# Why did Florida city agree to pay hackers $600k to get computer systems back? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [August 8, 2019, 9:01pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372 "2019-08-08T21:01:54Z")\ **Posts on this page:** 18\ **Page:** 3
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [August 9, 2019, 4:18pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/41 "2019-08-09T16:18:55Z")
> [@k9bfriender](#): > > While a well implemented OTP is as close to perfectly secure as is possible, for the purposes of this thread and talking about the hostile encrypting of other people’s files, it would not be a practical method of attack, as the one time pad would have to be at least as big as the data being ransomed, and that would be a bit harder to distribute with to unsuspecting users. But you could come up with a simple and unknown encryption method that would be effectively unbreakable within the time required to be useful. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [August 9, 2019, 8:02pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/42 "2019-08-09T20:02:26Z")
One of the ransomware systems out there is not actually encrypting the data, it’s [zeroing](https://it.slashdot.org/story/19/08/02/2112230/germanwiper-ransomware-hits-germany-hard-destroys-files-asks-for-ransom) it out! Apparently a mistake on their part if they’re going after good sized fish who would no doubt look at some files to see what’s what. (E.g., some older ransomwares just did an xor with a fixed string. Trivial to find the string if you have any backups at all and semi-trivial if you don’t.) If you’re going to be that evil just write random bits. And if somehow magically the NSA got involved, there’s nothing they can do at the bulk scale. Recovering overwritten bits on a HD can sometimes be done with significant effort. An SD can be partially recovered at best. At the data center level, the payment is cheaper and hopefully more reliable. Except that some ransomware folk aren’t providing the key anymore. Money down the drain. ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [August 9, 2019, 8:35pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/43 "2019-08-09T20:35:50Z")
Here’s a related thread from a couple years ago. [Ransomware: What is the alternative to paying the ransom?](https://boards.straightdope.com/sdmb/showthread.php?t=826321) ---
**Author:** ![edwardcoast](https://avatars.discourse-cdn.com/v4/letter/e/cab0a1/32.png) [@edwardcoast](https://boards.straightdope.com/u/edwardcoast)\ **Post date:** [August 10, 2019, 5:13am UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/44 "2019-08-10T05:13:25Z")
> [@MaverocK](#): > > The link to the article: [Mazech](https://www.mazechmedia.com/2019/06/florida-city-agrees-to-pay-hackers-600k-to-get-computer-systems-back/) > > What I don’t understand is why NSA did not help? They could crack it. Florida city is part of the US, right? Am I wrong? What I don’t understand is why some organizations are so lax with computer security they have no backups or disaster recovery plan is in place. The article said they believe it started with someone opening an e-mail with a virus. We easily have ways to filter out a virus. We have snapshot backups to be stored off-site and online. I just don’t get it. Something has been lost along the way, that they think reasonable computer security, backups and testing are no longer needed. ---
**Author:** ![scr4](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@scr4](https://boards.straightdope.com/u/scr4)\ **Post date:** [August 11, 2019, 5:43pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/45 "2019-08-11T17:43:28Z")
> [@bump](#): > > My mother-in-law was NOT happy when I pointed out to her that all her paranoid cybersecurity measures, up to and including deliberately turning the computer off when not in use were kind of pointless, because anyone who would actually deliberately target her would just go and break the glass beside the front door, let themselves in, turn the computer on, and go to town. I don’t think that would work. If she was paranoid about data security, I’m sure she used full disk encryption like Bitlocker, which should be effective against this type of attack. ---
**Author:** ![Pantastic](https://avatars.discourse-cdn.com/v4/letter/p/3bc359/32.png) [@Pantastic](https://boards.straightdope.com/u/Pantastic)\ **Post date:** [August 11, 2019, 6:06pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/46 "2019-08-11T18:06:09Z")
> [@edwardcoast](#): > > I just don’t get it. Something has been lost along the way, that they think reasonable computer security, backups and testing are no longer needed. Usually it’s a matter of management not wanting to budget for it. Slapping on some AV software is cheap and you can tell people you’ve done something security wise. Creating a comprehensive system of backups, including offsite backups, disaster recovery, centrally managed AV, and training/enforcing users not to bypass it (by doing things like saving important files to a local drive instead of the network drive that gets backed up) all need money and people. And if management isn’t familiar with IT and doesn’t have anyone pressing them to do it, they’re really not going to want to spend money on these sort of invisible background protections until after a disaster. A lot of states are waking up and enforcing standards for state and local agencies, but it’s nowhere near universal. Until they do, lots of cities and smaller agencies will just have horrible IT practices and will be highly vulnerable to situations like this. I mean, I know of an agency that finally got rid of their last Windows 2000 web servers about a year ago, even though windows 2000 stopped getting security patches around a decade ago. > [@bump](#): > > My mother-in-law was NOT happy when I pointed out to her that all her paranoid cybersecurity measures, up to and including deliberately turning the computer off when not in use were kind of pointless, because anyone who would actually deliberately target her would just go and break the glass beside the front door, let themselves in, turn the computer on, and go to town. Or break one of the 8 foot tall windows in the computer room and get in that way. If she knew what she was doing and using cyber security measures, then they’d turn the computer on, and not be able to get in because they couldn’t get past the encryption software. If she’s ‘regular paranoid’ it would just have a password, if she’s ‘seriously paranoid’ it could require some kind of physical device to get by. Encrypting drives that have data (and routinely cleaning drives that shouldn’t) massively reduces the risk of exposure from physical access. ---
**Author:** ![k9bfriender](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/k9bfriender/32/3283_2.png) [@k9bfriender](https://boards.straightdope.com/u/k9bfriender)\ **Post date:** [August 11, 2019, 7:25pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/47 "2019-08-11T19:25:40Z")
> [@scr4](#): > > I don’t think that would work. If she was paranoid about data security, I’m sure she used full disk encryption like Bitlocker, which should be effective against this type of attack. Except for the password taped to the side of the monitor, or the dongle sitting on the tower. 🙂 People are bad at physical security. ---
**Author:** ![SamuelA](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@SamuelA](https://boards.straightdope.com/u/SamuelA)\ **Post date:** [August 11, 2019, 7:57pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/48 "2019-08-11T19:57:27Z")
> [@Defensive\_Indifference](#): > > **I’m a university professor of cybersecurity.** I think **manson1972** is in the field as well, and we’re saying about the same thing. I mean, I know I’m just a rando on the internet, but I think I’ve established my knowledge in the field on this board. > > To add a little more context, as computers get more powerful, the threshold for computational feasibility gets lower. \*\* Some day, AES 256 will no longer be sufficient to withstand brute force cryptanalysis.\*\* However, that day is not here yet. Properly implemented AES256 with a long key is still effectively unbreakable and will remain so until we’re all doing quantum computing. Bolding mine. The two statements you made are inconsistent with each other. If you really have the background you claim, you would know that, short of non-classical computers or a breakthrough in mathematics, AES 256 is **impossible** to break with any computer that could be built with all the matter in the observable universe. It’s entirely possible that AES or other well known algorithms contain a \*mathematical \*flaw that the NSA is keeping under wraps. Some of the leaked documents hint, actually, that they might have something like that. But this isn’t a matter of computing power - _if_ the NSA can break such messages, it’s using a trick that allows them to do it with supercomputers that are feasible in the here and now. And obviously, if they did have such a trick, it’s going to be classified and kept secret to the maximum possible extent, so that foreign adversaries are unaware their secret communications are being decrypted. They aren’t going to “help out” over a mere $600k. ---
**Author:** ![bump](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@bump](https://boards.straightdope.com/u/bump)\ **Post date:** [August 12, 2019, 3:50pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/49 "2019-08-12T15:50:20Z")
> [@Pantastic](#): > > If she knew what she was doing and using cyber security measures, then they’d turn the computer on, and not be able to get in because they couldn’t get past the encryption software. If she’s ‘regular paranoid’ it would just have a password, if she’s ‘seriously paranoid’ it could require some kind of physical device to get by. Encrypting drives that have data (and routinely cleaning drives that shouldn’t) massively reduces the risk of exposure from physical access. Well of course; that was my point. She didn’t have a password or disk encryption software, but for some bizarre reason, she thought that turning the thing off every night somehow materially enhanced her security, despite having file cabinets full of sensitive stuff in the same room with the easily breakable windows. It was ignorant paranoid. It was a case of seriously flawed risk assessment- in her thinking, the risk was from random internet hackers somehow getting access to her PC, figuring out her bank info, and stealing her blind, not someone deliberately targeting her and getting into the house somehow. It’s like setting off on a hike through Death Valley and worrying more about whether you have enough toilet paper than if you have enough water. ---
**Author:** ![Defensive\_Indifference](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/defensive_indifference/32/6502_2.png) [@Defensive\_Indifference](https://boards.straightdope.com/u/Defensive_Indifference)\ **Post date:** [August 12, 2019, 5:11pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/50 "2019-08-12T17:11:18Z")
> [@SamuelA](#): > > Bolding mine. The two statements you made are inconsistent with each other. If you really have the background you claim, you would know that, short of non-classical computers or a breakthrough in mathematics, AES 256 is **impossible** to break with any computer that could be built with all the matter in the observable universe. Do you mean “non-classical computers” like, for example, quantum computers which I mention _in the very post you quoted?_ And I want to see a cite for that “all matter in the observable universe” claim. ---
**Author:** ![SamuelA](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@SamuelA](https://boards.straightdope.com/u/SamuelA)\ **Post date:** [August 12, 2019, 6:02pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/51 "2019-08-12T18:02:14Z")
> [@Defensive\_Indifference](#): > > Do you mean “non-classical computers” like, for example, quantum computers which I mention _in the very post you quoted?_ > > And I want to see a cite for that “all matter in the observable universe” claim. Hubble limit and that quote is actually true for AES-128. Google it yourself, this is basic knowledge anyone with a real PhD in cybersecurity would know. ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [August 12, 2019, 6:35pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/52 "2019-08-12T18:35:51Z")
> [@Slash1972](#): > > My guess is that you are unfamiliar with the fact that the current head of the Justice Department is a moron. He’s not a moron. He knows more about law enforcement capabilities than either of us - and especially you since you’ve shown a misunderstanding of how the intelligence community works. The actual problem is that Barr has terrible, dangerous, unprincipled judgment. ---
**Author:** ![Defensive\_Indifference](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/defensive_indifference/32/6502_2.png) [@Defensive\_Indifference](https://boards.straightdope.com/u/Defensive_Indifference)\ **Post date:** [August 12, 2019, 7:27pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/53 "2019-08-12T19:27:20Z")
> [@SamuelA](#): > > Hubble limit and that quote is actually true for AES-128. Google it yourself, this is basic knowledge anyone with a real PhD in cybersecurity would know. I googled it and I still don’t know what you’re referring to. Cybersecurity is a big field. Perhaps this is a concept I haven’t encountered. To be fair, I’m more on the business and management side than the math and computer science side. Can you point me to a resource? ---
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [August 12, 2019, 8:00pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/54 "2019-08-12T20:00:46Z")
> [@Ravenman](#): > > He’s not a moron. He knows more about law enforcement capabilities than either of us - and especially you since you’ve shown a misunderstanding of how the intelligence community works. > > The actual problem is that Barr has terrible, dangerous, unprincipled judgment. You clearly have no idea what you are talking about, nor know what any other poster is talking about. Thanks for posting though. ---
**Author:** ![Telemark](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/telemark/32/372_2.png) [@Telemark](https://boards.straightdope.com/u/Telemark)\ **Post date:** [August 12, 2019, 8:35pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/55 "2019-08-12T20:35:25Z")
> [@Defensive\_Indifference](#): > > I googled it and I still don’t know what you’re referring to. I assume this is what he is referring to - [https://www.eetimes.com/document.asp?doc\_id=1279619#](https://www.eetimes.com/document.asp?doc_id=1279619#) ---
**Author:** ![Defensive\_Indifference](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/defensive_indifference/32/6502_2.png) [@Defensive\_Indifference](https://boards.straightdope.com/u/Defensive_Indifference)\ **Post date:** [August 12, 2019, 9:18pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/56 "2019-08-12T21:18:05Z")
> [@Telemark](#): > > I assume this is what he is referring to - [https://www.eetimes.com/document.asp?doc\_id=1279619#](https://www.eetimes.com/document.asp?doc_id=1279619#) Yeah, after I posted I was thinking he meant either that or that 2^256 is a number larger than the number of all atoms in the universe. Which is all fine and dandy, but he wrote, “AES 256 is impossible to break with any computer that could be built with all the matter in the observable universe”, which is just a _bit_ different. So, **SamuelA** , in an effort to discredit me for whatever reason, you appear to have mangled an actual fact beyond recognition, failed to read the part of my post where I allow for advances in non-classical computing, and gotten in a huff when I asked you to back up your assertion. I award you no points, and may God have mercy on your soul. ---
**Author:** ![Telemark](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/telemark/32/372_2.png) [@Telemark](https://boards.straightdope.com/u/Telemark)\ **Post date:** [August 12, 2019, 9:29pm UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/57 "2019-08-12T21:29:08Z")
Agreed, he mangled the headline and ignored the caveat in your post. ---
**Author:** ![SamuelA](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@SamuelA](https://boards.straightdope.com/u/SamuelA)\ **Post date:** [August 13, 2019, 1:02am UTC](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372/58 "2019-08-13T01:02:16Z")
> [@Telemark](#): > > Agreed, he mangled the headline and ignored the caveat in your post. So did indifference. I said **non-classical** computers. The problem is these are speculative. Classical computers can clearly be scaled and made bigger, if nothing else. (and denser in 3d and so on). Quantum computers may or may not scale, if they don’t scale, then they might _never_ let you solve a problem that is effectively impossible to solve with classical computers. [Previous page](https://boards.straightdope.com/t/why-did-florida-city-agree-to-pay-hackers-600k-to-get-computer-systems-back/838372.md?page=2)