Indonesian government didn't have backups of ransomwared data, because DR was only an option
(2024/07/01)
- Reference: 1719809771
- News link: https://www.theregister.co.uk/2024/07/01/indonesian_president_orders_datacenter_audit/
- Source link:
Indonesia’s president Joko Widodo has ordered an audit of government datacenters after it was revealed that most of the data they store is not backed up.
The audit and revelation that Indonesia lacks a backup plan came in aftermath of [1]ransomware attack on the nation’s Temporary National Data Center (PDNS) that took place on June 20th and resulted in widespread disruption of digital services.
Government officials [2]communicated that a fresh variant of the LockBit malware, named Brain Cipher, was used in the attack.
[3]
“Just like other ransomware, it encrypts all data, all files on the server they attack," Deputy Minister of Communication and Information Nezar Patria explained.
[4]
[5]
The data is being held hostage for 131 billion Rupiah (US$8 million.) Communication and Informatics Minister Budi Arie Setiadi [6]told journalists the government does not intend to pay.
Authorities are instead attempting to decrypt the data.
[7]Indonesian government datacenter locked down in $8M ransomware rumble
[8]Levi's and more affected in pants-dropping week of data breaches
[9]Indonesia's president orders government to stop developing new applications
[10]FBI encourages LockBit victims to step right up for free decryption keys
The audit order [11]reportedly came after a closed door government meeting last Friday and was announced to reporters afterward by head of the Financial and Development Supervisory Agency Yusuf Ateh.
A timeline for the audit wasn’t given, but Ateh did comment “The sooner, the better,” as auto translated from Indonesian Bahasa.
[12]
On the [13]floor of Parliament [VIDEO] the head of the National Cyber and Encryption Agency (BSSN), Hinsa Siburian admitted no backup was made for 98 percent of the data stored in one of the two compromised data centers.
“This is not a governance issue, it’s a stupidity issue to have national data without a single backup,” responded Chair of the First Commission of the People's Representative Council, Meutya Hafid.
According to Budi, backup capacity is available to government agencies at the datacenters - but using it is optional. Most agencies did not use it because of budget constraints, however, in the future it will become mandatory.
[14]
While not backing up data has played an obvious role in the struggle to get systems back online, vice president Ma’ruf Amin has credited the severity of the attack to the unification of institutions and ministry data.
“Once it was centralized, it turned out that once it was hacked, everyone was affected. I didn't think hacking was so devastating in the past," [15]the vice president told reporters last Friday. ®
Get our [16]Tech Resources
[1] https://www.theregister.com/2024/06/24/indonesia_datacenter_ransomware/
[2] https://www.kominfo.go.id/content/detail/57355/siaran-pers-no-415hmkominfo062024-tentang-wamen-nezar-patria-insiden-pdns-2-jadi-pelajaran-penting/0/siaran_pers
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/malwaremonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZoJ@QUwestGcSQBcUTW@swAAAEE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/malwaremonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZoJ@QUwestGcSQBcUTW@swAAAEE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/malwaremonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZoJ@QUwestGcSQBcUTW@swAAAEE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://apnews.com/article/indonesia-ransomware-attack-national-data-center-213c14c6cc69d7b66815e58478f64cee
[7] https://www.theregister.com/2024/06/24/indonesia_datacenter_ransomware/
[8] https://www.theregister.com/2024/06/24/security_breaches_of_the_week/
[9] https://www.theregister.com/2024/05/28/indonesia_app_sprawl/
[10] https://www.theregister.com/2024/06/06/lockbit_fbi_decryption_keys/
[11] https://www.kompas.id/baca/polhuk/2024/06/28/presiden-jokowi-minta-audit-tata-kelola-pdn
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/malwaremonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZoJ@QUwestGcSQBcUTW@swAAAEE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.youtube.com/watch?v=sWg69OZAMAg
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/malwaremonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZoJ@QUwestGcSQBcUTW@swAAAEE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.kompas.id/baca/polhuk/2024/06/28/presiden-jokowi-minta-audit-tata-kelola-pdn
[16] https://whitepapers.theregister.com/
The audit and revelation that Indonesia lacks a backup plan came in aftermath of [1]ransomware attack on the nation’s Temporary National Data Center (PDNS) that took place on June 20th and resulted in widespread disruption of digital services.
Government officials [2]communicated that a fresh variant of the LockBit malware, named Brain Cipher, was used in the attack.
[3]
“Just like other ransomware, it encrypts all data, all files on the server they attack," Deputy Minister of Communication and Information Nezar Patria explained.
[4]
[5]
The data is being held hostage for 131 billion Rupiah (US$8 million.) Communication and Informatics Minister Budi Arie Setiadi [6]told journalists the government does not intend to pay.
Authorities are instead attempting to decrypt the data.
[7]Indonesian government datacenter locked down in $8M ransomware rumble
[8]Levi's and more affected in pants-dropping week of data breaches
[9]Indonesia's president orders government to stop developing new applications
[10]FBI encourages LockBit victims to step right up for free decryption keys
The audit order [11]reportedly came after a closed door government meeting last Friday and was announced to reporters afterward by head of the Financial and Development Supervisory Agency Yusuf Ateh.
A timeline for the audit wasn’t given, but Ateh did comment “The sooner, the better,” as auto translated from Indonesian Bahasa.
[12]
On the [13]floor of Parliament [VIDEO] the head of the National Cyber and Encryption Agency (BSSN), Hinsa Siburian admitted no backup was made for 98 percent of the data stored in one of the two compromised data centers.
“This is not a governance issue, it’s a stupidity issue to have national data without a single backup,” responded Chair of the First Commission of the People's Representative Council, Meutya Hafid.
According to Budi, backup capacity is available to government agencies at the datacenters - but using it is optional. Most agencies did not use it because of budget constraints, however, in the future it will become mandatory.
[14]
While not backing up data has played an obvious role in the struggle to get systems back online, vice president Ma’ruf Amin has credited the severity of the attack to the unification of institutions and ministry data.
“Once it was centralized, it turned out that once it was hacked, everyone was affected. I didn't think hacking was so devastating in the past," [15]the vice president told reporters last Friday. ®
Get our [16]Tech Resources
[1] https://www.theregister.com/2024/06/24/indonesia_datacenter_ransomware/
[2] https://www.kominfo.go.id/content/detail/57355/siaran-pers-no-415hmkominfo062024-tentang-wamen-nezar-patria-insiden-pdns-2-jadi-pelajaran-penting/0/siaran_pers
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/malwaremonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZoJ@QUwestGcSQBcUTW@swAAAEE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/malwaremonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZoJ@QUwestGcSQBcUTW@swAAAEE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/malwaremonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZoJ@QUwestGcSQBcUTW@swAAAEE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://apnews.com/article/indonesia-ransomware-attack-national-data-center-213c14c6cc69d7b66815e58478f64cee
[7] https://www.theregister.com/2024/06/24/indonesia_datacenter_ransomware/
[8] https://www.theregister.com/2024/06/24/security_breaches_of_the_week/
[9] https://www.theregister.com/2024/05/28/indonesia_app_sprawl/
[10] https://www.theregister.com/2024/06/06/lockbit_fbi_decryption_keys/
[11] https://www.kompas.id/baca/polhuk/2024/06/28/presiden-jokowi-minta-audit-tata-kelola-pdn
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/malwaremonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZoJ@QUwestGcSQBcUTW@swAAAEE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.youtube.com/watch?v=sWg69OZAMAg
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/malwaremonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZoJ@QUwestGcSQBcUTW@swAAAEE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.kompas.id/baca/polhuk/2024/06/28/presiden-jokowi-minta-audit-tata-kelola-pdn
[16] https://whitepapers.theregister.com/
Re: Of course you know what happens next...
trindflo
Or, go to the backups and find they are also encrypted.
Paul Crawford
Don't these data centres support snapshots? Not a replacement for backups if the data centre itself is destroyed or has catastrophic hardware failure, of course, but for ZFS (and I guess other file systems like the NetApp one, etc) they have very little cost/performance penalty and make winding back in time really easy.
sitta_europea
Yeah, but you do still actually have to do something about it.
"Authorities are instead attempting to decrypt the data"
Pascal Monett
Yeah well, given their competence in managing a government datacenter, I very much doubt that they'll get anywhere fast on that job.
Potemkine!
Most agencies did not use it because of budget constraints
Well done beancounters!
Paul Crawford
Money well saved! Oh wait...
sitta_europea
Ninja'd.
abend0c4
Actually, there's a very [1]recent article in which the Indonesian president was castigating officials for the proliferation of uncoordinated online projects.
From which you might conclude that there is more than sufficient money if only it were spent more effectively. But, then, you could say that about pretty much any government.
[1] https://www.theregister.com/2024/05/28/indonesia_app_sprawl/
Of course you know what happens next...
I think most Reg readers know what happens next when you mandate everything be backed up.
Three years down the road, next big failure: They go to restore backups, and, oops! They don't work because nobody ever tested recovering them. 'You only told us to make backups, and we did!'
I will bet one million rupiah (IDR) on this.