This happened to my state's library system a while back. Public computers and free wifi were down for a few months, but no major disruptions of lending services. I don't think the state paid any ransom, instead they just repaired their systems.
Definitely, but ransomware groups generally have incremental customer acquisition costs/margins that most other industries can only dream of. They'll encrypt first, ask questions/set prices later. The whole process might even be fully automated at this point, "thanks" to cryptocurrencies.
I remember hearing that they do have customer support, though! Not sure if you can escalate to a sales rep to get a personalized quote or non-profit discount from there.
Ailing Mrs. Cas tottered back to her small apartment from the failed book ban, her request to her YottaGPT to find a way to stop the center's library never quite settling in as a memory.
She thought of the tapioca she'd be served for lunch.
Today I learned that Queens has a public library system that predated the consolidated New York City library system and fiercely fought to maintain independence rather than come under the control of a Manhattan-based system
The tbree systems in NYC also serve the entire state, not just the city. Any NYS resident can get a card at each. I do and use the e book systems for all at the same time even though I rarely go into the city these days.
Is this due to the php vulnerability from a few weeks ago? Guessing they were on some php-based cms, and their staff never got around to fixing it in time.
I wish the headlines around such things were more honest and would just say the truth: "$company is currently offline because we never really invested in security and thought we could just wing it"
I wish the headlines around such things were more honest and would just say the truth: "$company is currently offline because we never really invested in security and thought we could just wing it"
Yes, because public libraries are well known for being awash in spare cash and never ever operate on a shoestring budget.
Exactly. No sarcasm. Public services should stop hiding the pain. People voted for this. They should carry the pain. In this case the QPL should have said decades ago: “we cannot offer these services in a secure manner on this budget, therefor we will stop offering our services.” Instead they choose to “wing it”.
It should be noted that the NY library system (NYPL, QPL, BPL) are some of the most well funded libraries in the world, and they still have issues like this. Smaller libraries have no chance.
Most of what libraries do technologically is now outsourced to SAAS companies that specialize in the library space (there are at least 2 major one in the US, and I think at least 3 or 4). (encore and bibliocommons are the 2 major ones that I remembered and am pretty sure I've seen at least 2 others).
If everything you are doing is in the cloud, I'd argue that recovering from a ransomware attack is more of a question of if the SAAS company did its job right (which it should be more capable of handling). Of course, that's a reasonable question if they did (similarly why I prefer paying with paypal or google or even (as not so common) amazon third party payment systems than a retailers own internal payment system, yeah they might screw up too, but they invest a lot more into not screwing it up).
And they would risk being completely shut down, I assume. Is that a better option? I'm not even talking about the livelihood of the librarians, but about the loss of the public service.
Winging it and making do with what you can is still probably a great deal for the public. Assuming that something shouldn't be done if it can't be done very well is an interesting position to take.
Typical developer response: if you can’t do X 100% properly you shouldn’t be doing it.
Sure, let’s close down all libraries and all public services for that matter. Let the public feel the pain. They will understand and vote better next time, right?
You think it is lack of information that got people to vote for this nonsense?
Closing things down is the argument taken to a logical extreme. Could they function without collecting that much PII though? If you can't do it right, don't do it, is far more reasonable when limited to just the collection of PII or other potentially sensitive information. Some identifying data might be absolutely required of course, but the great many cases like this show that collecting the absolute minimum must become the default choice.
If you leave your car unlocked and police detects that, they can confiscate your keys and probably even fine you after you collected them. The same principle applies to everything. To a certain extend, it is your duty to secure things. Just putting a sign there "please dont fuck with me" isn't enough these days.
What if the budget is cut so harshly that there is no budget for someone who might potentially notice the problem (and fix it before it is exploited, or make the “we have to stop” decision) at all? The problem becomes undetectable until exploited, so you can't proactively shut things down.
Your assumption that enough people would change their vote (or non-vote if they didn't turn out previously) based on this to make a difference, I think is unlikely to be correct. People complain a lot about public services when they don't work well, but seldom consider (or do but seldom prioritise them) them at the ballot box.
That’s not an excuse. They chose to operate an online service, one that collects personal information. That entails the responsibility to secure it. If they can’t do that, they shouldn’t have offered the service.
If you process personal data, you must secure it against attacks. Are you suggesting that they could just put the addresses of their customers on their website with a warning not to download them, and if someone downloaded them anyway then it would be the fault of that person that they were leaked?
According to this logic, anyone using PHP should also not be processing personal data, and of course Java, and also Javascript, and any other language that has had a huge zero-day. In NYS, your name is considered personal data, so these libraries should not have any digital collection of the names of their members let alone any online services. Although, I'd prefer we start with Meta, Amazon, Alphabet, Apple, etc when it comes to making them lose the right to storing all personal data every time they have a vulnerability.
There is a difference between being hit by the exploit of a zero-day and being hit by the exploit of something (incorrect security implementations) that has been known to be incorrect for years, decades even. The zero-day in PHP is not your fault (unless perhaps you wrote or maintain that bit of PHP) but bad security implementation using PHP (silly example: not bothering to hash password because it is easier and allows you to allow for typos which is convenient for the user) is ultimately the organisations fault.
Society hold a strong double standard when it comes to the notion of blame in criminal acts. In some cases, it is fully put on the criminal. In other cases, it is put on victims of the criminal. While each case can use logic to try to defend it, they are different standards not used consistently. Trying to call out this double standard is a sort of act of profaning the current social norm and not appreciated by most, no different than trying to attack the dominant moral system 500 or 1000 years ago for inconsistencies.
If we were being consistent, then to your later question, yes. But pointing this out is picking at society's reverse scale.
Not really. The victim here is the people whose information has been distributed, not the system (and the people running it) the information was exfiltrated from.
If we are going to use an SA analogy, this is closer to the recent case of a hotel chain where there were several instances of staff giving “randoms” keys to rooms that they should not have. Best practise procedures were not being followed, the ne'er-do-wells took advantage of this, someone else suffered as a result.
Or alternatively we could hold criminals responsible and return to a high trust society where you can provide public services without having your own military department.
You are aware that personal information is routinely stored in places that you can break into with a literal brick to smash a window? Somehow its only computers where people turn off their brains and argue that proactive measures need to be 100% effective at blocking all attacks no matter how high the cost.
> Somehow its only computers where people turn off their brains and argue that proactive measures need to be 100% effective at blocking all attacks no matter how high the cost.
I don't think I've ever seen anyone say they should be 100% effective. Even those physical locations follow some physical security practices. The difference is that computers can be attacked from literally anywhere in the world, and good luck finding the people who did it.
That's a somewhat naive take, ransomware attacks have been launched in the past against many organizations that spend a lot on security such as the Dodd Group, various airports, healthcare providers, and energy infrastructure. The Ukraine war has shown that virtually nothing is secure against dedicated attacks, all kinds of government sites, satellite communications, and even live TV programming have been attacked successfully by both sides. In the war, the attacks are more destructive, but the same techniques for entry could also be used by ransomware.
Libraries also have a extremely difficult task, they have complex, bespoke/customized older technology backends.
Their systems are largely open to the public, their computer spaces might be the only computer some have access to. There was a time when the advice about a dodgy file was to just open it at the library computer.
Much of their staff might be outreach hires and so limited/no workexperience that might have endured corporate training around information governance or cyber security.
And they do that on a budget where they can't afford shoe strings.
If only we could have some kind of jobs program where the government could pay people to fix their crap. A side benefit would be a reduction in unemployment.
There are no unemployed cybersecurity professionals (who are qualified). There is likely a fraction of a percent who are "Between jobs" and that's about it. It's still very difficult to find and hire qualified candidates, even despite the recent surge in programmers making the leap.
when it is other nation states that are attacking, its up to the nation you are in to defend you. you dont expect costco to defend itself against Spetznaz?
honestly blame Elmo / DOGE for this; they are the $company who divested your security for you, thinking you could just "wing" it too
You can't really expect a library with hardly any money to do something like that. With companies, however, I would expect them to have a backup of their entire system so that, if something like this happens, they can simply format everything and restore the backup without significant downtime. Ideally, this should be done in a way that isn’t tied to specific hardware. Then they can simply store the backup with AWS or a similar provider and, if necessary, activate the server and continue working from there.
https://spotlightdelaware.org/2024/09/23/delaware-libraries-...
This happened to my state's library system a while back. Public computers and free wifi were down for a few months, but no major disruptions of lending services. I don't think the state paid any ransom, instead they just repaired their systems.
That seems a pretty terrible target for ransomware, it's not like public libraries have huge amounts of money.
Immoral criminals? Now I've seen everything.
The point is that there are surely targets that are better funded and thus more likely to pay out large sums of money in order to fix things.
Definitely, but ransomware groups generally have incremental customer acquisition costs/margins that most other industries can only dream of. They'll encrypt first, ask questions/set prices later. The whole process might even be fully automated at this point, "thanks" to cryptocurrencies.
I remember hearing that they do have customer support, though! Not sure if you can escalate to a sales rep to get a personalized quote or non-profit discount from there.
I think Darknet Diaries talked about that. I don't remember what episode.
> Not sure if you can escalate to a sales rep to get a personalized quote or non-profit discount from there.
some groups offer it (not out of goodness: rather on price discrimination grounds)
Right? Like what are they going to delete? The digital books? Who had what checked out?
Kind of like "erase the debts" from Fight Club? "Haven't returned that digital book? Keep it!"
I highly doubt it was targeted.
A California nonprofit's computers were once stolen only to be returned by the thieves.
That would also have arguably been more risky of a redemptive act than the right thing to do in this circumstance.
Agreed. This is just shitty. Libraries are one of the few things holding the world together right now, and no they don't make tons of money...
Ailing Mrs. Cas tottered back to her small apartment from the failed book ban, her request to her YottaGPT to find a way to stop the center's library never quite settling in as a memory.
She thought of the tapioca she'd be served for lunch.
It’s a library.
Wipe the system and start again.
should be simple, restore from backup. right ?
Today I learned that Queens has a public library system that predated the consolidated New York City library system and fiercely fought to maintain independence rather than come under the control of a Manhattan-based system
Brooklyn too. (Bronx and Staten Island being served only by NYPL, the “Manhattan” one)
And the consequence of this is that I have to get three different library cards haha.
Another consequence is that on the Libby app you have better chances to find something available, and each one’s limits are separate!
The tbree systems in NYC also serve the entire state, not just the city. Any NYS resident can get a card at each. I do and use the e book systems for all at the same time even though I rarely go into the city these days.
Is this due to the php vulnerability from a few weeks ago? Guessing they were on some php-based cms, and their staff never got around to fixing it in time.
Ransomware infections frequently start with a phished user, not a popped web app.
Not to mention since a few weeks ago several other CVEs have dropped that would have been just as exploitable. Such as *sshole
Unfortunately, QPL has suffered a ransomware incident and currently much of the online access is unavailable
I wish the headlines around such things were more honest and would just say the truth: "$company is currently offline because we never really invested in security and thought we could just wing it"
I wish the headlines around such things were more honest and would just say the truth: "$company is currently offline because we never really invested in security and thought we could just wing it"
Yes, because public libraries are well known for being awash in spare cash and never ever operate on a shoestring budget.
Exactly. No sarcasm. Public services should stop hiding the pain. People voted for this. They should carry the pain. In this case the QPL should have said decades ago: “we cannot offer these services in a secure manner on this budget, therefor we will stop offering our services.” Instead they choose to “wing it”.
It should be noted that the NY library system (NYPL, QPL, BPL) are some of the most well funded libraries in the world, and they still have issues like this. Smaller libraries have no chance.
I'm unconvinced this is true.
Most of what libraries do technologically is now outsourced to SAAS companies that specialize in the library space (there are at least 2 major one in the US, and I think at least 3 or 4). (encore and bibliocommons are the 2 major ones that I remembered and am pretty sure I've seen at least 2 others).
If everything you are doing is in the cloud, I'd argue that recovering from a ransomware attack is more of a question of if the SAAS company did its job right (which it should be more capable of handling). Of course, that's a reasonable question if they did (similarly why I prefer paying with paypal or google or even (as not so common) amazon third party payment systems than a retailers own internal payment system, yeah they might screw up too, but they invest a lot more into not screwing it up).
There's a good list illustrating the market at https://librarytechnology.org//products/
I've noticed Spydus seems to have a big marketshare in the UK.
And they would risk being completely shut down, I assume. Is that a better option? I'm not even talking about the livelihood of the librarians, but about the loss of the public service.
Winging it and making do with what you can is still probably a great deal for the public. Assuming that something shouldn't be done if it can't be done very well is an interesting position to take.
Typical developer response: if you can’t do X 100% properly you shouldn’t be doing it.
Sure, let’s close down all libraries and all public services for that matter. Let the public feel the pain. They will understand and vote better next time, right?
You think it is lack of information that got people to vote for this nonsense?
Closing things down is the argument taken to a logical extreme. Could they function without collecting that much PII though? If you can't do it right, don't do it, is far more reasonable when limited to just the collection of PII or other potentially sensitive information. Some identifying data might be absolutely required of course, but the great many cases like this show that collecting the absolute minimum must become the default choice.
If you leave your car unlocked and police detects that, they can confiscate your keys and probably even fine you after you collected them. The same principle applies to everything. To a certain extend, it is your duty to secure things. Just putting a sign there "please dont fuck with me" isn't enough these days.
What if the budget is cut so harshly that there is no budget for someone who might potentially notice the problem (and fix it before it is exploited, or make the “we have to stop” decision) at all? The problem becomes undetectable until exploited, so you can't proactively shut things down.
Your assumption that enough people would change their vote (or non-vote if they didn't turn out previously) based on this to make a difference, I think is unlikely to be correct. People complain a lot about public services when they don't work well, but seldom consider (or do but seldom prioritise them) them at the ballot box.
That's the yardstick we use for corporations who put profit before safety, and you want use it with government services. Good luck with that.
That’s not an excuse. They chose to operate an online service, one that collects personal information. That entails the responsibility to secure it. If they can’t do that, they shouldn’t have offered the service.
Sort of a "she was asking for it" kind of situation, I take it?
If you process personal data, you must secure it against attacks. Are you suggesting that they could just put the addresses of their customers on their website with a warning not to download them, and if someone downloaded them anyway then it would be the fault of that person that they were leaked?
According to this logic, anyone using PHP should also not be processing personal data, and of course Java, and also Javascript, and any other language that has had a huge zero-day. In NYS, your name is considered personal data, so these libraries should not have any digital collection of the names of their members let alone any online services. Although, I'd prefer we start with Meta, Amazon, Alphabet, Apple, etc when it comes to making them lose the right to storing all personal data every time they have a vulnerability.
There is a difference between being hit by the exploit of a zero-day and being hit by the exploit of something (incorrect security implementations) that has been known to be incorrect for years, decades even. The zero-day in PHP is not your fault (unless perhaps you wrote or maintain that bit of PHP) but bad security implementation using PHP (silly example: not bothering to hash password because it is easier and allows you to allow for typos which is convenient for the user) is ultimately the organisations fault.
Society hold a strong double standard when it comes to the notion of blame in criminal acts. In some cases, it is fully put on the criminal. In other cases, it is put on victims of the criminal. While each case can use logic to try to defend it, they are different standards not used consistently. Trying to call out this double standard is a sort of act of profaning the current social norm and not appreciated by most, no different than trying to attack the dominant moral system 500 or 1000 years ago for inconsistencies.
If we were being consistent, then to your later question, yes. But pointing this out is picking at society's reverse scale.
Not really. The victim here is the people whose information has been distributed, not the system (and the people running it) the information was exfiltrated from.
If we are going to use an SA analogy, this is closer to the recent case of a hotel chain where there were several instances of staff giving “randoms” keys to rooms that they should not have. Best practise procedures were not being followed, the ne'er-do-wells took advantage of this, someone else suffered as a result.
Can any online service guarantee security?
The relevant part isn’t whether they can guarantee security, it’s whether they followed best practices in attempting to ensure it.
No restaurant can “guarantee” that you won’t die from eating their food, but that doesn’t mean anything goes in the kitchen.
Or alternatively we could hold criminals responsible and return to a high trust society where you can provide public services without having your own military department.
You are aware that personal information is routinely stored in places that you can break into with a literal brick to smash a window? Somehow its only computers where people turn off their brains and argue that proactive measures need to be 100% effective at blocking all attacks no matter how high the cost.
> Or alternatively we could hold criminals responsible
Ok. Where are the criminals who did this?
> Somehow its only computers where people turn off their brains and argue that proactive measures need to be 100% effective at blocking all attacks no matter how high the cost.
I don't think I've ever seen anyone say they should be 100% effective. Even those physical locations follow some physical security practices. The difference is that computers can be attacked from literally anywhere in the world, and good luck finding the people who did it.
That's a somewhat naive take, ransomware attacks have been launched in the past against many organizations that spend a lot on security such as the Dodd Group, various airports, healthcare providers, and energy infrastructure. The Ukraine war has shown that virtually nothing is secure against dedicated attacks, all kinds of government sites, satellite communications, and even live TV programming have been attacked successfully by both sides. In the war, the attacks are more destructive, but the same techniques for entry could also be used by ransomware.
Libraries also have a extremely difficult task, they have complex, bespoke/customized older technology backends.
Their systems are largely open to the public, their computer spaces might be the only computer some have access to. There was a time when the advice about a dodgy file was to just open it at the library computer.
Much of their staff might be outreach hires and so limited/no workexperience that might have endured corporate training around information governance or cyber security.
And they do that on a budget where they can't afford shoe strings.
What's the right percentage of its budget a year that a public library should spend on cybersecurity? 10%? More or less?
If only we could have some kind of jobs program where the government could pay people to fix their crap. A side benefit would be a reduction in unemployment.
There are no unemployed cybersecurity professionals (who are qualified). There is likely a fraction of a percent who are "Between jobs" and that's about it. It's still very difficult to find and hire qualified candidates, even despite the recent surge in programmers making the leap.
when it is other nation states that are attacking, its up to the nation you are in to defend you. you dont expect costco to defend itself against Spetznaz?
honestly blame Elmo / DOGE for this; they are the $company who divested your security for you, thinking you could just "wing" it too
You can't really expect a library with hardly any money to do something like that. With companies, however, I would expect them to have a backup of their entire system so that, if something like this happens, they can simply format everything and restore the backup without significant downtime. Ideally, this should be done in a way that isn’t tied to specific hardware. Then they can simply store the backup with AWS or a similar provider and, if necessary, activate the server and continue working from there.