4 ms·

I don't get why everybody cares so much about the ransomware/cryptominer part, but not the data being exfiltrated and sold/used for criminal activity part..

g_p 5y ago
My cynical suspicion is because exfiltration/sale doesn't prevent the business from continuing to operate, pretending nothing is wrong, and gaslighting their users via reassuring language if anyone finds out or is approached. When the data is encrypted and locked up, the company itself cries foul (not out of care for people's data) as it can't keep doing whatever mundane things it was doing day-to-day.
- Craighead 5y ago
  Mundane... like providing health care?
deleted 5y ago
[deleted]
johnvaluk 5y ago
This attack is most effective against victims without backups who are desperate to get back their data. If you have backups, you basically shrug it off, restore your data, (re)train your users and use forensics to mitigate any obvious weaknesses. In most cases, it takes less effort for the attackers to move on to the next victim instead of trying to extract value from any data they may have exfiltrated (probably none in a lot of cases).
bluGill 5y ago
Most data just isn't that useful. Sure there are exceptions, but most isn't very useful. If you offered my company our competitors source code for free, we wouldn't take it - we have some ethics. I think most of you are in the same boat - even if you don't have strong company ethics are quick check would discover that you already know how to do everything they are doing, so time looking at their code is time you aren't adding those features to yours. (the one exception would be their file format which are valuable) Even if the data is valuable, can they use it? I know the database admins in my company are registered with the SEC as not able to trade some things because we have insider information from our customers. Even if someone got that data though, they would have to figure out the database, what it means, AND be lucky enough to do that when there is something non-public that can be traded. Most of the time the expected supply is the same as actual supply, so that fact that we have insider information on the actual supply isn't actually useful. (the above is a different department from mine so I don't know the details very well) Thus the example of a police department is an outlier as the data is sensitive for a long time.
- pixl97 5y ago
  Um, ya, you are only thinking of US/EU companies. There are plenty of other places that would RIP off your code in a heartbeat.

g_p 5y ago

My cynical suspicion is because exfiltration/sale doesn't prevent the business from continuing to operate, pretending nothing is wrong, and gaslighting their users via reassuring language if anyone finds out or is approached. When the data is encrypted and locked up, the company itself cries foul (not out of care for people's data) as it can't keep doing whatever mundane things it was doing day-to-day.

Craighead 5y ago
Mundane... like providing health care?

deleted 5y ago

[deleted]

johnvaluk 5y ago

This attack is most effective against victims without backups who are desperate to get back their data. If you have backups, you basically shrug it off, restore your data, (re)train your users and use forensics to mitigate any obvious weaknesses. In most cases, it takes less effort for the attackers to move on to the next victim instead of trying to extract value from any data they may have exfiltrated (probably none in a lot of cases).

bluGill 5y ago

Most data just isn't that useful. Sure there are exceptions, but most isn't very useful. If you offered my company our competitors source code for free, we wouldn't take it - we have some ethics. I think most of you are in the same boat - even if you don't have strong company ethics are quick check would discover that you already know how to do everything they are doing, so time looking at their code is time you aren't adding those features to yours. (the one exception would be their file format which are valuable) Even if the data is valuable, can they use it? I know the database admins in my company are registered with the SEC as not able to trade some things because we have insider information from our customers. Even if someone got that data though, they would have to figure out the database, what it means, AND be lucky enough to do that when there is something non-public that can be traded. Most of the time the expected supply is the same as actual supply, so that fact that we have insider information on the actual supply isn't actually useful. (the above is a different department from mine so I don't know the details very well) Thus the example of a police department is an outlier as the data is sensitive for a long time.

pixl97 5y ago
Um, ya, you are only thinking of US/EU companies. There are plenty of other places that would RIP off your code in a heartbeat.