You’d think that the payment would be the most significant aspect of a ransomware attack—especially given that the average paid ransom in 2021 was just over $800,000.

And, hey, ransom’s in the name…

But a survey of 300 ransomware victims discovered that other factors hit harder than the ransom: lost productivity, increased downtime, and ruined reputations. The GetApp poll found that, among respondent companies that paid up, only 11% considered the sum to be the most consequential impact—a fact that didn’t surprise incident-response professionals who spoke with IT Brew.

The “easy” part. Responding to a ransomware attack has financial costs: You’ll likely need to pay your recovery team of security providers, outside counsel, and negotiations specialists.

“Sometimes, the payment’s the easiest thing to do, if it’s possible from a legal perspective, because the other costs for that whole ecosystem may outweigh what the bad actor is asking for, in terms of a payment,” said Jess Burn, senior analyst at Forrester.

Paying up in downtime. 34% of the companies surveyed by GetApp that did not pay a ransom still incurred damages above $50,000, which included factors like device replacement and downtime.

“The extortion is maybe 10% of the overall costs,” said Dave Wong, VP at Mandiant, citing legal fees, data recovery, and productivity loss.

“The financial aspect of it doesn’t even describe how impactful it is for most organizations, because it’s very disruptive. You’re running a business, and then all of the sudden, a lot of things stop,” Wong told IT Brew.

Read the rest here.—BH

Do you work in IT or have information about your IT department you want to share? Email [email protected] or DM @BillyHurls on Twitter.

A new form of side-channel attack can use hard drive cables to turn a computer into the digital equivalent of a numbers station, according to research published in July by researcher Mordechai Guri at Ben-Gurion University of the Negev, Israel.

Side channels are potential information pathways indirectly generated by the operation of a computer system—everything from the sounds of keyboards and internal components to leaking electromagnetic radiation and power-monitoring data. Creative attackers can exploit these side channels to exfiltrate information from a system they can’t otherwise access directly, such as air-gapped networks that do not directly communicate with external systems.

One method of side-channel attack is to turn existing computer hardware into a transmitter. For example, in 2020, security firm Duo manipulated the clock rates of Radeon graphics cards to turn GPUs into radios capable of transmitting up to 50 feet away. Guri’s method, dubbed “SATAn,” converts the ubiquitous SATA cable into a radio antenna operating in the 6 GHz frequency band. A system thus subverted is capable of transmitting at 1-bit-per-second over a distance of approximately one meter.

But, it’s pretty niche. No hardware modifications are required; the SATAn exploit uses shellcode to manipulate file-system activity, generating a radio signal via the electromagnetic leakage from the SATA cable. Placing it on an air-gapped system, Guri wrote, might require advanced techniques such as “supply chain attacks, removable media attacks, malicious insiders, and deceived employees to breach the network.”

Then the attacker would need a way to place a receiver close by. Guri’s method was a USB software-defined radio plugged into a laptop—a pretty specific piece of equipment to plop down near a secure system—but as he noted in the paper, “a hardware receiver might be hidden or implanted” in any number of devices, like servers.

Read more here.—TM

Do you work in IT or have information about your IT department you want to share? Email [email protected] or DM @thetomzone on Twitter. Want to go encrypted? Ask Tom for his Signal.

Today’s top IT reads.

Stat: 120,000. That’s the number of Barclays “colleagues and service partners” replacing their collaboration tools with Microsoft Teams, per an agreement between the two companies. (Microsoft)

Quote: “We have confirmed that no Cloudflare systems were compromised.”—Network-security company Cloudflare, addressing an unsuccessful phishing attack that was thwarted due to the use of physical security keys (ITPro)

Read: Gene-editing startup Colossal is using CRISPR to attempt to “de-extinct” Australia’s Tasmanian tiger. (CNET)

IT’ll cost ya: But with Electric’s free IT cost calculator, you can get an estimate of the time and money your biz spends on IT-related tasks. Not crazy about your result? Electric can save you 50% on IT costs with their lightning-fast support. Calculate here.*

^{*This is sponsored advertising content.}