| The first rule of blocking ransomware attacks is: Don't talk about how you blocked ransomware attacks. Or, on the other hand, maybe you should shout it from the rooftops. That's a debate that's roiling the cybersecurity community after a deep dive story from ProPublica and MIT Technology Review revealed that an ill-timed cybersecurity company news release may have helped a ransomware gang launch a devastating attack against Colonial Pipeline. That attack caused fuel shortages across the eastern United States and a spike in gas prices. In the news release in question, the Romanian cybersecurity firm BitDefender touted a digital tool it had developed to unlock computers that were locked by the ransomware gang DarkSide without the victim paying a ransom. BitDefender was offering the tool free to all DarkSide victims. That news release helped a lot of DarkSide victims. But it also gave the gang a chance re-engineer its ransomware based on what BitDefender published in ways that ultimately made the tool ineffective.  Tanker trucks are parked near the entrance of Colonial Pipeline Company. (Chris Carlson/AP) | A few months later, when DarkSide's ransomware hit Colonial Pipeline, there was no easy fix. Ultimately, Colonial paid a $4.4 million ransom to regain access to its computer systems. The article accuses BitDefender of being a "secret weapon" for the ransomware gang and valuing its own self-promotion over public safety. If the company had just quietly shared its tool with DarkSide victims rather than publishing it online, the tool might have still worked when Colonial was hacked, the authors Renee Dudley and Daniel Golden argue. Indeed, two other researchers, Fabian Wosar and Michael Gillespie, had been doing just that with a similar tool they discovered. "The incident…shows how anti-virus companies eager to make a name for themselves sometimes violate one of the cardinal rules of the cat-and-mouse game of cyberwarfare: Don't let your opponents know what you've figured out," Dudley and Golden write. But BitDefender sees it differently. By publicizing its tool, the company helped far more DarkSide victims than it could have by simply scouring news reports about victims and quietly reaching out, the company's director of threat research Bogdan Botezatu told ProPublica. And even if the company had kept mum, DarkSide might have figured out the flaws in its ransomware on its own. "We are well aware that attackers are agile and adapt to our decryptors," Botezatu said. "[But] we don't believe in ransomware decryptors made silently available. Attackers will learn about their existence…while the vast majority of victims will have no idea that they can get their data back for free." Here's more from CyberScoop reporter Sean Lyngaas: | Cybersecurity venture capitalist Bob Ackerman, meanwhile, called the story a warning that "the cybersecurity community can sometimes do as much harm as good" by publicizing their work. |  | | | | Ransomware hackers can be voracious consumers of news about their exploits, noted Allan Liska, senior threat intelligence analyst at Recorded Future. |  | | | The dispute is a twist on a familiar debate in cybersecurity — whether it's better to gather more information about the bad guys or to stop them in their tracks. "The security researcher angle says, 'Don't disclose any information here. Keep the ransomware bugs that we've found that allow us to decode the data secret, so as not to notify the threat actors,' " Rob McLeod, senior director of the threat response unit for the cybersecurity firm eSentire, told ProPublica. On the marketing side, however, "you are singing that song from the rooftops," he said. U.S. intelligence agencies have similarly struggled to strike a balance between gathering more information about hacking groups backed by foreign governments and using what they know to prevent future attacks. An added danger in that case is that actions that disrupt other governments' hacking groups may reveal the sources and methods by which intelligence agencies know what they do — and cut off those sources of information in the future. | Share The Cybersecurity 202 |  |  |  | | | 
Email 
No comments:
Post a Comment