This article originally appeared in Dark Reading on June 20, 2019.
Riviera Beach’s decision to pay ransom to criminals might get files back, but it almost guarantees greater attacks against other governments.
Paying the ransom for ransomware is rarely recommended, but that didn’t stop Riviera Beach, Florida — a town with a population of around 35,000, north of West Palm Beach — from authorizing a payment of 65 Bitcoin, worth more than $600,000, to criminals in the hope that municipal data would be unlocked.
The attack, which began on May 29 when a police department employee opened a malicious email attachment, ultimately disabled all of the city’s online systems, including email, a water utility pumping station, some phones, and the ability to accept utility payments online or by credit card.
Ilia Kolochenko, founder and CEO of ImmuniWeb, says that the payment could have far-reaching consequences. “This is very alarming news that will likely spur an unprecedented spike of ransomware attacks on the critical infrastructure of small cities that are unable to duly protect themselves.” This means that “cities, municipalities, and smaller governmental entities are a low-hanging fruit for insatiable and smart cybercriminals.”
And those criminals may have begun ramping up their activities even before Riviera Beach showed that there can be significant profit. “Cyber extortion is a growing type of attack, with a questionable effectiveness,” says Allan Liska, an intelligence analyst at Recorded Future. “While there are a lot of these attacks occurring, most of them are simply bluffs. There aren’t as many cases of a legitimate cybercriminal with legitimate access to the target organization using this technique. It is an interesting area to watch for potential growth.”
“Cybercriminals always try to get maximum profit doing the least effort,” says Cesar Cerrudo, chief technology officer of IOActive and founder of Securing Smart Cities. “That’s why targeting city technology is a good business opportunity to them as the private sector is becoming more secure and difficult to hack, while most city systems are easier to hack.
“There is a lack of cybersecurity knowledge and skilled resources in most cities around the world, while technology adoption and dependence keep increasing,” Cerrudo adds, pointing out that the combination creates an especially dangerous opportunity for criminals. And things could get worse. “So far, the consequences have been mostly financial, but soon attacks could end up putting human lives at risk,” he says.
In addition to the ransom payment, Riviera Beach moved purchase of $900,000 in new computer hardware forward a year in order to replace infected systems. And all of the expense could have been avoided, according to some security professionals. “Bad actors are rational. They will invest time and effort into attacks that work,” says Unman Rahim, digital security and operations manager for The Media Trust. “The takeaway from this and other similar attacks is this: All businesses should back up their data and train their employees on how to avoid such cyberattacks.”
Sam McLane, chief technology services officer at Arctic Wolf Networks, gets even more specific with his recommendations for municipal governments. “First, having good backup and recovery is essential to counter ransomware. If malware slips through your defenses, you need the ability to revert to a recent backup and avoid the pain that the City of Riviera Beach is encountering,” McLane says. “Second, organizations also need to have detection technology like network monitoring via intrusion detection or endpoint detection and response. And third, organizations must monitor the entire environment to detect and respond when something slips through.”
