6 ms·
While these stories are becoming all too common I’d like to think that while we’re in a golden age of being a ransomware payouts, it will lead to actually carin
by hellotomyrars 6y ago
While these stories are becoming all too common I’d like to think that while we’re in a golden age of being a ransomware payouts, it will lead to actually caring about security by many of the high-profile affected companies.
While the overall cost may be low for them, if they don’t make meaningful changes to prevent these issues in the future, it’s not hard to imagine it might add up quickly.
I don’t support these attacks and some of the targets in particular are insidious, like hospitals where an attack could lead to an actual death toll, but it might actually be the kick in the ass many organizations need to actually care.
It’s sad that it’s come to this point but the end result may be better for everyone.
- StavrosK 6y agoIt definitely makes the costs of bad security immediately obvious to the company, rather than just taking the data and selling it, which externalizes the cost to the user.
- walrus01 6y agoTo me this seems kind of like a company that has a big warehouse full of product that intentionally (or carelessly) neglects its fire alarm and fire suppression system. Or a warehouse of valuable product (say, many pallets of $5000 DSLR cameras) that has very lax security. It's the network security and endpoint security version of that. It's not absolutely guaranteed that your warehouse is going to catch on fire, or that some guys are going to back up a box truck and clean out your valuable inventory at 3am, but there is a high likelihood of it occurring.
- greesil 6y agoThink of it as a very expensive bug bounty.
- sqrt17 6y agoBug bounties work well for publically accessible systems, e.g. a site's web service. As a result, many of the more visible break-ins occur through phishing or spear-phishing and combine social engineering with malware as well as classical intrusion techniques from within the network perimeter.
- AnIdiotOnTheNet 6y agoYeah, let's just equate criminal behavior with doing people a service, that's going to reflect well on people in IT.
- foobiekr 6y agoThe people releasing terrible software (that has a default-open admin port with no login credentials and no filtering, as just one of many examples) are not usually the ones who end up paying the ransoms.
- hellotomyrars 6y agoI'd argue on the scale of a company like in this example and other high-profile example that if you're integrating software with such glaring holes in your network then you're the one who is culpable. Obviously if there are unknown vulnerabilities that is one thing, but there is a level of due diligence you should practice as the operator.
- foobiekr 6y agoI agree that they are culpable, but that doesn’t close the loop.
- 0x00000000 6y agoNothing will change until they make it a felony to pay a ransom.
- trianglem 6y agoImpossible. Some things are just worth more than any amount of money and punishing the victim will not change that.
- hn_throwaway_99 6y agoAt the very least they should require full disclosure, including an analysis of how the hackers were able to breach their systems. I believe that some laws requiring notification to customers in case of a data breach would already cover this. However, from another article I found this statement from CWT: "While the investigation is at an early stage, we have no indication that personally identifiable information/customer and traveller information has been compromised." That appears to be a complete lie based on the chat transcripts, and if so I hope CWT is punished legally for it.
- baddox 6y agoIsn’t it already a felony to attack computer systems and hold data for ransom? That doesn’t seem to be working flawlessly.
- mytailorisrich 6y agoI'm sure criminals would like that. Victims would still have an incentive to pay, but also an incentive not to say anything.
- Animats 6y agoWhile these stories are becoming all too common I’d like to think that while we’re in a golden age of being a ransomware payouts, it will lead to actually caring about security by many of the high-profile affected companies. It may also lead to companies paying for a more aggressive response. Uber has been known to deal with fraud by eventually finding the fraudster, even in Nigeria, and having them "visited".[1] [1] "Super Pumped: The Battle for Uber" Isaac, (2009)
- deleted 6y ago[deleted]
- Cederfjard 6y agoWould you mind elaborating a little bit? To me what you're saying implies extralegal activities, just want to make sure I'm not misunderstanding.
- pc86 6y agohttp://digamoo.free.fr/isaac2019.pdf http://digamoo.free.fr/isaac2019.pdf page 177 has a (very) brief summary of what happened. And just to clarify for others, "extralegal" isn't necessarily bad, and does not mean illegal. It simply means not regulated by the law one way or the other. Calling a Nigerian lawyer and having them talk to someone is definitely not illegal.
- throwanem 6y ago2019, not 2009.
- exikyut 6y agoThis made me curious enough to go digging to learn more. Finding the eBook on Amazon then quote-Googling for verbatim sections of text doesn't always work, but there are sometimes nice exceptions :) For anyone who wants to save 5 minutes, data:text/plain;base64,R29vZ2xlICJpc2FhYzIwMTkucGRmIiA8LS0gaW5jbHVkaW5nIHF1b3Rlcw
- koonsolo 6y ago> It’s sad that it’s come to this point but the end result may be better for everyone. Meanwhile in the real world, a company I develop for implemented the most draconian security measures to "prevent ransomware". Development environment is a virtual machine at the other end of the world, with disabled copy-pasting from and to the local system. A complete separation between safe internal network and unsafe development environment. No copy pasting from and to email, etc. Horrible environment to work in.
- tiew9Vii 6y agoHad one of these. All development through Citrix. The security policy was draconian to the extent I’m sure it was well intentioned but led you to do things in the least secure way possible as it was the only way to complete a contract. I.e the servers on the other end running Windows 7 (in late 2019) where so old they didn’t have the required cpu instruction set to run some required software. Likewise input lag was extremely noticeable to the point you hit a key, wait one second then press again thinking something went wrong only to have to press delete some seconds later. How did I deliver that project? Developed on my own local machine, emailed the artifact to the cooperate email address obfuscated, log in to the corporate laptop, then Citrix, ssh the artifact up to the cloud ec2 servers. That’s another one. The cloud ec2 servers. No public outbound internet, no internal trusted repositories. What was the accepted way of setting up the servers? Going to random internet sites, downloading random binaries to your Citrix account, scp’ing then to the servers. Trying to explain how stupid this is gets no where in organisations with thousands of people. When you mention trusted artifact repositories, immutable / reproducible builds, deployment pipelines the answer was we don’t have this as they didn’t meet security guidelines. This was a tier 1 bank. Experience is the bigger the company the worse things are due to the size and different teams/departments being so disconnected.
- awakeasleep 6y agoThe organization has externalized all the responsibility for the next breach to you, the individual contributor who is breaking security protocol to get work done. When we little employees roll our eyes and say "this doesn't make sense," we're telling ourselves a comforting lie because the situation you describe DOES make sense- from the organizational perspective. Management did everything their rules allow to make the computing environment safe, but you, the individual, hacked an unsafe circumvention into the workflow by finagling some personal website and using SCP. I bet none of that process is documented- and if it is, whoever made that documentation is now the responsible party and fall guy.
- netflixandkill 6y agoBack in 2018 I spent six months trying to get a small software shop to implement automated backups as their answer to ransomware fears.(on top of the usual anti-malware and restrictions on lateral movement where we could put those in) They didn't object to the idea insomuch as they had somehow convinced themselves that they needed some kind of security specific product. We were never able to tease the shape or color beyond a silver bullet. When basic business continuity planning with simple tools that companies should have anyway for a dozen reasons still aren't deployed, I'm pessimistic that this phenomenon is going away anytime soon.
- wlesieutre 6y agoMarketing opportunity for a backup product named Ransomware Protect?
- meshaneian 6y ago"Ransomwair Protect for National Security is detected suspicious activity on your computer. Please be call Windows technology Support for assistence with the files at 1-800-xxx-xxxx as required by the FBI and IRS required laws." [sic]* /s
- ptero 6y ago> It’s sad that it’s come to this point but the end result may be better for everyone. You make a lot of good points, but I am afraid that when such organizations start caring the cure will be worse than the disease. Some of this already leads to either draconian security policies (that make development hard but do not improve ransomware security by much) or passing the risk on someone else, for example by buying a security policy (which increases costs, but seldom improves security). Similar to most restrictions introduced "because pornography" or "because terrorism" those are likely to be mostly a drag on society. We might eventually get to better security practices: general policies that are easy to implement and not onerous to comply with and flexible exceptions, where the damage is small and relaxing a policy leads to other improvements, but this state seems very far away. My 2c.