Ransomware Infects All St Louis Public Library Computers (theguardian.com) 163
An anonymous reader quotes a report from The Guardian: Libraries in St Louis have been bought to a standstill after computers in all the city's libraries were infected with ransomware, a particularly virulent form of computer virus used to extort money from victims. Hackers are demanding $35,000 (£28,000) to restore the system after the cyberattack, which affected 700 computers across the Missouri city's 16 public libraries. The hackers demanded the money in electronic currency bitcoin, but, as CNN reports, the authority has refused to pay for a code that would unlock the machines. As a result, the library authority has said it will wipe its entire computer system and rebuild it from scratch, a solution that may take weeks. On Friday, St Louis public library announced it had managed to regain control of its servers, with tech staff continuing to work to restore borrowing services. The 16 libraries have all remained open, but computers continue to be off limits to the public. Spokeswoman Jen Hatton told CNN that the attack had hit the city's schoolchildren and its poor worst, as many do not have access to the internet at home. "For many [...] we're their only access to the internet," she said. "Some of them have a smartphone, but they don't have a data plan. They come in and use the wifi." As well as causing the loans system to seize up, preventing borrowers from checking out or returning books, the attack froze all computers, leaving no one able to access the four million items that should be available through the service. The system is believed to have been infected through a centralized computer server, and staff emails have also been frozen by the virus. The FBI has been called in to investigate.
Re: (Score:3)
Re: (Score:2)
Why do these companies continue to pay Microsoft for Windows licenses rather than paying CodeWeavers to improve Wine to the point where it can run the same applications?
Re: (Score:3, Informative)
Because many companies require the use of specialized software that ONLY runs on Windows. Look at any industry, and you will find that software. The only companies that can do without windows are the ones that only use web browsers and email.
My industry (chip design and manufacture) runs pretty much with specialized software that only runs on Linux. You can ask for a windows version, but the sales guy would look at you funny.
Re: (Score:2)
Opening a Word document, or any other Office document, shouldn't put your master boot record at risk, so that was just ridiculous of Microsoft.
It doesn't, not unless you grant administrative (root) privileges to users.
Re: Why do people keep using Windows? (Score:4, Interesting)
For one thing, even without administrative access to a computer, ransomware with full access to an employee's user account can do a lot of damage. For another, administrative access might be the result of a cost-benefit analysis that concluded that avoiding the cost of paying employees to sit and produce no value for the company while waiting for the IT department to complete a review of each application or device driver that each employee requires to do his or her job outweighs the risk of being the next ransomware victim.
Re: (Score:2)
Opening a Word document, or any other Office document, shouldn't put your master boot record at risk, so that was just ridiculous of Microsoft.
It doesn't, not unless you grant administrative (root) privileges to users.
Because privilege escalation vulnerabilities don't exist?
Re: (Score:2)
LOL, block Word documents. That would be fun to explain to your userbase, and management.
Re: (Score:3)
LOL, block Word documents. That would be fun to explain to your userbase, and management.
I'm doing fine with Latex thank you very much.
Re: (Score:2)
What you see is what you deserve
Re: (Score:2)
LOL, block Word documents. That would be fun to explain to your userbase, and management.
Thankfully in the intervening decades Microsoft put more effort to discourage and disallow active (Macro) content, to the point of having a seperate extension that could be blocked (.xlsm), and distrusting internet sourced files.
My favorite Microsoft security feature was when these HTML tags:
<img src="con">
<img src="com1">
<img src="nul">
Would cause a BSOD on Win 9x. Good times were had posting to forums with linked images. Same era as pinging people on IRC with the payload "+++ATH0"
Re: (Score:2)
Overwritten master boot records is just the cost of doing business.
A smart system would have three master boot records and the bios would find the first good one.
Re: (Score:2)
They would have to work 3 times as hard.
Oh No, they did not use Linux ! (Score:1)
Oh No, they did not use Linux !
Re: (Score:2)
Randomware usually spreads either through fooling the user, and/or by exploiting flaws in their security. Are you saying that other operating systems do not have users who can be fooled and never have security flaws?
Re: (Score:2)
I want to know who decided to put the PUBLIC TERMINALS on the same network as the administrative computers. Not only that, but malware like this needs write access to network shares. So not only were ALL computers on the same network, the public terminals utilized user accounts that had write access to the same network shares as the administrative computers... unbelievable...
Re: Why do people keep using Windows? (Score:5, Insightful)
Decision-makers at the top of organizations love Windows. They love Microsoft. They love all of the pretty graphs and charts and menus that make it look easy to administer a system or network. The problem is, they often start to think that they actually know how to do just that once they've been through the marketing experience meetings where the people from the vendor with a lot of knowledge make it look so simple, or else they hire people that do a very convincing job of sounding like they know what they're doing but don't. Worst, those people (either the bosses or the ignorant hirees) may be convinced that they know what they're doing far beyond reality.
Now, I will give it this much, sometimes the GUI tools can be useful. It's much easier to plot how network traffic is being passed among multiple interfaces to the WAN or to the ISP across multiple NAT firewalls with a GUI graph than it is on a text console. On the other hand, actually figuring out what's going on is often a function of the console, rather than of the GUI.
Re: (Score:2)
However being prepared costs time and some resources so it looks like it was ignored.
Re: Why do people keep using Windows? (Score:4, Informative)
I used to run an OPAC. I kept the front end on a IBM-RS6000 H70, the database on a H-80, and proxies and workers on a HMC with various flavors of hardware.
It served +100 different libraries, and had a unique holdings over 10 million (that means not counting the same holding twice if you had 2 copies (or more) of it.)
Transaction Backups happened every hour and were written to WORM media.
Databases were backed up with transaction logs every 4 hours to mag tape then ejected until needed.
Complete backups were done once a week by quescesing the database, breaking the RAID 5 + 0, backing up the cold DB while restarting the hot DB. Once the cold backup was complete, the RAID was hot re-synced to the online set.
Disaster recovery was using the cold backup tape (which was a full boot tape, one of the reasons I _like_ RS6000's is you can boot from a backup), then re-running the transaction until it was all current.
Circulation systems did not have RW disks, they booted from a Linux live CD with the OPAC already open.
The run-of-the-mill systems for patrons ran windows. I didn't worry about those as I only ran the Unix/AIX/Linux side but they had image deployment systems. A tech could reimage a machine in under 2 minutes, and I guess they could have remote commanded a re-image, since they did every year anyway.
The system was since pulled down and converted to SaaS with an outside vendor. Seems they didn't want to pay for people and licenses.
And thus it is written - why Microsoft? Because it's cheap and easy to find some stumble bum that can pretend to run your shit. He might even keep it going - at least until it all falls down.
Re: (Score:3)
Re: (Score:3)
make it look easy to administer a system or network
Sounds good up until that point. Decision makers at the top of organizations don't give a rats ass how easy something is to administer -- they hire people to do that for them.
They just want something that works. And they know they can pay somebody to fix it when it doesn't work. Yes, they "paying" part is important! These are people whose entire lives revolve around money and they intrinsically don't trust anything that's free.
And then there's the fragmentation issue. Should they use Redhat or Suse or
Re: (Score:3)
That part should be easy to explain to those types. "Those are several vendors competing for the same market, so if things go wrong you can switch between them without having to completely retrain your tech people. If you start having problems with Windows too bad - Microsoft is t
Re: (Score:2)
That's a justification, not an explanation. That tells me that different Linux distros exist, but I already know that. What I want to know is why I should pick one distro over another? What are the benefits and down sides of each? Does it even matter? And if not, why is there so many distros in the first place?
If you go to buy a laptop at your local Best Buy for example, they have a breakdown of all of the important numbers as well as a price tag. That gives you three entire sets of reasoning a person
Re: (Score:2)
Sounds good up until that point. Decision makers at the top of organizations don't give a rats ass how easy something is to administer -- they hire people to do that for them.
This has not been my experience. In my experience the top brass are wined and dined by the vendors and shown demos, and in-turn those top-brass seek to take credit for their amazing decisions to use this wonderful product that they've been shown. They simply expect it to work as-advertised and for the staff to make it so, whether or not that's practical or not or if it's even a good fit for the environment.
Re: (Score:2)
Apparently they weren't competent enough to separate public terminals from the rest of the network though... There is just no reason that 16,000 computers should be affected by a single bit of malware. That is poor network design imo.
Re: (Score:2)
Yeah, not sure where I got the 16,000 number from. Even still, my comment stands. Just substitute 16,000 with the actual number of 700.
Reading between the lines... (Score:5, Informative)
...sounds like they have valid backups, so this should be considered a "success" story more than anything else.
Still, I do wonder if the admins were practicing valid security, how anything could have infected the entire system.
Re:Reading between the lines... (Score:5, Insightful)
Re:Reading between the lines... (Score:5, Insightful)
My bet is they are well accustomed to re-imaging the public facing computers.
Re: (Score:2)
Yup, that's what I'm thinking.
Just seems all too often with these ransomware stories we read how organizations have lost all their data and have to pay in order to restore it. It's good to see one where that didn't happen.
Re: (Score:2)
Good for St. Louis (Score:2, Insightful)
As a St. Louisan, I'm glad they're not paying. It sounds like there are some serious issues while they restore their systems, but it sounds like they do have backups. It will take awhile to clean up the mess, but I applaud them for not giving in to the criminals responsible for this. Although many articles aren't clear about this, the library did have backups to restore from, so despite the security breach, someone knew what they were doing well enough to avoid paying the ransom demands. Good for St. Louis
Surely an inadvertent target (Score:5, Informative)
Re:Surely an inadvertent target (Score:5, Interesting)
Re: (Score:3)
I've done something like this. I ended up using a CD-R removing the hard drives. The advantage of a CD-R is that it can't be modified easily which removed 99% of the possible ways to mess with the system. (I wouldn't be as confident a USB drive couldn't be modified.) It also makes it easy to test upgrades and deploy them rapidly.
I know it would be possible to do network booting [slashdot.org] but I've tried it and it was slower and took more effort. For my purposes, I found slax [slax.org] easy to set up, modify and use. I tried out
Re: (Score:1)
The advantage of a CD-R is that it can't be modified easily which removed 99% of the possible ways to mess with the system.
That's both an advantage AND a disadvantage. The last thing I want to have to do is have to touch hundreds of machines when there is a systems change. These days, information databases like Follett are accessible through an online portal, and I've had to update the access urls a couple of times now. Making the CD-R tamper proof, which you would need to do, would make it even more of a PITA to deal with.
PXE boot works fine too, but then you're back to maintaining the state of the image. On top of that, they
Re: (Score:2)
Dang it, you're right. Chromebooks are one of the best options.
Re: (Score:2)
You must be joking, public libraries in the US have some of the largest IT budgets except perhaps public schools. On average libraries spend about 10% of revenue on IT systems vs 2-6% for comparable commercial companies, even small sites like my local libraries will spend $100k/year on a dozen computers.
They do not want 40 different people messing with their system, they'll rather spend $300k/y of a $1M budget to a local IT consulting company sending out the 18yo Cisco Certified Senior Network Systems Engin
Re: (Score:2)
Have you people never heard of Clonezilla?
Re: (Score:2)
When I worked at a college we could do 3000 computers in a week and still have time to play quake rocket arena.
Re: (Score:2)
There are 700 computers to fix. 16 staff members each working 40h/week at the rate of 1 machine/2h will take.... 2.2 weeks.
Meh, you need to basically force it to boot from some kind of other media with a script on it. I could hack something together with linux to restore an identical image to each pc, and there are no doubt packages that make it trivially easy. They shouldn't need 2h a machine. The biggest annoyance is probably dealing with windows product numbers. That might be easier just to update manually. Of course if you created a linux image then it is easier.
It shouldn't be that hard to have the machines load an image automatically by first checking a remote server after boot. You could wait till the OS boots, check for an update via wget, then if it is there, you write the non active partition and then update where grub points. Sure there are details to work out and sometimes you will need manual intervention, but it is all scriptable..
Of course, in practice, find the software that already exists to automate the job and be done with it. No need to roll a custom solution.
Windows volume licence should take care of licencing automatically (deployed image will find the KMS). While a machine might take up to 2h to deploy (seems extreme, hopefully no more than 30 min), you can have several machines working away at once. Very little of that time should involve human interaction.
I'm Angry (Score:5, Interesting)
Re:I'm Angry (Score:4, Insightful)
I think you think this was a targeted attack, but personally I really doubt that. I think it was a target of opportunity seized by some automated bot. Which doesn't mean you should think more kindly of those who released it.
Re: (Score:2)
It's called, "phishing," for a reason.
Throw enough bait into the water and you might catch a bass.
Of course, you might catch a boot.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
It takes a special kind of asshole to attack a library; a place where people go to learn and access the internet.
^^^^^^^^^^THIS.
-
Why go after one of the poorest resources and attack those that have the least to give?
Because the people that do this are scumbag losers without a shred of self-awareness. Sadly, some people just like to break things and fuck shit up.
Re: (Score:2)
By African standards? Not rich, but doing OK. Not starving.
This is why America can't have nice things (Score:2)
Mostly reminds me of my experiences as a volunteer trying to support the public-use computers in the Austin Public Library. That was almost 30 years ago, way before we had anything like network access problems. Basically I wound up just wiping the systems every time I visited and restoring them as well as I could to their "legal" condition. The big problem in those days was just pirated software, especially an expensive CAD package, but the big threats these days are keyloggers intercepting passwords used f
Re: (Score:2)
The big problem in those days was just pirated software, especially an expensive CAD package, but the big threats these days are keyloggers intercepting passwords used for email and data stored in the network...
Aw, man. I've never had need to use a library terminal for any work other than looking things up in the catalog, so I never gave it much thought. Now I'll never look at one of those public terminals the same way again.
I've used internet cafes in Europe, but even years ago those would be automatically re-imaged after each customer logs out. I don't think the libraries here do anything of the kind. Imagine how many Gmail and Facebook accounts you could gain access to, even if they re-imaged the systems once p
Comment removed (Score:3)
Re: (Score:2)
not too far removed from negotiating with terrorists
There's an enormous gulf between locking someone's data and blowing them up. We tend to be a lot harder on people who murder innocents than those who just steal money (well, as long as its somebody else' money of course.)
physically access a nearly exploit-proof repository
Sure you can access it, but most library usage of the book variety is loan-based since few people want to actually sit in the library for hours on end while reading. And the systems that track the book loans are all computerized these days.
This particular library could potentially lose a
Re: (Score:2)
not too far removed from negotiating with terrorists
There's an enormous gulf between locking someone's data and blowing them up. We tend to be a lot harder on people who murder innocents than those who just steal money (well, as long as its somebody else' money of course.)
Yes and no. Yes, it's a far worse crime to blow things and people up, than is it to ransom their data. However, the way we deal with these two types of crime really should be the same. No deals. The more times we cave in to ransomware the worse this type of attack will get. If criminals can make money off it, they are definitely going to try to infect more computers. If no one will pay, the crime will simply go away since it's not profitable.
Re: (Score:2)
Third - and this ties back to second - libraries in general don't have a budget for public IT. They can't afford the expertise to implement FOSS when the vast majority of the people who will maintain and use the provided services are not trained to use it. Even on their web presence, ease of implementation (which probably contributed to this problem) equals lower TCO for them.
I'm not so sure this is accurate. I would think the library system's computer needs would be handled by the City's IT department (and cities have these now.) But really depends on the locality, I suppose. But libraries are generally administered by the city government they reside in which would in turn mean they should be under the control of the city's IT department, which definitely has a budget.
Re: (Score:2)
What's so expensive about building a Knoppix CD, duplicating one for every public computer to boot from, and removing all their hard drives?
Back Up! Back Up!... (Score:2)
Re: (Score:2)
The "strategy" part is crucial, though.
Before I retired, I backed up every single night to external hard drives (EHD).
Every fucking evening, for 18 years, I'd take last night's backup home and bring those drives back in the morning.
I'd put in "today's" tape and take last night's home with me again.
I had seven (7) EHD and every Wednesday I'd delete an innocuous file on each server and restore it from the EHD.
The object is not to get stuff ON the EHD as much as it is to get the data back OFF the EHD.
If a serv
Re: (Score:2)
Re: (Score:2)
Good point.
A good backup strategy includes off site copies as I did, taking the EHD home each day.
I've been retired 2 years now and I'm not up to speed on the state of the art.
Can cloud backups be encrypted by local server infection of ransomeware?
I searched, but didn't find a definitive answer.
Re: (Score:2)
Can cloud backups be encrypted by local server infection of ransomeware?
The short answer is "yes".
If it's not literally offline (disconnected) then it's susceptible to corruption, period.
I keep three sets of backup drives, rotating through them periodically with the last two drives stored in a safety deposit box at a local bank.
Re: (Score:2)
I do like the 100% off site backup idea.
During my career of 34 years, I had two (2) things that scared the shit out of me:
1.) No backup
2.) Malware or security breach
I had a Novell 3.1 server crash on me at 5:30 pm and Novell worked with me till 6:30 the next morning rebuilding it.
It was broken at the core and we didn't lose any data.
Didn't need the backup tapes then (no such thing as EHD), but I had them.
I had my share of infected computers, but it was all single-box shit.
Viruses ruled the day back then.
Lat
Re: (Score:2)
The problem with really good backup strategies is they are also really expensive, being demanding of disk I/O and disk capacity. We joke sometimes that based on usage patterns, many customers should run production on backup storage and backups to production storage because backup uses more IOPS, throughput and capacity than primary.
I don't know what their systems or processes are like in St Louis or what they had to restore, but a smaller library I worked with once had something like 5 TB of production dat
attack funded by the University of Calgary (Score:2)
Ransomware Thieves Cost Canada University C$20,000 In Bitcoin [slashdot.org]
Isn't it interesting how this works?
Spin (Score:2)
How Many??? (Score:2)
I did a quick count, and the city of 1.4 million people I live in has 59 libraries. St. Louis has 2.9 million people. Very few of them read apparently.
Re: (Score:1)
St. Louis *City* has only 315 thousand people. The city 'divorced' itself from the county in 1876. The greater St. Louis area has 2.9 million. Most the surrounding municipalities are part of the St Louis county public library system ( http://www.slcl.org/ ) which is separate from the city's library system (http://www.slpl.org/ ) . Other surrounding municipalities just roll their own ( http://kirkwoodpubliclibrary.org/ )
http://www.riverfronttimes.com/newsblog/2010/05/04/the-great-divorce-everything-you-ever-
Re: (Score:3)
While the MSA has 2.9 million, St louis proper only has 316000. Those libraries serve the residents of the City, not the entire MSA. The communities of the MSA have their OWN libraries.
16 for 316000 is actually a fairly high ratio.
Re: (Score:2)
Re: (Score:2)
The city of St. Louis has about 300,000 people, the county and even part of Illinois is included in your 3 million number. They all have their own libraries. I live in St. Louis, there are 2 libraries within 2.5 miles of my house (one is less than 1.2 mile, the other is the central public library which has awesome architecture and lots of art).
A particularly virulent form of computer virus .. (Score:2)
Do you mean a Windows Word Macro virus?
CARD CATALOGS! (Score:1)
STILL WORK!
The only danger to them is the occasional termite
Re:Just Roll Back to Snapshot... (Score:4, Informative)
Even for those users who have their own PC for themselves, if you're providing network storage and if the use of that network storage has been your corporate policy, then content lost on the local disk is their problem, not yours. Obviously try to be polite but don't commit to restoring data that was not properly saved.
Re:Just Roll Back to Snapshot... (Score:4, Informative)
These are public terminals, by and large, user data on the local disk shouldn't be a factor at all.
From TFA, it affected their servers as well. The system that allows patrons to borrow books and other items went down. So did access to all of the thousands of digital items the libraries offer. Re-imaging the public PCs should be simple enough, but restoring access might be hard if the systems that connect the libraries to the internet are down (gateways, firewalls, DHCP and DNS servers, etc)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
In this case it is the authorities who are the clowns, acting too little and too late to do anything worthwhile. A investigatory flying squad https://en.wikipedia.org/wiki/... [wikipedia.org], should be the first ones on the scene as soon as it is reported. This to gather evidence for proper investigation. This requires additional effort, as you can not just strip the victim of the core computer hardware but must provide a temporary stop gap and get it up and running, whilst the infected machines are properly analysed or e
Hack (Score:2)
Perhaps, but it seems many hack at the library !
Re: (Score:2)
St. Louis is about 50/50 black and white. But you're the only one who brought up race.
Re: (Score:2)
By the way, Bitcoin is traceable (by everyone) but anonymous.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
I don't support Trump OR either Clinton (Clinton #1 removed Glass-Steigell, causing the subprime crisis years later by letting banks do stupid things, Clinton #2 - just look at the middle east, Trump - he's no Bernie Sanders, who was the only reasonable candidate - and the fact that he was left of the DINOs - Democrats in Name Only - is a bonus).
So don't be stupid with your lies - anyone can search my history and find your accusations of my supporting Trump are full of shit. You elected him, you get the go
Re: (Score:2)
Pretending to support Bernie Sanders when it's documented you despised him is only furthering your deceits.
I dare you to find ANYTHING that "documents" that, you fucktard. Oh wait - you can't. That's why all you can do is post lies on slashdot with no proof. But tell us again how it wasn't Bill Clinton who signed the law, even though it was, and I even provided the link.
Re: (Score:2)
Bill Clinton and the democrats had a majority in both houses when he signed the law into place. If they hadn't liked it, they could have stopped it - they had absolute majorities in the House of Congress, the Senate, and they also controlled the White House. They certainly had the power to re-write it, or not pass it, and a presidential veto would not have been overridden by republicans because there just weren't enough of them.
So show me ONE SINGLE REASON why anyone should believe that Clinton was opposed
Re: (Score:2)
It's mostly used for illegal stuff anyway, and we have plenty of ways to transfer money that are traceable. We don't need bitcoin, or any cryptocurrency.
Mostly illegal? How about almost entirely? Bitcoin has been a boom for criminal enterprises, which in my opinion is the only widespread use case they have presently.
I'm aware some people think having this semi-anonymous, decentralized, ungoverned currency around is somehow cool and/or beneficial, but is it really necessary? And given the fact it's main use is for criminal behavior, do we really need its perceived benefits when it's main use is for crime?
Sadly, the scarcity of Bitcoins which have a percei
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
If you choke off the flow of money, you won't even have to follow the money.
Re: (Score:2)
Except you can't trace it to any particular exchange. I mean if the criminal withdraws exactly $35000 an hour after the library paid them that amount, then sure it becomes (a bit) easier to track.
But if they withdraw it $100 at a time on a weekly basis or something just to cover their living expenses, or if they withdraw it through a Chinese or Russian bitcoin exchange or the such.. there's little that can be done.
For better or worse, Bitcoin was intentionally designed to be untraceable and while there may
Re: (Score:2)
Re: (Score:2)
I think perhaps your previous post was missing a word:
Bitcoin will make it harder to collect ransoms
Perhaps that was supposed to be "Banning bitcoin"? Which would make a bit more sense grammatically to boot :P. And of course completely negates the meaning and thus my response!
Re: (Score:2)
You mean like gift cards? There are some many ways to anonymize money these days.
Re: (Score:2)
Re: (Score:2)
To the point of purchase (the victim). By the time anything happens after that, it's relatively untraceable.
Re: (Score:2)
Re: (Score:2)
That means you can maybe see the start and end. You buy it with cash, it gets traded/sold numerous times. You can see when/where it was spent, but you can't follow it back through its path
Re: (Score:2)
Re: (Score:2)
Quote:
Additionally, the Library District plans to upgrade to Windows version 10 in late 2017 at an estimated cost of $20,000 and also upgrade Microsoft Office to version 10 at a cost of $48,500.
They spend about $1M/y on computer technology (~$1500/computer/year) not accounting for staff or digital databases/collections and their computers are 5 years old so they need replacement which is a separate line item. With those sorts of budgets, you'd think they have this figured out.
In comparison, I work in resear