Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

7/2/2019
11:15 AM
50%
50%

Lake City Employee Fired Following Ransom Payment

The Florida city approved its insurer to pay $460,000 in ransom for a cyberattack that shut down servers, email, and phone.

The director of information technology for Lake City, Fla., has been fired in the aftermath of a massive cyberattack that shut down its phones, servers, and email capabilities. Lake City recently agreed to pay 42 Bitcoin ($460,000) through its insurer, the Florida League of Cities.

About three weeks have passed since Lake City systems were hit with ransomware. Following the attack, city networks were taken offline and recovery efforts began with participation from a third-party security vendor, the Florida League of Cities, and Lake City's IT staff. Attempts to bring systems back online yielded no results; last week, the city's insurer received a ransom request for the decryption key.

The Florida League of Cities negotiated with attackers and paid the ransom, a decision approved by Lake City's Emergency Council. The city is responsible for the $10,000 deductible to the insurer. Lake City officials report its IT director and security vendor advised a more cost-approach to retrieve the key.

Lake City mayor Stephen Witt says city manager Joe Helfenberg made the decision to terminate an employee. Helfenberg is revamping its entire IT department to overcome the incident and set up a system to ensure it doesn't happen again. He also reports the decryption key has been working and the city has been consulting security experts to get back online within the coming days.

Read more details here.

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
tdsan
50%
50%
tdsan,
User Rank: Ninja
7/8/2019 | 4:20:01 PM
RE: Lake City Employee Fired Following Ransom Payment
I agree with you, I was thinking could there be a better way to resolve this issue.

Think about this, we have implemented software that takes an image of a 50-70GB HD (running on NVMe and USB 3.1) where we were able to image the system in about 5-8 minutes. We then took the NVMe disk with the iso for the imaging startup, then booted up the iso (started the application or in certain instances, we would leave it running) in the cloud. We then would point the software to the data iso and recreate the server using this imaging software, cloud, virtual machine or physical machine - minutes to restore) without ever leaving our desk, we pointed the ELB, F5 or Citrix Netscaler to this virtual cloud machine and we were back up and running.

For one-offs, I do think your solution worked great, but if the client is in another state, then that may be somewhat difficult; especially if they live states over (maybe FedEx would work), but it was just a thought.

T
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/8/2019 | 3:08:11 PM
RE: Lake City Employee Fired Following Ransom Payment
AND a very good thought - a wide range of alternative technical guidelines of course - the main thing is that a backup and restore scenario DOES WORK if well thought out and tested well in advance.  At 2am, when restoring a server, one is not THINKING right so testing allows familiarity and documentation to be compiled.  And FAR better than paying ransom.
tdsan
50%
50%
tdsan,
User Rank: Ninja
7/5/2019 | 8:56:58 PM
RE: Lake City Employee Fired Following Ransom Payment
Nice, would you consider putting the server (Web, DB) in the cloud and replicate the server ever so many hours, this could be an option when performing the recovery task. Just a thought.

VMware DR Design Scheme
bwilkes8@gmail.com
50%
50%
[email protected],
User Rank: Moderator
7/3/2019 | 10:53:00 AM
RE: Lake City Employee Fired Following Ransom Payment
Sweet!!!!
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/3/2019 | 10:32:57 AM
RE: Lake City Employee Fired Following Ransom Payment
THANKS - i know from experience.  In 2014 before moving to Georgia, I supported small and local businesses and other entities.  One 501C3 museum was hit by Cryptolocker in January - just like that, server gone and all data encrypted.  I had a dedicated system for each client with tested backup and restore protocols so I picked the Dell computer up - put it into car and drove to my client.  System had SAME NAME as server so all data instantly available when I turned server down.  Only active directory was not available of course.

I then restored data to the server offline, and in 3 hours had 98% restoration of data - only one computer lost the desktop.  NOT BAD indeed. 
bwilkes8@gmail.com
50%
50%
[email protected],
User Rank: Moderator
7/3/2019 | 10:04:31 AM
RE: Lake City Employee Fired Following Ransom Payment
Having previously worked at a company where we were hit with ransonware, before I was tasked with backups, I can say you do have a vaild point.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/3/2019 | 9:45:56 AM
RE: Lake City Employee Fired Following Ransom Payment
EVER notice that in every single one of the ransomware events posted on this page, NO ONE EVER use a backup and restore option.  REBUILD EVERYTHING is a waste of effort.  I suspect, though, that NOBODY HAS A BACKUP AND RESTORE PLAN in the first place. 
bwilkes8@gmail.com
50%
50%
[email protected],
User Rank: Moderator
7/3/2019 | 9:41:16 AM
RE: Lake City Employee Fired Following Ransom Payment
1. Firing the Director is an interesting call.  The Director possesses the institutional knowledge necessary to facilitate a restructuring.

2. The Mayor is going to be rich once he incorporate the layers of security necessary for this to never happen again.

3. It's interesting that recovery from backup would cost more than paying the ransom.  Hopefully they're relooking their backup solution and periodical test procedures as well.
iani540
50%
50%
iani540,
User Rank: Apprentice
7/2/2019 | 8:18:38 PM
Unintelligible grammar
What does "advised a more cost-approach to retrieve the key." mean? Did you mean "cost-effective approach"?  If so, what exactly did that involve? A combination of bad proof-reading and lack of information leave us with no information about who was fired, and what for.
paul.mcaninch@btlaw.com
50%
50%
[email protected],
User Rank: Apprentice
7/2/2019 | 3:44:38 PM
Good Luck
Lake City mayor Stephen Witt says city manager Joe Helfenberg made the decision to terminate an employee. Helfenberg is revamping its entire IT department to overcome the incident and set up a system to ensure it doesn't happen again. 

 

I wish him a lot of luck.  If he really can "set up a system to ensure it doesn't happen again." he's going to be a rich man.
Page 1 / 2   >   >>
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
CVE-2019-18197
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...