[ale] Linux Ransom-ware

[Lightner, Jeff]

Ideally rather than having a local backup source your server pushes to, you have a remote backup server that pulls backups.   That won’t prevent a backup run AFTER the infection from containing the infection but it will keep the infection from pushing out to backups made before the backups.

Really, Web Servers, shouldn’t be doing much PUSHING in the first place.    Here we have a limited number of connections allowed from our DMZ to internal systems and none of it is obvious things such as ssh.  We can ssh into the web server but cannot ssh from the web server back into our internal network.  I periodically have to remind people that requests ssh trusts in from web server that we don’t even allow ssh inbound let alone setup trusts in that direction.


From: ale-bounces at ale.org [mailto:ale-bounces at ale.org] On Behalf Of Scott Plante
Sent: Monday, November 09, 2015 11:46 AM
To: Atlanta Linux Enthusiasts
Subject: Re: [ale] Linux Ransom-ware

The article says it goes after backup files too. It seems what you need is either a backup drive or media you manually connect to do backups, or a separate backup server that only accepts new backups and doesn't give the client write access to old backups. I think it might be fairly easy to script something like this, but is anyone aware of an existing backup server software that does this kind of thing? Most of the backup software I've seen assumes you have read/write access to a "backup drive" whether that's a USB, NFS, or other network accessible mount, or of course a tape or dvd that someone manually changes. For all the advantages of removable media, you always have the problem of human error or laziness fouling up your backup regime, so automated is good.

For a backup server, it would of course be of some limited space. You wouldn't want the push process to be able to just keep pushing junk until your good backups are pushed off. Just a thought that popped into my head in the vein of maybe a push-only backup server is more complicated than I first thought. Seems like some of the issues people have worked out for log servers that accept log messages but are extra hard for hackers to mess with.
________________________________
From: "Leam Hall" <leamhall at gmail.com<mailto:leamhall at gmail.com>>
To: "Atlanta Linux Enthusiasts" <ale at ale.org<mailto:ale at ale.org>>
Sent: Monday, November 9, 2015 5:53:07 AM
Subject: Re: [ale] Linux Ransom-ware

On 11/09/15 04:35, DJ-Pfulio wrote:
> Linux Ransom-ware is out looking for ways to attack and encrypt your
> systems:
> https://krebsonsecurity.com/2015/11/ransomware-now-gunning-for-your-web-sites/
>
> Good news: They only want 1 bitcoin as payment.
>
> Bad news: 1 BC is about US$420 and the unlock process doesn't put
> everything back exactly like it was.

Good news; we're all now reminded to back up our files and sites.  :)

Leam
_______________________________________________
Ale mailing list
Ale at ale.org<mailto:Ale at ale.org>
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.ale.org/pipermail/ale/attachments/20151109/6cbc2733/attachment.html>