency, or at least be so prevalent?
fails to check that files are indeed encrypted before running the decryption algorithm on them – meaning formerly OK files end up being scrambled.
That seems like two very trivial and very easy to fix problems right there.