5 ms·

> Does anybody here think that even adopting and correctly practicing all practically deployed recommendations of the security industry that a system could resi

by aj3 6y ago

> Does anybody here think that even adopting and correctly practicing all practically deployed recommendations of the security industry that a system could resist such an attack? There are multiple examples of organizations successfully thwarting advanced attacks by following (and exceeding) industry best practices. Most of that stuff isn't disclosed to the public unfortunately. Coinbase incident from the last year is one such example: https://blog.coinbase.com/responding-to-firefox-0-days-in-the-wild-d9c85a57f15b https://blog.coinbase.com/responding-to-firefox-0-days-in-th...

Veserv 6y ago
Thank you for your response. Unfortunately, that example is about 2 orders of magnitude (100x) cheaper to do at market rates than the standard I proposed before the questions of $30M. I arrived at the number of the thwarted attack by looking at Zerodium payouts https://zerodium.com/program.html https://zerodium.com/program.html where a Firefox RCE+LPE goes for up to $100K, so even if we say both such exploits were a RCE+LPE (they are not, the pair amounts to a single RCE+LPE) two such exploits is only on the order of $200K. Adding in the cost of social engineering and any custom work, it probably only amounts to a $300K attack or so. I think it is fair to say that achieving 1% of a standard is inadequate to be a valid example of achieving a standard. If I want to be even more pedantic, the attack was not even targeted at Coinbase since it appears to be part of a larger-scale opportunistic attack. I think you would agree that a more targeted attack that used all resources allocated to the various targets to just Coinbase would be harder to defeat, so we should actually be distributing the cost of attack across all the targets when evaluating the effort level of the attack on Coinbase itself. The article also indicates that the exploit was active for hours before it was stopped. That is more than enough time to cause the vast majority of damage if intended. In this particular case all they did was exfiltrate credentials and documents, but in many cases that is already the majority of the damage intended. As another example, the Maersk attack in the OP only took a few hours to do the $250M of damages.
- aj3 6y ago
  You're right, that wasn't a 30M attack. But that's because there aren't any 30M attacks that we know of (coming from economically-motivated attackers). NotPetya as a whole would have cost <100k for example. Probably the most successful financial attacks have been carried by APT38. It is assumed that it's NK so it might not even fit parameters of a typical crew that multinationals care about, but even these attacks would have cost <2M per attack and 300M is close to what they got in total after all these years, no single attack lead to such payment. So, your math just does not represent real life. Criminals that have 30M lying around are looking for a way to get out and would rather invest their money into legitimate(ish) businesses with lower ROI, criminals that don't have 30M would rather invest into multiple smaller campaigns with higher ROI rather than putting all their eggs into one basket, developers that can attract valley level salary on black market can also find positions in the valley or at defense contractors. On the other hand just because company faces X damages does not mean they are willing to pay anywhere near to X to avoid them. Ethical issues aside, Maersk would have faced impressive damages even if they decided to pay out ransom. Their operations would have been disrupted regardless, they would need to carry out the massive data restoration anyway. Their networks where compromised and there were no guarantees about consistency/integrity of restored data or that paying out ransom wouldn't make them even bigger targets and that hackers (possibly some other crew) wouldn't return next week through the same or different vulnerabilities. So they would need to plan extremely fast migration to win10 in any case, as well as fixing their network architecture, permission systems, putting in place mitigations, buying new defensive solutions and requiring various consulting services. It is hard to say how much money would they be able to save if they would have chosen to pay ransom (and if NotPetya was a ransomware), but it wouldn't be anywhere close to 300M, maybe just <10M. > If I want to be even more pedantic That's ignorant not pedantic. Attackers spent month on spearphishing attacks targeting Coinbase engineers specifically which included making verifyable fake identities and compromising Cambridge web & mail systems. That's exact opposite of a large-scale opportunistic attack.
  - Veserv 6y ago
    Before I get onto the main topic, the timeline seems to indicate that non-Coinbase engineers were also targeted by the attack given that, to paraphrase, it says: "Early June: people click link" and in a separate block "June 17: Coinbase employee clicks link". Using that reading, which may be mistaken, I concluded that it is non-targeted. If it is non-targeted then the fake Cambridge identities were presumably used on all targets which would then make it purely opportunistic as well. Luckily, even if my reading is incorrect, it does not affect the conclusion I wrote since it assumed the strongest possible interpretation of a targeted attack. Onto the other topic, yes I agree there are probably no $30M attacks in the wild. This means that every attack that hits and breaches a company is less than the standard that I proposed. Given that essentially every major company using every combination security solution has been successfully attacked and the situation of continuous hacks has only gotten worse over the years, this supports my position. The lack of $30M attacks is most likely an indication of the immaturity of the attacker market. The fact that an entity can accidentally do $250M in damages to a company, get away with it, and nobody is trying to do that themselves all the time is plain incompetence in the criminal industry. To further support my point that the attacker market is immature, the number and size of economically-motivated attacks has been rapidly increasing over the years. 30 years ago, it was all pranks. 20 years ago it was all data loss. 10 years ago it was all cheesy $200/computer ransoms from consumers. Now we are seeing hospitals being ransomed for $1M. Given the cost of these attacks it is massively profitable at this stage to continue upping the ante. I computed $30M by back-calculating from the damages with an extortion payment of $100M from an extortion damages of $300M. I think this is a reasonable analysis, but you are free to substitute your own numbers on those. If I wanted to give a forward-calculated number based on my knowledge of attack difficulty, I would say that a targeted attack by a competent adversary whose primary goal was to extort Maersk and researched how to actually do damage would be able to allocate ~$10M and cause ~$10B in damages. As for how they might do such damage, they could hack every ship in their fleet and crash them into each other or land. They hack the ships while they are at sea and crash them into cruise ships. They could take over the shipping cranes and drop containers incorrectly onto ships destroying them. They could make the shipping cranes operate in unsafe parameters destroying all of them. They could use the shipping cranes to drop containers on the employees. They could reorganize the shipping manifests subtly over a few weeks to violate shipping agreements that Maersk made. They could sit on every computer until backups are made and then take over the backup systems and destroy them then destroy all the existing systems and servers and wipe the shipping manifests. The list goes on. If you want cases for other companies that might be desirable to attack with high extortion value: An attacker could take over every 2019 Camry then wait until rush hour to engage the ABS so the brakes do not work, engage the cruise control to 120 MPH, then engage autosteer to turn slightly left (or right depending on your country). They would kills tens of thousands in 3 minutes which would completely irrevocably destroy Toyota. An attacker could take over every internet connected GE stove with remote turn-on capabilities (they make these, seriously) and engage the gas at 3:00 AM then wait 30 minutes then ignite blowing up every house with the stove killing everybody inside while they are asleep and at least thousands worldwide which would completely irrevocably destroy GE. An attacker could hit Merck (also hit by NotPetya for apparently ~$1.3B or more) by targeting one of their pharmaceutical plants to either vent and over-pressurize all of the chemicals so they explode into the nearby community or you could re-tune the chemistry to increase toxicity while preventing the automated QA systems from rejecting them which would both completely irrevocably destroy Merck. The list goes on. Given the continuous failure to protect against attacks less than $10M by every company in every industry for decades I see no reason to give the benefit of the doubt to any of these companies, so I assert that not a single one of these companies can protect against an attack funded on the order of $10M where as the extortion value is in the tens to hundreds of billions and thousands of lives. I further assert that there is not a single well known company in the world that can do so and is willing to make that statement in a legally binding manner. And, even if they did so, that is still only minimally sufficient for unimportant industries. A thousand lives should not be subject to the whim of someone with $10M, that is criminally irresponsible in the actual sense where you should go to jail if you do that. For the cases I gave above, you probably need a number on the order of ~$100B on the low end.

by aj3 6y ago

Veserv 6y ago

Thank you for your response. Unfortunately, that example is about 2 orders of magnitude (100x) cheaper to do at market rates than the standard I proposed before the questions of $30M. I arrived at the number of the thwarted attack by looking at Zerodium payouts https://zerodium.com/program.html https://zerodium.com/program.html where a Firefox RCE+LPE goes for up to $100K, so even if we say both such exploits were a RCE+LPE (they are not, the pair amounts to a single RCE+LPE) two such exploits is only on the order of $200K. Adding in the cost of social engineering and any custom work, it probably only amounts to a $300K attack or so. I think it is fair to say that achieving 1% of a standard is inadequate to be a valid example of achieving a standard. If I want to be even more pedantic, the attack was not even targeted at Coinbase since it appears to be part of a larger-scale opportunistic attack. I think you would agree that a more targeted attack that used all resources allocated to the various targets to just Coinbase would be harder to defeat, so we should actually be distributing the cost of attack across all the targets when evaluating the effort level of the attack on Coinbase itself. The article also indicates that the exploit was active for hours before it was stopped. That is more than enough time to cause the vast majority of damage if intended. In this particular case all they did was exfiltrate credentials and documents, but in many cases that is already the majority of the damage intended. As another example, the Maersk attack in the OP only took a few hours to do the $250M of damages.

aj3 6y ago
You're right, that wasn't a 30M attack. But that's because there aren't any 30M attacks that we know of (coming from economically-motivated attackers). NotPetya as a whole would have cost <100k for example. Probably the most successful financial attacks have been carried by APT38. It is assumed that it's NK so it might not even fit parameters of a typical crew that multinationals care about, but even these attacks would have cost <2M per attack and 300M is close to what they got in total after all these years, no single attack lead to such payment. So, your math just does not represent real life. Criminals that have 30M lying around are looking for a way to get out and would rather invest their money into legitimate(ish) businesses with lower ROI, criminals that don't have 30M would rather invest into multiple smaller campaigns with higher ROI rather than putting all their eggs into one basket, developers that can attract valley level salary on black market can also find positions in the valley or at defense contractors. On the other hand just because company faces X damages does not mean they are willing to pay anywhere near to X to avoid them. Ethical issues aside, Maersk would have faced impressive damages even if they decided to pay out ransom. Their operations would have been disrupted regardless, they would need to carry out the massive data restoration anyway. Their networks where compromised and there were no guarantees about consistency/integrity of restored data or that paying out ransom wouldn't make them even bigger targets and that hackers (possibly some other crew) wouldn't return next week through the same or different vulnerabilities. So they would need to plan extremely fast migration to win10 in any case, as well as fixing their network architecture, permission systems, putting in place mitigations, buying new defensive solutions and requiring various consulting services. It is hard to say how much money would they be able to save if they would have chosen to pay ransom (and if NotPetya was a ransomware), but it wouldn't be anywhere close to 300M, maybe just <10M. > If I want to be even more pedantic That's ignorant not pedantic. Attackers spent month on spearphishing attacks targeting Coinbase engineers specifically which included making verifyable fake identities and compromising Cambridge web & mail systems. That's exact opposite of a large-scale opportunistic attack.
- Veserv 6y ago
  Before I get onto the main topic, the timeline seems to indicate that non-Coinbase engineers were also targeted by the attack given that, to paraphrase, it says: "Early June: people click link" and in a separate block "June 17: Coinbase employee clicks link". Using that reading, which may be mistaken, I concluded that it is non-targeted. If it is non-targeted then the fake Cambridge identities were presumably used on all targets which would then make it purely opportunistic as well. Luckily, even if my reading is incorrect, it does not affect the conclusion I wrote since it assumed the strongest possible interpretation of a targeted attack. Onto the other topic, yes I agree there are probably no $30M attacks in the wild. This means that every attack that hits and breaches a company is less than the standard that I proposed. Given that essentially every major company using every combination security solution has been successfully attacked and the situation of continuous hacks has only gotten worse over the years, this supports my position. The lack of $30M attacks is most likely an indication of the immaturity of the attacker market. The fact that an entity can accidentally do $250M in damages to a company, get away with it, and nobody is trying to do that themselves all the time is plain incompetence in the criminal industry. To further support my point that the attacker market is immature, the number and size of economically-motivated attacks has been rapidly increasing over the years. 30 years ago, it was all pranks. 20 years ago it was all data loss. 10 years ago it was all cheesy $200/computer ransoms from consumers. Now we are seeing hospitals being ransomed for $1M. Given the cost of these attacks it is massively profitable at this stage to continue upping the ante. I computed $30M by back-calculating from the damages with an extortion payment of $100M from an extortion damages of $300M. I think this is a reasonable analysis, but you are free to substitute your own numbers on those. If I wanted to give a forward-calculated number based on my knowledge of attack difficulty, I would say that a targeted attack by a competent adversary whose primary goal was to extort Maersk and researched how to actually do damage would be able to allocate ~$10M and cause ~$10B in damages. As for how they might do such damage, they could hack every ship in their fleet and crash them into each other or land. They hack the ships while they are at sea and crash them into cruise ships. They could take over the shipping cranes and drop containers incorrectly onto ships destroying them. They could make the shipping cranes operate in unsafe parameters destroying all of them. They could use the shipping cranes to drop containers on the employees. They could reorganize the shipping manifests subtly over a few weeks to violate shipping agreements that Maersk made. They could sit on every computer until backups are made and then take over the backup systems and destroy them then destroy all the existing systems and servers and wipe the shipping manifests. The list goes on. If you want cases for other companies that might be desirable to attack with high extortion value: An attacker could take over every 2019 Camry then wait until rush hour to engage the ABS so the brakes do not work, engage the cruise control to 120 MPH, then engage autosteer to turn slightly left (or right depending on your country). They would kills tens of thousands in 3 minutes which would completely irrevocably destroy Toyota. An attacker could take over every internet connected GE stove with remote turn-on capabilities (they make these, seriously) and engage the gas at 3:00 AM then wait 30 minutes then ignite blowing up every house with the stove killing everybody inside while they are asleep and at least thousands worldwide which would completely irrevocably destroy GE. An attacker could hit Merck (also hit by NotPetya for apparently ~$1.3B or more) by targeting one of their pharmaceutical plants to either vent and over-pressurize all of the chemicals so they explode into the nearby community or you could re-tune the chemistry to increase toxicity while preventing the automated QA systems from rejecting them which would both completely irrevocably destroy Merck. The list goes on. Given the continuous failure to protect against attacks less than $10M by every company in every industry for decades I see no reason to give the benefit of the doubt to any of these companies, so I assert that not a single one of these companies can protect against an attack funded on the order of $10M where as the extortion value is in the tens to hundreds of billions and thousands of lives. I further assert that there is not a single well known company in the world that can do so and is willing to make that statement in a legally binding manner. And, even if they did so, that is still only minimally sufficient for unimportant industries. A thousand lives should not be subject to the whim of someone with $10M, that is criminally irresponsible in the actual sense where you should go to jail if you do that. For the cases I gave above, you probably need a number on the order of ~$100B on the low end.