4 ms·

You're still thinking all-or-nothing, talking about "exploits" or "vulnerabilities" where finding one lets you take over the whole ystem at once. That is not h

by brazzy 6y ago

You're still thinking all-or-nothing, talking about "exploits" or "vulnerabilities" where finding one lets you take over the whole ystem at once. That is not how these attacks happen, that is not what happened at Maersk, and that is not what the article is about. The breach happend via compromised third-party software installed on a small number of regular workplace PCs. The big damages happened largely because sloppy privilege managment allowed the attackers to hop between systems and gradually acquire more credentials and more privileges via weak or reused passwords and accounts shared across systems and functions, until the attackers controlled thousands of PCs and servers across the entire international company. This kind of thing is a process, and the amount of damages depends mostly on how fast the attackers can gain more privileges vs. how soon they are noticed and countermeasures taken. Better privilege management, as suggested by the article, can easily slow down that process to a point where it won't cause significant damage. And your whole extortion argument hinges on the idea that an attacker can demonstrate the ability to cause X amount of damage without actually doing it or giving the victim information that can be used to prevent the attack. That is not how it works in reality, except in the case of DDOS attacks, which are an infrastructure rather than a security issue. In reality, the amount of damage an extortionist hacker can put a price on is only the amount they can undo or provably refrain from doing in the future. Specific examples of this are mass-encrypting data and threatening to publish trade secrets. And those are things we see happening in reality, but the amounts are much smaller because they cannot include the large-scale disruption of operations that Maersk experienced. By your logic, the form of extortion you describe should already be happening, constantly, to every large company on the planet. It should be the most profitable form of organized crime ever. But that is not happening in reality. Because in reality, security and security breaches don't work like you seem to think they do.

Veserv 6y ago
No. I made no claim about attack procedure. I said an attack that would cause X dollars of damage which can include instantaneous, short duration, remote control, automated control, long duration, social engineering, multiple attacks, etc. To constrain the type of attack is ludicrous since attackers are not required to constrain the type of their attack, so doing so does not properly reflect the threat model. What is your evidence that better privilege management would prevent an attack funded on the order of $30M from being anything other than devastating? Given that nearly every company in the world is routinely successfully attacked, I see no justification for giving the benefit of the doubt to claims of security that are not rigorously analyzed and tested. Have you ever seen a company run a $30M pentest that did not find ways in? If your answer is that no company does a $30M pentest since that is a crazy amount to pay, that supports my point since they are only bothering to test things easier than the standard I put forward. There is no reason to trust an entity in an industry that claims they are better than can be verified. If your answer is that a $30M pentest is not indicative of anything and nobody tests that way, then please suggest a test that correlates to difficulty of attack that is at the $30M level. If the answer is no such test exists, then I fail to see why there should be any confidence at all in claims that can not even be loosely quantified or correlated against the primary problem. I will actually claim $30M is far too high. I bet attacks of this caliber would only take ~$1M to develop and deploy against best-in-class defenses. Therefore, my extortion argument actually becomes that they engineer 30 independent attacks and can burn one or two of them to demonstrate that they can do at least $300M in damages. Even developing 30 independent attacks, the strategy is highly profitable under my assumptions. No, the extortion market is new. There is no reason to suggest that a new greenfield market with a multi-billion dollar potential market should be instantaneously saturated. That is ridiculous. This should be especially true in light of the fact that criminals do not have access to high-growth funding models due to being criminals so are generally required to bootstrap. Just because some criminal act is not done does not mean that it can not be done. Nobody hijacked a plane and flew it into a building before 9/11, but nobody is claiming that it was not feasible beforehand or that it would not have been an efficient act of terror if done previously. If you actually want to make a meaningful counter-argument that may be convincing, please start from $300M in damages and then back-calculate the necessary cost of attack for a criminal to find such an attack profitable. State assumptions on each step for why it influences cost or benefit in some fashion and then we can discuss if those steps seem reasonable. I already did this previously when back-calculating to $30M from $300M, so you could also discuss why you think the individual steps are invalid. Please try to include quantitative estimates or beliefs. Ranges and probabilities are fine to hedge any statements.

by brazzy 6y ago

Veserv 6y ago

No. I made no claim about attack procedure. I said an attack that would cause X dollars of damage which can include instantaneous, short duration, remote control, automated control, long duration, social engineering, multiple attacks, etc. To constrain the type of attack is ludicrous since attackers are not required to constrain the type of their attack, so doing so does not properly reflect the threat model. What is your evidence that better privilege management would prevent an attack funded on the order of $30M from being anything other than devastating? Given that nearly every company in the world is routinely successfully attacked, I see no justification for giving the benefit of the doubt to claims of security that are not rigorously analyzed and tested. Have you ever seen a company run a $30M pentest that did not find ways in? If your answer is that no company does a $30M pentest since that is a crazy amount to pay, that supports my point since they are only bothering to test things easier than the standard I put forward. There is no reason to trust an entity in an industry that claims they are better than can be verified. If your answer is that a $30M pentest is not indicative of anything and nobody tests that way, then please suggest a test that correlates to difficulty of attack that is at the $30M level. If the answer is no such test exists, then I fail to see why there should be any confidence at all in claims that can not even be loosely quantified or correlated against the primary problem. I will actually claim $30M is far too high. I bet attacks of this caliber would only take ~$1M to develop and deploy against best-in-class defenses. Therefore, my extortion argument actually becomes that they engineer 30 independent attacks and can burn one or two of them to demonstrate that they can do at least $300M in damages. Even developing 30 independent attacks, the strategy is highly profitable under my assumptions. No, the extortion market is new. There is no reason to suggest that a new greenfield market with a multi-billion dollar potential market should be instantaneously saturated. That is ridiculous. This should be especially true in light of the fact that criminals do not have access to high-growth funding models due to being criminals so are generally required to bootstrap. Just because some criminal act is not done does not mean that it can not be done. Nobody hijacked a plane and flew it into a building before 9/11, but nobody is claiming that it was not feasible beforehand or that it would not have been an efficient act of terror if done previously. If you actually want to make a meaningful counter-argument that may be convincing, please start from $300M in damages and then back-calculate the necessary cost of attack for a criminal to find such an attack profitable. State assumptions on each step for why it influences cost or benefit in some fashion and then we can discuss if those steps seem reasonable. I already did this previously when back-calculating to $30M from $300M, so you could also discuss why you think the individual steps are invalid. Please try to include quantitative estimates or beliefs. Ranges and probabilities are fine to hedge any statements.