8 ms·
Fujifilm shuts down network after suspected ransomware attack
- sschueller 5y agoLet's see if fujifilm has better network security and backups than others. Cutting the network seems like a good way to gain time to figure out what is affected and how.
- slver 5y agoBrought to you by cryptocurrency.
- vmception 5y agoand underpriced bug bounties.
- slver 5y agoThat's like a gang attacking you on the street, and someone remarking you should've hired (more) bodyguards. No infrastructure is perfectly secure. This is why it's illegal to attack infrastructure and blackmail the owners. However "illegal" doesn't mean anything to cryptocurrency, because it's beyond anyone's control. Before crypto, there was no direct way to pay the blackmailers, unless they were nearby, and willing to send someone to get cash in a briefcase. Which involves a lot of risk, obviously. With crypto anyone in the world can attack you, and get paid risk-free.
- boringg 5y agoAnd that someone happens to have a lot of bodyguards for sale / is a body guard
- vmception 5y agoBut its more like the incentives to crowdsource security improvements can be improved with bug bounties more closely reflecting the value of the system or bounty
- slver 5y agoI can play your game. But I'll make it fair. I'll pay you to find bugs in my system. I'll pay you a lot. But if it gets hacked: 1. You return all money. 2. You're personally responsible for all negative financial and legal outcomes. 3. And I don't mean I get to take your Nintendo Wii and your half-eaten donut. I mean you need to prove you have a whole lot of money, like how much I stand to lose. And if I lose them due to a hack you failed to prevent, I take all your money. 4. Also you can't have contracts with other people, unless you have a separate pile of money for them when they get hacked. You game? Sign here, here and here.
- vmception 5y agoorrrrr just use the existing bug bounty systems with higher payouts and less arbitrary nature of whether a payout will occur or not, as they already have sorted out liability exemptions and the limit of what the hacker will do.
- slver 5y agoBug bounty programs help when you want to gradually improve the quality of your system, but no single bug can be used to blackmail or halt your entire business. You see, your proposal's math doesn't work. Acme has a system worth 100 million. This means a blackmailer can ask for 100 million if they find one bug (let's keep things simple). Obviously Acme can't offer 100 million in a bug bounty program for every bug found. So let's say they offer 100k, they're very generous. This means after 1000 bugs found, they've transferred their entire worth to bug bounty hunters. So while Acme had to create a system worth 100 million, they own 0 of it now. They gave everything to bounty hunters. Is this fair? No. What happened is that instead of one blackmailer, there were 1000 blackmailers saying "we're the good guys, we help you find bugs in your system, OR ELSE". When a health industry keeps raising the prices on you, because they keep saying "we're the good guys, we help you not die of cancer, give us your house, OR ELSE" we love them right? But that's not the end of the story. Did the good guys who took all your money found all the bugs? Well a blackmailer still stands to gain 1000x more than anyone on the bug bounty program, if they can find a bug before the bug bounty hunters have leeched the host dry of their last drop of blood. So a malicious hacker is motivated to be faster, and financed to be better, with more people, better equipment, and so on. So the bug bounty program is absolutely inadequate solution to the problem. Paying more to match what a blackmailer would ask, turns the bug bounty hunters into blackmailers. Except they also can't guarantee shit. And they can't cover losses for shit if they miss something either. They just take your money and leave you almost as vulnerable as you were. So, no. Companies won't have bigger bug bounty programs. Instead they'll do something that might help. Like move off the internet, making things more inconvenient for everyone, and insure heavily anything they put online.
- samatman 5y agoBrought to you by a culture of insecurity in computer programming and network engineering. I understand the temptation to blame cybercoins, because the actual explanation is a stunning inditement of our entire profession. But, no, the insecurity is optional, and comes from an entire culture of "good enough", which is manifestly not good enough. Cybercoins provide a general-purpose medium to profit from exploiting this insecurity. But the insecurity was already there, with plenty of economic and political reasons to exploit it; the pre-Bitcoin status quo was chock full of data breaches and state actors siphoning off anything they wanted to, and we just put up with it because we're lazy and arrogant.
- slver 5y ago> But, no, the insecurity is optional, and comes from an entire culture of "good enough", which is manifestly not good enough. You sound so sure of this. You should start a company that guarantees security, and get everyone's trillions of dollars flowing your way. Good luck with that, seriously. Or maybe you'll realize how complexity breeds imperfection and realize the countless ways in which theory and practice are the same in theory, but in practice aren't. It's very easy to imagine a secure system, though. I give you that. Also everyone at the company is completely impervious to social engineering, even the cleaning lady. I'm imagining it.
- jonny_eh 5y agoWe’re ruining the environment to enable ransomware attacks.
- slver 5y ago20th century consensus: centralized stupidity is a threat, we must decentralize 21st century consensus: decentralized stupidity is worse, turns out
- rantwasp 5y agoreally? crypto is to blame? not the weak security and culture of passing the buck? do you know what is the currency involved in most number of crimes in the world? i’ll let you guess.
- evgen 5y agoCorrect, crypto is to blame for the current ransomware epidemic. Weak security and a culture of passing the bunk may have created the environment, but crypto made the entire enterprise profitable and is completely to blame for what is happening now. Whether you like it or not this is a simple truth. Do you know what 'currency' is involved in ALL ransomware crimes? I'll let you guess.
- rantwasp 5y agowow. just wow. so crypto is to blame? let me ask you this? after to get your bitcoins or whatever you are getting with this ransomware, what exactly do you do with them? what do you do with all those bitcoins? also, your argument is that a centralized currency / a central authority vouching for the currency makes things better and deters crime? lol.
- FDSGSG 5y agoIf cryptocurrency disappeared tomorrow ransomware operators would have no difficulty switching to bank transfers or bags of cash flown to Russia.
- evgen 5y agoBut their victims would have a hard time paying in that manner. For the longest time the exchange was the hard part of any ransom operation. Cryptocurrency makes it easy. If it changes to bank transfers then that is easier to trace and adds significant risk, it also raises the bar in terms of who can pull it off. Bags of cash? That never works.
- FDSGSG 5y ago
- sebyx07 5y agoPowered by Microsoft
- dang 5y agoWould you please stop posting unsubstantive and flamebait comments to HN? You've done it a lot, including in this thread, and it lowers discussion quality considerably. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- tibbydudeza 5y agoImagine if they targeted TSMC or ASML ???.
- buildbot 5y agoI know some people who work for a TSMC subsidiary- they take security extremely seriously, all data is physically located in Taiwan and everyone remotes in, super locked down systems, etc. I can’t imagine their actual production floor being connected to anything at all, ever. You’d need a stuxnet style airgap jump.
- fomine3 5y agoIt seems that possibly now is a chance to data breach thanks to their fab expansion plan to overseas.
- jagger27 5y agoThose companies have state level adversaries to contend with.
- tibbydudeza 5y agoChinese hackers already hacked the NSA and stole their zero day exploits - it was 2014 but still.
- jbay808 5y agoDon't worry, I'm sure the NSA has acquired lots of fresh new exploits since then!
- entropic88 5y agoYep..MS just had to send out a 'security update' to provide them with a few new vectors.
- sebyx07 5y agoMS Windows is 100% to blame. How can a worm spread that easily in 2021 to pcs across the network? 0day trash windows exploits
- Grakel 5y agoWhy is infrastructure on the internet?
- totetsu 5y agoHaving worked at a Japanese startup and seen the advice that came down from our customer companies and the country, I got the impression that there is an ernest attempt to modify peoples behaviour to secure against ransomware sw getting in to a network. But I didn't have much confidence on the over all security in depth of things.