We have to get very, very tough on cyber and cyber warfare… and backups?
Cockrell Hill, Texas has a population of just over 4,000 souls and a police force that managed to lose eight years of evidence when a departmental server was compromised by ransomware.
In a public statement, the department said the malware had been introduced to the department’s systems through email. Specifically, it arrived “from a cloned email address imitating a department issued email address” and after taking root, requested 4 Bitcoin in ransom, worth about $3,600 today, or “nearly $4,000” as the department put it.
It was at this point that the cops’ backup procedures were tested and found to have failed to account for the mischief. When recovery was attempted, they realised they had only managed to back up the encrypted files.
The cops then spoke to the FBI “and upon consultation with them it was determined there were no guarantees that the decryption file would actually be provided, therefore the decision was made to not go forward with the Bitcoin transfer and to simply isolate and wipe the virus from the servers”.
Guarantee or not, the criminals operating ransomware schemes often do indeed decrypt the hijacked files if victims pay up. This is simple economics: if the criminal has a reputation for receiving money without decrypting the files, then their victims will be discouraged from paying up, and this is all about the money.
The ransomware is described as having “affected all Microsoft Office Suite documents, such as Word documents and Excel files. In addition, all body camera video, some in-car video, some in-house surveillance video, and some photographs that were stored on the server were corrupted and were lost.”
While the police state that the malware “was determined to be an ‘OSIRIS’ virus” no such virus actually exists. Instead, the police seem to have been confused by a new extension being used by the Locky ransomware, which renames the files it encrypts and gives them a .osiris extension.
According to news channel WFAA, which broke the story, the department initially discovered the infection back in December, but had not gone public with the information. Instead, the news began to emerge “when the department began alerting defense attorneys that video evidence in some of their criminal cases no longer exists”.
Stephen Barlag, Cockrell Hill’s police chief, said of the encrypted docs: “None of this was critical information.”
WFAA quoted J Collin Beggs, a criminal defence lawyer in Dallas, who said: “That depends on what side of the jail cell you’re sitting,” referencing a client of his, charged in a Cockrell Hill case involving some of the lost video evidence.
Beggs bemoaned the loss of the video evidence, stating it was significant to his client and to others that the department has charged. “It makes it incredibly difficult if not impossible to confirm what’s written in police reports if there’s no video,” Beggs said. “The playing field is already tilted in their favor enormously and this tilts it even more.”
Beggs said he has asked the FBI for proof that the computer virus incident happened. An FBI spokeswoman on Wednesday told News 8 that the bureau does not “confirm or deny the existence of an investigation.”
Source:https://www.theregister.co.uk/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
