6 ms·

Ugh. This ransomware crap doesn't stop until the money stops. At this point, ransomware operators are bribing insiders to install their custom, AV-evading ranso

Ugh. This ransomware crap doesn't stop until the money stops. At this point, ransomware operators are bribing insiders to install their custom, AV-evading ransomware directly on company servers (e.g. https://www.secureworldexpo.com/industry-news/fbi-sting-the-ransomware-gang-trying-to-bribe-employees https://www.secureworldexpo.com/industry-news/fbi-sting-the-...). No need to trick someone into running a malicious Word attachment when you can just wire someone $1M to do it deliberately! And, best of all, you can set this up in a totally plausibly deniable way - the employee just "accidentally" opens that attachment and off you go. A lot of ransomware operators are on sanctions lists. Paying them is already illegal. The US DoJ might want to check if Colonial has violated any laws in making these payments - and if they have, punishing them to serve as an example could well discourage future ransomware payers. As long as ransomware operators know they can get paid for their work, they're going to keep doing it.

andy_ppp 5y ago
I wonder how long you’d sit it out losing money before you paid. I think it’s very easy to talk a big game until you’ve lost many multiples of the ransom with no end in sight. It’s literally just a waiting game for the hackers, they have nothing to lose and everything to gain. So what if you don’t pay, you can just leave them screwed and move on to the next one.
- viraptor 5y ago
  Or if you're running a service which can't wait. Like a medical clinic with no access to patient records.
  - andy_ppp 5y ago
    Or you know people's power, heating, electricity, ability to drive, ability for services to run generally. etc. etc.
sudosysgen 5y ago
Realistically, ransomware will just never stop until IT systems are sufficiently hardened.
- user3939382 5y ago
  Or sufficiently backed up, right? If you’ve got a backup and quick recovery process ransomware is impotent.
  - salawat 5y ago
    This is by far the cheapest solution.
    - phkahler 5y ago
      unless your data is legally required to stay confidential under HIPPA or similar law. Then a backup just keeps you operating but not immune to the threat of data publication.
      - johnvaluk 5y ago
        While the threat of publication is a risk, the data has already been breached and you are no longer compliant with the law.
      - mateo- 5y ago
        I wonder if companies still get fined if the data is just encrypted without any exfil
      - dragontamer 5y ago
        What data needs to be confidential in the case of the Colonial Pipeline? I'm sure that there's proprietary data. Maybe knowing how much oil / gasoline is flowing might allow some traders to make unfairly informed trades (or maybe not: only inside trading is illegal. If someone figures out the information some other way, its not illegal IIRC). And maybe employee data should be kept private, but there's no HIPPA requirement on that. Its not like there's payment processors on this thing either, so no PCI compliance here. So I'm not exactly seeing why backing up data would be an issue in this case.
comboy 5y ago
I think ransomware is the best thing that happened in computer security in a long time. All these companies keeping lots of people data or even being relevant to national security having completely no incentive to stay secure. Now There is incentive to test their security. A single person being able to compromise your company when paid a lot is a security issue that needs to be addressed.
- AnIdiotOnTheNet 5y ago
  This sounds like the kind of argument a ransomware developer would use to delude themselves... or quite a lot like the "Bitcoin is actually good for the environment!" people.
  - fastball 5y ago
    Maybe let's try more substantive arguments than a genetic fallacy.
  - HarryHirsch 5y ago
    Wasn't that what Jesus said about Judas Iskariot? To paraphrase: there must necessarily be evil in the world, but woe to the one who makes himself its conduit.
- HarryHirsch 5y ago
  They could have started incentivizing after the Equifax hack. Personal data of hundreds of millions of people spilled over the web, everyone plus their dog gets to monitor their credit report or swap credit cards, yet Equifax still exists, and no meaningful consequences for anyone, including the CEO who sold his shares before the intrusion become public. Why is that even permitted?
  - hellbannedguy 5y ago
    I was going to say fine these companies a fair amount if there's a data breach; But they would just turn around and add their costs on to the consumer. I'll get hammered for this, but there's a part of me that would like to just outlaw all bitcoins worldwide, and even that might not work unless every country banned them?
ttul 5y ago
Absolutely this. Paying a ransom should be illegal and company officers should face personal criminal liability for allowing it. If the CEO of Colonial was facing jail time, there is no way the payment would have happened.
- Guest42 5y ago
  I would sooner have security negligence be criminalized as there are a number of products that are critical to the economy and peoples health. Having a companies systems get wiped out can have a monumental amount of collateral damage.
  - silexia 5y ago
    Paying Ransoms should be criminalized as there is far more damage from allowing this to continue then having a few systems wiped and restored from backups. Not taking steps to have cybersecurity in companies should be criminalized as well... I am a CEO and thinks CEO's should be held directly criminally responsible for this. Finally, any nation that allows hackers to operate from within their borders should be subject to 100x over damages caused sanctions. Countries without strong governments to enforce this should have direct airstrikes conducted against the individual hackers.
    - mjevans 5y ago
      If you think the 100X damages is overkill please reconsider within this framework: Any nation that harbors international terrorists by not at least attempting to hold them accountable is implicitly operating an outsourced covert activities team. The actions of any such team should be considered representative of that country and thus this would be an act of guerilla warfare.
      - warlog 5y ago
        Nukem from orbit, it's the only way to be sure.
- 5y ago
panny 5y ago
>ransomware I prefer to think of them as bug bounties. Too often, bugs are reported now to bug bounty programs and are either grossly underpaid for the bug's actual value, or deflected as not a real issue at all. Ransomware is ultimately the result. "Fuck you, pay me." https://www.youtube.com/watch?v=3XGAmPRxV48 https://www.youtube.com/watch?v=3XGAmPRxV48

andy_ppp 5y ago

I wonder how long you’d sit it out losing money before you paid. I think it’s very easy to talk a big game until you’ve lost many multiples of the ransom with no end in sight. It’s literally just a waiting game for the hackers, they have nothing to lose and everything to gain. So what if you don’t pay, you can just leave them screwed and move on to the next one.

viraptor 5y ago
Or if you're running a service which can't wait. Like a medical clinic with no access to patient records.
- andy_ppp 5y ago
  Or you know people's power, heating, electricity, ability to drive, ability for services to run generally. etc. etc.

sudosysgen 5y ago

Realistically, ransomware will just never stop until IT systems are sufficiently hardened.

user3939382 5y ago
Or sufficiently backed up, right? If you’ve got a backup and quick recovery process ransomware is impotent.
- salawat 5y ago
  This is by far the cheapest solution.
  - phkahler 5y ago
    unless your data is legally required to stay confidential under HIPPA or similar law. Then a backup just keeps you operating but not immune to the threat of data publication.
    - johnvaluk 5y ago
      While the threat of publication is a risk, the data has already been breached and you are no longer compliant with the law.
    - mateo- 5y ago
      I wonder if companies still get fined if the data is just encrypted without any exfil
    - dragontamer 5y ago
      What data needs to be confidential in the case of the Colonial Pipeline? I'm sure that there's proprietary data. Maybe knowing how much oil / gasoline is flowing might allow some traders to make unfairly informed trades (or maybe not: only inside trading is illegal. If someone figures out the information some other way, its not illegal IIRC). And maybe employee data should be kept private, but there's no HIPPA requirement on that. Its not like there's payment processors on this thing either, so no PCI compliance here. So I'm not exactly seeing why backing up data would be an issue in this case.

comboy 5y ago

I think ransomware is the best thing that happened in computer security in a long time. All these companies keeping lots of people data or even being relevant to national security having completely no incentive to stay secure. Now There is incentive to test their security. A single person being able to compromise your company when paid a lot is a security issue that needs to be addressed.

AnIdiotOnTheNet 5y ago
This sounds like the kind of argument a ransomware developer would use to delude themselves... or quite a lot like the "Bitcoin is actually good for the environment!" people.
- fastball 5y ago
  Maybe let's try more substantive arguments than a genetic fallacy.
- HarryHirsch 5y ago
  Wasn't that what Jesus said about Judas Iskariot? To paraphrase: there must necessarily be evil in the world, but woe to the one who makes himself its conduit.
HarryHirsch 5y ago
They could have started incentivizing after the Equifax hack. Personal data of hundreds of millions of people spilled over the web, everyone plus their dog gets to monitor their credit report or swap credit cards, yet Equifax still exists, and no meaningful consequences for anyone, including the CEO who sold his shares before the intrusion become public. Why is that even permitted?
- hellbannedguy 5y ago
  I was going to say fine these companies a fair amount if there's a data breach; But they would just turn around and add their costs on to the consumer. I'll get hammered for this, but there's a part of me that would like to just outlaw all bitcoins worldwide, and even that might not work unless every country banned them?

ttul 5y ago

Absolutely this. Paying a ransom should be illegal and company officers should face personal criminal liability for allowing it. If the CEO of Colonial was facing jail time, there is no way the payment would have happened.

Guest42 5y ago
I would sooner have security negligence be criminalized as there are a number of products that are critical to the economy and peoples health. Having a companies systems get wiped out can have a monumental amount of collateral damage.
- silexia 5y ago
  Paying Ransoms should be criminalized as there is far more damage from allowing this to continue then having a few systems wiped and restored from backups. Not taking steps to have cybersecurity in companies should be criminalized as well... I am a CEO and thinks CEO's should be held directly criminally responsible for this. Finally, any nation that allows hackers to operate from within their borders should be subject to 100x over damages caused sanctions. Countries without strong governments to enforce this should have direct airstrikes conducted against the individual hackers.
  - mjevans 5y ago
    If you think the 100X damages is overkill please reconsider within this framework: Any nation that harbors international terrorists by not at least attempting to hold them accountable is implicitly operating an outsourced covert activities team. The actions of any such team should be considered representative of that country and thus this would be an act of guerilla warfare.
    - warlog 5y ago
      Nukem from orbit, it's the only way to be sure.
5y ago

panny 5y ago

>ransomware I prefer to think of them as bug bounties. Too often, bugs are reported now to bug bounty programs and are either grossly underpaid for the bug's actual value, or deflected as not a real issue at all. Ransomware is ultimately the result. "Fuck you, pay me." https://www.youtube.com/watch?v=3XGAmPRxV48 https://www.youtube.com/watch?v=3XGAmPRxV48