Sterling Auctions Site Up *DO NOT BID at this time*

[swarmee]

It was mentioned on the other board that it might be illegal currently to pay ransomware extortion. So not sure if this opens up the site to federal issues.

[bobfreedman]

Originally Posted by swarmee

It was mentioned on the other board that it might be illegal currently to pay ransomware extortion. So not sure if this opens up the site to federal issues.

Only if the hackers are on the OFAC list which these people are not. We have received the key to unencrypt the files but it will take a long time to unencrypt all of the machines and nodes etc...

Bob

[swarmee]

Originally Posted by bobfreedman

Only if the hackers are on the OFAC list which these people are not. We have received the key to unencrypt the files but it will take a long time to unencrypt all of the machines and nodes etc...

Bob

Thanks; glad you're tracking it.

[UKCardGuy]

I'll be very interested to see the analysis of the vector of attack used by the hackers, which auctions sites were affected and what types of personal data was potentially exposed.

Hopefully Bob will provide clarity about what happened and which sites were affected.

Whether the hackers use thst information, or not, is immaterial. Customers should have the opportunity to manage their risks from the attack.

Personally, I can't condone paying the ransom. If someone steals the keys to my front door, I'm not going to pay them to get the keys back. I'm going to call the locksmith and move on.

If a appropriate backups existed, then there should have been no need to pay any ransom. I'll be reconsidering my patronage of any AH using SimpleAuctionSite as a result.

[Stampsfan]

I too am in IT. I’ve said this before on this board. If I do the forget my password thing, I’ve had emails sent to me with my password in it. Not the way it’s supposed to be handled and I get very leery about that auction house and cloud provider when that happens.

[Tabe]

Originally Posted by UKCardGuy

I'll be very interested to see the analysis of the vector of attack used by the hackers, which auctions sites were affected and what types of personal data was potentially exposed.

Hopefully Bob will provide clarity about what happened and which sites were affected.

Whether the hackers use thst information, or not, is immaterial. Customers should have the opportunity to manage their risks from the attack.

Personally, I can't condone paying the ransom. If someone steals the keys to my front door, I'm not going to pay them to get the keys back. I'm going to call the locksmith and move on.

If a appropriate backups existed, then there should have been no need to pay any ransom. I'll be reconsidering my patronage of any AH using SimpleAuctionSite as a result.

Theoretically, all the hackers should be able to get from an auction site would be your contact info and purchase history. Your credit card and password info SHOULD be stored in encrypted format. If it's not, the auction host should be put out of business. Period.

As for restoring from backups, it's not always that simple. Yes, you would hope you can restore from a clean backup but that's not always possible.

[iwantitiwinit]

Anyone hearing an update on the timing of auction open?

[philo98]

Originally Posted by iwantitiwinit

Anyone hearing an update on the timing of auction open?

Ive received a number of emails from different AH who have delayed opening from yesterday afternoon until it appears Wednesday now.

[Exhibitman]

Originally Posted by iwantitiwinit

Anyone hearing an update on the timing of auction open?

Monday

[birdman42]

Originally Posted by UKCardGuy

Personally, I can't condone paying the ransom. If someone steals the keys to my front door, I'm not going to pay them to get the keys back. I'm going to call the locksmith and move on.

That's not the right analogy. It's more like the hackers called the locksmith and changed the locks, and they have the only key to your house.

Bill

[chriskim]

those hacker normally demand $50k bitcoin as far as I know.

[drcy]

Originally Posted by swarmee

It was mentioned on the other board that it might be illegal currently to pay ransomware extortion. So not sure if this opens up the site to federal issues.

Never heard of that.

[philo98]

Originally Posted by drcy

Never heard of that.

https://home.treasury.gov/system/fil...10012020_1.pdf