{"id":2965,"date":"2020-07-27T15:23:41","date_gmt":"2020-07-27T13:23:41","guid":{"rendered":"https:\/\/www.haruspexsecurity.com\/?p=2965"},"modified":"2020-07-27T16:54:16","modified_gmt":"2020-07-27T14:54:16","slug":"traveling-back-in-time-to-avoid-paying","status":"publish","type":"post","link":"https:\/\/www.haruspexsecurity.com\/it\/traveling-back-in-time-to-avoid-paying\/","title":{"rendered":"Traveling back in time to avoid\u00a0paying"},"content":{"rendered":"

On March 19, 2019, the computer systems Norsk Hydro ASA, a large aluminum manufacturer, started encrypting files and going offline en masse. Two hours later, someone in an operations center in Hungary realized what was happening and, according to a predefined procedure, took down the company\u2019s website, email system, payroll, and everything else. By then, a lot of damage was already done. The ransomware had\u00a0rendered useless five hundred servers and 2,700 PCs. A note asking for a ransom note was flashing on computer screens. The attack was implemented by FIN6, a Financially motivated cybercrime group from eastern Europe.
\u00a0
In spite of all the complex problems to be faced, Hydro never considered paying the ransom, because the attacker could have just taken the Bitcoin and disappear. Even if the description key they might provide worked\u200a\u2014\u200ait would have sent a message that Hydro was an easy mark, leading to future attacks and more extortion.
\u00a0
Instead, Hydro attempted a recovery from the attack, improvising with ancient PCs, fax machines, Post-it notes, and all manner of other analog technology. As an example, customers, suppliers, employees, and investors, were informed of the attack the day after by an employee that used his personal cellphone to make a post on the Hydro Facebook page\u00a0<\/p>\n\n\n\n

\u201cHydro is currently under cyber-attack. Updates regarding the situation will be posted on Facebook.\u201d <\/p><\/blockquote>\n\n\n\n

To recover from the lack of information about customer orders and production scheduling, Hydro employees began calling customers, asking them to text or send orders to personal email accounts. Orders were printed on paper to distribute them in production plants.<\/p>\n\n\n\n

This travel back in time resulted in the huge cost of more than $60 million\u200a\u2014\u200away more than the $3.6 million the insurance policy has paid out so far. According to the prosecutor investigating the breach, this is still the worst cyberattack in Norway\u2019s history.<\/p>\n\n\n\n

Travels in time may become more and more popular as prosecutors are starting to sanction cyber criminals. As an example, currently, Garmin is under attack by the WastedLocker ransomware. This ransomware is operated by Russian hacking group Evil Corp that was sanctioned by the U.S. Treasury last year after one of its members was indicted by U.S. prosecutors. Hence, even if Garmin chooses to pay the ransom, it cannot\u00a0do it because now it is highly illegal. Let\u2019s hope Garmin has backups otherwise we will see another travel in time.
\u00a0
\u00a0Link
\u00a0
\u00a0https:\/\/www.bloomberg.com\/news\/features\/2020-07-23\/how-to-survive-ransomware-attack-without-paying-ransom?srnd=code-wars<\/a><\/p>","protected":false},"excerpt":{"rendered":"

On March 19, 2019, the computer systems Norsk Hydro ASA, a large aluminum manufacturer, started encrypting files and going offline en masse. Two hours later, someone in an operations center in Hungary realized what was happening and, according to a predefined procedure, took down the company\u2019s website, email system, payroll, and everything else. By then, […]<\/p>","protected":false},"author":1,"featured_media":2966,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"yoast_head":"\nTraveling back in time to avoid\u00a0paying - Haruspex<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.haruspexsecurity.com\/it\/traveling-back-in-time-to-avoid-paying\/\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Traveling back in time to avoid\u00a0paying - Haruspex\" \/>\n<meta property=\"og:description\" content=\"On March 19, 2019, the computer systems Norsk Hydro ASA, a large aluminum manufacturer, started encrypting files and going offline en masse. Two hours later, someone in an operations center in Hungary realized what was happening and, according to a predefined procedure, took down the company\u2019s website, email system, payroll, and everything else. By then, […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.haruspexsecurity.com\/it\/traveling-back-in-time-to-avoid-paying\/\" \/>\n<meta property=\"og:site_name\" content=\"Haruspex\" \/>\n<meta property=\"article:published_time\" content=\"2020-07-27T13:23:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-07-27T14:54:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/Fuga-Collage-Banner-Blog-1-1024x576.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"576\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Scritto da\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo di lettura stimato\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minuti\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/ba9bb2a47928bbcee8f611f1fccde3b1\"},\"headline\":\"Traveling back in time to avoid\u00a0paying\",\"datePublished\":\"2020-07-27T13:23:41+00:00\",\"dateModified\":\"2020-07-27T14:54:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/\"},\"wordCount\":419,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/Fuga-Collage-Banner-Blog-1.png\",\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/\",\"url\":\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/\",\"name\":\"Traveling back in time to avoid\u00a0paying - Haruspex\",\"isPartOf\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/Fuga-Collage-Banner-Blog-1.png\",\"datePublished\":\"2020-07-27T13:23:41+00:00\",\"dateModified\":\"2020-07-27T14:54:16+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#breadcrumb\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#primaryimage\",\"url\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/Fuga-Collage-Banner-Blog-1.png\",\"contentUrl\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/Fuga-Collage-Banner-Blog-1.png\",\"width\":2240,\"height\":1260},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.haruspexsecurity.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Traveling back in time to avoid\u00a0paying\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#website\",\"url\":\"https:\/\/www.haruspexsecurity.com\/\",\"name\":\"Haruspex\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.haruspexsecurity.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#organization\",\"name\":\"Haruspex\",\"url\":\"https:\/\/www.haruspexsecurity.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/01\/cropped-NewissimoLogoBigBlack-3.png\",\"contentUrl\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/01\/cropped-NewissimoLogoBigBlack-3.png\",\"width\":6920,\"height\":1858,\"caption\":\"Haruspex\"},\"image\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/ba9bb2a47928bbcee8f611f1fccde3b1\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/dcc17c0300d18055ae340c8615d9fbe8?s=96&d=retro&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/dcc17c0300d18055ae340c8615d9fbe8?s=96&d=retro&r=g\",\"caption\":\"admin\"},\"url\":\"https:\/\/www.haruspexsecurity.com\/it\/author\/admin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Traveling back in time to avoid\u00a0paying - Haruspex","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.haruspexsecurity.com\/it\/traveling-back-in-time-to-avoid-paying\/","og_locale":"it_IT","og_type":"article","og_title":"Traveling back in time to avoid\u00a0paying - Haruspex","og_description":"On March 19, 2019, the computer systems Norsk Hydro ASA, a large aluminum manufacturer, started encrypting files and going offline en masse. Two hours later, someone in an operations center in Hungary realized what was happening and, according to a predefined procedure, took down the company\u2019s website, email system, payroll, and everything else. By then, […]","og_url":"https:\/\/www.haruspexsecurity.com\/it\/traveling-back-in-time-to-avoid-paying\/","og_site_name":"Haruspex","article_published_time":"2020-07-27T13:23:41+00:00","article_modified_time":"2020-07-27T14:54:16+00:00","og_image":[{"width":1024,"height":576,"url":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/Fuga-Collage-Banner-Blog-1-1024x576.png","type":"image\/png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Scritto da":"admin","Tempo di lettura stimato":"2 minuti"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#article","isPartOf":{"@id":"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/"},"author":{"name":"admin","@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/ba9bb2a47928bbcee8f611f1fccde3b1"},"headline":"Traveling back in time to avoid\u00a0paying","datePublished":"2020-07-27T13:23:41+00:00","dateModified":"2020-07-27T14:54:16+00:00","mainEntityOfPage":{"@id":"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/"},"wordCount":419,"commentCount":0,"publisher":{"@id":"https:\/\/www.haruspexsecurity.com\/#organization"},"image":{"@id":"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#primaryimage"},"thumbnailUrl":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/Fuga-Collage-Banner-Blog-1.png","inLanguage":"it-IT","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/","url":"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/","name":"Traveling back in time to avoid\u00a0paying - Haruspex","isPartOf":{"@id":"https:\/\/www.haruspexsecurity.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#primaryimage"},"image":{"@id":"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#primaryimage"},"thumbnailUrl":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/Fuga-Collage-Banner-Blog-1.png","datePublished":"2020-07-27T13:23:41+00:00","dateModified":"2020-07-27T14:54:16+00:00","breadcrumb":{"@id":"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#breadcrumb"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/"]}]},{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#primaryimage","url":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/Fuga-Collage-Banner-Blog-1.png","contentUrl":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/Fuga-Collage-Banner-Blog-1.png","width":2240,"height":1260},{"@type":"BreadcrumbList","@id":"https:\/\/www.haruspexsecurity.com\/traveling-back-in-time-to-avoid-paying\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.haruspexsecurity.com\/"},{"@type":"ListItem","position":2,"name":"Traveling back in time to avoid\u00a0paying"}]},{"@type":"WebSite","@id":"https:\/\/www.haruspexsecurity.com\/#website","url":"https:\/\/www.haruspexsecurity.com\/","name":"Haruspex","description":"","publisher":{"@id":"https:\/\/www.haruspexsecurity.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.haruspexsecurity.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"it-IT"},{"@type":"Organization","@id":"https:\/\/www.haruspexsecurity.com\/#organization","name":"Haruspex","url":"https:\/\/www.haruspexsecurity.com\/","logo":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/01\/cropped-NewissimoLogoBigBlack-3.png","contentUrl":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/01\/cropped-NewissimoLogoBigBlack-3.png","width":6920,"height":1858,"caption":"Haruspex"},"image":{"@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/ba9bb2a47928bbcee8f611f1fccde3b1","name":"admin","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/dcc17c0300d18055ae340c8615d9fbe8?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/dcc17c0300d18055ae340c8615d9fbe8?s=96&d=retro&r=g","caption":"admin"},"url":"https:\/\/www.haruspexsecurity.com\/it\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/posts\/2965"}],"collection":[{"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/comments?post=2965"}],"version-history":[{"count":5,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/posts\/2965\/revisions"}],"predecessor-version":[{"id":2971,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/posts\/2965\/revisions\/2971"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/media\/2966"}],"wp:attachment":[{"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/media?parent=2965"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/categories?post=2965"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/tags?post=2965"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}