Ransomware Attacks on the Rise; Hackers Target IoT

Welcome to 16 Minutes, the A16Z show where we talk about tech trends in the news, what's hype and what's real, and the long arc of innovation. I'm Zoran, and today we're talking about the latest developments and trends in cybercrime, including the trends of ransomware and attacks on physical infrastructure. First, we have the recent attack on the meat processing plant JBS, the largest meat processor in the world. Just last week, it had to temporarily shut down some operations in the US, Canada, and Australia due to an attack on its servers, with the hackers demanding payment from the company. These types of ransomware attacks are increasing. Recently, hackers hit the Colonial Pipeline, the largest refined oil pipeline in the US, and disrupted fuel distribution on the East Coast. In that attack, hackers demanded and received millions in ransom, though the Justice Department announced on Monday it had recovered much of that ransom paid in Bitcoin. Hackers have also recently hit healthcare organizations, school systems, and even ferry services. In the second segment, we'll briefly talk about the breach of home and enterprise wireless network management technology provider Ubiquiti. Security researcher Brian Krebs reported allegations from a whistleblower, and more recently lawsuits have been filed. Here we'll focus on the questions of security that it raises. Both segments feature A16z operating partner for security and former Box CSO Joel de la Garza. A16z general partner Martin Casado, co-founder of networking company Nicira, joins us for the second segment. But we start with Joel explaining how technology trends are leading to a wider range of potential targets for hackers.

Every business is essentially becoming a software business, and and meat processing, and a large chunk of our food processing infrastructure is now a software business. These highly automated facilities are run by computers and essentially are subject to disruption by things like ransomware. Like, it makes sense that a pipeline operator or some of these other bits of critical infrastructure, a power plant, et cetera, but, you know, for a meat processing conglomerate to be subject to these same forces is pretty incredible.

The FBI on Wednesday provided information on the identity of the JBS ransomware hackers, saying it was a cybercrime group with links to Russia. So what do we know about this group and the way they operate?

So this has been attributed to the REvil hacking ransomware group, and this is a ransomware-as-a-service organization, pretty similar to all the other ones that are out there, and their MO is pretty similar. So there is certainly a freelance nature to this. They have kind of an affiliate model where people can bring victims into the ecosystem and then get paid for bringing those victims into the ecosystem. Let's say you were a freelance hacker that got yourself into JBS. Well, you can go to someone like REvil, use their infrastructure, deploy the tools, and take kind of a percentage of the payment of ransom that comes in as part of that activity.

And we don't know right now whether JBS has paid or plans to pay any ransom, although in the case of the Colonial Pipeline attack in May, the company that operates the pipeline did confirm that it paid a ransom. But focusing on the news of the JBS attack and based on what we know of these types of crimes, how do these hackers get access?

The hackers that are doing this ransomware stuff are using very basic attacks because you don't pick the door if the window's left open. You just go through the easiest point of access. And so these people are going after really low-hanging fruit, getting into really critical pieces of our supply chain, and then disrupting them for a lot of money. Typically, they guess a password on like a remote administration terminal, or they maybe send a spear phishing email. And get their malware in there. Basically, they get access to the company, they lock up their computers, they lock up their systems, and then they sell a key to unlock those systems back to the people who've been breached.

So let's separate what's hype from what's real. Are there actually more ransomware attacks going on, or are we just hearing more about them?

No, there's way more. I mean, it's become so lucrative. I think what actually enabled this was, you know, widespread adoption by businesses of cyber insurance policies combined with a belief that if you buy an insurance policy, you don't have to take any precautions to protect yourself. And so you just had a bunch of companies that were like, rather than hiring security people, building a program, securing their infrastructure, they thought, well, I've paid for insurance now, so it doesn't matter. And this is just very much the sign of a super early, super kind of immature industry, and it's kind of Wild West. You flush billions of dollars into the cyber insurance market and the policies start paying out, what happens? Well, a whole ecosystem develops that existed extract that value from those insurers. That's what's happening now.

So these attacks are hitting important infrastructure targets now, such as fuel pipelines. We had the recent Colonial Pipeline attack and major supply chains, food sources, like in the JBS case. And this all has national security implications. So the Department of Justice announced late last week that they were elevating ransomware attacks to a similar priority as terrorism. What kind of impact will this have? And are there any other steps that should be taken for example, by security regulators?

On the federal government side, like, before we rush to kind of like implement new regulations and expand the scope of control for regulators, it'd just be really nice if there could be some coordinated law enforcement activity around this. And I think you're seeing this, a task force that's been set up by Department of Justice. They're going to be working as sort of a fusion center with National Security Council and other intelligence agencies to bring the hammer down on these folks. Like, once these mechanisms get into motion, there's going to be a lot of pressure brought to bear, not just on the criminal actors, right? Because, you know, they'll put a few of them in jail, but they're not going to get all of them, but like a lot of the intermediaries that enable this. And then what's going to be interesting is thinking about what comes next. If cyber insurers, like wholesale, decide to stop paying ransoms, what does that do to the market? Well, the price of ransoms will go down because they're going to try to find an amount that a business could pay out of pocket without it destroying the business. But then they're also going to move more aggressively to monetize the data they steal. And we've seen that. That is a new monetization strategy, which is like, hey, if I ran ransomware a hospital, let me steal patient records, and then let me go to the patients and make the patients pay me to not make their records public, right? It's just going to kind of slide down the chain. So right now you have deep-pocketed insurance companies that are making a lot of the payments. You're going to have smaller-pocketed corporations making the payments, and then eventually it's going to hit the individuals. And so they'll be looking to collect, you know, smaller sums from hundreds or thousands of people.

In our next segment, we're talking about ubiquity. There's a lot going on here, but let's just start with the basics. And Joel, let's start with you. What do we actually know about the breach? What actually happened here?

We have a whistleblower, either a person who was working inside of Ubiquiti as an employee or an external contractor, or perhaps even a consultant, outlining all of the different ways in which Ubiquiti had been breached. And it turns out, according to this whistleblower, that it was actually a compromise of credentials from somebody's LastPass password manager. So somebody got in to a password manager for an administrator that gave them full access to their AWS accounts. And so there was a lot more information there that obviously was not shared with the public in the initial breach disclosure.

Martine, when we say full access, what does that actually mean?

Based on the allegations, it seemed that they had access to everything, including signing keys, which seems to me, if that involves firmware updates, that means the attackers could potentially run arbitrary software on all of these devices that are around the world.

Yeah, absolutely. And I mean, the allegations that they've made, to be very specific, is that they gained root administrator access to all of their AWS accounts, all of their S3 data buckets, all application logs, all databases, all user database credentials. So everything and all secrets.

If true, it's almost like an attacker is able to get access to any device anywhere in the world. And, you know, this isn't some app on your desktop, right? This is like your Wireless infrastructure, and this is potentially your security cameras, right? I mean, it's critical infrastructure that you rely on for security and connectivity, et cetera. I don't recall in near history an allegation for an attack that's potentially so dramatic that touches small business and consumers.

Okay. So according to the allegations, the hackers gained all kinds of access, but how big of a deal is this really? Like, how far did this attack spread?

If you travel anywhere in the world, especially a more remote region, and you look up and you'll see like a little white antenna, that's Ubiquiti. I mean, it's basically, you know, the last mile of connectivity for low-cost and rural areas. So it's absolutely everywhere.

Okay, so let's tease apart what's hype and what's real, as we do on this show. Does this kind of hack tell us anything we didn't know about our vulnerabilities?

Here's where I'll say that this is a little bit different. You know, it's one thing, like, you lose a bunch of data, but then you come and you remediate it, and the companies have the money to do it, and they have the awareness, and they have the knowledge. It's also something to attack software on an end computer because the companies that provide the software learn about it and they kind of upgrade and so forth. And that's kind of very well understood in the industry. What is not as common is, I mean, we're talking about devices that people buy or antennas or security cameras and they put them up and they never think about them again. And it's not like these things go through upgrade cycles. It's not that these are sitting on our desktops. It's not that we interact with them as software in the traditional sense. And it could be the case that whatever attack and backdoors are gonna be with us for the next decade as the equipment like sits out there. I mean, it's actually got a materially different flavor in that sense. It's like these little crumbs all over the world that are unlikely to be upgraded.

Like we've spent the last 20 years conditioning users to update their software, but updating your toaster is a whole new motion, right? So like, it's just gonna sit around broken forever.

Right, and the interesting thing is like a lot of these, you know, we always say Nest and toasters and cameras, but a lot of IoT devices are, you know, kind of like a new thing that a few people have and like they don't have like a lot of deployment, but we're literally talking about pretty much anybody that has a network connection anywhere in the world right now, the chances are 50% or greater, it's Ubiquiti. So this is a big deal of things that we don't really think about patching and upgrading.

Yeah. As technology has gotten easier to use and into the hands of individuals rather than large organizations, it exposes this kind of new vulnerability.

But it's even different than that, in that you could say that for an iPhone, but we understand how to fix those and patch them and upgrade them because it's part of the user experience with computers and laptops and iPads and iPhones. But we're talking about something that people view as almost like as non-technology, like a table or something. And then not only that, it's in the most furthest reaches of the world. And so we potentially have these devices that don't have a software interaction. Like the way that we use them is we don't think about them being compromised and we don't have an upgrade cycle. And so it could be this now endemic thing.

So what do we know about the hackers in this case? The Krebs Report says they demanded 50 bitcoins as ransom to stay quiet about the attack back when the breach was first discovered. So based on that news and the overall fact pattern here, what can we glean about who is doing this and why?

There's probably like two potential actors for this. And, you know, I would say the first is always nation-state. Just think of the surveillance capabilities of having a network that was this large, right? Like, you get access to millions of routers around the world, and now you surveil private internet traffic and you can look in people's homes. That is a spy agency's dream. You would also have ransomware actors, and they did eventually ask for a ransom in the course of this negotiation, but that could be subterfuge, and that could be a way to make it look like it wasn't a nation state. And then the third case is that there are a lot of people who are doing government work that are working for, you know, intelligence agencies that are also kind of moonlighting in the ransomware scene. And so I think, like, it's some confluence of that kind of a group probably relatively sophisticated.

What's the bottom line here in your view? What's the big takeaway for people?

So Joel and I have been in this for a long time. We've seen a lot of attacks. This is another one. My primary message is like, let's not let this stall progress. I think that the benefits that we get from connecting the next billion and from having kind of far more advanced physical security far outweigh the risks that you see from these attacks, but it still is a very interesting situation.

Yeah, it ultimately comes down to just like focusing on the basics and just focusing on good fundamentals is super important in protecting your enterprise.

Martine and Joel, thank you so much for being with us today.

Thank you.

Thank you.