4 ms·

This is ridiculous. You're basically saying that having any security at all is pointless because someone will always still be able to break into your system in

by brazzy 6y ago

This is ridiculous. You're basically saying that having any security at all is pointless because someone will always still be able to break into your system in some way. Nothing could be further from the truth. Only ignorant amateurs believe that security is an all-or-nothing game. By making your system more difficult to break into, you: * increase the effort and thus cost for the attacker, thereby reducing the number of opponents that can successfully attack you * reduce the damage they can do before the attack is discovered and stopped * make yourself a less attractive target compared to others > Therefore, any company in a similar circumstance should probably not be deploying connected systems that allow this level of attack. That is simply not an option. You'd increase operating costs far more than the damage caused by this attack, and at the same time lose capabilities that customers have come to expect. Most of the cost of this attack came from having to operate without connected systems.

Veserv 6y ago
No. I made a very specific statement about the cost of attack relative to the benefit of attack for this class of attack. The cost of attack is so far from the benefit of attack that there is no meaningful defense being offered. To use an analogy, making a tank from paper provides more defense than tissue paper. That does not, however, mean that there is any meaningful defense against credible threats. To provide a theoretical example, which should not be misconstrued as my specific belief on effectiveness, if the existing techniques could only stop an untrained child, but the best techniques in the world could only stop an untrained teenager, I do not think anybody would consider that to be a meaningful defense. To go through your arguments in order: Increasing the effort to attack is meaningful if it reduces aggregate harm in excess of the cost of implementation. In the specific case of the NotPetya attack on Maersk and generalized to similar attacks, there is no evidence that any of the proposed measures would meaningfully reduce the probability or raise the cost to be other than extremely profitable (this is my statement that $30M cost of attack is profitable). This is because the benefit of attack is so high relative to the cost of exploit development and deployment. So, in the specific case of techniques designed to prevent large, valuable attacks, it has no significant impact since you would need to raise the cost of such an attack to around the benefit of doing such an attack. Reducing the damage they can do would be useful. The damage done in the Maersk attack occurred over the course of a few hours at most. Any defense against such a technique would need to already be prepared or completely automated. From my reading, damage mitigation usually occurs far after and mostly only prevents the marginal long tail, so I will contend, as in my previous post, that an organization with $30M in funding would be able to do the same amount of damage to any system given that they have the element of surprise and reconnaissance. Making yourself a less attractive target is only meaningful if nobody wants to attack in you particular, it is not easy to wantonly attack all vulnerable parties, and the attacker does not have enough resources after attacking all even more profitable targets before attacking you since, as we stated before, it is still very beneficial to attack you. For the first, that is a bad bet when running a large-scale multinational. For the second, that is literally what software is good at, mass synchronized automated attacks. NotPetya is literally an example of a wanton attack. It is mentioned in that article that Maersk was not even the target. They were accidentally attacked for $250M in damages. Being a less attractive target means nothing if somebody has a weapon that hits all attractive targets at the same time for no extra effort. And for the third, that is a terrible bet in the long run because profitable targets means they have money after each attack, so they will have money to spare to go after you. The only comfort is that it may take them time to hockey-stick to the point where they can saturate the market, but saturate they will. We are already seeing this with the increase in attacks with meaningful economic upside for the attacking parties instead of cheesy little $200/computer attacks. Not deploying vulnerable systems is always an option, it just depends on the cost-benefit analysis as you state. My thesis is that the cost of vulnerable systems is, in the long run, significantly worse than almost all companies realize and there is no effective solution. My justification for this is that I am firmly of the belief, as my questions above indicate, that there is no company that can defend against a $30M attack and that a $30M attack can easily and credibly cause $300M in damages, and, even assuming good-faith extortion so they do not just extort for more money with the same attack, there are enough more $30M attacks that can cause $300M in damages that any such company will go bankrupt either from paying the extortion or from the extortion following through on their threats. As a thought-experiment to go with this, if Maersk offered a $30M bounty for each unique vulnerability discovered that could cause them over $300M in damages, do you think they would run out of such bugs first or go bankrupt first? If the answer is "bugs first", why do they not offer such a bounty since each such vulnerability discovered is at least a 10:1 ROI for criminals and thus would be highly attractive to discover? Just to get ahead of a common response to the above thought experiment corollary. Some people will respond that companies do not need to offer that much to get such vulnerabilities reported to them. This indicates that the problem is even worse than I stated since the cost of discovery is lower which means the criminal ROI is even higher. If they offered $30M for all such vulnerabilities they would be more likely to remove the highly attractive 10+:1 ROI attacks that can do tremendous amounts of damage to them which is a great ROI for the company.
- aj3 6y ago
  You are wrong to focus on 300M. That's the cost of dealing with consequences of an attack, not the cost of measures that would have prevented it. So, you're right to say that attacking some businesses leads to >10 ROI for an attacker (actually much higher ROI are quite common although with lower thresholds), but that's only assuming that these businesses do not invest into proper protections ahead of the attack. The whole point of InfoSec is to find the right balance of investment into preventive measures and incident response teams so that the cost/risk/reward ratios of an attack make it non viable for economically motivated attacker.
  - Veserv 6y ago
    I agree with your statement on the point of infosec. I disagree that any particular infosec organization is equipped to deal with problems of this class in any meaningful way. In fact, it is so far off as to be mind-boggling and probably criminally irresponsible. To this end, I will clarify what I meant. I believe that an attack funded on the order of $30M would be able to do $300M in damages to Maersk even if Maersk adopted best-in-class preventative measures and implemented them as a primary focus with support from management at all levels. An attack, able to do $300M in damages that Maersk can not prevent after we have assumed it already did the best it possibly can, should be able to support a $100M extortion payment. This is an ROI of 3 for an attacker with high threshold and an ROI of 3 for Maersk, so I think this is a valid assessment. So, a counterargument/example is an organization where an attack funded on the order of $30M can not impact operations by more than 1%. I chose the number of 1% because Maersk has a revenue of $39B, so a $300M attack is only ~1% reduction in company output. I hope this clarifies my statement. I also stated in a different response that I believe that the number of $30M attacks that could do $300M in damages probably exceeds Maersk's profit if they paid for all of them at $30M, let alone paying extortion at $100M or having the attack follow through at the cost of $300M. Therefore, in the long run the potential market size is enough to destroy Maersk. As a mildly related note, if anybody here is a member of the infosec community I have a question: How much do you think it would cost for a targeted attack to breach and cause significant damage to the best system you have every personally observed? How did you verify that number? Three pentests by three different competent companies paid that amount and that found no vulnerabilities of note would be convincing. I would likely find other things on that general level convincing, but I can not declare them off-hand.

by brazzy 6y ago

Veserv 6y ago

No. I made a very specific statement about the cost of attack relative to the benefit of attack for this class of attack. The cost of attack is so far from the benefit of attack that there is no meaningful defense being offered. To use an analogy, making a tank from paper provides more defense than tissue paper. That does not, however, mean that there is any meaningful defense against credible threats. To provide a theoretical example, which should not be misconstrued as my specific belief on effectiveness, if the existing techniques could only stop an untrained child, but the best techniques in the world could only stop an untrained teenager, I do not think anybody would consider that to be a meaningful defense. To go through your arguments in order: Increasing the effort to attack is meaningful if it reduces aggregate harm in excess of the cost of implementation. In the specific case of the NotPetya attack on Maersk and generalized to similar attacks, there is no evidence that any of the proposed measures would meaningfully reduce the probability or raise the cost to be other than extremely profitable (this is my statement that $30M cost of attack is profitable). This is because the benefit of attack is so high relative to the cost of exploit development and deployment. So, in the specific case of techniques designed to prevent large, valuable attacks, it has no significant impact since you would need to raise the cost of such an attack to around the benefit of doing such an attack. Reducing the damage they can do would be useful. The damage done in the Maersk attack occurred over the course of a few hours at most. Any defense against such a technique would need to already be prepared or completely automated. From my reading, damage mitigation usually occurs far after and mostly only prevents the marginal long tail, so I will contend, as in my previous post, that an organization with $30M in funding would be able to do the same amount of damage to any system given that they have the element of surprise and reconnaissance. Making yourself a less attractive target is only meaningful if nobody wants to attack in you particular, it is not easy to wantonly attack all vulnerable parties, and the attacker does not have enough resources after attacking all even more profitable targets before attacking you since, as we stated before, it is still very beneficial to attack you. For the first, that is a bad bet when running a large-scale multinational. For the second, that is literally what software is good at, mass synchronized automated attacks. NotPetya is literally an example of a wanton attack. It is mentioned in that article that Maersk was not even the target. They were accidentally attacked for $250M in damages. Being a less attractive target means nothing if somebody has a weapon that hits all attractive targets at the same time for no extra effort. And for the third, that is a terrible bet in the long run because profitable targets means they have money after each attack, so they will have money to spare to go after you. The only comfort is that it may take them time to hockey-stick to the point where they can saturate the market, but saturate they will. We are already seeing this with the increase in attacks with meaningful economic upside for the attacking parties instead of cheesy little $200/computer attacks. Not deploying vulnerable systems is always an option, it just depends on the cost-benefit analysis as you state. My thesis is that the cost of vulnerable systems is, in the long run, significantly worse than almost all companies realize and there is no effective solution. My justification for this is that I am firmly of the belief, as my questions above indicate, that there is no company that can defend against a $30M attack and that a $30M attack can easily and credibly cause $300M in damages, and, even assuming good-faith extortion so they do not just extort for more money with the same attack, there are enough more $30M attacks that can cause $300M in damages that any such company will go bankrupt either from paying the extortion or from the extortion following through on their threats. As a thought-experiment to go with this, if Maersk offered a $30M bounty for each unique vulnerability discovered that could cause them over $300M in damages, do you think they would run out of such bugs first or go bankrupt first? If the answer is "bugs first", why do they not offer such a bounty since each such vulnerability discovered is at least a 10:1 ROI for criminals and thus would be highly attractive to discover? Just to get ahead of a common response to the above thought experiment corollary. Some people will respond that companies do not need to offer that much to get such vulnerabilities reported to them. This indicates that the problem is even worse than I stated since the cost of discovery is lower which means the criminal ROI is even higher. If they offered $30M for all such vulnerabilities they would be more likely to remove the highly attractive 10+:1 ROI attacks that can do tremendous amounts of damage to them which is a great ROI for the company.

aj3 6y ago
You are wrong to focus on 300M. That's the cost of dealing with consequences of an attack, not the cost of measures that would have prevented it. So, you're right to say that attacking some businesses leads to >10 ROI for an attacker (actually much higher ROI are quite common although with lower thresholds), but that's only assuming that these businesses do not invest into proper protections ahead of the attack. The whole point of InfoSec is to find the right balance of investment into preventive measures and incident response teams so that the cost/risk/reward ratios of an attack make it non viable for economically motivated attacker.
- Veserv 6y ago
  I agree with your statement on the point of infosec. I disagree that any particular infosec organization is equipped to deal with problems of this class in any meaningful way. In fact, it is so far off as to be mind-boggling and probably criminally irresponsible. To this end, I will clarify what I meant. I believe that an attack funded on the order of $30M would be able to do $300M in damages to Maersk even if Maersk adopted best-in-class preventative measures and implemented them as a primary focus with support from management at all levels. An attack, able to do $300M in damages that Maersk can not prevent after we have assumed it already did the best it possibly can, should be able to support a $100M extortion payment. This is an ROI of 3 for an attacker with high threshold and an ROI of 3 for Maersk, so I think this is a valid assessment. So, a counterargument/example is an organization where an attack funded on the order of $30M can not impact operations by more than 1%. I chose the number of 1% because Maersk has a revenue of $39B, so a $300M attack is only ~1% reduction in company output. I hope this clarifies my statement. I also stated in a different response that I believe that the number of $30M attacks that could do $300M in damages probably exceeds Maersk's profit if they paid for all of them at $30M, let alone paying extortion at $100M or having the attack follow through at the cost of $300M. Therefore, in the long run the potential market size is enough to destroy Maersk. As a mildly related note, if anybody here is a member of the infosec community I have a question: How much do you think it would cost for a targeted attack to breach and cause significant damage to the best system you have every personally observed? How did you verify that number? Three pentests by three different competent companies paid that amount and that found no vulnerabilities of note would be convincing. I would likely find other things on that general level convincing, but I can not declare them off-hand.