4 ms·

Call me naïve, but who is such a hot target to warrant so much effort to exfiltrate PII? Defense? FinTech? Government?

by anticristi 6y ago

draugadrotten 6y ago
I'd add medical to that list. Vaccine test results are hot stuff.
- clankyclanker 6y ago
  Not just vaccines, but basically all your data, including billing and disease history. Perfect for both scamming and extortion. Keep in mind that you actually want your medical provider to have that data, so they can treat you with respect to your medical history, without killing you in the process.
  - anticristi 6y ago
    True. However, reading between the lines, the exfiltration "project" was targeted (i.e. one-off), skilled and long. I would put the cost anywhere between 1 megabuck and 10 megabucks. Given risks and dubious monetization, I would assume the "sponsor" demands at least a 10x ROI. Is medical data really that valuable?
    - webnrrd2k 6y ago
      How about psychiatric data from the area around Washington DC? Hospitals/practices that are frequented by New York CEO-types? I can picture that being quite valuable to the right parties.
- daveslash 6y ago
  I think you're right that it's medical. The author calls out PII was the target. Sure, there's PII in Defense/Fintech/Government, but it's probably not the target in those sectors and PII doesn't have the same spotlight on it as in the Medical world (e.g. HIPPA & GDPR).
  - dane-pgp 6y ago
    Are you saying that, for example, the addresses of military generals and spies are less of a target for hackers than the addresses of medical patients? While there are laws to protect medical information, I think all governments care more about protecting national security information.
    - daveslash 6y ago
      Ah, good point! No, I was not saying that at all, and thank you for pointing that out. When I was thinking of "defense", I was thinking of the defense contractors who are designing/building things like the next-gen weapons, radar, vehicles, and the like. In that context, when it comes to what they can exfiltrate, I think attackers probably prioritize the details & designs over PII. Just a guess though.
    - jldugger 6y ago
      > the addresses of military generals and spies are less of a target for hackers than the addresses of medical patients? Why not both? Think how valuable the medical information of military staff would be as a source of coersive power.
    - anonymousiam 6y ago
      At least in the USA, the addresses of military generals has already been pwned (at least by the CCP/PRC). https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management...
h2odragon 6y ago
Who is such a hot target and can take such an independent attitude, even to allowing this to be published? If this had been a bank, they'd have had to report to regulators and likely we'd have heard none of these details for years if ever. Same for most anything else big enough to be a target i can think of offhand.
- dathinab 6y ago
  Idk. while banks have to report on this they are (as far as I know) still free to publicize details. We normally don't hear about this things not because they can't speak about it but because they don't want to speak about it (bad press). My guess is that it's a company which takes security relatively serious, but isn't necessary very big. > hot target [..] else big enough to be a target I don't thing you need to be that big to be a valid target for a attack of this kind, neither do I think this attack is on a level where "only the most experienced/best hackers" could have pulled it of. I mean we don't know how the dev laptop was infected but given that it took them 3 month to reinfect it I would say it most likely wasn't a state actor or similar.
  - hda111 6y ago
    Doesn’t the GDPR force them to talk about it? I mean all potentially affected people must be informed.
    - anticristi 6y ago
      Indeed, GDPR requires you to inform the Data Protection Authority and affected users.
TameAntelope 6y ago
If they can get to you, they can get to your clients, who have clients they're now better able to get to, etc... HVAC company working in a building where a subcontractor of a major financial firm has an office, for a random example...
deleted 6y ago
[deleted]
perlgeek 6y ago
Hotel or b2b travel agencies also have PII that can be very useful to intelligence agencies.
bsamuels 6y ago
Based on how outlandish the GW setup is, this is definitely a bank. It could conceivably belong to a defense organization, but if it did, they wouldn't be able to write up a blog about their findings.
- alinspired 6y ago
  sounds like a non-conventional bank with many details allowed to be posted, perhaps something crypto ?

Call me naïve, but who is such a hot target to warrant so much effort to exfiltrate PII? Defense? FinTech? Government?

draugadrotten 6y ago

I'd add medical to that list. Vaccine test results are hot stuff.

clankyclanker 6y ago
Not just vaccines, but basically all your data, including billing and disease history. Perfect for both scamming and extortion. Keep in mind that you actually want your medical provider to have that data, so they can treat you with respect to your medical history, without killing you in the process.
- anticristi 6y ago
  True. However, reading between the lines, the exfiltration "project" was targeted (i.e. one-off), skilled and long. I would put the cost anywhere between 1 megabuck and 10 megabucks. Given risks and dubious monetization, I would assume the "sponsor" demands at least a 10x ROI. Is medical data really that valuable?
  - webnrrd2k 6y ago
    How about psychiatric data from the area around Washington DC? Hospitals/practices that are frequented by New York CEO-types? I can picture that being quite valuable to the right parties.
daveslash 6y ago
I think you're right that it's medical. The author calls out PII was the target. Sure, there's PII in Defense/Fintech/Government, but it's probably not the target in those sectors and PII doesn't have the same spotlight on it as in the Medical world (e.g. HIPPA & GDPR).
- dane-pgp 6y ago
  Are you saying that, for example, the addresses of military generals and spies are less of a target for hackers than the addresses of medical patients? While there are laws to protect medical information, I think all governments care more about protecting national security information.
  - daveslash 6y ago
    Ah, good point! No, I was not saying that at all, and thank you for pointing that out. When I was thinking of "defense", I was thinking of the defense contractors who are designing/building things like the next-gen weapons, radar, vehicles, and the like. In that context, when it comes to what they can exfiltrate, I think attackers probably prioritize the details & designs over PII. Just a guess though.
  - jldugger 6y ago
    > the addresses of military generals and spies are less of a target for hackers than the addresses of medical patients? Why not both? Think how valuable the medical information of military staff would be as a source of coersive power.
  - anonymousiam 6y ago
    At least in the USA, the addresses of military generals has already been pwned (at least by the CCP/PRC). https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management...

h2odragon 6y ago

Who is such a hot target and can take such an independent attitude, even to allowing this to be published? If this had been a bank, they'd have had to report to regulators and likely we'd have heard none of these details for years if ever. Same for most anything else big enough to be a target i can think of offhand.

dathinab 6y ago
Idk. while banks have to report on this they are (as far as I know) still free to publicize details. We normally don't hear about this things not because they can't speak about it but because they don't want to speak about it (bad press). My guess is that it's a company which takes security relatively serious, but isn't necessary very big. > hot target [..] else big enough to be a target I don't thing you need to be that big to be a valid target for a attack of this kind, neither do I think this attack is on a level where "only the most experienced/best hackers" could have pulled it of. I mean we don't know how the dev laptop was infected but given that it took them 3 month to reinfect it I would say it most likely wasn't a state actor or similar.
- hda111 6y ago
  Doesn’t the GDPR force them to talk about it? I mean all potentially affected people must be informed.
  - anticristi 6y ago
    Indeed, GDPR requires you to inform the Data Protection Authority and affected users.

TameAntelope 6y ago

If they can get to you, they can get to your clients, who have clients they're now better able to get to, etc... HVAC company working in a building where a subcontractor of a major financial firm has an office, for a random example...

deleted 6y ago

[deleted]

perlgeek 6y ago

Hotel or b2b travel agencies also have PII that can be very useful to intelligence agencies.

bsamuels 6y ago

Based on how outlandish the GW setup is, this is definitely a bank. It could conceivably belong to a defense organization, but if it did, they wouldn't be able to write up a blog about their findings.

alinspired 6y ago
sounds like a non-conventional bank with many details allowed to be posted, perhaps something crypto ?