5 ms·

The person who claimed to be the "hacker" commented on Finnish 4chan-like board (kuvalauta) that the credentials to access the servers were root:root. AFAIK the

The person who claimed to be the "hacker" commented on Finnish 4chan-like board (kuvalauta) that the credentials to access the servers were root:root. AFAIK there's no evidence for or against the claim, but if true, I see two quilty parties here.

michaericalribo 6y ago
This is a false equivalence, and victim blaming. Using root:root credentials is sloppy and poor dev practices, but that is minuscule compared with extortion and inflicting widespread stress on a vulnerable population. There’s a reason we have laws against both negligent manslaughter and first degree murder, and there’s also a reason why the penalties for the latter are much more severe than for the former.
- fastball 6y ago
  Nobody said that they were equivalent, just that there are multiple guilty parties. Not guilty of the same thing, but guilty nonetheless. It's not victim blaming because the victims are the patients. The people who were in charge of securing the records and left the creds as root:root are not victims.
  - TeaDrunk 6y ago
    IMO we are using the language of someone who we know to act maliciously on a massive scale (tens of thousands of people, including minors)as if their words can mean anything without corroboration. Frankly I wouldn't believe a rapist saying "but look at what they were wearing" or a serial killer for saying "but they went home alone". Similarly, I don't hold any credence to a black hat saying "but look at how insecure they were".
    - deleted 6y ago
      [deleted]
    - fastball 6y ago
      Again, nobody is blaming the victims. People hired to secure records that then do an exceedingly poor job are not the victims in this situation. Victims == patients. In your analogies of rape/murder, the (almost) equivalent would be if there was a doorman at an apartment building who was supposed to verify the identity of everyone entering the building, but failed to do so, letting the unauthorized perpetrator into the building and thus allowing the victim to be raped/murdered. It was literally his job to prevent such a situation, and he failed. You maintain that he has no responsibility in this matter?
      - TeaDrunk 6y ago
        I'm just saying why assume a malicious actor is saying any truth about the circumstances of their malice?
        fastball 6y ago
        I agree, but the comment I was responding to was operating under the assumption that the claim was true and was making a different point than merely "don't accept things hackers say at face value". Probably because the OC had already hedged: > if true, I see two quilty parties here.
        TeaDrunk 6y ago
        Yes, and my response is "I don't see why we need to give it any credence whatsoever enough to comment on it".
      - deleted 6y ago
        [deleted]
  - hn_throwaway_99 6y ago
    > The people who were in charge of securing the records and left the creds as root:root are not victims. We have to stop designing systems where if one administrative task is mistakenly skipped, the result is catastrophic. Imagine if when you tried to start your car that if you didn't have the brake fully pressed that your car blew up. Would you say "Oh, wow, how irresponsible it is to not fully press the brake"? No, you'd blame the manufacturer for building an exploding car. Systems should not start if strong admin credentials are not the first thing that are set up.
    - fastball 6y ago
      I agree that better design is imperative. However that is not the situation we are in currently. If you are hired to secure a system and leave the credentials as root:root, you are derelict in your duty. Period. If there is a system with external access, someone set it up. It is the responsibility of whoever setup that system to ensure access controls are in place. The barest minimum of that is to change the default creds to something unguessable.
    - spurgu 6y ago
      It's more like the car left the factory with the blow-up function still enabled. The equivalent of whomever left the root:root in place.
    - Memosyne 6y ago
      > No, you'd blame the manufacturer for building an exploding car. A better analogy would be accidentally crashing the vehicle - an action resulting from negligence or incompetence rather than some 1/1000000 chance of your car exploding due to a failure in functional safety. If someone is operating a vehicle in a manner that it was not intended to be used should we blame the manufacturer? You expect litigation to follow someone forgetting their keys, driving their car into a lake, or running out of gas on a busy freeway? The solution should be to mandate more certifications and security audits for high-risk organizations. The safety mechanisms should be legal and not technical; you shouldn't be permitted to operate a business dealing with sensitive data if you haven't been audited. Delegating more responsibility to the system architects doesn't solve the fact that you have incompetent people performing the administrative tasks and malicious actors abusing this incompetence. It isn't about someone making a mistake, it's about someone being irresponsible in a security sensitive environment - something that should carry severe legal repercussions.
- soulofmischief 6y ago
  It's not just sloppy and poor. In the context of confidential health records, such negligence should be and often is illegal precisely because such carelessness leads to this current situation. Hackers are an inevitability. You can't shed responsibility when they come for your unprotected data anymore than you can blame the water if you swim out in the deep alone and get caught in a riptide.
- tartoran 6y ago
  Breaking into a low security is one thing but distributing private personal information is IMHO ten times worse and senseless too
- Natsu 6y ago
  The victims here are the people who had their information exposed. And this meme is silly, because more than one person can be at fault in a situation. This binary division of blame simply doesn't deal with the complexity of the real world. If their security really was that bad--something which has to be proven by more than a random, anonymous rumor--then they should be financially liable for contributing to the situation.
- tgsovlerkhgsel 6y ago
  The real victims are the people the data is about, not the entity improperly storing the data. The entity that stored the data is to some small extent a victim, but most importantly they are a perpetrator.
- reitzensteinm 6y ago
  They had a duty of care to make the medical records secure, and didn't take that seriously. This is not victim blaming. It is person-at-fault blaming. Just because someone else is even more at fault doesn't absolve these jokers the tiniest bit. If this isn't a criminal offense, Finnish law is broken.
- rebuilder 6y ago
  Blame is not a zero-sum game. Yes, the extortionist deserves all the blame you can heap on them. But that does not change the fact that Vastaamo were in charge of securing highly sensitive patient data and failed to do so.
deleted 6y ago
[deleted]
fogihujy 6y ago
Definitely criminal negligence if true, but Terapiakeskus are not guilty of the hack nor the leaks or the blackmail. You can't blame your own crimes on others making them easy to commit; that's on the level on blaming a rape victim for being drunk.
- colonwqbang 6y ago
  You have this completely backwards. The victims here are the patients whose information was leaked. The care provider failed in their duty to prevent the leak. If you want a rape analogy, it's like blaming a police officer for failing to prevent a rape due to the police officer being drunk.
  - fogihujy 6y ago
    Fair enough. The police officer would still not be guilty of the rape.
  - lucb1e 6y ago
    Given that the care provider is the owner of this data, not the users themselves, I think they are also a victim. If we want to continue this analogy it might be a victim that walked uninvited into a house with a big sign "you will be raped if you walk into my house", but is still a victim nevertheless. I do think that solely blaming the care provider for their failure to protect is incorrect because a non-victim can hardly file charges against the perpetrator. Of course, I agree that the care provider also did something wrong (as well as the hacker(s)) and that the people are also victims, but "the people vs. the care provider" is a separate matter from "the care provider vs. the criminal".
Hamuko 6y ago
That'd make sense since what I read was that the attackers didn't actually target this company and that they gained the data by just randomly scraping. It'd also explain why they sat on this data for like two years.

michaericalribo 6y ago

This is a false equivalence, and victim blaming. Using root:root credentials is sloppy and poor dev practices, but that is minuscule compared with extortion and inflicting widespread stress on a vulnerable population. There’s a reason we have laws against both negligent manslaughter and first degree murder, and there’s also a reason why the penalties for the latter are much more severe than for the former.

fastball 6y ago
Nobody said that they were equivalent, just that there are multiple guilty parties. Not guilty of the same thing, but guilty nonetheless. It's not victim blaming because the victims are the patients. The people who were in charge of securing the records and left the creds as root:root are not victims.
- TeaDrunk 6y ago
  IMO we are using the language of someone who we know to act maliciously on a massive scale (tens of thousands of people, including minors)as if their words can mean anything without corroboration. Frankly I wouldn't believe a rapist saying "but look at what they were wearing" or a serial killer for saying "but they went home alone". Similarly, I don't hold any credence to a black hat saying "but look at how insecure they were".
  - deleted 6y ago
    [deleted]
  - fastball 6y ago
    Again, nobody is blaming the victims. People hired to secure records that then do an exceedingly poor job are not the victims in this situation. Victims == patients. In your analogies of rape/murder, the (almost) equivalent would be if there was a doorman at an apartment building who was supposed to verify the identity of everyone entering the building, but failed to do so, letting the unauthorized perpetrator into the building and thus allowing the victim to be raped/murdered. It was literally his job to prevent such a situation, and he failed. You maintain that he has no responsibility in this matter?
    - TeaDrunk 6y ago
      I'm just saying why assume a malicious actor is saying any truth about the circumstances of their malice?
      - fastball 6y ago
        I agree, but the comment I was responding to was operating under the assumption that the claim was true and was making a different point than merely "don't accept things hackers say at face value". Probably because the OC had already hedged: > if true, I see two quilty parties here.
        TeaDrunk 6y ago
        Yes, and my response is "I don't see why we need to give it any credence whatsoever enough to comment on it".
    - deleted 6y ago
      [deleted]
- hn_throwaway_99 6y ago
  > The people who were in charge of securing the records and left the creds as root:root are not victims. We have to stop designing systems where if one administrative task is mistakenly skipped, the result is catastrophic. Imagine if when you tried to start your car that if you didn't have the brake fully pressed that your car blew up. Would you say "Oh, wow, how irresponsible it is to not fully press the brake"? No, you'd blame the manufacturer for building an exploding car. Systems should not start if strong admin credentials are not the first thing that are set up.
  - fastball 6y ago
    I agree that better design is imperative. However that is not the situation we are in currently. If you are hired to secure a system and leave the credentials as root:root, you are derelict in your duty. Period. If there is a system with external access, someone set it up. It is the responsibility of whoever setup that system to ensure access controls are in place. The barest minimum of that is to change the default creds to something unguessable.
  - spurgu 6y ago
    It's more like the car left the factory with the blow-up function still enabled. The equivalent of whomever left the root:root in place.
  - Memosyne 6y ago
    > No, you'd blame the manufacturer for building an exploding car. A better analogy would be accidentally crashing the vehicle - an action resulting from negligence or incompetence rather than some 1/1000000 chance of your car exploding due to a failure in functional safety. If someone is operating a vehicle in a manner that it was not intended to be used should we blame the manufacturer? You expect litigation to follow someone forgetting their keys, driving their car into a lake, or running out of gas on a busy freeway? The solution should be to mandate more certifications and security audits for high-risk organizations. The safety mechanisms should be legal and not technical; you shouldn't be permitted to operate a business dealing with sensitive data if you haven't been audited. Delegating more responsibility to the system architects doesn't solve the fact that you have incompetent people performing the administrative tasks and malicious actors abusing this incompetence. It isn't about someone making a mistake, it's about someone being irresponsible in a security sensitive environment - something that should carry severe legal repercussions.
soulofmischief 6y ago
It's not just sloppy and poor. In the context of confidential health records, such negligence should be and often is illegal precisely because such carelessness leads to this current situation. Hackers are an inevitability. You can't shed responsibility when they come for your unprotected data anymore than you can blame the water if you swim out in the deep alone and get caught in a riptide.
tartoran 6y ago
Breaking into a low security is one thing but distributing private personal information is IMHO ten times worse and senseless too
Natsu 6y ago
The victims here are the people who had their information exposed. And this meme is silly, because more than one person can be at fault in a situation. This binary division of blame simply doesn't deal with the complexity of the real world. If their security really was that bad--something which has to be proven by more than a random, anonymous rumor--then they should be financially liable for contributing to the situation.
tgsovlerkhgsel 6y ago
The real victims are the people the data is about, not the entity improperly storing the data. The entity that stored the data is to some small extent a victim, but most importantly they are a perpetrator.
reitzensteinm 6y ago
They had a duty of care to make the medical records secure, and didn't take that seriously. This is not victim blaming. It is person-at-fault blaming. Just because someone else is even more at fault doesn't absolve these jokers the tiniest bit. If this isn't a criminal offense, Finnish law is broken.
rebuilder 6y ago
Blame is not a zero-sum game. Yes, the extortionist deserves all the blame you can heap on them. But that does not change the fact that Vastaamo were in charge of securing highly sensitive patient data and failed to do so.

deleted 6y ago

[deleted]

fogihujy 6y ago

Definitely criminal negligence if true, but Terapiakeskus are not guilty of the hack nor the leaks or the blackmail. You can't blame your own crimes on others making them easy to commit; that's on the level on blaming a rape victim for being drunk.

colonwqbang 6y ago
You have this completely backwards. The victims here are the patients whose information was leaked. The care provider failed in their duty to prevent the leak. If you want a rape analogy, it's like blaming a police officer for failing to prevent a rape due to the police officer being drunk.
- fogihujy 6y ago
  Fair enough. The police officer would still not be guilty of the rape.
- lucb1e 6y ago
  Given that the care provider is the owner of this data, not the users themselves, I think they are also a victim. If we want to continue this analogy it might be a victim that walked uninvited into a house with a big sign "you will be raped if you walk into my house", but is still a victim nevertheless. I do think that solely blaming the care provider for their failure to protect is incorrect because a non-victim can hardly file charges against the perpetrator. Of course, I agree that the care provider also did something wrong (as well as the hacker(s)) and that the people are also victims, but "the people vs. the care provider" is a separate matter from "the care provider vs. the criminal".

Hamuko 6y ago

That'd make sense since what I read was that the attackers didn't actually target this company and that they gained the data by just randomly scraping. It'd also explain why they sat on this data for like two years.