,
4 tweets,
1 min read
Read on Twitter
New front in ransomware: someone is using disclosed Git hosting passwords to wipe the repo and then ransom back a copy for ~$500 in Bitcoin.
about.gitlab.com/2019/05/03/sus…
about.gitlab.com/2019/05/03/sus…
"That shouldn't work, because Git means that the company will have a full local copy."
It doesn't need to work 100% of the time or even 1% of the time, because this will be substantially automated, and the staff cost of figuring who at the company has the most recent repo > $500
It doesn't need to work 100% of the time or even 1% of the time, because this will be substantially automated, and the staff cost of figuring who at the company has the most recent repo > $500
I hesitate to say the following but since it might help at least one startup out there:
If you have your repository accessed by an external party in this fashion, irrespective of whether you have backups, you need to take a deep breath, then push the Big Red Button. Bad news.
If you have your repository accessed by an external party in this fashion, irrespective of whether you have backups, you need to take a deep breath, then push the Big Red Button. Bad news.
There exists a specialized type of infosec consultant called Incident Response (IR) and you might want to consider engaging the services of one. They are probably not cheap. You will probably be advised to e.g. roll every credential you have. This will not be fun. Do it anyhow.
