• coco@lemmy.world
    link
    fedilink
    arrow-up
    49
    ·
    1 year ago

    Uh no

    Go to the main breaker that feed the servers whatever. And pull the 600v switch off

    The smartest layout for that situation is having the main breaker box close to the hooman IT operator room

    No choice if it is very serious breach

    • Chunk@lemmy.world
      link
      fedilink
      arrow-up
      21
      arrow-down
      2
      ·
      1 year ago

      Nah. Rip that shit right out of the chassis. Destroy that RJ45 port. Make it so the security audit team has to resolder a jack to the mobo before they can even ssh to the box.

      Trust me I run a security company. If you need help with your security please feel free to contact me! We are the best in the business!

    • Trainguyrom@reddthat.com
      link
      fedilink
      English
      arrow-up
      11
      ·
      1 year ago

      The advice I’ve always heard is disconnect network but leave powered for forensics/recovery. Some ransomware store the decryption key soley in memory, so it is lost upon power loss

      • Haui@discuss.tchncs.de
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        That actually makes sense. We had a ransomware attack once. We also disconnected the device but I cant remember if we powered it off. At the time it stopped encrypting due to that since our network drives were not reachable anymore.

        Is there actually a way to spread the encryption process to a server?

        • Trainguyrom@reddthat.com
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Best I understand the encryption key is needed to encrypt and decrypt, so if the malware isn’t written well enough it may well continue to store the encryption key in memory.

          There’s some old malware on archive.org that just pulls the FAT off the filesystem into memory and offers a dice roll to restore it

    • JuxtaposedJaguar@lemmy.ml
      link
      fedilink
      arrow-up
      6
      ·
      1 year ago

      I vaguely remember the advice actually being to leave it running but disconnect it from the internet. Although maybe hard disconnect the backups if you can.

    • gazter
      link
      fedilink
      arrow-up
      6
      ·
      1 year ago

      Depending on where the breaker is relative to the UPS, of course.

    • RizzRustbolt@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      Should be a trunk line disconnect switch that kills both power and data. And if your manager is cool, then it’s a guillotine switch.

  • TenderfootGungi@lemmy.world
    link
    fedilink
    arrow-up
    28
    arrow-down
    1
    ·
    1 year ago

    Great idea, and realize likely a joke, but wouldn’t you just need to pull the one or two that connect out to the internet?

    • bonn2@lemm.ee
      link
      fedilink
      arrow-up
      33
      ·
      edit-2
      1 year ago

      There could, in theory, be a malicious machine on the internal network that was previously infected, which is now acting as command and control. So if you didn’t know which one it was…

    • deadbeef79000@lemmy.nz
      link
      fedilink
      arrow-up
      12
      ·
      1 year ago

      Given that fucking rats nest of cables, even if you needed to only pull one: good luck finding it in a hurry and good luck pulling only that one.

    • blabber6285@sopuli.xyz
      link
      fedilink
      arrow-up
      8
      ·
      1 year ago

      Depends. If you’re at home with a single endpoint, maybe.

      But in cases like the image there’s a lot of internal traffic and you’d want to stop the malware spreading internally. There might not even be internet connection at all.

      Most serious infections are able to work within isolated internal network. You can stop data breaches by cutting external traffic but if you have ransomware you might want to cut internal connections too.

      You might be able to stop the ransomware from triggering on some devices. That of course depends on the type of ransomware and whether it’s triggered based on time, external command or something else.

        • blabber6285@sopuli.xyz
          link
          fedilink
          arrow-up
          4
          ·
          1 year ago

          I think that’s rather odd comment. Naturally nobody wants ransomware. And there are good reasons.

          Backups may exist, but do they work properly? Or are the backups encrypted too?

          How old are the backups? They might be less than a day old. But less than a day might still mean a lot of extra work and financial loss.

          There might be a lot of work restoring the backups. You might have a lot of different systems.

          In one of the largest ransomware cases in history, Maersk worked for months to get systems back up and running and data up to date. The insurance payout for it was 1,4 billions. Which is at least indicative of the cost.

          And Maersk had recent and working backups.

          • ryannathans
            link
            fedilink
            arrow-up
            2
            ·
            1 year ago

            Don’t tell me you’d try to continue using the compromised systems if you somehow aborted the drive encryption process

            • blabber6285@sopuli.xyz
              link
              fedilink
              arrow-up
              1
              ·
              1 year ago

              Likely not, but definitely depends on the situation.

              And how do you know the backup is not compromised?

              I think it’s not as clear cut. It’s always a risk assessment and depends on context.

              I have to say that I’m not a security expert, just an amateur with conceptual understanding of the topic and some opinions.