11 ms·

It's annoying how "cyber attacks" are still treated like some kind of natural disaster, instead of calling them by what they are: the result of negligence, both

by lima 6y ago

It's annoying how "cyber attacks" are still treated like some kind of natural disaster, instead of calling them by what they are: the result of negligence, both by vendors who sell products that are insecure by default, and customers who fail to invest in proper security measures/mitigations. Avoiding ransomware is not rocket science. Ransomware attacks are loud and noisy - imagine the amount of stealthy attacks we don't hear about.

ISL 6y ago
Failing to mitigate attacks is negligence, sure, but the ownership of the consequences of such attacks must be primarily shared by those who would create and initiate malicious attacks.
- lima 6y ago
  Ironically, the criminals are likely doing many of their victims an expensive favor by forcing them to improve security, preventing compromise for more sinister purposes such as industrial espionage.
  - DFHippie 6y ago
    An expensive favor they will do as often as they find loopholes in whatever security practices their victims adopt. They're very generous this way.
DFHippie 6y ago
Well, negligence is involved but this isn't what they are unless burglary is having unsecured entrances or murder is having vital organs under too little bone and gristle.
- lima 6y ago
  Fair point, rephrased as "the result of negligence".
ChuckNorris89 6y ago
If you leave the door of your home open and I can just enter and walk out with your TV, it's negligence on your side and your insurance most likely won't cover you for the damages, but I'm still the felon here and your negligence will not absolve me of the charges I will face since I'm not allowed by law to enter and take private property even if it's unsecured.
- drzaiusapelord 6y ago
  Or more closer to infosec, I think, is that I bought a house and it had 'cheap' locks that anyone with 10 minutes and a lockpick can open. Sure, maybe I should have considered some harder core stuff, but in the end thats what I have and what is practical for 100 good reasons. The same way corporate IT can only be so secure. So no one is really leaving the door open, its just with enough effort you can break any lock. Which puts this further on the attacker. The attacker can't claim that I should have nicer things and he couldn't help himself. There's way too much victim blaming in information security.
  - ampdepolymerase 6y ago
    Try living in some of the African states. Good luck using cheap locks and not securing your house.
    - jacquesm 6y ago
      The norm in plenty of places where there is a big difference between rich and poor both in degree and in number is that the rich will have private security. Locks are really not going to be worth much as protection at all in those situations.
- Nextgrid 6y ago
  The difference is that the TV can not be used to harm anyone else, unlike computing equipment that can be (and is) used to attack others. In your example let's replace the TV with a weapon and I bet you will be still found liable for not taking appropriate precautions to secure your weapon like keeping it in a locked safe. Similarly, most online crime uses lots of compromised machines as its infrastructure. Making their owners/operators liable would actually add an incentive to not buy/operate insecure devices which in turn would put pressure on manufacturers to make secure products, otherwise customers will be afraid to buy them if it can get them in legal trouble.
jorblumesea 6y ago
Would you call getting mugged on the street negligence? Even if you walk into a bad neighborhood? People might say use your head more next time, but no one blames the person who was mugged. Criminality is just that.
- rkagerer 6y ago
  There's a big difference between a helpless pedestrian walking down the street and a wealthy corporation abdicating their security responsibilities. Of course the criminal should ultimately be held accountable, but to be honest when when these kind of hacks occur I tend to direct more rage toward the corporation. The analogy I picture is more like an overloaded train crossing the same creaky and neglected bridge every day.
- anigbrowl 6y ago
  People might say use your head more next time, but no one blames the person who was mugged. They do, quite often. Same is true for rape victims. It may even be that weak-seeming people are more likely to be blamed as victims, because they serve as an uncomfortable reminder of danger and have already shown that they can be defeated. Think of negative feedback loops where people start to avoid someone they perceive as being unlucky, thus leading to poorer outcomes in future.
raverbashing 6y ago
While yes, it is negligence, nobody is allowed to enter your house without permission even with the door unlocked. It is a criminal activity that should be investigated and prosecuted. Period Don't blame the victim
mr_overalls 6y ago
This is victim-blaming. Security incidents, viewed generally, are the conjunction of two factors: threats and vulnerabilities. It is a massive over-generalization to view all cyber attacks through a lens that focuses only on one factor. Sure, there might have been vulnerabilities in the software or processes of Funke group. But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability.
- orf 6y ago
  > But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability. If I leave my ground floor window open with cash sitting just inside and someone reaches in and steals it, that's my fault. It's dishonest to suggest that dishonest actors don't exist or are anything other than a fact of life/force of human nature. As such they don't bear much discussion - I left the window open. That's on me.
  - zo1 6y ago
    You blame yourself, sure. "It's on you". But the other person committed a crime, and that's separate to your view on the matter.
    - FeepingCreature 6y ago
      The fact that the attacker committed a crime and carries sole blame does not absolve you from your responsibility to secure your belongings.
    - heavenlyblue 6y ago
      Not every crime means businesses are not liable for the results of their negligence. If the business does not provide the reasonable means for dealing with fraud it’s their responsibility in front of the law for the result of given fraud.
  - Juliate 6y ago
    No. That was not thoughtful of you given the threat model. But the fault is always, _always_ on the one who commits the crime. Claiming the contrary is exactly victim blaming.
varjag 6y ago
It's funny because you in fact treat it here like it's a natural disaster and not a premeditated crime.
jariel 6y ago
It's just straight up extortion.
ThePhysicist 6y ago
Compromising a single endpoint via a malware e-mail / link is just the first step of such an attack, you then need to move laterally in the network to get access to the important bits of the infrastructure. For Windows networks this often involves breaking into the Active Directory / domain controller, which then gives you administrative access and makes it possible to e.g. encrypt data. This usually requires manual enumeration and specific exploits, it's not something that can be fully automated yet. So you're describing just the first link in a long attack chain. Eliminating that weak link doesn't mean the attackers can't gain access to the network, it just means they have to find another entrypoint, and in a real-world network where people need to regularly click on links and open untrusted documents it's notoriously difficult to plug all holes. Even the largest DAX corporations in Germany regularly become victims of cyber attacks, and trust me they spend a ton of money on cyber security and have thousands of people working on it.
specialist 6y ago
What are those proper measures, mitigations? Which orgs are immune to ransomware?

by lima 6y ago

ISL 6y ago

Failing to mitigate attacks is negligence, sure, but the ownership of the consequences of such attacks must be primarily shared by those who would create and initiate malicious attacks.

lima 6y ago
Ironically, the criminals are likely doing many of their victims an expensive favor by forcing them to improve security, preventing compromise for more sinister purposes such as industrial espionage.
- DFHippie 6y ago
  An expensive favor they will do as often as they find loopholes in whatever security practices their victims adopt. They're very generous this way.

DFHippie 6y ago

Well, negligence is involved but this isn't what they are unless burglary is having unsecured entrances or murder is having vital organs under too little bone and gristle.

lima 6y ago
Fair point, rephrased as "the result of negligence".

ChuckNorris89 6y ago

If you leave the door of your home open and I can just enter and walk out with your TV, it's negligence on your side and your insurance most likely won't cover you for the damages, but I'm still the felon here and your negligence will not absolve me of the charges I will face since I'm not allowed by law to enter and take private property even if it's unsecured.

drzaiusapelord 6y ago
Or more closer to infosec, I think, is that I bought a house and it had 'cheap' locks that anyone with 10 minutes and a lockpick can open. Sure, maybe I should have considered some harder core stuff, but in the end thats what I have and what is practical for 100 good reasons. The same way corporate IT can only be so secure. So no one is really leaving the door open, its just with enough effort you can break any lock. Which puts this further on the attacker. The attacker can't claim that I should have nicer things and he couldn't help himself. There's way too much victim blaming in information security.
- ampdepolymerase 6y ago
  Try living in some of the African states. Good luck using cheap locks and not securing your house.
  - jacquesm 6y ago
    The norm in plenty of places where there is a big difference between rich and poor both in degree and in number is that the rich will have private security. Locks are really not going to be worth much as protection at all in those situations.
Nextgrid 6y ago
The difference is that the TV can not be used to harm anyone else, unlike computing equipment that can be (and is) used to attack others. In your example let's replace the TV with a weapon and I bet you will be still found liable for not taking appropriate precautions to secure your weapon like keeping it in a locked safe. Similarly, most online crime uses lots of compromised machines as its infrastructure. Making their owners/operators liable would actually add an incentive to not buy/operate insecure devices which in turn would put pressure on manufacturers to make secure products, otherwise customers will be afraid to buy them if it can get them in legal trouble.

jorblumesea 6y ago

Would you call getting mugged on the street negligence? Even if you walk into a bad neighborhood? People might say use your head more next time, but no one blames the person who was mugged. Criminality is just that.

rkagerer 6y ago
There's a big difference between a helpless pedestrian walking down the street and a wealthy corporation abdicating their security responsibilities. Of course the criminal should ultimately be held accountable, but to be honest when when these kind of hacks occur I tend to direct more rage toward the corporation. The analogy I picture is more like an overloaded train crossing the same creaky and neglected bridge every day.
anigbrowl 6y ago
People might say use your head more next time, but no one blames the person who was mugged. They do, quite often. Same is true for rape victims. It may even be that weak-seeming people are more likely to be blamed as victims, because they serve as an uncomfortable reminder of danger and have already shown that they can be defeated. Think of negative feedback loops where people start to avoid someone they perceive as being unlucky, thus leading to poorer outcomes in future.

raverbashing 6y ago

While yes, it is negligence, nobody is allowed to enter your house without permission even with the door unlocked. It is a criminal activity that should be investigated and prosecuted. Period Don't blame the victim

mr_overalls 6y ago

This is victim-blaming. Security incidents, viewed generally, are the conjunction of two factors: threats and vulnerabilities. It is a massive over-generalization to view all cyber attacks through a lens that focuses only on one factor. Sure, there might have been vulnerabilities in the software or processes of Funke group. But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability.

orf 6y ago
> But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability. If I leave my ground floor window open with cash sitting just inside and someone reaches in and steals it, that's my fault. It's dishonest to suggest that dishonest actors don't exist or are anything other than a fact of life/force of human nature. As such they don't bear much discussion - I left the window open. That's on me.
- zo1 6y ago
  You blame yourself, sure. "It's on you". But the other person committed a crime, and that's separate to your view on the matter.
  - FeepingCreature 6y ago
    The fact that the attacker committed a crime and carries sole blame does not absolve you from your responsibility to secure your belongings.
  - heavenlyblue 6y ago
    Not every crime means businesses are not liable for the results of their negligence. If the business does not provide the reasonable means for dealing with fraud it’s their responsibility in front of the law for the result of given fraud.
- Juliate 6y ago
  No. That was not thoughtful of you given the threat model. But the fault is always, _always_ on the one who commits the crime. Claiming the contrary is exactly victim blaming.

varjag 6y ago

It's funny because you in fact treat it here like it's a natural disaster and not a premeditated crime.

jariel 6y ago

It's just straight up extortion.

ThePhysicist 6y ago

Compromising a single endpoint via a malware e-mail / link is just the first step of such an attack, you then need to move laterally in the network to get access to the important bits of the infrastructure. For Windows networks this often involves breaking into the Active Directory / domain controller, which then gives you administrative access and makes it possible to e.g. encrypt data. This usually requires manual enumeration and specific exploits, it's not something that can be fully automated yet. So you're describing just the first link in a long attack chain. Eliminating that weak link doesn't mean the attackers can't gain access to the network, it just means they have to find another entrypoint, and in a real-world network where people need to regularly click on links and open untrusted documents it's notoriously difficult to plug all holes. Even the largest DAX corporations in Germany regularly become victims of cyber attacks, and trust me they spend a ton of money on cyber security and have thousands of people working on it.

specialist 6y ago

What are those proper measures, mitigations? Which orgs are immune to ransomware?