11 ms·

Germany: 'Colossal' cyberattack knocks out Funke news group

169 points by samizdis 6y ago

lima 6y ago
It's annoying how "cyber attacks" are still treated like some kind of natural disaster, instead of calling them by what they are: the result of negligence, both by vendors who sell products that are insecure by default, and customers who fail to invest in proper security measures/mitigations. Avoiding ransomware is not rocket science. Ransomware attacks are loud and noisy - imagine the amount of stealthy attacks we don't hear about.
- ISL 6y ago
  Failing to mitigate attacks is negligence, sure, but the ownership of the consequences of such attacks must be primarily shared by those who would create and initiate malicious attacks.
  - lima 6y ago
    Ironically, the criminals are likely doing many of their victims an expensive favor by forcing them to improve security, preventing compromise for more sinister purposes such as industrial espionage.
    - DFHippie 6y ago
      An expensive favor they will do as often as they find loopholes in whatever security practices their victims adopt. They're very generous this way.
- DFHippie 6y ago
  Well, negligence is involved but this isn't what they are unless burglary is having unsecured entrances or murder is having vital organs under too little bone and gristle.
  - lima 6y ago
    Fair point, rephrased as "the result of negligence".
- ChuckNorris89 6y ago
  If you leave the door of your home open and I can just enter and walk out with your TV, it's negligence on your side and your insurance most likely won't cover you for the damages, but I'm still the felon here and your negligence will not absolve me of the charges I will face since I'm not allowed by law to enter and take private property even if it's unsecured.
  - drzaiusapelord 6y ago
    Or more closer to infosec, I think, is that I bought a house and it had 'cheap' locks that anyone with 10 minutes and a lockpick can open. Sure, maybe I should have considered some harder core stuff, but in the end thats what I have and what is practical for 100 good reasons. The same way corporate IT can only be so secure. So no one is really leaving the door open, its just with enough effort you can break any lock. Which puts this further on the attacker. The attacker can't claim that I should have nicer things and he couldn't help himself. There's way too much victim blaming in information security.
    - ampdepolymerase 6y ago
      Try living in some of the African states. Good luck using cheap locks and not securing your house.
      - jacquesm 6y ago
        The norm in plenty of places where there is a big difference between rich and poor both in degree and in number is that the rich will have private security. Locks are really not going to be worth much as protection at all in those situations.
  - Nextgrid 6y ago
    The difference is that the TV can not be used to harm anyone else, unlike computing equipment that can be (and is) used to attack others. In your example let's replace the TV with a weapon and I bet you will be still found liable for not taking appropriate precautions to secure your weapon like keeping it in a locked safe. Similarly, most online crime uses lots of compromised machines as its infrastructure. Making their owners/operators liable would actually add an incentive to not buy/operate insecure devices which in turn would put pressure on manufacturers to make secure products, otherwise customers will be afraid to buy them if it can get them in legal trouble.
- jorblumesea 6y ago
  Would you call getting mugged on the street negligence? Even if you walk into a bad neighborhood? People might say use your head more next time, but no one blames the person who was mugged. Criminality is just that.
  - rkagerer 6y ago
    There's a big difference between a helpless pedestrian walking down the street and a wealthy corporation abdicating their security responsibilities. Of course the criminal should ultimately be held accountable, but to be honest when when these kind of hacks occur I tend to direct more rage toward the corporation. The analogy I picture is more like an overloaded train crossing the same creaky and neglected bridge every day.
  - anigbrowl 6y ago
    People might say use your head more next time, but no one blames the person who was mugged. They do, quite often. Same is true for rape victims. It may even be that weak-seeming people are more likely to be blamed as victims, because they serve as an uncomfortable reminder of danger and have already shown that they can be defeated. Think of negative feedback loops where people start to avoid someone they perceive as being unlucky, thus leading to poorer outcomes in future.
- raverbashing 6y ago
  While yes, it is negligence, nobody is allowed to enter your house without permission even with the door unlocked. It is a criminal activity that should be investigated and prosecuted. Period Don't blame the victim
- mr_overalls 6y ago
  This is victim-blaming. Security incidents, viewed generally, are the conjunction of two factors: threats and vulnerabilities. It is a massive over-generalization to view all cyber attacks through a lens that focuses only on one factor. Sure, there might have been vulnerabilities in the software or processes of Funke group. But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability.
  - orf 6y ago
    > But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability. If I leave my ground floor window open with cash sitting just inside and someone reaches in and steals it, that's my fault. It's dishonest to suggest that dishonest actors don't exist or are anything other than a fact of life/force of human nature. As such they don't bear much discussion - I left the window open. That's on me.
    - zo1 6y ago
      You blame yourself, sure. "It's on you". But the other person committed a crime, and that's separate to your view on the matter.
      - FeepingCreature 6y ago
        The fact that the attacker committed a crime and carries sole blame does not absolve you from your responsibility to secure your belongings.
      - heavenlyblue 6y ago
        Not every crime means businesses are not liable for the results of their negligence. If the business does not provide the reasonable means for dealing with fraud it’s their responsibility in front of the law for the result of given fraud.
    - Juliate 6y ago
      No. That was not thoughtful of you given the threat model. But the fault is always, _always_ on the one who commits the crime. Claiming the contrary is exactly victim blaming.
- varjag 6y ago
  It's funny because you in fact treat it here like it's a natural disaster and not a premeditated crime.
- jariel 6y ago
  It's just straight up extortion.
- ThePhysicist 6y ago
  Compromising a single endpoint via a malware e-mail / link is just the first step of such an attack, you then need to move laterally in the network to get access to the important bits of the infrastructure. For Windows networks this often involves breaking into the Active Directory / domain controller, which then gives you administrative access and makes it possible to e.g. encrypt data. This usually requires manual enumeration and specific exploits, it's not something that can be fully automated yet. So you're describing just the first link in a long attack chain. Eliminating that weak link doesn't mean the attackers can't gain access to the network, it just means they have to find another entrypoint, and in a real-world network where people need to regularly click on links and open untrusted documents it's notoriously difficult to plug all holes. Even the largest DAX corporations in Germany regularly become victims of cyber attacks, and trust me they spend a ton of money on cyber security and have thousands of people working on it.
- specialist 6y ago
  What are those proper measures, mitigations? Which orgs are immune to ransomware?
sudoaza 6y ago
> attack had left the data on its IT systems encrypted and made them "unusable for now."
ttul 6y ago
Governments should enact legislation making the payment of a Cybersecurity ransom a criminal offense with serious penalties. Organizations would then be faced with the choice of paying the bribe or facing time in jail - an uneasy decision. However, the effect would be to reduce the likelihood of ransom payment, thereby reducing the incentive to launch such an attack in the first place.
- rini17 6y ago
  That would spur generation of creative paperwork like fake "support contracts" or "licensing" deals. I think best solution was IIRC in Italy where whole families of people kidnapped by mafia had assets frozen. It made ransom inattractive. So in this case company could apply for having frozen all funds in exchange for evidence. It would both mostly absolve the management from the ethical dilemma, punish those responsible for negligent IT and make ransoms less attractive.
- valesco 6y ago
  So the mere threat of a ransomware attack would be enough to extract huge sums of money.
  - ttul 6y ago
    Presumably paying that ransom would also be illegal.
owlbynight 6y ago
There are literally dozens of posts
kyboren 6y ago
I think what people are missing with all these analogies about burglaries and negligence is the funny difference between cyberspace and meatspace: In cyberspace, your attacker can be anywhere on the planet, located in virtually any jurisdiction, and reliably tracing and attributing attacks is a very difficult task. In meatspace, your attacker must be physically present and is generally obvious and thus vulnerable. This difference has dramatic implications on the ability of the enforcement model to reduce incidence of attacks. In meatspace, assigning 100% of the burden of blame to the attacker and absolving the victim of any blame at all agrees with our ideas of morality and sort of works because there is a non-negligible chance of holding the attacker accountable. This provides a measure of deterrence to would-be attackers. In contrast, in cyberspace, the chance of holding attackers accountable is much lower. There is little deterrence to would-be attackers, especially state-sponsored attackers. Here we need to let go of our fantasy that blame must be assigned according to our idea of who is morally at fault. Of course the attacker is always morally at fault. But legally, we must hold accountable organizations who are breached, because we need them to improve their security posture. An improved security posture is the only realistic path to a future with fewer and less impactful cyberspace attacks. Strict liability or "victim blaming" for cyberspace attacks goes against our notions of morality but IMO it is essential.
- perlgeek 6y ago
  > I think what people are missing with all these analogies about burglaries and negligence is the funny difference between cyberspace and meatspace: In cyberspace, your attacker can be anywhere on the planet, located in virtually any jurisdiction, and reliably tracing and attributing attacks is a very difficult task. In meatspace, your attacker must be physically present and is generally obvious and thus vulnerable. This difference has dramatic implications on the ability of the enforcement model to reduce incidence of attacks. The jurisdiction part is the key here, IMHO. Sure, the likelyhood of reliably tracing a single attack to a crew is very low, but a prolific crew has dozens or even hundreds of attacks going on in parallel, so tracing just one of them should be enough to take them down. However, most crews live in "bullet proof" jurisdictions, where we cannot reach them. If this practice of ransomware attacks continue, we really need a better solution for that. This could go as far as cutting off the "bullet proof" countries from the Internet, if it weren't for China and Russia, that simply from an economic and political perspective, we cannot disconnect. I guess diplomatic solutions are needed, as well as investing more in IT security, secure OSS etc.
durnygbur 6y ago
Someone clicked a link from mass distributed spam email? ...and everyone working on Windows I bet.
dschuetz 6y ago
First Funke buys & eats most of the regional news outlets, then it's paralyzed due to some random "cyber attack" after failing to implement a decently secure IT infrastructure for 6000 workers who depend on it now. Why am I not surprised.
- Binichgross0 6y ago
  Traurig aber wahr
linspace 6y ago
Reading some comments that blame the victim of the cyber attack reminds me of something I thought a couple of days ago while I was cursing bureaucracy and taxes: it's amazing how in IT we take the bureaucrats stance. We develop impossible to understand overcomplicated systems and then we blame the users of those system, which usually are forced to use them, for not taking into account every possible detail. You can substitute "you should know the law" with RTFM and a similar attitude. I'm not sure what is the conclusion of all this. Maybe bureaucrats are as good as developers, maybe developers are as bad as bureaucrats, maybe people should do what I did and pay specialists.
miohtama 6y ago
How much of these attacks could be avoided by moving away from Microsoft Windows and EXE execution model? What is the cost of going back to thin clients?
- throw_m239339 6y ago
  > How much of these attacks could be avoided by moving away from Microsoft Windows and EXE execution model? What is the cost of going back to thin clients? I bet the great majority of them. > "It's actually not that sophisticated," said Christian Beyer of the German company Securepoint. "You open the Word document, the document contains a macro, and the macro downloads the malware from the internet." A macro is a kind of shorthand instruction for the computer. Why the F does a text processor needs to execute anything at first place when reading a document? this is madness. And yes, the solution is, on top of every possible IT security practice, and linux everywhere, make enterprise computers dumb terminals with the help of browsers and webtechs. Nothing else should be executed on them. The people who refuse to unlearn MS Office and co, well too bad...
  - Stierlitz 6y ago
    > Why the F does a text processor needs to execute anything at first place when reading a document? this is madness. If you're stuck on Windows, make normal.dotm readonly. > And yes, the solution is, on top of every possible IT security practice, and linux everywhere .. To keep people stuck on Windows, the Microsoft mantra used to be, our stuff works better with our stuff. Since most OS functionality is moving to the msCloud. Regardless of the OS, you'll be paying the yearly software rent to Microsoft.
richx 6y ago
How bad must their IT system be, when they are not even able to write and publish articles?
Sideloader 6y ago
And of course China and Russia are mentioned in the comments. Propaganda works. Repeat something often enough and people will internalize it and assume it’s true even when no proof is provided.

169 points by samizdis 6y ago

lima 6y ago

It's annoying how "cyber attacks" are still treated like some kind of natural disaster, instead of calling them by what they are: the result of negligence, both by vendors who sell products that are insecure by default, and customers who fail to invest in proper security measures/mitigations. Avoiding ransomware is not rocket science. Ransomware attacks are loud and noisy - imagine the amount of stealthy attacks we don't hear about.

ISL 6y ago
Failing to mitigate attacks is negligence, sure, but the ownership of the consequences of such attacks must be primarily shared by those who would create and initiate malicious attacks.
- lima 6y ago
  Ironically, the criminals are likely doing many of their victims an expensive favor by forcing them to improve security, preventing compromise for more sinister purposes such as industrial espionage.
  - DFHippie 6y ago
    An expensive favor they will do as often as they find loopholes in whatever security practices their victims adopt. They're very generous this way.
DFHippie 6y ago
Well, negligence is involved but this isn't what they are unless burglary is having unsecured entrances or murder is having vital organs under too little bone and gristle.
- lima 6y ago
  Fair point, rephrased as "the result of negligence".
ChuckNorris89 6y ago
If you leave the door of your home open and I can just enter and walk out with your TV, it's negligence on your side and your insurance most likely won't cover you for the damages, but I'm still the felon here and your negligence will not absolve me of the charges I will face since I'm not allowed by law to enter and take private property even if it's unsecured.
- drzaiusapelord 6y ago
  Or more closer to infosec, I think, is that I bought a house and it had 'cheap' locks that anyone with 10 minutes and a lockpick can open. Sure, maybe I should have considered some harder core stuff, but in the end thats what I have and what is practical for 100 good reasons. The same way corporate IT can only be so secure. So no one is really leaving the door open, its just with enough effort you can break any lock. Which puts this further on the attacker. The attacker can't claim that I should have nicer things and he couldn't help himself. There's way too much victim blaming in information security.
  - ampdepolymerase 6y ago
    Try living in some of the African states. Good luck using cheap locks and not securing your house.
    - jacquesm 6y ago
      The norm in plenty of places where there is a big difference between rich and poor both in degree and in number is that the rich will have private security. Locks are really not going to be worth much as protection at all in those situations.
- Nextgrid 6y ago
  The difference is that the TV can not be used to harm anyone else, unlike computing equipment that can be (and is) used to attack others. In your example let's replace the TV with a weapon and I bet you will be still found liable for not taking appropriate precautions to secure your weapon like keeping it in a locked safe. Similarly, most online crime uses lots of compromised machines as its infrastructure. Making their owners/operators liable would actually add an incentive to not buy/operate insecure devices which in turn would put pressure on manufacturers to make secure products, otherwise customers will be afraid to buy them if it can get them in legal trouble.
jorblumesea 6y ago
Would you call getting mugged on the street negligence? Even if you walk into a bad neighborhood? People might say use your head more next time, but no one blames the person who was mugged. Criminality is just that.
- rkagerer 6y ago
  There's a big difference between a helpless pedestrian walking down the street and a wealthy corporation abdicating their security responsibilities. Of course the criminal should ultimately be held accountable, but to be honest when when these kind of hacks occur I tend to direct more rage toward the corporation. The analogy I picture is more like an overloaded train crossing the same creaky and neglected bridge every day.
- anigbrowl 6y ago
  People might say use your head more next time, but no one blames the person who was mugged. They do, quite often. Same is true for rape victims. It may even be that weak-seeming people are more likely to be blamed as victims, because they serve as an uncomfortable reminder of danger and have already shown that they can be defeated. Think of negative feedback loops where people start to avoid someone they perceive as being unlucky, thus leading to poorer outcomes in future.
raverbashing 6y ago
While yes, it is negligence, nobody is allowed to enter your house without permission even with the door unlocked. It is a criminal activity that should be investigated and prosecuted. Period Don't blame the victim
mr_overalls 6y ago
This is victim-blaming. Security incidents, viewed generally, are the conjunction of two factors: threats and vulnerabilities. It is a massive over-generalization to view all cyber attacks through a lens that focuses only on one factor. Sure, there might have been vulnerabilities in the software or processes of Funke group. But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability.
- orf 6y ago
  > But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability. If I leave my ground floor window open with cash sitting just inside and someone reaches in and steals it, that's my fault. It's dishonest to suggest that dishonest actors don't exist or are anything other than a fact of life/force of human nature. As such they don't bear much discussion - I left the window open. That's on me.
  - zo1 6y ago
    You blame yourself, sure. "It's on you". But the other person committed a crime, and that's separate to your view on the matter.
    - FeepingCreature 6y ago
      The fact that the attacker committed a crime and carries sole blame does not absolve you from your responsibility to secure your belongings.
    - heavenlyblue 6y ago
      Not every crime means businesses are not liable for the results of their negligence. If the business does not provide the reasonable means for dealing with fraud it’s their responsibility in front of the law for the result of given fraud.
  - Juliate 6y ago
    No. That was not thoughtful of you given the threat model. But the fault is always, _always_ on the one who commits the crime. Claiming the contrary is exactly victim blaming.
varjag 6y ago
It's funny because you in fact treat it here like it's a natural disaster and not a premeditated crime.
jariel 6y ago
It's just straight up extortion.
ThePhysicist 6y ago
Compromising a single endpoint via a malware e-mail / link is just the first step of such an attack, you then need to move laterally in the network to get access to the important bits of the infrastructure. For Windows networks this often involves breaking into the Active Directory / domain controller, which then gives you administrative access and makes it possible to e.g. encrypt data. This usually requires manual enumeration and specific exploits, it's not something that can be fully automated yet. So you're describing just the first link in a long attack chain. Eliminating that weak link doesn't mean the attackers can't gain access to the network, it just means they have to find another entrypoint, and in a real-world network where people need to regularly click on links and open untrusted documents it's notoriously difficult to plug all holes. Even the largest DAX corporations in Germany regularly become victims of cyber attacks, and trust me they spend a ton of money on cyber security and have thousands of people working on it.
specialist 6y ago
What are those proper measures, mitigations? Which orgs are immune to ransomware?

sudoaza 6y ago

> attack had left the data on its IT systems encrypted and made them "unusable for now."

ttul 6y ago

Governments should enact legislation making the payment of a Cybersecurity ransom a criminal offense with serious penalties. Organizations would then be faced with the choice of paying the bribe or facing time in jail - an uneasy decision. However, the effect would be to reduce the likelihood of ransom payment, thereby reducing the incentive to launch such an attack in the first place.

rini17 6y ago
That would spur generation of creative paperwork like fake "support contracts" or "licensing" deals. I think best solution was IIRC in Italy where whole families of people kidnapped by mafia had assets frozen. It made ransom inattractive. So in this case company could apply for having frozen all funds in exchange for evidence. It would both mostly absolve the management from the ethical dilemma, punish those responsible for negligent IT and make ransoms less attractive.
valesco 6y ago
So the mere threat of a ransomware attack would be enough to extract huge sums of money.
- ttul 6y ago
  Presumably paying that ransom would also be illegal.

owlbynight 6y ago

There are literally dozens of posts

kyboren 6y ago

I think what people are missing with all these analogies about burglaries and negligence is the funny difference between cyberspace and meatspace: In cyberspace, your attacker can be anywhere on the planet, located in virtually any jurisdiction, and reliably tracing and attributing attacks is a very difficult task. In meatspace, your attacker must be physically present and is generally obvious and thus vulnerable. This difference has dramatic implications on the ability of the enforcement model to reduce incidence of attacks. In meatspace, assigning 100% of the burden of blame to the attacker and absolving the victim of any blame at all agrees with our ideas of morality and sort of works because there is a non-negligible chance of holding the attacker accountable. This provides a measure of deterrence to would-be attackers. In contrast, in cyberspace, the chance of holding attackers accountable is much lower. There is little deterrence to would-be attackers, especially state-sponsored attackers. Here we need to let go of our fantasy that blame must be assigned according to our idea of who is morally at fault. Of course the attacker is always morally at fault. But legally, we must hold accountable organizations who are breached, because we need them to improve their security posture. An improved security posture is the only realistic path to a future with fewer and less impactful cyberspace attacks. Strict liability or "victim blaming" for cyberspace attacks goes against our notions of morality but IMO it is essential.

perlgeek 6y ago
> I think what people are missing with all these analogies about burglaries and negligence is the funny difference between cyberspace and meatspace: In cyberspace, your attacker can be anywhere on the planet, located in virtually any jurisdiction, and reliably tracing and attributing attacks is a very difficult task. In meatspace, your attacker must be physically present and is generally obvious and thus vulnerable. This difference has dramatic implications on the ability of the enforcement model to reduce incidence of attacks. The jurisdiction part is the key here, IMHO. Sure, the likelyhood of reliably tracing a single attack to a crew is very low, but a prolific crew has dozens or even hundreds of attacks going on in parallel, so tracing just one of them should be enough to take them down. However, most crews live in "bullet proof" jurisdictions, where we cannot reach them. If this practice of ransomware attacks continue, we really need a better solution for that. This could go as far as cutting off the "bullet proof" countries from the Internet, if it weren't for China and Russia, that simply from an economic and political perspective, we cannot disconnect. I guess diplomatic solutions are needed, as well as investing more in IT security, secure OSS etc.

durnygbur 6y ago

Someone clicked a link from mass distributed spam email? ...and everyone working on Windows I bet.

dschuetz 6y ago

First Funke buys & eats most of the regional news outlets, then it's paralyzed due to some random "cyber attack" after failing to implement a decently secure IT infrastructure for 6000 workers who depend on it now. Why am I not surprised.

Binichgross0 6y ago
Traurig aber wahr

linspace 6y ago

Reading some comments that blame the victim of the cyber attack reminds me of something I thought a couple of days ago while I was cursing bureaucracy and taxes: it's amazing how in IT we take the bureaucrats stance. We develop impossible to understand overcomplicated systems and then we blame the users of those system, which usually are forced to use them, for not taking into account every possible detail. You can substitute "you should know the law" with RTFM and a similar attitude. I'm not sure what is the conclusion of all this. Maybe bureaucrats are as good as developers, maybe developers are as bad as bureaucrats, maybe people should do what I did and pay specialists.

miohtama 6y ago

How much of these attacks could be avoided by moving away from Microsoft Windows and EXE execution model? What is the cost of going back to thin clients?

throw_m239339 6y ago
> How much of these attacks could be avoided by moving away from Microsoft Windows and EXE execution model? What is the cost of going back to thin clients? I bet the great majority of them. > "It's actually not that sophisticated," said Christian Beyer of the German company Securepoint. "You open the Word document, the document contains a macro, and the macro downloads the malware from the internet." A macro is a kind of shorthand instruction for the computer. Why the F does a text processor needs to execute anything at first place when reading a document? this is madness. And yes, the solution is, on top of every possible IT security practice, and linux everywhere, make enterprise computers dumb terminals with the help of browsers and webtechs. Nothing else should be executed on them. The people who refuse to unlearn MS Office and co, well too bad...
- Stierlitz 6y ago
  > Why the F does a text processor needs to execute anything at first place when reading a document? this is madness. If you're stuck on Windows, make normal.dotm readonly. > And yes, the solution is, on top of every possible IT security practice, and linux everywhere .. To keep people stuck on Windows, the Microsoft mantra used to be, our stuff works better with our stuff. Since most OS functionality is moving to the msCloud. Regardless of the OS, you'll be paying the yearly software rent to Microsoft.

richx 6y ago

How bad must their IT system be, when they are not even able to write and publish articles?

Sideloader 6y ago

And of course China and Russia are mentioned in the comments. Propaganda works. Repeat something often enough and people will internalize it and assume it’s true even when no proof is provided.