7 ms·

This is victim-blaming. Security incidents, viewed generally, are the conjunction of two factors: threats and vulnerabilities. It is a massive over-generalizat

This is victim-blaming. Security incidents, viewed generally, are the conjunction of two factors: threats and vulnerabilities. It is a massive over-generalization to view all cyber attacks through a lens that focuses only on one factor. Sure, there might have been vulnerabilities in the software or processes of Funke group. But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability.

orf 6y ago
> But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability. If I leave my ground floor window open with cash sitting just inside and someone reaches in and steals it, that's my fault. It's dishonest to suggest that dishonest actors don't exist or are anything other than a fact of life/force of human nature. As such they don't bear much discussion - I left the window open. That's on me.
- zo1 6y ago
  You blame yourself, sure. "It's on you". But the other person committed a crime, and that's separate to your view on the matter.
  - FeepingCreature 6y ago
    The fact that the attacker committed a crime and carries sole blame does not absolve you from your responsibility to secure your belongings.
  - heavenlyblue 6y ago
    Not every crime means businesses are not liable for the results of their negligence. If the business does not provide the reasonable means for dealing with fraud it’s their responsibility in front of the law for the result of given fraud.
- Juliate 6y ago
  No. That was not thoughtful of you given the threat model. But the fault is always, _always_ on the one who commits the crime. Claiming the contrary is exactly victim blaming.
  - AnimalMuppet 6y ago
    The moral fault is always on the perpetrator. Always. But in a world that contains muggers, and that you know contains muggers, walking around the bad part of town with cash visibly hanging out of your pocket is not very wise. It's not a moral failure, but it is a failure of common sense and reasonable prudence.
    - Juliate 6y ago
      We're saying exactly the same thing, but well...
  - orf 6y ago
    _always_ finding fault with the one who commits the crime is as pointless as finding fault with a hurricane for destroying your property, or the sea for drowning you without an oxygen tank. In the case of murder, sure. But I'm with you. But bad actors (in the form of petty theft, exploitation, confidence tricks, etc) are a fact of life. Failing to account for them, just as failing to account for hurricanes if you live in hurricane alley, is completely on you. You can reduce that down to a blanket "but you're just victim shaming!" if you'd like, but it doesn't make it any less true.
- buran77 6y ago
  Not all exploits are due to negligence or at least not crass negligence. Sure, something may have been forgotten (although the present article says nothing about this), systems are complex and as the "defender" you only have to make one mistake. But your "it's on me" is very much victim blaming unless you can show a pattern of intentional ignorance or malfeasance within a network. I can get in your house even if you close the window. It's a window and can be opened. Are you still to blame? I can look for money even if you hide them, I'll search around. Are you still to blame? You could have taken the precaution of not having money in the house or at least not living on the ground floor if you do. Many attacks are 0day, many others are supply chain attacks, many exploit the weakest of links, the human. There's a limit to how much you can protect yourself from one attack in an instant before you cause yourself harm slowly but continuously. No matter how many locks you put you're not guaranteeing anything. It's a calculated risk and sometimes the calculation doesn't pay off.
anigbrowl 6y ago
I read it as blaming the suppliers who don't provide their customers with better tools. Door locks are only modestly secure in absolute terms but it takes some effort or skill to defeat one.
- cosmodisk 6y ago
  I could probably pick an average lock after only a few hours of training. It would probably take me a good few years to get to the point where I would be able to run a successful hack.
  - anigbrowl 6y ago
    Yeah, but could you do it with confidence on the street, eg break into a commercial building? Also, I don't think it's that difficult to run a successful hack; admittedly I have many many years of computer experience to draw on, but conversely modern tools make it unnecessary to reinvent the wheel.
  - adrianN 6y ago
    I think you overestimate the effort needed to buy the building blocks for your own ransomware.
heavenlyblue 6y ago
I am sorry, but the term invented for the purpose of dealing with rape culture does not exist to be generalisable to a completely different niche. In this case the victim is the one paying huge bonuses to execs who decided that security is less important than their salaries. And other people are suffering for it.
young_unixer 6y ago
Are Hackers criminals? Yes, because the law says they are. Does that matter? Not much outside the realm of law. I don't think hacking/cracking should be illegal. If I send you a series of electrical pulses and that causes your systems to do something stupid, that's your problem. You are not a "victim". Laws against physical violence and against stealing physical objects have good reasons to exist, because otherwise there would be no point in having any moral conception at all, because everyone would solve their problems through violence. On the other hand, sending messages through a wire doesn't have good reasons to be outlawed. We could live peacefully sending each other all sorts of bytes, and each entity would make an effort for their own systems to behave correctly. Most people disagree with me, but their abstraction is leaking, because even they agree with me on a fundamental level, they just don't know it. The moral discussion is so disconnected from concrete actions and formal definitions that it devolves into dumb analogies like "but if you left your door open blah blah". Having a "right not to be hacked" is of the same nature as having a "right not to be offended".
- blowfish721 6y ago
  Genuine question: I can understand your reasoning regarding physical violence but why would you include stealing physical objects? If there was no physical violence or threat of it during the stealing.
  - young_unixer 6y ago
    You're right. In my opinion there are good reasons for physical property to exist (individual freedom), but avoiding violence is not the best theoretical argument for it. Is physical property against freedom or in favor of freedom? I think both, depending how you look at it. I've though about this a lot, and tend to fall on the side of proprietarianism, because I think property is absolutely necessary for the fulfillment of human needs and desires.
  - pixl97 6y ago
    You would absolutely authorize violence by proxy if someone stole your stuff, and if you wanted to cash in your insurance policy it would be required in the form of a police report.
dfxm12 6y ago
"Victim blaming" implies that the parent poster is saying that Funke would be responsible for the hackers' actions, that they somehow stuck their necks out and invited an attack. That's not the case. The parent poster is saying Funke and/or their software vendors are guilty of negligence. You, too, even go on to admit there might have been vulnerabilities in the software or processes of Funke group. The parent poster is not the one being dishonest...
deleted 6y ago
[deleted]
kevstev 6y ago
I mean its tricky to do an analogy between the digital and physical worlds- but I do find it interesting that I mean there is a whole range of possibilities here, at what point do you stop blaming the victim? 1- The front door was left wide open 2- The front door was closed, but left unlocked. 3- The back door was left unlocked. 4- All doors were locked, but with an easily picked lock. 5- All doors were locked and with a legit key, but a window was left closed, but not locked. 6- All windows and doors were locked, but the windows were easily broken. 7- The windows were reinforced, but a door was broken down or someone drilled the locks, or just forced the window until the lock failed. 8- The doors and window locks were reinforced, but they pried up the garage door and broke through the flimsy door between the house and garage. 9- The exterior entryways were all truly secured, but they found a way in through a chimney, a sewer pipe, or just sawz-alled through the exterior siding... At what point do you stop calling the resident an idiot and start blaming the perpetrator? Personally I would say around #4 in the meatspace the world, but 2/3 I would say they are still being victimized depending on where they lived and whether they routinely left the door unlocked or not. And then in the digital world, there are things like not setting a password or leaving a default one up, but what about patching known vulnerabilities? How long is too long once a patch is made available? What about zero days, and vectors of attack no one thought of... and maybe line employees who just don't know better? Just in general, people are very quick to blame the victims in situations like this- I just had an argument about this with someone the other day when I heard the news that a neighbor's bike was stolen- from outside their door on the third floor. It was an exterior door/stairway, but not visible from the street, and the bike was locked but with a cheap one. They brought bolt cutters and took the bike. People were like "this is on you for using that cheap lock..." but I think he took reasonable precautions, but many had no sympathy for the guy. Personally I can't wrap my head around that mindset.
nisten 6y ago
There has to exist a difference between victim-blaming and people screwing up at their jobs. In the case of the SolarWinds attack, their management seemed to be quite technical and the attacker was just too strong/sophisticated, so SolarWinds is considered a victim. But in the case of the Equifax, they're considered at fault because their head of security seemed unqualified for the job and the victims were actually the millions of users whose private data was put at risk of abuse. The probability in this case is very high that the upper management at Funke was quite incompetent at how they've digitized their operations.

orf 6y ago

> But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability. If I leave my ground floor window open with cash sitting just inside and someone reaches in and steals it, that's my fault. It's dishonest to suggest that dishonest actors don't exist or are anything other than a fact of life/force of human nature. As such they don't bear much discussion - I left the window open. That's on me.

zo1 6y ago
You blame yourself, sure. "It's on you". But the other person committed a crime, and that's separate to your view on the matter.
- FeepingCreature 6y ago
  The fact that the attacker committed a crime and carries sole blame does not absolve you from your responsibility to secure your belongings.
- heavenlyblue 6y ago
  Not every crime means businesses are not liable for the results of their negligence. If the business does not provide the reasonable means for dealing with fraud it’s their responsibility in front of the law for the result of given fraud.
Juliate 6y ago
No. That was not thoughtful of you given the threat model. But the fault is always, _always_ on the one who commits the crime. Claiming the contrary is exactly victim blaming.
- AnimalMuppet 6y ago
  The moral fault is always on the perpetrator. Always. But in a world that contains muggers, and that you know contains muggers, walking around the bad part of town with cash visibly hanging out of your pocket is not very wise. It's not a moral failure, but it is a failure of common sense and reasonable prudence.
  - Juliate 6y ago
    We're saying exactly the same thing, but well...
- orf 6y ago
  _always_ finding fault with the one who commits the crime is as pointless as finding fault with a hurricane for destroying your property, or the sea for drowning you without an oxygen tank. In the case of murder, sure. But I'm with you. But bad actors (in the form of petty theft, exploitation, confidence tricks, etc) are a fact of life. Failing to account for them, just as failing to account for hurricanes if you live in hurricane alley, is completely on you. You can reduce that down to a blanket "but you're just victim shaming!" if you'd like, but it doesn't make it any less true.
buran77 6y ago
Not all exploits are due to negligence or at least not crass negligence. Sure, something may have been forgotten (although the present article says nothing about this), systems are complex and as the "defender" you only have to make one mistake. But your "it's on me" is very much victim blaming unless you can show a pattern of intentional ignorance or malfeasance within a network. I can get in your house even if you close the window. It's a window and can be opened. Are you still to blame? I can look for money even if you hide them, I'll search around. Are you still to blame? You could have taken the precaution of not having money in the house or at least not living on the ground floor if you do. Many attacks are 0day, many others are supply chain attacks, many exploit the weakest of links, the human. There's a limit to how much you can protect yourself from one attack in an instant before you cause yourself harm slowly but continuously. No matter how many locks you put you're not guaranteeing anything. It's a calculated risk and sometimes the calculation doesn't pay off.

anigbrowl 6y ago

I read it as blaming the suppliers who don't provide their customers with better tools. Door locks are only modestly secure in absolute terms but it takes some effort or skill to defeat one.

cosmodisk 6y ago
I could probably pick an average lock after only a few hours of training. It would probably take me a good few years to get to the point where I would be able to run a successful hack.
- anigbrowl 6y ago
  Yeah, but could you do it with confidence on the street, eg break into a commercial building? Also, I don't think it's that difficult to run a successful hack; admittedly I have many many years of computer experience to draw on, but conversely modern tools make it unnecessary to reinvent the wheel.
- adrianN 6y ago
  I think you overestimate the effort needed to buy the building blocks for your own ransomware.

heavenlyblue 6y ago

I am sorry, but the term invented for the purpose of dealing with rape culture does not exist to be generalisable to a completely different niche. In this case the victim is the one paying huge bonuses to execs who decided that security is less important than their salaries. And other people are suffering for it.

young_unixer 6y ago

Are Hackers criminals? Yes, because the law says they are. Does that matter? Not much outside the realm of law. I don't think hacking/cracking should be illegal. If I send you a series of electrical pulses and that causes your systems to do something stupid, that's your problem. You are not a "victim". Laws against physical violence and against stealing physical objects have good reasons to exist, because otherwise there would be no point in having any moral conception at all, because everyone would solve their problems through violence. On the other hand, sending messages through a wire doesn't have good reasons to be outlawed. We could live peacefully sending each other all sorts of bytes, and each entity would make an effort for their own systems to behave correctly. Most people disagree with me, but their abstraction is leaking, because even they agree with me on a fundamental level, they just don't know it. The moral discussion is so disconnected from concrete actions and formal definitions that it devolves into dumb analogies like "but if you left your door open blah blah". Having a "right not to be hacked" is of the same nature as having a "right not to be offended".

blowfish721 6y ago
Genuine question: I can understand your reasoning regarding physical violence but why would you include stealing physical objects? If there was no physical violence or threat of it during the stealing.
- young_unixer 6y ago
  You're right. In my opinion there are good reasons for physical property to exist (individual freedom), but avoiding violence is not the best theoretical argument for it. Is physical property against freedom or in favor of freedom? I think both, depending how you look at it. I've though about this a lot, and tend to fall on the side of proprietarianism, because I think property is absolutely necessary for the fulfillment of human needs and desires.
- pixl97 6y ago
  You would absolutely authorize violence by proxy if someone stole your stuff, and if you wanted to cash in your insurance policy it would be required in the form of a police report.

dfxm12 6y ago

"Victim blaming" implies that the parent poster is saying that Funke would be responsible for the hackers' actions, that they somehow stuck their necks out and invited an attack. That's not the case. The parent poster is saying Funke and/or their software vendors are guilty of negligence. You, too, even go on to admit there might have been vulnerabilities in the software or processes of Funke group. The parent poster is not the one being dishonest...

deleted 6y ago

[deleted]

kevstev 6y ago

I mean its tricky to do an analogy between the digital and physical worlds- but I do find it interesting that I mean there is a whole range of possibilities here, at what point do you stop blaming the victim? 1- The front door was left wide open 2- The front door was closed, but left unlocked. 3- The back door was left unlocked. 4- All doors were locked, but with an easily picked lock. 5- All doors were locked and with a legit key, but a window was left closed, but not locked. 6- All windows and doors were locked, but the windows were easily broken. 7- The windows were reinforced, but a door was broken down or someone drilled the locks, or just forced the window until the lock failed. 8- The doors and window locks were reinforced, but they pried up the garage door and broke through the flimsy door between the house and garage. 9- The exterior entryways were all truly secured, but they found a way in through a chimney, a sewer pipe, or just sawz-alled through the exterior siding... At what point do you stop calling the resident an idiot and start blaming the perpetrator? Personally I would say around #4 in the meatspace the world, but 2/3 I would say they are still being victimized depending on where they lived and whether they routinely left the door unlocked or not. And then in the digital world, there are things like not setting a password or leaving a default one up, but what about patching known vulnerabilities? How long is too long once a patch is made available? What about zero days, and vectors of attack no one thought of... and maybe line employees who just don't know better? Just in general, people are very quick to blame the victims in situations like this- I just had an argument about this with someone the other day when I heard the news that a neighbor's bike was stolen- from outside their door on the third floor. It was an exterior door/stairway, but not visible from the street, and the bike was locked but with a cheap one. They brought bolt cutters and took the bike. People were like "this is on you for using that cheap lock..." but I think he took reasonable precautions, but many had no sympathy for the guy. Personally I can't wrap my head around that mindset.

nisten 6y ago

There has to exist a difference between victim-blaming and people screwing up at their jobs. In the case of the SolarWinds attack, their management seemed to be quite technical and the attacker was just too strong/sophisticated, so SolarWinds is considered a victim. But in the case of the Equifax, they're considered at fault because their head of security seemed unqualified for the job and the victims were actually the millions of users whose private data was put at risk of abuse. The probability in this case is very high that the upper management at Funke was quite incompetent at how they've digitized their operations.