Conrad's Blog – Technology Leadership and Software Engineering

Welcome to conradlotz.com, your ultimate destination for expert insights on software engineering and technology leadership. Our platform brings together a team of seasoned software engineers and business leaders, all eager to share their wealth of knowledge and expertise with you. From coding and development to project management and team leadership, we cover a wide range of topics to cater to both seasoned professionals and those just starting out in the field. Our practical tips and advice are designed to empower you with actionable strategies that you can implement immediately. Join us at conradlotz.com and take your software engineering and technology leadership skills to the next level!

A Costly Lesson in Data Security: How Ransomware Cost Me a Friend

On

By

Conrad Lotz

In

,

Introduction

Let’s be honest – the blame doesn’t always lie solely with the perpetrators of cyber attacks like ransomware. In this personal account, I’ll share a story that exposed my ignorance, leading to a devastating data disaster and straining a precious friendship. Join me as I recount how a seemingly small oversight in data security had far-reaching consequences and the valuable lessons it taught me about safeguarding sensitive information.

The Genesis of the Project

In 2018, my friend approached me with an opportunity to modernize their invoicing process by transitioning from an Excel-based system to a web-based solution. Excitedly, I took on the project as my second contract, collaborating with an excellent Software Engineer friend to build the system. We opted for the PEAN stack – Angular, NodeJS/ExpressJS, and PostgreSQL – an impressive choice for our needs.

After months of hard work, the system was up and running smoothly. Although I encountered the challenge of finding affordable and reliable servers while living in South Africa, I managed to secure a low-spec Windows Server in the US. Despite some minor adjustments and fixes, the system performed flawlessly, making everyone involved quite pleased.

The Fateful Incident

While on a relaxing vacation, I received a shocking call from my friend, informing me that the website was down on a critical day when they needed to print a large invoice for a client. My investigation revealed that all databases had vanished, replaced with a placeholder email demanding a ransom for their return.

The Ransom Dilemma

Unwilling to comply with the attacker’s demands, I decided to restore the databases from my backups. But to my dismay, the backups had been failing for quite some time, and I hadn’t noticed. The realization left me with no other option but to confront the attacker directly.

The Ransom Negotiation

In a polite email exchange, the attacker demanded a ransom payment in Bitcoin for the return of my databases.

As much as I wished to retrieve the lost data, I couldn’t risk paying without any guarantees. With a Rand/Dollar exchange rate of R14 to $1 hit was simply too much money at that time. In addition, having read of cases where victims were left empty-handed despite paying, I had found myself without a solution and had to face the music.

Facing the Consequences

Sadly, I had to admit to my friend that the critical data for their invoice was lost, resulting in a sense of embarrassment and unprofessionalism. The disappointment in my friend’s voice was evident, and even his boss called me in to explain the situation. Convincing my friend to embrace the modern system and move away from Excel had been challenging, and now we had to redo the entire large invoice using Excel!

Identifying the Security Lapse

In the aftermath of the attack, I conducted a thorough analysis of how the attacker breached my system. The glaring oversight was having my PostgreSQL instance’s IP address exposed to the public on port 5432, making it vulnerable to attackers’ scanning scripts.

postgres://username:password@<external ip>:5432

However, the IP address was not the main issue. My lack of applying basic security by selecting a complex password made it simple for the attackers. It is embarrassing saying this as a Technology professional!

postgres://postgres:postgres@44.55.66.77:5432

The combination of both the exposed IP and simple credentials made it easy for a script cyber attacker to scan potentially thousands of PostgreSQL instances and guess the combination of username and password until a successful response is found. The attacker would focus on the successful ones and cause damage.

Conclusion

In my role as Technology Leader in my organization, this experience has served as that constant anchoring reminder of how important security is and what it can cost. It cost me a friend and his reputation of me which was a lot to me. For companies, it could cost millions and clients as well as irreversible reputational damage especially if you are in financial software.

One cannot be angry at the attacker. It is the reality and the way of the world today. Those threats will never go away. The responsibility lies with you. Every Technologist has the responsibility to understand security in their domain. We cannot offload it to security specialists anymore. Companies receive thousands of cyber attacks per day. Defensive programming and best practices on cloud integrations are critical to any system.

27 responses to “A Costly Lesson in Data Security: How Ransomware Cost Me a Friend”

  1. Наш интернет-магазин предлагает доставку свежие цветы от лучших голландских поставщиков по всей Финляндии.
    Каждый букет составляется из отборных цветов, чтобы подарить вам радость.
    toimittaa kukkia

  4. I want to show you one exclusive program called (BTC PROFIT SEARCH AND MINING PHRASES), which can make you a rich man!

    This program searches for Bitcoin wallets with a balance, and tries to find a secret phrase for them to get full access to the lost wallet!

    Run the program and wait, and in order to increase your chances, install the program on all computers available to you, at work, with your friends, with your relatives, you can also ask your classmates to use the program, so your chances will increase tenfold!
    Remember the more computers you use, the higher your chances of getting the treasure!

    DOWNLOAD FOR FREE

    Telegram:
    https://t.me/btc_profit_search

  6. На этом сайте вы сможете найти подробную информацию о способах лечения депрессии у пожилых людей. Также здесь представлены профилактических мерах, современных подходах и советах экспертов.
    http://ladistribution.net/fr/wiki/wiki/dokuwiki/doku.php?id=%D0%A1%D1%82%D0%B0%D1%80%D1%87%D0%B5%D1%81%D0%BA%D0%B0%D1%8F%20%D0%B4%D0%B5%D0%BF%D1%80%D0%B5%D1%81%D1%81%D0%B8%D1%8F

  7. На этом сайте вы сможете найти полезную информацию о способах лечения депрессии у людей преклонного возраста. Вы также узнаете здесь о методах профилактики, актуальных подходах и рекомендациях специалистов.
    http://www.lowellcampuscomputer.com/business/how-business-technology-changed-how-we-think-about-death/

  8. This CCTV software delivers a robust video surveillance solution, featuring intelligent detection capabilities for humans, felines, avians, and canines. As a comprehensive surveillance camera software, it acts as an IP camera recorder and supports time-lapse recording. CCTV Software Enjoy secure remote access to your IP camera feeds through a reliable cloud video surveillance platform. This video monitoring software strengthens your security system and is an ideal option for your CCTV monitoring needs.

  9. На данном сайте можно найти актуальные промокоды ЦУМ https://tsum.egomoda.ru.
    Применяйте данные купоны, чтобы получить выгоду на покупки.
    Предложения обновляются, поэтому следите за новыми скидками.
    Экономьте на товары с выгодными промокодами для ЦУМа.

  10. На этом сайте можно купить фирменные сумки Coach https://coach-bag-shop.ru/.
    В предложении представлены различные модели для любых случаев.
    Всякая сумка сочетает в дизайне качество и утонченность.
    Закажите сейчас и получите доставку в сжатые сроки!

  11. Программа видеонаблюдения – это актуальное решение для защиты имущества, объединяющий технологии и удобство использования .
    На веб-ресурсе вы найдете подробное руководство по настройке и установке систем видеонаблюдения, включая онлайн-хранилища, их сильные и слабые стороны.
    Новости видеонаблюдения
    Рассматриваются комбинированные системы, объединяющие локальное и удаленное хранение, что делает систему универсальной и эффективной.
    Важной частью является разбор ключевых интеллектуальных возможностей, таких как детекция движения , распознавание объектов и дополнительные алгоритмы искусственного интеллекта.

  12. На этом сайте можно ознакомиться с информацией о телешоу “Однажды в сказке”, развитии событий и ключевых персонажах. once upon a time смотреть онлайн Здесь размещены интересные материалы о производстве шоу, актерах и любопытных деталях из-за кулис.

  13. На данном сайте у вас есть возможность приобрести виртуальные телефонные номера разных операторов. Они подходят для подтверждения аккаунтов в разных сервисах и приложениях.
    В ассортименте доступны как долговременные, так и одноразовые номера, которые можно использовать чтобы принять SMS. Это удобное решение если вам не хочет использовать основной номер в сети.
    таджикский номер телефона
    Процесс покупки максимально удобный: выбираете подходящий номер, оплачиваете, и он сразу становится доступен. Попробуйте сервис уже сегодня!

  14. На данном сайте вы можете приобрести онлайн телефонные номера различных операторов. Они подходят для подтверждения аккаунтов в различных сервисах и приложениях.
    В каталоге представлены как долговременные, так и одноразовые номера, что можно использовать чтобы принять SMS. Это простое решение если вам не желает указывать основной номер в интернете.
    купить виртуальный номер для смс
    Оформление заказа максимально простой: выбираете подходящий номер, вносите оплату, и он становится доступен. Оцените сервис прямо сейчас!

Leave a Reply

Your email address will not be published. Required fields are marked *

Categories

Archives

Tags

career communication confidence cyber dao data science decentralized defi design development email engineering imposter improve leadership load balancer machine learning management manager microsoft one-one-one ransomeware security self-doubt skill slack software support systems teams tip training upskill web3