PSA: Backup Your Data!

[Sidewinderpb]

Our firm was just hit with the RSA4096 crypto virus (ransomware). It encrypted about half of our client data before being detected, but luckily we had a backup from just a few hours prior. Don't let those basement babies get the best of you!

[zx10guy]

If any corporation doesn't have backup plan, they deserve to go under. Any company worth anything would have set backup procedure which involves incremental and full backups along with snap shots if the corporation is big enough to have a SAN. Also, storing backups off site should be a major consideration in any backup plan. But all the above is dictated by what the company determines a their RPO (recovery point objective) and RTO (recovery time objective). Closer you want both RTO and RPO to be with real time the more you're going to pay to execute it.

[P1]

How was the company "hit"? Was it due to one of your employees falling for a dodgy email with a bad attachment? Phishing?

[Sidewinderpb]

Originally Posted by zx10guy

If any corporation doesn't have backup plan, they deserve to go under. Any company worth anything would have set backup procedure which involves incremental and full backups along with snap shots if the corporation is big enough to have a SAN. Also, storing backups off site should be a major consideration in any backup plan. But all the above is dictated by what the company determines a their RPO (recovery point objective) and RTO (recovery time objective). Closer you want both RTO and RPO to be with real time the more you're going to pay to execute it.

There are a great number of firms that are not adequately prepared for these types of events, and they're becoming increasingly prevalent. I'm not that familiar with the technical details, but I have to tip my hat to our tech guys.

http://www.kaspersky.com/about/news/...rs-in-One-Year

[Sidewinderpb]

Originally Posted by P1et

How was the company "hit"? Was it due to one of your employees falling for a dodgy email with a bad attachment? Phishing?

We haven't figured that out yet. Every machine came back clean, with the exception of some standard adware. We've boiled it down to two machines - both of which are brand new, having only been in service for three weeks. With zero programs open, they were both showing upward of 900 files open. It's a bit sketchy that they were both just purchased; however, the two users often work on the same cases, exchanging materials frequently.

Edit: they were also the only machines running Windows 10

[te37]

Originally Posted by Sidewinderpb

Our firm was just hit with the RSA4096 crypto virus (ransomware). It encrypted about half of our client data before being detected, but luckily we had a backup from just a few hours prior. Don't let those basement babies get the best of you!

What "virus" protection was on your firms computers?

[Sidewinderpb]

Originally Posted by te37

What "virus" protection was on your firms computers?

Symantec

[te37]

Originally Posted by Sidewinderpb

Symantec

Best stuff out there, hmm must more to the story

[SHoTTa35]

Hey Norwalk! Used to live on Matilda Ave

Anyways, Symantec.... are you using the latest 12.1.6.RU6 MP5 build released like 2 weeks ago?

There is a 0-day flaw that affects basically all of the products because of the scan engine needs to be updated (not the virus definations).

https://www.neowin.net/news/symantec...zero-day-flaws

I'm upgrading all of our clients within the next few weeks to help prevent these kind of issues... about 25,000 workstations and 2500 servers.

.............

We had a similar issue however and this was a smaller remote site that still used tape backups so they were able to restore from about 8hrs overnight (lost some very little data but still could have been worse).

Other larger sites use storage snapshots so that is a bit faster and is not affected by the OS. So easy to mount a previous snapshot and boot up and off we go. Just delete the encrypted VM HDDs and off we go.

[Sidewinderpb]

Originally Posted by SHoTTa35

Hey Norwalk! Used to live on Matilda Ave

Anyways, Symantec.... are you using the latest 12.1.6.RU6 MP5 build released like 2 weeks ago?

There is a 0-day flaw that affects basically all of the products because of the scan engine needs to be updated (not the virus definations).

https://www.neowin.net/news/symantec...zero-day-flaws

I'm upgrading all of our clients within the next few weeks to help prevent these kind of issues... about 25,000 workstations and 2500 servers.

.............

We had a similar issue however and this was a smaller remote site that still used tape backups so they were able to restore from about 8hrs overnight (lost some very little data but still could have been worse).

Other larger sites use storage snapshots so that is a bit faster and is not affected by the OS. So easy to mount a previous snapshot and boot up and off we go. Just delete the encrypted VM HDDs and off we go.

Not familiar with Matilda - perhaps a different Norwalk?

Funny you should mention that. As I was reading your post, I received an email stating that servers would be going down tonight to update Symantec. Good call!

[zkb21]

AOMEI Backupper is the simplest FREE backup software with system/disk/partition/file backups and system/disk clone. http://www.backup-utility.com

[CruzBobby23]

Ransomware is a scary virus. A friend of mine lives in Maine and he told me about how his local police station got hit with the virus, they had no choice but to pay. FBI tracked the bitcoins to a Swiss bank but it was a dead end after that.