Nearly two weeks after the city of Baltimore’s internal networks were compromised by the Samsam ransomware worm (previously), the city is still weeks away from recovering services — that’s weeks during which the city is unable to process utility payments or municipal fines, register house sales, or perform other basic functions of city governance.
911 and emergency services are OK, because after they were hit by a ransomware attack last year, they were hardened against future attacks. The city did not allocate funds to improve its security, or improve its training, or take out cyberattack insurance, despite a recommendation from the city’s information security manager.
Baltimore’s city government has been wracked by a string of corruption scandals, including the abrupt resignation of Mayor Catherine Pugh this month, as well as the precipitous departure of four CIOs over the past five years in a string of firings and forced resignations.
The ransomware crooks who seized control over Baltimore’s servers asked for $70,000 to restore them. Baltimore will spend far, far more than that on recovering its servers the hard way, in part because it was so vulnerable to begin with, thanks to the city officials’ decision not to appropriate funds to improve its resiliency and security.
Until the ransomware attack, the city’s email was almost entirely internally hosted, running on Windows Server 2012 in the city’s data center. Only the city’s Law Department had moved over to a cloud-based mail platform. Now, the city’s email gateway has moved to a Microsoft-hosted mail service, but it’s not clear whether all email will be migrated to the cloud—or if it’s even possible. While Mayor Young said the city had data backups, it’s not clear how widely backups were implemented. And Johnson would not say whether there was a disaster-recovery plan in place to deal with a ransomware attack.
Some of Baltimore’s systems are hosted elsewhere, including the city’s primary website, which is hosted on Amazon Web Services and operated by a contractor. But the city almost lost that website last week, and not because of ransomware: the contract for operating the site had expired, and the city was delinquent in its payments.
Baltimore ransomware nightmare could last weeks more, with big consequences [Sean Gallagher/Ars Technica]
Trump’s initial appointee to run the EPA was Scott Pruitt, who resigned in disgrace in 2018 amid a massive corruption scandal in which he was found to have spent lavishly and assigned improper personal duties to government employees.
Axon — formerly Taser International — makes police bodycams that they sell to towns on the cheap, betting that they’ll make it up by gouging the towns for cloud-based storage for footage from the cameras (what could possibly go wrong?!).
NSO Group is a notorious Israeli cyber-arms dealer whose long trail of sleaze has been thoroughly documented by the University of Toronto’s Citizen Lab (which may or may not be related to an attempt to infiltrate Citizen Lab undertaken by a retired Israeli spy); NSO has been implicated in the murder and dismemberment of the […]
Raspberry Pi is one of the world’s most versatile open-source computers. Alexa is a home automation hub with limitless potential. Together, they’re a dream team for ambitious makers, opening the door to everything from automatic lights to voice-controlled robots. Learning Raspberry Pi is meant to be relatively easy for newbies, but its applications with Alexa […]
Heads up: The clock is winding down on a free-entry contest to win not only one of the best smartphones on the market but a handy pair of earbuds. A simple sign-up is all you need to be eligible to win a 256 GB iPhone XS Max, along with AirPods. And while “free” is tough […]
Kudos to those of us who have chosen a less wasteful third option to “paper or plastic” at the supermarket or club stores. Tote bags are reusable, but they can be a pain to tote around. Here’s an upgrade to that planet-saving measure. The Club Cart Lotus Trolley Bag is that rare tote you’ll want […]