Speaker 1: When you're ready to ride Metro, we want you to
Speaker 1: know we're ready for you. Here are just a few
Speaker 1: of the people at Metro to tell you how we're
Speaker 1: doing our part to keep riders safe. We're cleaning like
Speaker 1: never before greatly. You've found half sut of station. No mask,
Speaker 1: no Metro need one. We have a few extras at Metro.
Speaker 1: We're doing our part to keep the DC area moving.
Speaker 1: Find out more at well mata dot com slash doing
Speaker 1: our part. So listen. If you heard about the recent
Speaker 1: wave of ransomware attacks in some small towns in Texas,
Speaker 1: it was hospitals a while ago, UM, and it's coming
Speaker 1: to a business or town near you. Well, we've invited
Speaker 1: on Alan listco is a threat intelligence analyst UM to
Speaker 1: talk about UM ransomware attacks and how they work and
Speaker 1: the rest of it. Alan works, it recorded future Alan.
Speaker 1: How are you good? How are you guys doing today? Terrific? Hey,
Speaker 1: for folks who are not to what's going on, could
Speaker 1: you just explain how a ransomware attack unfold. Say, we're
Speaker 1: we're both working at the City of Pleasantville, Texas. What happens?
Speaker 1: So there are a couple of different ways that it
Speaker 1: generally works. The most common way that we see is
Speaker 1: you click an email, uh you know, it'll look something
Speaker 1: like a uh, do you have an overdue invoice? Click
Speaker 1: on this invoice, or you have a package coming click
Speaker 1: on the the this link to find out when it's arriving.
Speaker 1: And it turns out, instead of being uh, you know,
Speaker 1: an invoice, it's actually malware. It installs the ransomware on
Speaker 1: your system, and then it jumps from your system to
Speaker 1: the rest of the network that you're attached to. So
Speaker 1: if it was just your system would be fairly easy.
Speaker 1: They delete your computer and give you a new one.
Speaker 1: But when it when these ransomware attacks hit hundreds of
Speaker 1: systems in the same organization, then it becomes a crisis.
Speaker 1: And then what what does it look like at that point?
Speaker 1: Does your computer go blank? Do you get an email?
Speaker 1: Or how do you how do you get the word
Speaker 1: that you've been compromising? You owe somebody money, so your
Speaker 1: operating system itself isn't affected. Instead, what it does is
Speaker 1: it encrypts all of the relevant files on your system,
Speaker 1: so your images, your your any word documents or PowerPoint
Speaker 1: documents or spreadsheets. Uh, if you've got databases on your system,
Speaker 1: they all get encrypted, and then it pops up with
Speaker 1: a message saying you've been hit by whatever the ransomware is.
Speaker 1: If you want to get your files back, send me
Speaker 1: bitcoin um. And they often have a little portal that
Speaker 1: you go to. Uh. You give them your their big
Speaker 1: your bitcoin, and then they give you a key so
Speaker 1: you can un encrypt your files. Well, and from my
Speaker 1: reading about this, the guys who do this are pretty
Speaker 1: good in that they make the ransom amount significant, but
Speaker 1: less than you'd probably spend on rebuilding everything. Right, So,
Speaker 1: generally speaking, you're talking, uh you know, so ransoms in
Speaker 1: general have gone up a few years ago. I mean,
Speaker 1: just like anything else you have inflation, they have to
Speaker 1: keep up with their costs. Uh. Uh So you have
Speaker 1: kids in college or something. You don't know, right, college
Speaker 1: is expensive even in Estonia. Um, anyway, go on, certain
Speaker 1: that's okay. Um. So a couple of years ago they
Speaker 1: generally were asking for a few thousand dollars, but now
Speaker 1: the ransoms tend to be in the six figures um,
Speaker 1: so somewhere between a hundred thousand and three hundred thousand
Speaker 1: dollars generally what they're asking just real quick, can we
Speaker 1: go back to the original email you shouldn't have clicked on.
Speaker 1: Are the good ones able to like mimic? I don't know.
Speaker 1: I might get an email from Jack saying, hey, you
Speaker 1: gotta see this story. Are they that good? Yes? So? Um,
Speaker 1: if if it's a target did ransomware attacks, So, if
Speaker 1: they're specifically coming after you, that's exactly the kind of
Speaker 1: tactic that they'll use. We've seen that. We also have
Speaker 1: seen you'll get an email from like the seat that
Speaker 1: looks like it's coming from the CEO of I Heart Radio. Hey,
Speaker 1: I need you to do this for me immediately. Um.
Speaker 1: And of course if you're getting an email from the ceo, uh,
Speaker 1: your your your first involces. Yes, I better do this
Speaker 1: right away without necessarily thinking, Wait, why is he sending
Speaker 1: me an email from a Gmail account or a dot
Speaker 1: areu email address type thing? So, do you have any
Speaker 1: idea how many places this has happened around the country?
Speaker 1: And what the how many how many towns, counties, whatever
Speaker 1: are paying the ransom versus saying screw you, I'm not paying.
Speaker 1: It will start over right. So when we did our research, uh,
Speaker 1: we we found um and we don't know, we don't
Speaker 1: think this is all of them in fact, we know
Speaker 1: it's not all of them because a lot of them
Speaker 1: aren't public they reported, but since two thousand and thirteen,
Speaker 1: sound two hundred and fourteen publicly reported attacks against state
Speaker 1: and local governments. But I don't know if that's ten
Speaker 1: percent or of the total number. That's already a lot
Speaker 1: more than I think most people would have guessed that
Speaker 1: this has happened across the country. Wow, And I can
Speaker 1: understand why people people keep it quiet because you don't
Speaker 1: want to encourage you, right exactly. So one of the
Speaker 1: things that we've seen in our research, first answer your
Speaker 1: previous question, state and local governments are actually better than
Speaker 1: most organizations of paying the ransom and not paying the ransom,
Speaker 1: I should say so. We found report based on public reporting,
Speaker 1: we found about seventeen percent of state and local governments
Speaker 1: pay the ransom versus about of overall ransomware victims. So
Speaker 1: they're actually significantly less likely. And we think that's because
Speaker 1: it's much harder to pay the ransom when you're paying
Speaker 1: it with tax care money. So like if you're a
Speaker 1: bank or you're a hospital that gets hit, that's your
Speaker 1: money that you're paying with. It's much harder to go
Speaker 1: the taxpayers and say, hey, we just gave a hundred
Speaker 1: thousand dollars to some guys in Russia, um to get
Speaker 1: our files back. That that's a much more difficult conversation
Speaker 1: to have. Alan Liska has a company called Recorded Future.
Speaker 1: He's written a couple of books on network security and
Speaker 1: that sort of thing that are more and more important
Speaker 1: these days. Hey, real quick, Uh, if if my town
Speaker 1: gets hit with ransomware, and I don't know, say there's
Speaker 1: like three weeks a month that they're trying to figure
Speaker 1: out what to do or whatever, how does that affect
Speaker 1: taxpayers and citizens? What sort of things get messed up? Well?
Speaker 1: So and and that's been a real problem, and that's
Speaker 1: one of the reasons why attackers are starting to focus
Speaker 1: in on cities and towns because it becomes a big
Speaker 1: deal in the press when this happens. Because constituent services
Speaker 1: are interrupted, so you can't pay your water bill, for example,
Speaker 1: because all of that's digitized. You can't buy a house
Speaker 1: because they can't do title transfers. H if you have
Speaker 1: a court case spending, you may not be able to
Speaker 1: go to that because court dockets get encrypted. When Atlanta
Speaker 1: was hit last year, Hartfield Jackson had to shut down
Speaker 1: their WiFi for a couple of hours because they were
Speaker 1: afraid the ransomware that was spreading was going to jump
Speaker 1: from the city to their WiFi network and then potentially
Speaker 1: to people in the airports. Alan Liska is a threat
Speaker 1: intelligence analysts company has recorded Future. Um, if you need
Speaker 1: this sort of help, we'll have a link Alan so
Speaker 1: that folks can find you and recorded Future really easily.
Speaker 1: But great stuff. Enjoyed the chat. Thanks, thank you very much. Yeah,
Speaker 1: I tell you what man that is. Oh, that's got
Speaker 1: to be a bad feeling. Hey, your files are encrypted.
Speaker 1: Send us a hundred thousand dollars. I think I'm anti
Speaker 1: paying these people. But there was I think it was
Speaker 1: in Pennsylvania. There was a city that instead of paying
Speaker 1: the seventy thousand dollars, they spent several million dollars, right,
Speaker 1: And Allen was talking about going to the taxpayers for that.
Speaker 1: Have any thousand? Well, how do you go to them
Speaker 1: for the several million? Well you don't. It just gets
Speaker 1: built into the money they regularly spend. Yeah, because taxpayers
Speaker 1: are generally I hate to say stupid, but we don't.
Speaker 1: We don't pay enough attention. Yeah, fair enough to where
Speaker 1: our money is spent. Back to paperman, index cards, file cabinets.
Speaker 1: They were able to do it before carbon copy. Carbon
Speaker 1: copies exactly, mimi agraph machines by the telegraph. When you're
Speaker 1: ready to ride Metro, we want you to know we're
Speaker 1: ready for you. Here are just a few of the
Speaker 1: people at Metro to tell you how we're doing our
Speaker 1: part to keep riders safe. We're cleaning like noble before
Speaker 1: half build it greatly. You've found half out of no mask,
Speaker 1: no Metro need one. We have a few extras at Metro.
Speaker 1: We're doing our part to keep the DC area moving.
Speaker 1: Find out more at Wellta dot com slash doing our
Speaker 1: part