As ransomware attacks continue to wreak havoc on police departments, school districts and city and county governments, some state legislators say they’ve had enough.
At least three states—New York, North Carolina and Pennsylvania—are considering legislation that would ban state and local government agencies from paying ransom if they’re attacked by cybercriminals. A similar bill in Texas died in committee earlier this year.
Prohibiting ransom payments would help deter attacks because cybercriminals would know they couldn’t get paid and would have no financial incentive, the legislators say.
“If criminals know that Pennsylvania will not pay ransom, we are going to make ourselves a less likely target for these types of attacks,” said Republican state Sen. Kristin Phillips-Hill, who is sponsoring a no-ransom bill. “Our citizens’ personal information is on the line. We have to do everything we can to protect them.”
One of the reasons the Fastly outage seems so wide scale is that cloud computing service companies like Fastly are consolidating, leaving websites dependent on a shrinking number of providers. Even if there aren’t that many total outages, the fact that so many everyday sites rely on fewer cloud providers makes each individual outage feel pretty significant to an average internet user who just wanted to buy some stuff on Amazon and read the New York Times early Tuesday morning.
There are benefits to consolidation, explains Doug Madory, the head of internet analysis at the network monitoring company Kentik. For instance, a smaller number of cloud providers means it’s much easier to get those providers to deploy a particular security change. “The flip side is the liability [of] having a few megacompanies, whether they’re CDNs or other types of internet firms, responsible for a lot of our internet activities,” Madory told Recode.
In other words, when one of these megacompanies updates its systems and inadvertently causes an outage, the damage radius could be quite wide. This is what happened in 2011 when one of Amazon’s cloud computing systems, Elastic Block Store (EBS), crashed and brought Reddit, Quora, and Foursquare offline. After the incident, Amazon explained that engineers inadvertently caused technical problems that trickled down through its systems and caused the outage.
The Justice Department said on Monday that it had seized much of the ransom that a major U.S. pipeline operator had paid last month to a Russian hacking collective, turning the tables on the hackers by reaching into a digital wallet to snatch back millions of dollars in cryptocurrency.
Federal investigators tracked the ransom as it moved through a maze of at least 23 different electronic accounts belonging to DarkSide, the hacking group, before landing in one that a federal judge allowed them to break into, according to law enforcement officials and court documents.
The Justice Department said it seized 63.7 Bitcoins, valued at about $2.3 million. (The value of a Bitcoin has dropped over the past month.)
Subway safety in New York took on a new meaning when the Metropolitan Transportation Authority acknowleged a cyber intrusion, which set off loud alarm bells about the rising threat of system hacks.
The MTA is one of the largest municipal issuers and reports linked China’s government to the episode.
Despite MTA officials? assurances of quick troubleshooting and no evidence of compromise to its operational systems, employee or customer information, this marked the latest chilling cybersecurity event for public finance.
A ransomware attack against JBS SA sent shock waves throughout the U.S. food industry and exacerbated tension between Washington and Moscow, even as the meatpacker restarted plant operations.
JBS said most of its plants resumed operations Wednesday, though some shifts and processing operations remained suspended, according to individual plants’ social-media posts.
Meat supplies were already tight before the cyberattack. Surging demand from reopening restaurants, along with production problems at meat plants, are driving up costs of bacon, chicken wings and other products as people continue to make big grocery purchases. Some restaurants and supermarkets have raised prices for consumers as a result.
Distributor Gordon Food Service Inc. bought meat from other suppliers Tuesday while JBS plants were offline, said Jagtar Nijjar, Gordon’s director of imports and commodities. Mr. Nijjar said he expected it to take four business days for its normal order flow from JBS to resume. Normally, he said, Gordon gets more than half of its pork from JBS, at least half a million pounds every week.
U.S. cattle producers, meanwhile, said they were waiting to learn whether they would be able to deliver animals to JBS plants on schedule this week. U.S. meat companies slaughtered 105,000 cattle and 439,000 hogs on Wednesday, down 13% and 9%, respectively, from a week prior, according to USDA data.
If you want to get Americans’ attention, hit their ability to drive. Panic buying and gas lines were quickly seen in the Southeast. Midweek, 71 percent of the gas stations in car-burdened Charlotte, North Carolina, were dry.
Ransomware takes control of a company’s or organization’s software or data until the owners make a payment. Even paying a ransom doesn’t guarantee the owners will get control again.
Initial reports said Colonial refused to pay ransom. But Colonial handed over nearly $5 million to the hackers. Bloomberg reports that the payment was in difficult-to-trace cryptocurrency. In exchange, Colonial received a decrypting tool to help restore its disabled network.
DarkSide, believed to be based in Eastern Europe, released a statement saying, “We are apolitical, we do not participate in geopolitics … Our goal is to make money, and not creating problems for society.”
But no one is safe from cybercrime, whether the attacker is a shadowy group or tied to a nation-state, whether they want money or data or to paralyze infrastructure. Whether the victim is an individual who opened an email containing malware or a leading technology company.
Colonial has acknowledged that its computer networks were hit by a ransomware attack — in essence, an attack in which a hacker or criminal group breaks in and encrypts the contents of a victim’s computers until a ransom is paid. And while the company has declined to say whether it has offered a ransom, the attack is focusing new attention on a potentially radical proposal to stem the growing threat posed by ransomware: making it illegal for targets to pay their attackers.
Callow says a ban is just part of the answer, and in its report, the ransomware task force said governments would need to ease the transition before moving to a world where ransom payments are prohibited. Changes would need to be phased in, it said, and allow time for governments to set up protection and support programs for victims. A bipartisan bill introduced last year in the Senate, for example, called for study into the creation of a federal fund to help support the recovery and response to significant cyber-incidents.
The clock may already be ticking — at least for some. In what is likely a first, the global insurance company Axa announced last week that it would stop offering policies in France that reimburse customers for extortion payments made to cybercriminals.