小镇在网络攻击中避免支付500万美元的巨额赎金

小镇在网络攻击中避免支付500万美元的巨额赎金

When the city of New Bedford, Mass., was hit by a ransomware attack in July, with hackers demanding $5.3 million in bitcoin to release the city's data, town officials tried an old law enforcement tactic to deal with hostage-takers: open dialogue and stall for time.

今年7月，马萨诸塞州新贝德福德市遭到勒索软件攻击，黑客要求用530万美元的比特币换取该市的数据，该市官员尝试了一种古老的执法策略来对付劫持者：公开对话，拖延时间。

New Bedford's computer network was attacked with Ryuk ransomware on the night of July 4, Mayor John Mitchell told reporters on Wednesday. Because the attack occurred over a holiday and most computers were shut off, the malware spread to just 4% of the city's more than 3,500 computers.That was the first lucky break.

新贝德福德市长约翰·米切尔周三告诉记者，7月4日晚，新贝德福德市的电脑网络遭到了流氓勒索软件的攻击。由于攻击发生在假日期间，大多数电脑是关闭的，所以该恶意软件仅传播了该市3500多台电脑的4%。这是第一次幸运的逃过一劫。

After IT personnel discovered the attack the next day, city officials contacted the anonymous hacker through an email address provided and were told to pay the ransom — one of the largest-ever known demands for such an attack — in exchange for a decryption key to unlock the city's data.

第二天，在IT人员发现攻击后，市政官员通过被提供的电子邮件地址联系了匿名黑客，并被告知支付赎金——这是迄今为止对此类攻击已知的最大要求之一——以换取解密密钥来解锁该市的数据。

Mitchell said he was initially opposed to talking with the attacker, a position most cybersecurity experts recommend. Experts say paying the ransom can encourage hackers to launch other attacks or repeated strikes against a city that paid up.

米切尔说，他最初反对与攻击者对话，这是大多数网络安全专家建议的立场。专家表示，支付赎金可能会鼓励黑客发动其他攻击，或对支付过赎金的城市发动多次袭击。

But Mitchell changed his mind, offering the perpetrator $400,000, using insurance proceeds, because that was about how much other cities had paid in similar circumstances to get their files back. The city's insurance policy covers ransom payments, and Mitchell insisted it would not have come out of taxpayers' pockets.

但米切尔改变了主意，用保险金支付给作恶者40万美元，因为这差不多是其他城市在类似情况下为取回他们的文件所支付的金额。该市的保险单涵盖了赎金，米切尔坚称这笔钱不会出自纳税人的口袋。

Even if negotiations were unsuccessful, it would "buy the city time" to strengthen security ahead of another attack and to figure out whether engineers could restore the data without a decryption key, Mitchell said.

米切尔说，即使谈判没有成功，它也会“为城市争取时间”，在另一场攻击之前加强网络安全，并确定工程师们能否在没有解密密钥的情况下恢复数据。

The plan worked. While officials were talking to the attacker, the city's IT personnel were able to restore a large portion of the data via backup systems.

这个计划生效了。当官员们与攻击者交谈时，该市的IT人员能够通过备份系统恢复大部分数据。

Since then, city officials have made "tremendous progress" in using backup servers to recover or reconstruct the rest of the data, the mayor said. The city is also implementing new security software and new protocols.

市长说，从那时起，市政府官员在使用备份服务器恢复或重建其余数据方面取得了“巨大的进展”。该市还在实施新的安全软件和协议。

"Cybersecurity experts were able to remind us that every computer network, however hardened, is always just one keyboard click away from allowing malicious code to slip past its defenses," Mitchell said at the news conference.

米切尔在新闻发布会上说:“网络安全专家提醒我们，每一个计算机网络，无论多么坚固，只要点击一下键盘，恶意代码就会越过防御系统。”

New Bedford is just the latest municipality to be hit in a string of recent ransomware attacks this year. More than 40 cities and towns have fallen victim to ransomware, including 22 in Texas alone, The New York Times reported. While the government computer systems of Atlanta and Baltimore were infected with these viruses, most of this year's attacks have targeted smaller cities, according to the IT security firm Barracuda.

新贝德福德是今年一系列勒索软件攻击中最新一个受到攻击的城市。据《纽约时报》报道，已有40多个城镇成为勒索软件的受害者，仅德克萨斯州就有22个。据IT安全公司Barracuda称，虽然亚特兰大和巴尔的摩的政府计算机系统感染了这些病毒，但今年的大多数攻击目标都是较小的城市。

Ransomware often spreads through phishing emails that contain harmful attachments.

勒索软件通常通过含有有害附件的网络钓鱼电子邮件传播。

When a similar attack hit Lake City, Fla. — a town of only 12,000 residents — officials paid up because their backup servers were compromised. In that case, the ransom was $460,000 and only $10,000 came out of taxpayer.

佛罗里达州莱克城(Lake City)也发生了类似的袭击，这个小镇只有1.2万居民，该小镇的官员支付了这笔费用，因为他们的备用服务器遭到了攻击。在那次事件中，赎金为46万美元，只有1万美元来自纳税人。