Comments on: ‘Time Bomb’ May Have Destroyed 800 Norfolk City PCs http://krebsonsecurity.com/2010/02/time-bomb-may-have-destroyed-800-norfolk-city-pcs/ In-depth security news and investigation Sat, 11 Feb 2012 19:29:31 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Malcom Reynolds http://krebsonsecurity.com/2010/02/time-bomb-may-have-destroyed-800-norfolk-city-pcs/comment-page-2/#comment-14170 Malcom Reynolds Mon, 13 Dec 2010 18:22:13 +0000 http://www.krebsonsecurity.com/?p=1137#comment-14170 That totally sucks. i do not understand people who do this. What do they have to gain from causing other people grief and trouble? I hate these kind of people. That totally sucks. i do not understand people who do this. What do they have to gain from causing other people grief and trouble? I hate these kind of people.

Like or Dislike: Thumb up 0 Thumb down 0
]]> By: Tony Smit http://krebsonsecurity.com/2010/02/time-bomb-may-have-destroyed-800-norfolk-city-pcs/comment-page-2/#comment-7351 Tony Smit Sat, 03 Jul 2010 23:46:22 +0000 http://www.krebsonsecurity.com/?p=1137#comment-7351 quote: IT specialists for the city found that the system serving as the distribution point for the malware within the city’s network was a print server that handles printing jobs for Norfolk City Hall. However, an exact copy of the malware on that server may never be recovered, as city computer technicians quickly isolated and rebuilt the offending print server. endquote As I understand it, print servers have one or more hard drives. All the technicians needed to do was remove the hard drives from the print server and isolate them for forensic review. To make the print servers usable, install new-from-the-print-server-maker hard drives and begin the setup. That's what spares are for. quote:
IT specialists for the city found that the system serving as the distribution point for the malware within the city’s network was a print server that handles printing jobs for Norfolk City Hall. However, an exact copy of the malware on that server may never be recovered, as city computer technicians quickly isolated and rebuilt the offending print server.
endquote

As I understand it, print servers have one or more hard drives. All the technicians needed to do was remove the hard drives from the print server and isolate them for forensic review. To make the print servers usable, install new-from-the-print-server-maker hard drives and begin the setup. That’s what spares are for.

Like or Dislike: Thumb up 0 Thumb down 0
]]> By: Baldemar Huerta http://krebsonsecurity.com/2010/02/time-bomb-may-have-destroyed-800-norfolk-city-pcs/comment-page-2/#comment-6809 Baldemar Huerta Mon, 14 Jun 2010 07:44:14 +0000 http://www.krebsonsecurity.com/?p=1137#comment-6809 I can't even get my staff of 5 people to even save their word files in the officially sanctioned network folder so they can be backed up. When yet ANOTHER seagate died, I shrugged when the sales weasel started crying about lost files. I can’t even get my staff of 5 people to even save their word files in the officially sanctioned network folder so they can be backed up. When yet ANOTHER seagate died, I shrugged when the sales weasel started crying about lost files.

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: L.T. http://krebsonsecurity.com/2010/02/time-bomb-may-have-destroyed-800-norfolk-city-pcs/comment-page-1/#comment-6311 L.T. Tue, 01 Jun 2010 15:13:03 +0000 http://www.krebsonsecurity.com/?p=1137#comment-6311 It is absolutely true that you can boot to a recovery CD (my favorites are Ubuntu or Knoppix) to recover non-encrypted data. Sometimes this is a little difficult to do if the Big Wig or Highly Regarded Politico has "accidentally" gained access to the PC repair lab, and is rocking back and forth from one foot to the other, all the while moaning about "when am I getting MY laptop back?" In that case it is more expedient to load a fresh image, and let them get back to work ... It is absolutely true that you can boot to a recovery CD (my favorites are Ubuntu or Knoppix) to recover non-encrypted data. Sometimes this is a little difficult to do if the Big Wig or Highly Regarded Politico has “accidentally” gained access to the PC repair lab, and is rocking back and forth from one foot to the other, all the while moaning about “when am I getting MY laptop back?”

In that case it is more expedient to load a fresh image, and let them get back to work …

Like or Dislike: Thumb up 1 Thumb down 1
]]> By: Peacock http://krebsonsecurity.com/2010/02/time-bomb-may-have-destroyed-800-norfolk-city-pcs/comment-page-2/#comment-5897 Peacock Mon, 17 May 2010 16:07:43 +0000 http://www.krebsonsecurity.com/?p=1137#comment-5897 Many of the comments recommend punishing the people who made an error by firing them. Perhaps these IT guys are undereducated in security and instead of punishment, they should be sent to training. As an IT guy, it is difficult to keep up on security, it is a lower priority. These are my sysadmin priorities: 1) immediate problems that keep people from working 2) creating/deleting accounts 3) backup 4) patching 5) upgrades 6) security Many of the comments recommend punishing the people who made an error by firing them.

Perhaps these IT guys are undereducated in security and instead of punishment, they should be sent to training.

As an IT guy, it is difficult to keep up on security, it is a lower priority. These are my sysadmin priorities:

1) immediate problems that keep people from working
2) creating/deleting accounts
3) backup
4) patching
5) upgrades
6) security

Like or Dislike: Thumb up 3 Thumb down 1
]]> By: Solo Owl http://krebsonsecurity.com/2010/02/time-bomb-may-have-destroyed-800-norfolk-city-pcs/comment-page-2/#comment-5880 Solo Owl Sun, 16 May 2010 14:52:38 +0000 http://www.krebsonsecurity.com/?p=1137#comment-5880 You want us all to read 369 pages of tech stuff and then take a couple of 1-week out-of-town courses? You think time grows on trees? You want us all to read 369 pages of tech stuff and then take a couple of 1-week out-of-town courses? You think time grows on trees?

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: bob http://krebsonsecurity.com/2010/02/time-bomb-may-have-destroyed-800-norfolk-city-pcs/comment-page-1/#comment-5327 bob Fri, 23 Apr 2010 21:48:42 +0000 http://www.krebsonsecurity.com/?p=1137#comment-5327 "Time to dump Active Directory and go to Network File System (NFS) or Andrew FIle System (AFS) for true data redundancy." Active Directory is an LDAP implementation, not a network file system... SMB... DFS..... “Time to dump Active Directory and go to Network File System (NFS) or Andrew FIle System (AFS) for true data redundancy.”

Active Directory is an LDAP implementation, not a network file system… SMB… DFS…..

Like or Dislike: Thumb up 2 Thumb down 2
]]> By: Time Bomb May Have Destroyed 800 Norfolk City PCs’ Data | JetLib News http://krebsonsecurity.com/2010/02/time-bomb-may-have-destroyed-800-norfolk-city-pcs/comment-page-2/#comment-3008 Time Bomb May Have Destroyed 800 Norfolk City PCs’ Data | JetLib News Mon, 01 Mar 2010 08:40:55 +0000 http://www.krebsonsecurity.com/?p=1137#comment-3008 [...] of Norfolk, Virginia is reeling from a massive computer meltdown in which an unidentified family of malicious code destroyed data on nearly 800 computers citywide. The incident is still under investigation, but city officials say the attack may have been the [...] [...] of Norfolk, Virginia is reeling from a massive computer meltdown in which an unidentified family of malicious code destroyed data on nearly 800 computers citywide. The incident is still under investigation, but city officials say the attack may have been the [...]

Like or Dislike: Thumb up 0 Thumb down 0
]]> By: WR http://krebsonsecurity.com/2010/02/time-bomb-may-have-destroyed-800-norfolk-city-pcs/comment-page-1/#comment-2666 WR Wed, 24 Feb 2010 15:27:44 +0000 http://www.krebsonsecurity.com/?p=1137#comment-2666 You are absolutely correct!!! I automatically boot from CD\USB key in these types of incidents to try to save any worthwhile data while at the same time look for anything suspicious... I mainly work on people's home PCs but I used to work for City government; this smells of a lot of CYA'ing... If they had the slightest inkling that a SERVER (of all things) may have been infected, a case should have been started, image created, etc... Just saying

You are absolutely correct!!! I automatically boot from CD\USB key in these types of incidents to try to save any worthwhile data while at the same time look for anything suspicious…

I mainly work on people’s home PCs but I used to work for City government; this smells of a lot of CYA’ing…

If they had the slightest inkling that a SERVER (of all things) may have been infected, a case should have been started, image created, etc…

Just saying

Well-loved. Like or Dislike: Thumb up 7 Thumb down 1
]]> By: CyberBits 20 Feb 2010 | Cyber Loop http://krebsonsecurity.com/2010/02/time-bomb-may-have-destroyed-800-norfolk-city-pcs/comment-page-2/#comment-2478 CyberBits 20 Feb 2010 | Cyber Loop Sun, 21 Feb 2010 06:18:02 +0000 http://www.krebsonsecurity.com/?p=1137#comment-2478 [...] ‘Time Bomb’ May Have Destroyed 800 Norfolk City PCs: The City of Norfolk, Virginia is reeling from a massive computer meltdown in which an unidentified family of malicious code destroyed data on nearly 800 computers citywide. The incident is still under investigation, but city officials say the attack may have been the result of a computer time bomb planted in advance by an insider or employee and designed to trigger at a specific date. [...] [...] ‘Time Bomb’ May Have Destroyed 800 Norfolk City PCs: The City of Norfolk, Virginia is reeling from a massive computer meltdown in which an unidentified family of malicious code destroyed data on nearly 800 computers citywide. The incident is still under investigation, but city officials say the attack may have been the result of a computer time bomb planted in advance by an insider or employee and designed to trigger at a specific date. [...]

Like or Dislike: Thumb up 0 Thumb down 0
]]>