12 ms·
This is a national security issue — malicious actors based in other nation-states are raiding American companies. It seems that US defense forces are not up to
by rectang 5y ago
This is a national security issue — malicious actors based in other nation-states are raiding American companies. It seems that US defense forces are not up to the task of repelling these invaders — yet we're expecting individual companies to go up against them??
It will be a long, long time before the marketplace evolves sufficient technological measures to guard against state-sanctioned/possibly-state-sponsored malicious actors operating with impunity in a lawless environment.
- wearywanderer 5y agoThe military can't stop it, the police can't stop it, companies can't stop it, and the marketplace can't stop it.... so what are you proposing? Surrender? Escalating to a hot war?
- leecarraher 5y agoI agree, this is a classic do as I say not as I do situation. Punish businesses for paying out ransomware ransomes meanwhile the government(mainly local, but sometimes larger) pay out routinely when their systems are compromised.
- Ottolay 5y agoMuch of the proposed legislation applies to local governments too. E.G. http://pulse.ncpolicywatch.org/2021/05/12/as-nc-lawmakers-fast-track-legislation-prohibiting-ransomware-payments-federal-officials-focus-on-pipeline-shutdown-future-attacks/ http://pulse.ncpolicywatch.org/2021/05/12/as-nc-lawmakers-fa...
- cortesoft 5y ago“Government” is not a monolith.... the group trying to punish for paying ransoms is not the same group paying out ransoms
- happymellon 5y agoI guess that they could always have backups. Then they also don't need to pay the ransoms.
- CogitoCogito 5y agoYeah I think this is the way it should be interpreted. If you get yourself in the position where you need to pay the ransom, your security practices have failed. This makes that possibility more expensive. This is not a ridiculous idea.
- uses 5y agoBackups are no longer a cure-all. Because now the attackers threaten to publish the data.
- dd82 5y agobackups are a one-way hash unless you've tested your restoration
- Spivak 5y agoWhile it's always good to state the importance of testing your backups the fear that HN seems to have surrounding backups seems really out-of-touch. You would believe that everyone's backups are teetering on the edge of failure constantly. If your backup process is so brittle and complex that you assume that it will be broken when you need it you should probably do something about that. It's not that hard to have the things that store your data spit it out on a schedule to be transferred somewhere write-only and durable.
- kuratkull 5y agoGetting it back into a fresh live server without warnings and errors is the tricky part.
- davidgh 5y agoBut if you have a backup of the data, at least it’s possible.
- bluGill 5y agoOh sure, but if you have the data you can hire people to get it done. The important part is having the data, if the data is there (meaning not encrypted) money and time can get it working. I'd much prefer to have a good backup media vs having to find someone who knows how to read faded data from a way overused and well out of date tape, but there is technology to get back data from such bad backups. The important part is having the backup in some form. Having a well tested restore ability is a great idea, but not nearly as important as having the backups in the first place. Most backup programs are designed for restore, even if you screwed up, odds are you can get the data back later.
- baybal2 5y ago> sufficient technological measures to guard against state-sanctioned/possibly-state-sponsored malicious actors You mean an average person will uninstall MicroSoft Windows? Peope were telling of the inevitable downfall of MicroSoft since before I was born.
- balabaster 5y agoAnd really it only takes a bad actor inside a company to circumvent most of the security on-site anyway. Until companies treat every accessor to the network as malicious, this will continue to go round in circles. Most businesses just don't have the budget to deal with security this way.
- emteycz 5y agoPerhaps it's time for network police then. We don't expect businesses to deal with other crimes...
- balabaster 5y agoThere needs to be something. I'm curious what we will come up with. Some kind of sentinel that sits on the network and does behavioural and threat analysis of all network traffic and prevents damage before it can happen perhaps?
- aaronax 5y agoWhen I hear something like "network police", I start drawing parallels to the real world. In the physical world, you generally don't have anonymous people running around (or at least most cases you have a way of linking any actions/crimes committed to a real, permanent identity), disguises aren't allowed, and trespassing is not permitted. So the Internet could be like this if it was more regulated. Anonymous traffic could be prohibited...no more TOR nodes, no hands-off proxying of traffic, no "it's an open access point, I totally don't know who was creating that torrent traffic". Would these sorts of laws be accepted, or would they simply result in more attempts to anonymize traffic? I imagine that this is sort of what things are like in more authoritarian places like China. Is it effective there?
- nradov 5y agoSuch sentinel devices have been available for years. The trouble is they can't reliably identify attempts to exploit zero-days because the patterns are unknown.
- 5y ago
- sneak 5y agoSuggesting that this is a government problem to solve, or an invasion, leads to a type of framing that harms you and everyone else in your country that has or uses computers. It's also not really a national security issue. The USA will continue to exist and function as the USA even without gas pipelines and power generation. "National security" isn't some blanket term to mean "large infrastructure required for major industries", it has a specific, defined meaning. Just because the feds use it as a blanket justification for a bunch of stuff doesn't mean we should embrace that usage, otherwise when everything is a matter of "national security" than nothing is. It's just like the overuse of the term "terrorism" to mean "any big crime".
- adrianN 5y agoWhat alternative definition of "national security" do you propose?
- throwawaygh 5y ago> The USA will continue to exist and function as the USA even without gas pipelines and power generation. Temporary outages, maybe. Sustained outages (or destruction) of gas pipelines and power generation, if systemic, would almost certainly mean mass starvation.
- sneak 5y agoI agree. That's not at all what ransomware does or is even within the realm of possibility here, however.
- bluGill 5y agoIt leads in the direction. The better we get at defending against these "lesser" attacks, the better we are at defending against the bigger attacks that might happen. Also the less likely it is someone will develop those attacks in the first place because there is less incentive to learn how they work.
- tw04 5y ago> It seems that US defense forces are not up to the task of repelling these invaders — yet we're expecting individual companies to go up against them?? They aren't? Has NORAD control been hacked? Any battleships or predator drones? I admit it's a bad look when, for instance, a VA database is compromised and private information for millions of government employees are exposed, but I'd also be SHOCKED if the NSA were dedicating resources to protecting that data. Outside of Snowden, what leaks of stuff "the US defense forces" are actually attempting to protect have been captured? >yet we're expecting individual companies to go up against them? The companies in question appear to not even be doing basic things like taking backups and making them immutable. I don't think anybody is expecting them to have perfect security, but it doesn't take a lot of effort to backup to a tape and stick it in iron mountain for 2 years, it just takes money.
- eagsalazar2 5y agoThe US military doesn't exist to protect its own assets. That is a secondary concern.
- xpe 5y agoNo. The old adage tells an important lesson: you cannot take care of others if you cannot take care of yourself. Even a cup of water cannot function if it cannot maintain structural integrity.
- roywiggins 5y agoHas NORAD control been hacked? If it was, how would we know? (outside of, uh, kinetic consequences)
- dataangel 5y ago> Any battleships or predator drones? yes actually over ten years ago this happened already https://www.cnn.com/2009/US/12/17/drone.video.hacked/index.html https://www.cnn.com/2009/US/12/17/drone.video.hacked/index.h...
- 5y ago
- eagsalazar2 5y agoThere are so many levels on which our own govt is complicit in foreign crimes. There is no way our govt ever "fights" these attacks until we first eliminate the deeply corrupt forces that currently control it. Also very unlikely. OTOH, this isn't just about bad actors raiding. This is also about terrible security practices that are easily avoidable with an ounce of expertise and giving a shit. In addition to your idea (let's make believe for a moment...) how about the US govt itself sponsors these attacks, and then instead of demanding ransom, they just levy huge fines against the companies who have carelessly let this happen? Extending your analogy, this would be no different than fines or lawsuits for carelessness and failures in physical infrastructure.
- birdyrooster 5y agoIn the US, as long as you pay the IRS, you can do the same and raid our military adversaries. There should be some militias like in the old days.
- throwawaygh 5y ago> It will be a long, long time before the marketplace evolves sufficient technological measures to guard against state-sanctioned/possibly-state-sponsored malicious actors operating with impunity in a lawless environment. Unfortunately, the marketplace -- at least certain segments of it -- are far beyond .mil/.gov in terms of capacity and sophistication. E.g., AWS's formal tools for code-level security is what DARPA's been yelling about doing for decades, but gov't contractors and the branches/agencies are unable/unwilling to catch. I'm not sure how to fix gov or mil, but a good starting point within mil is to stop making career officers with theology and polisci degrees but zero CS training the first-line managers of cyber commands.
- dataangel 5y ago> AWS's formal tools for code-level security what tools?
- someguydave 5y agoyeah what tools?
- sodality2 5y agohttps://aws.amazon.com/security/provable-security/ https://aws.amazon.com/security/provable-security/ as one example
- sodality2 5y agohttps://aws.amazon.com/security/provable-security/ https://aws.amazon.com/security/provable-security/ as one example
- Phrodo_00 5y agoWhat AWS tools? This [1]? If so, it looks interesting, I need to take a closer look at it. [1] https://aws.amazon.com/security/provable-security/ https://aws.amazon.com/security/provable-security/
- StrictDabbler 5y ago
- adrianN 5y agoRight, so we replace every companies' IT department with a division of the military, as a first step.
- munk-a 5y agoA socialized defense force against these sort of ransom attacks seems a bit antithetical to the American culture - taxes would go up and profits down to provide a service that only exists for a few "market losers". I suspect this bill will face significant lobbying against it by companies involved in secured backups along with the ransomware distributors themselves.
- hollerith 5y agoIt is not a bill/legislation: it is an action of the executive branch.
- shoto_io 5y agoYes. It's called asymmetric warfare. It's very cheap to attack. And it's very expensive/resource intense to defend. Most probably "state actors" are taking advantage of this asymmetry to extort money and bind resources. It's a hidden "war" going on out there.
- citrin_ru 5y agoIt's depends. One can setup a web server with BSD/Linux and nginx - it would be cheap to create and maintain and very hard/expensive to attack. Balance is different when you have and a company with understaffed IT and all which usually goes along with this: software which is not updated for months if not years despite known vulnerabilities in it, legacy systems which are kept "just in case" because no-one knows what will be broken if they will be decommissioned, poorly managed credentials to external systems, and so on.
- mcguire 5y ago"It will be a long, long time before the marketplace evolves sufficient technological measures to guard against state-sanctioned/possibly-state-sponsored malicious actors operating with impunity in a lawless environment." Only because we, as a society, have decided that we don't care about information security, to the extent that we protect incompetent, ignorant, or uncaring individuals and organizations from any liability for their actions. How much better off would we be if we had fined Experian $1M for every user account they lost? Or for any of the other breaches in the preceding decades? How much more careful would your average bootcamp grad be writing the code that forms attack surfaces if they had to pay liability insurance? By and large, we have had a good idea how to make technological measures much more resistant to attack since the '80s. It's always been considered too difficult and too expensive, something we have put exactly no resources towards fixing. Ten years of a quarter of the collective budget we spend on using ML to violate privacy would probably take everyone except state sanctioned actors out of the picture. (All numbers pulled out of my flying monkeys.)