56 ms·
U.S. to give ransomware hacks similar priority as terrorism, official says
- effnorwood 5y agoZFS. This is not hard.
- Woodi 5y agoThey already failed - let's make taskforce for central monitoring of revents... Do they hear about evaluation of the problem ? a) un-Internet that damn infra; b) replace M$ system with Linux or other for of nix excluding Apple products (too user brain replacing and limiting for building on them). Now you say nixes have bugs too and hackers already have malware versions running on them ? But there is at least one difference: admins have control of that systems parts and can do what they please - including components upgrades. Not so much with 40's years M$ big-ball-of-mud. And why I'm so so anti M$ ? Remember Ukraine electric-factory problems ? M$. Hydro-dam in US ? M$. Lastly something in Brasil ? Guess what. Do the evaluation of base problem. And build more fibers for infrastructure handling !
- lenkite 5y agoJust wonderful. Look forward to a number of false-flag attacks and the extension of the US 'War On Terror'. What should be solved via safety-conscious engineering is going to be solved by Murican War Machine.
- andred14 5y agothese cyberattacks are lies. i work for an essential utility and none of their control systems are on the internet. what do the water pumps come with wireless now? if there is no cable connecting to the internet then how do these hacks take place? we had water, power, etc before computers so the computer part is not essential to operation.
- ocdtrekkie 5y agoWhelp, that's the end of cryptocurrency... probably should sell your HODLings now. If we're going to Patriot Act the crud out of ransomware, Bitcoin is gonna be illegal.
- WrtCdEvrydy 5y agoYeah, that's what happened with drugs. The price of drugs actually dropped to zero and it's now impossible to get LSD.
- ocdtrekkie 5y agoI mean, does Bitcoin give people the sort of high that they'd risk going to prison for? I'm not sure nearly-random numbers has the staying power compared to addictive substances.
- WrtCdEvrydy 5y agoYeah, opening it up and seeing 30%+ gains in a day does give me a sort of high.
- chitowneats 5y agoYou won't be seeing 30%+ gains when they're throwing people in prison for it. Most drug users are never prosecuted. But the threat of prosecution does very little to affect the quality of their purchase, relative to what it would do to BTC market as a whole.
- WrtCdEvrydy 5y agoYeah, illegal things definitely don't end being sold above market price.
- handrous 5y agoI think this dynamic will play out very differently with something the value of which is mostly determined by current and future-expected transaction velocity & volume (to the extent that it's not sheer speculation). Now, the cost for services involving Bitcoin, like converting it into dollars, would probably shoot way up. Outlawing Bitcoin (or cryptocurrency generally) would cause a huge demand reduction. Some coins might adjust supply to compensate, but total crypto "market cap" would surely plummet.
- JumpCrisscross 5y agoCurious if this will result in extraterritorial enforcement. For example, it's clear Moscow is either unwilling or unable to prosecute cyber criminals within its border.
- ocdtrekkie 5y agoThat's one possible reading. Another is that the US will start working on their own Great Firewall, such that your packets need to be cleared by a metaphorical digital TSA to enter the country.
- handrous 5y agoSomething like SCION may be in the "Western" Internet's future, is my guess. I don't expect protection-at-edge or pervasive atop-the-current-Internet surveillance to be the solution for the OECD. https://en.wikipedia.org/wiki/SCION_(Internet_architecture) https://en.wikipedia.org/wiki/SCION_(Internet_architecture)
- AnimalMuppet 5y agoAll that takes is the adversary bringing one person within the firewall (that is, within the country).
- handrous 5y ago1) All security has weaknesses or work-arounds. That doesn't mean that all security is worthless. Forcing adversaries to take more risks and expend more effort is kind of the whole point, and that's exactly what you're talking about. 2) Are you arguing that the actual Great Firewall, a real thing we see actually working on a massive scale, does not make it much harder for foreigners to cyber-attack China? 3) See my other post on this thread—there's work toward re-designing the Internet to make evading state- or bloc-level origin control, including communicating with existing compromised nodes inside a state, remotely, way harder than it is now. I'm talking at the node-to-node routing and backbone level. It's interesting/terrifying stuff. 4) Couple 3 with some other minor and fairly obvious tweaks to how Internet access works, and even getting a foreign device with its own infinite-range radio into the target state would be reduced to step one of several to gain access to a target state's network, and that access would likely not last long if you start doing anything weird with it.
- excalibur 5y agoYou mean they're going to be poorly defined, highly subjective, and abused to further a questionable agenda?
- Semiapies 5y agoAnd most of the uses of any new legal powers will be in drug cases.
- chongli 5y agoWhat about the other side of this? Instead of seeking backdoors and using them to spy on Americans, the NSA should be stepping up their game and securing vital infrastructure and domestic businesses against these attacks.
- partiallypro 5y agoMost of these are private companies, the NSA doesn't really have a role there.
- ocdtrekkie 5y agoGenerally speaking, you'll find the federal government has a litany of agencies, on both the offensive and defensive side of... everything. There are absolutely government resources working on securing American infrastructure. And shifting from one to the other appears to be happening, to some degree: https://breakingdefense.com/2021/06/dod-budget-appears-to-cut-cyber-offense-beef-up-defenses/ https://breakingdefense.com/2021/06/dod-budget-appears-to-cu...
- graphtrader 5y agoAt this point though we need to have entire new branch of the military. Otherwise, I just don't see how we are taking this serious enough. The way the Air Force specializes in the air. It is just incredible how we are always fighting the last war. From 9/11, instead of learning we need to constantly stay on top of a shifting battlefield we learned to fight Islamic terrorism. Not good.
- LegitShady 5y agoI agree, but I also don't mind the idea of drone striking ransomware guys...
- spookthesunset 5y agoForum spammers too.... they are parasites who cost website owners tons and tons of time.
- 5y ago
- Hermel 5y agoWhat’s next? Using anti-terror laws for copyright enforcement?
- chickenpotpie 5y agoRansomware is actually a legitimate threat to the well-being and health of all people. They lock down government and health records. It a huge risk to the American people
- AnimalMuppet 5y agoSure. But laws for dealing with legitimate threats sometimes get co-opted to also deal with extraneous matters.
- ineedasername 5y agoThat doesn't mean you avoid making laws for the legitimate threats, it means you also keep tabs on how they're used. A system of laws, and a system of oversight for the use of those laws.
- AnimalMuppet 5y agoYes, keep tabs on how it's used. But also, when it's being written, try to think about how it's likely to be misused, and write it in a way that it can't be misused like that. (Amusingly, I made a typo, and misused came out mis-sued.) Legislators try to write laws broad enough that they cover everything and can't be weaseled out of, but that leads to them covering more than intended.
- ineedasername 5y agoAgreed-- lack of oversight for the legal system creates significant potential for abuse even if the laws are well written
- viro 5y ago
- stonepresto 5y agoIf the USG treats this even close to the way they treat terrorism in regards to policy and funding, I’m curious what that will look like and how nation-states harboring those people will react.
- rejectedandsad 5y agoThey absolutely should. We are in the midst of a cyberwar against criminal gangs sheltered by a kleptocracy that already attempted political sabotage against this country. All options must be on the table including physical retaliation - the threat isn’t going away.
- okareaman 5y agoI think a lot of people don't realize this, because I never see it mentioned, but when the Soviet Union dissolved we (U.S.) convinced the Ukrainians to give up their loose nuclear weapons with the promise that we would protect them going forward. I may be time to ratchet up on that promise and help the Ukrainians drive the Russians back across their border. Crimea will stay gone because it belonged to Russia to begin with (https://en.wikipedia.org/wiki/1954_transfer_of_Crimea https://en.wikipedia.org/wiki/1954_transfer_of_Crimea) There are a lot of things we could do with Ukraine to punish Russia.
- kgeist 5y agoEveryone points at Moscow as if they are behind the attacks, when, in fact, all we know is that the hackers are probably based in Russia (if treating Cyrillic keyboards specially isn't a silly false flag). They say Russia is unwilling to do anything etc. But did the FBI actually reach to their Russian counterparts for assistance? Or are they waiting for Moscow to come forward and fix all their security problems on its own? 10 years ago when mail bride order scams were popular (targeted at US/Canada/Australia), Russian police actually did catch and imprison a lot of scammers after American/Canadian requests; some of them in my own town
- ian_lotinsky 5y agoBruce Schneier, our country needs you! If you—or someone with your mindset—isn’t in authority and we get the technical equivalent of the TSA, we’re in for a world of hurt and trouble.
- JasonFruit 5y agoOf course you get the technical equivalent of the TSA. Even if you had Bruce Schneier setting it up, he won't run it in perpetuity; government in the long run descends to maximum power exercised with minimum intelligence unless prevented by the people governed.
- deleted 5y ago[deleted]
- cma 5y agoHow about a crypto-wealth tax to pay for ransomware disruptions?
- andred14 5y agothese cyberattacks are lies. i work for an essential utility and none of their control systems are on the internet. we had water, power, etc before computers so the computer part is not essential to operation.
- sharkweek 5y agoTime to bring back the chart that never dipped below yellow! [1] [1] - https://upload.wikimedia.org/wikipedia/commons/thumb/1/10/Hsas-chart_with_header.svg/1200px-Hsas-chart_with_header.svg.png https://upload.wikimedia.org/wikipedia/commons/thumb/1/10/Hs...
- chickenpotpie 5y agoI really hope this copies the principal of not negotiating with terrorists. Everytime we pay out ransomware it just encourages more ransomware.
- stonepresto 5y agoThe downward trend in bug bounty payouts and frustration from researchers might also sweeten that deal for more experienced persons.
- paxys 5y agoCompanies which fall victim to such attacks aren't normally the kind which have bug bounties or engage with security researchers.
- deleted 5y ago[deleted]
- KirillPanov 5y agoThey're running software sold by companies that do.
- grayfaced 5y agoIf they treat them as terrorists, then paying a ransom is funding terrorists. Which is how it it should be treated.
- freddie_mercury 5y ago"Not negotiating with terrorists" is mostly a myth. Everyone from the US to Israel to the UK negotiates with terrorists: https://en.wikipedia.org/wiki/Government_negotiation_with_terrorists https://en.wikipedia.org/wiki/Government_negotiation_with_te... https://foreignpolicy.com/2014/06/03/the-u-s-does-negotiate-with-terrorists/ https://foreignpolicy.com/2014/06/03/the-u-s-does-negotiate-...
- y04nn 5y agoFor me "Terrorism is, in the broadest sense, the use of intentional violence to achieve political aims", there is no political aims here, their goal is to extort as much money as they can from their victims. This is a criminal activity and any small or big companies that pay for it are feeding the monster and should be persecuted. But the US has been ignoring it for years and now it comes right back to them.
- elliekelly 5y agoThey haven’t said ransomeware is terrorism, only that they’re going to prioritize it like terrorism. As in, it will follow a similar centralized reporting process. I don’t think the goal is to start sending hackers to Guantanamo or categorize ransomware as WDMs. Not yet, at least.
- bostonsre 5y agoThe willful ignorance and non-action by states that provide a safe haven for launching these attacks seems to be potentially political to me. If the attackers are state backed, then its definitely political. If the attackers are not state backed, it seems plausible that the state has made a decision to allow the attacks to take place because sowing chaos and discord in the united states is an aim of their government.
- viraptor 5y agoIt's the international "finger in front of the face, I'm not touching you" game. But by any reasonable interpretation, yeah, it looks the lack of prosecution of ransomware groups is lacking for one reason or another.
- PicassoCTs 5y agoFinally we going to get security research paid properly and companies punished for not fixing their zero-day-sponges. Oh, its just another monstrous deterrence Three letter agency. But yeah, in a game-theory sense, its the cheapest option, to have a nuclear counter strike, instead of building all cities like underground bunkers. Security, by strike team. That would actually work, if all countries agreed on that. Or the internet is expected to break into allegiance-sized parts. The server only connects to country, who will extradite cyber-criminals and adhere to this connection contract. It was a nice dream, while it lasted.
- anti-nazi 5y agothat's a pretty big joke
- Buttons840 5y agoBefore the yacht was launched, before it was first put in the water, there was a big problem with rats entering through the large holes in the bottom of the hull. To remedy the situation, the yacht builders began feeding a large number of cats around the base of the yacht while they finished the furnishings and painted the gold trims. The rat problem was solved and the happy day of launch is near.
- failwhaleshark 5y agoThey'll just hire a million little Dutch boys with SCUBA to put their fingers where less wholy materials up to ship-building codes belongs. Problem solved!
- gerdesj 5y agowholy -> holey? Definitely not wholy. That's partly wholly. Wholly is derived from whole (all/everything/complete) and not relating to a hole. This is an adjective derived from a noun, so hole -> holey. It could be hole + ly -> holely but it isn't. Now, we have the word pinned down. How on earth do you pronounce the bloody thing? For me (en_GB): hole-ee. The dash "-" is not a pause, I would run the word hole straight into the ee sound. The ee phoneme is quite short.
- failwhaleshark 5y agoHoley'ier than thou? I kant splel. Edit: I blame running out of coffee and almost falling-asleep at the keybbbbbbbbbbbbbbbbbbndfjhkngbc
- pkulak 5y agoThat is really great, haha. What's it from?
- paxys 5y agoSo we are going to launch a trillion dollar war on ransomware which inevitably leads to more ransomware before patting ourselves on the back and saying "mission accomplished"? Are we also going to make ordinary citizens take off their shoes and get probed before using their computer?
- jessaustin 5y agoMan, you're not supposed to take the authoritarians literally!
- freeflight 5y agoIf the war on terror is anything to go by, then that would indeed be the most likely outcome [0]. [0] https://ourworldindata.org/grapher/fatalities-from-terrorism?tab=chart&time=earliest..2017&country=~OWID_WRL https://ourworldindata.org/grapher/fatalities-from-terrorism...
- duxup 5y agoFood supply, fuel, utilities. I get it, this is serious stuff.
- chapium 5y agoHospitals are routinely hit by ransomware too.
- hfjfirkrkrj 5y agoI remember reading many years ago that US gov said it reserves the right to physically go after cyber attackers, ie: kill the hackers behind the hack. What's the current official policy, is this still on the table (probably only for massive attacks)?
- nosmokewhereiam 5y ago"Bombs for bits"
- wearywanderer 5y agoMy heart goes out to the people of Iraq, who apparently are once again going to get bombed for no good reason.
- coolspot 5y agoHere is the proof (shakes an USB flash drive) that they are hiding malware of mass destruction in there and we shall invade!
- ctdonath 5y agoUS Constitution empowers Congress to issue "Letters of Marque and Reprisal" - to wit grant permission for private entities (people, companies) to wage war on other private entities. Enacted to help shipping companies deal with pirates, applies today for the likes of ransomware perpetrators.
- mannerheim 5y agoSeems like a reasonable solution - if Russia won't arrest Russians who extort Americans, why should America arrest Americans who extort Russians?
- Igelau 5y agoLetters of Marque! I like this way option way better than that other commentator who wanted to start a nuclear war.
- ping_pong 5y agoThey fucked up by targeting infrastructure. If they stuck with small companies they could keep doing it till the cows came home. But now they have governments against them so now they will be hunted down.
- paxys 5y agoThese groups aren't really "targeting" anyone. These ransomware attacks are as sophisticated as nigerian prince emails. Send out a lot of spam, wait for someone who clicks on it and is running outdated software and boom. Sooner or later you will encrypt something important enough to pay for.
- throwaway492338 5y agoI've seen a lot of recent articles on the subject that claim it's moving in the targeted direction, here's an example: Over the past few years, threat actors have shifted to much more targeted attacks that net higher Bitcoin payment returns for their efforts. https://blog.cloudflare.com/targeted-ransomware-attack/ https://blog.cloudflare.com/targeted-ransomware-attack/ Edit: Commonly mentioned in the same breath: - the move from just demanding a ransom for the key, to threatening publication of sensitive info - trawling through the data to look for anything especially sensitive, as well as clues to what number to ask for in financial records
- nuker 5y ago> Send out a lot of spam, wait for someone who clicks on it and is running outdated software and boom. outdated Windows software
- TwoBit 5y agoAnd not by targeting hospitals?
- markhahn 5y agoThere's a huge difference: ransomware "attacks" are due to sloppy security by the victim. That's not the case for terrorism.
- mullingitover 5y agoEhh, you can have reasonable security and still be a terrorism victim, you can have reasonable security and still be a crypto-ransomware victim. This is like tut-tutting arson victims for using wood in the construction of their buildings. I'm okay with encouraging reasonable levels of security while also making life horrifically miserable for people engaged in criminal enterprises that attack those victims.
- coliveira 5y agoSo let's look at the chain of events: companies start to become monopolies, make billions of dollars that way. They become "too big too fail", important "infrastructure" for the US. Then, start to expose their user's data on public networks, and don't follow proper security procedures. Now, the public has to pay for the government to secure the magacorp networks! It's a non-stop scam, where they fail their (already small) responsibilities and use public funds to increase their monopolies!
- A4ET8a8uTh0 5y agoIt is good, but it still does not beat JIT. First MBAs various JIT acolytes did everything to make sure there is nothing on hand or manufactured in US just in case it ate into the profits and then when the 'everything shortage' happened, they had the balls to run to the government asking for bailou.. sorry.. incentives to move manufacturing to US. It is fascinating to watch, because it is done with a very straight face and expensive lawyers.
- coliveira 5y agoIt is all another chapter of the US war against its own people. All the money is going to scammers, I mean, mega corps.
- xibalba 5y agoThe Colonial Pipeline is a monopoly? It appears to be a joint venture between at least 5 energy companies. Or to what monopoly are you referring? There is not mention of any other companies in this article. When hackers start to interfere with American food and energy supply chains, it rises to the level of national security, IMHO. With all due respect, it seems like you might be jamming this story into a pre-chosen narrative.
- ginja 5y agoI too dislike megacorps, but you could say the same thing about a business being robbed - they most likely could have done something to prevent it but police will still respond and not charge them for it.
- fartcannon 5y agoIf I wanted to make encryption illegal, and I ran a 3 letter agency, how could I get my population to support me?
- rawtxapp 5y agoIf encryption was illegal, all these corporate secrets would be even more out in the open, not sure how that's better.
- sebyx07 5y ago... Just don't allow users run stuff as administrator... If 0days are found by nsa they should report it and fix it, not exploited
- maniatico 5y agoWonder if this also means that at some point there are going to be kinetic responses
- mikewarot 5y agoLet's look at the chain of events. Computing machinery becomes exponentially cheaper, and it gets pushed into all corners of industry. Shared computing becomes a thing, and the need to have a better model of security is realized as a lesson from Viet Nam, and the Capability Based Security model is born. Microprocessors again exponentially decrease the cost of computing, and Capability Based Security isn't required because all of the installations tend to have one or a handful of users. The internet is born, and the cost of networking becomes exponentially cheaper, now all of those low security end users are connected together. Systems become more powerful with the continuing drop in the cost of processor, memory and storage, so they become more complex. Nobody writes their own software any more, almost all coding is outsourced in some fashion. Security is only a concern if it trickles back to the original source as a problem. A culture of "move fast and break things" pervades Silicon Valley, and the internet, and thus newer is always seen as better. The lack of a security model at the base of all these systems is exploited for financial gain. Band-aid layers are added to try to patch the obviously inferior operating systems that pervade the land. Because the lessons of capability based security were ignored for decades, and not taught, the common consensus is that computers can never be made secure, and your best hope is to hire the smartest people in the world, at less than the average market rate, to secure your systems. And we repeatedly blame criminals, corporations, programmers, users, and now other countries, instead of solving the problem by properly implementing security.
- cyrrus 5y agoAs someone who isn’t a security expert, If you had a magic wand, what does this future look like to you? What is properly implemented security?
- Karrot_Kream 5y ago> Because the lessons of capability based security were ignored for decades, and not taught, the common consensus is that computers can never be made secure, and your best hope is to hire the smartest people in the world, at less than the average market rate, to secure your systems. I presume the OP is a fan of capability-security and while I'm not an expert on capabilities, I agree they can go a _long_ way to mitigating risk. Unfortunately, none of the mainstream OSs even offer a smidge of a way of actually working with capabilities. Google's recently laughed Fuschia _does_ support capabilities out of the box, but they have a long way to go before they're regarded as mainstream.
- rsj_hn 5y agoThe title is a bit misleading. It is the U.S. Department of Justice that is promising to give the prosecution of these hacks a similar priority to terrorism. Not the entire United States government. Please keep this in mind before speculating about military actions or SEC regulation or new lays being passed or the intelligence community getting involved. This is about DoJ priorities.
- owenmarshall 5y ago“Relax, it’s only the Department of Justice” is not exactly reassuring. USAs have a 99+% conviction rate for a reason.
- Semiapies 5y agoYes, just DOJ. So not drone strikes, but undercover FBI agents spending months trying to cajole and harass coders into writing ransomware so that they can bust them.
- hayst4ck 5y agoEvery business owner is either ignorant (default), has made the wilful calculation that risk < cost, or is so busy barely surviving that things like security are not high priority enough to get attention. Security is fundamentally a resource attribution problem. Overspending on security results in high opportunity cost. Under-spending on security results in high risk in terms of trust and money, as well as poor national security. A valley company that takes security seriously will: Hire experts. Scope attack surface/risks. Implement direct mitigations. Implement policy. Implement defense in depth. Develop a system capable of discovering indicators of compromise (IOC's). Verify security via bug bounty and pen testing, both internal and external. Clearly most of these things are not "features" and therefore are a cost. Furthermore, since every company must impeliment these, the cost of security for society at large is an O(N) problem. We must set up a system that mitigates the unpayable O(N) cost of security. Pen testing/Bug Bounty/verification is probably the most easily scalable problem to solve. Whether you unleash hackers on companies by indemnifying them or specifically pay for Project Zero like entities or turn our own nation-state attackers against US companies with the weight of the US government behind it, it seems quite feasible to create scaled cybersecurity monitoring which can then better inform both technical solutions and policy solutions. Once companies know they have poor security and once a business can see being breached as a certainty rather than a potential risk, I think the free market can probably solve the problem.
- ExcavateGrandMa 5y agoI'm gonna throw the truth to ya big entertaining crew :Ð get skilled... FIRST... before assuming you are a service :Ð damn nab crying... => again :Ð
- blast 5y agoI'm surprised at how dismissive the comments are. We need many angles of defense against these criminals. Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise. That's silly. We need preventative care and treatment. I'm not surprised by this announcement because the way that the pipeline-company ransomware hackers beat a hasty retreat was noticeably unusual, and already seemed to telegraph that the state was getting involved more...actively. Good.
- ncr100 5y agoWell put. It is an absurd argument up to the point of "reasonableness" that it's the responsibility of the company to defend against 100% of theoretical security vulnerabilities, in my opinion. There will always be a vulnerability, unless some truly secure-by-design technology exists .. airgap, not vulnerable to social engineering .. ?
- tracerbulletx 5y agoAgreed. I'm a bit tired of the victim blaming with security. It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Crime is a social problem, we can't rely on a dream world of mathematically perfect zero trust security.
- Barrin92 5y agonope but we also demand some due diligence from private entities. When you leave the garage, the windows and the front door open with a "here's the money" sign pointing at your safe you might have a problem if someone steals your customers stuff. Company private security and protection against these attacks is more than abysmal. Just take the pipeline hack as an example. There should be no way at all that infrastructure critical to the nations security is getting shut down because of a corporate hack. If the private sector wants to earn profit from these things they need to show they're competent enough to handle it.
- tracerbulletx 5y ago
- bigbillheck 5y agoWhat, in that they're going to entrap kids into thinking they're doing it?
- sebmellen 5y agoNo, we’re going to surreptitiously fund it and then spend billions of dollars fighting a war against it (while continuing to secretly fund it).
- throwaway0a5e 5y agoOr maybe they're going to grant themselves more power to violate our rights then invade some 3rd world countries.
- ixacto 5y ago“Colonial Pipeline decided to pay the hackers who invaded their systems nearly $5 million to regain access, the company said.” That is the problem right there. Someone just made 5MM tax free. Time to make paying ransomware illegal and that will stop the potential criminal market for ransomware attacks apart from political motivations.
- deleted 5y ago[deleted]
- rodneyg_ 5y agoIf it was illegal to pay the hackers back, and the Colonial Pipeline ransomware attack still happened, what would the options be? We'd have to turn the systems back on some way right?
- N00bN00b 5y agoRestore from backup.
- grayfaced 5y agoThey'd restore from backups, which is already what they did even after paying the ransom. More importantly, would the hack have happened in first place if they knew there was no chance of being paid? Every ransom paid just funds and encourages the next hack. The social damage is deserving of a large fine (i.e. 10x the ransom).
- 5y ago
- splithalf 5y agoSo many of today’s problems result from a lack of morality. If the solution doesn’t involve Bitcoin then it involves religion. Security is impossible and digital security doubly so.
- samstave 5y agoTWENTY FUCKING ++++ YEARS LATE. Fuck these guys - cluesless morons.
- vanattab 5y agoN . .
- unnouinceput 5y agoSo, will this will be another TSA? Time will tell, but looking at recent history of what USG decided lately in past 2 decades, the score is leaning overwhelmingly to "yes".
- solutron 5y agoIf we don't get ahead of this we'll regulatory capture ourselves into oblivion and the enemy will win anyway. As long as state-sponsored-actors are indistinguishable from black-market criminals this will never escalate beyond the perpetual cat and mouse game. We simply have to be better, and we can't have oversight committees and regulatory boards managing it. Infosec is ripe for being revolutionized.
- zmmmmm 5y agoI think this is needed because the security industry seems to be well on the way to adopting paying off these people as a routine cost of business. That is going to lead to an absolute disaster if it is allowed to continue and grow. It needs to be a double edged sword though where companies are just as afraid of facilitating ransomware attacks as they would be of the consequences of facilitating terrorists. In other words, this will only work if it means company's are taking the threat more seriously, not less.
- ehsankia 5y agoLet's just hope it won't be the same kind of priority as "terrorist" was after 9/11, with useless wars, TSA and all the security theater.
- thedogeye 5y agoDoes that mean targeted assassinations?
- darwingr 5y agousing drones
- deleted 5y ago[deleted]
- thoughtstheseus 5y agoThese attacks make me question the security of critical infrastructure. Are people asleep at the wheel or is this overblown?
- dredmorbius 5y agoGiven the US response to threats and disasters including COVID-19, global warming, fascism, white nationalism, gross media manipulation, wildfire, drought, opioid crisis, the 2007-8 global financial crisis, housing bubble, Hurricane Katrina, and 9/11 attacks, just to cover the past two decades, I'd say "asleep at the wheel" is standard operating proceedure. All of those were known threats or repeat instances of similar previous threats. It's the likely threats for which there've been no earlier parallels that I'm truly terrified of.
- DudeInBasement 5y agoUndocumented Users
- deleted 5y ago[deleted]
- Igelau 5y ago> a cyber criminal group... penetrated a pipeline operator on the U.S. East Coast, locking its systems and demanding a ransom. The hack caused a shutdown lasting several days... I expect more precise language than this from Reuters. This makes it sound like the ransomware was responsible for shutting down the pipeline. The billing system was compromised. Colonial shut the pipeline down themselves so they wouldn't have billing inaccuracies.
- spuz 5y agoThey shut down the pipeline so that the malware wouldn't affect more critical systems. It's a myth that they did it to prevent billing inaccuracies.
- Animats 5y agoThis is just DOJ, so far. If ransomware gets defined as terrorism for the US anti-terrorism community, it could become very dangerous to be in the ransomware business. The US has a huge anti-terrorism operation in being, and it's not that busy. Islamic terrorism against the US has been confined to minor local nuts since the US wiped out Bin Laden. And, before that, being "#2 in Al Queda" meant having a rather short life expectancy. Now, all those people in northern Virginia and southern Maryland may be getting new targets.
- koheripbal 5y agoI don't really see how this designation helps stop hackers based in Russia, China, Iran, North Korea, etc...
- Siira 5y agoThe same way it did with Afghanistan, presumably?
- notsureaboutpg 5y agoIslamic terrorism was confined to minor nuts before 9/11. Some of those minor nuts hijacked a few planes and the US paid trillions of dollars to lose to some more minor nuts in the hinterlands of Afghanistan after 20 years of war. You think terrorism was a huge operation but it never was. The US made it seem huge to deceive the world, erode human rights, fight needless wars, kill millions of civilians, assert dominance, and waste our money.
- kiadimoondi 5y agoWould a nationalized bug bounty program help here? Along with some compliance enforcement that the bounty is actually addressed, fulfilled, and payed by the vulnerable entity or the government (funded through some form of corporate tax). I haven't really thought out the details, but likely some kind of practical and effective threshold exists where a business entity in the US enters into mandatory participation. Genuinely curious, would love to see others' thoughts.
- KirillPanov 5y ago> Would a nationalized bug bounty program help here? A nationalized ransomware team would. I'm serious. Just like how NSA said "we can't beat em so we'll join em" and started buying zero-days with both fists. If, back in the 1990s, you tried telling people this would happen you would get shouted down by everyone in the room. But it did happen. If you get owned by Team Fed you get a phone number. You call the phone number, get informed that you got hacked, and get the decryption key immediately. The ransom is added to your company's next annual tax filing. Ransom levels are slowly jacked up until morale^H^H^H security improves.
- zzbzq 5y agoInsiders can then defraud it without harming their own company much. Find bug, tell your "friend", friend reports it, money comes from communal pool.
- threshold 5y agoI think this is right on point. We need to protect critical infrastructure before these yahoos miscalculate and cause a tragedy.
- easton 5y agoI wonder how many of these would be stopped by getting rid of SMB file shares. Not that that is really an option, of course, but things like OneDrive and Google Drive scan for malware during upload and often don't sync a file (especially a shared file) to a user's device until they specifically click on it. Seems like it would make it a lot harder to move around if you were malware. (You can't do this if you want on-prem Active Directory or a good open-source cross-platform file sharing service like Samba, which means 90% of companies can't do this. And there are of course actual security things you can do [like blocking hard mapping of network drives in Windows] instead of the cowards way out I speak of.)
- Aeolun 5y agoThe, dare I say it? War-against-ransomware.
- myrandomcomment 5y ago1. Make ransom illegal to pay. 2. Fine the hell out of any company that has not kept up with best practice in security. Require the board and exec staff to resign without payouts. 3. Make minimum jail time for ransomware hackers 100 years. 4. Make any hack that can be attributed to a loss of life (like shutting down a hospital) a death penalty offense. 5. State actors get economic death penalty - no US company or company that does business with a US company is allowed to do business (banking, etc.) with the state actor for 1 year for each offense. 6. Authorize NSA to retaliate in kind vs state actors. At the height of the Roman Empire a citizen could walk the length of it without fear, because if they where attacked and killed the legion would burn the city / village to the ground that was responsible. We had the Cold War and not a Hot War because of mutually assured destruction. I fail to see a reason not to bring that balance to hacking by state actors. Bla, bla, I am a bad person. No, I am suggesting a reasonable measurable set of steps that force the companies to do better while imposing great risk to the criminals and state actors.
- drcode 5y agoNot the minimum jail sentences: The government will then just keep watering down the definition of "ransomware hacker" until all of us are technically eligible for 100 years of prison because of that one time we used an incognito tab to circumvent the NYT subscription nagware.
- myrandomcomment 5y agoThere are a ton of different types of murder charges. This can be codified to be safe.
- myrandomcomment 5y agoAlso… https://www.npr.org/2021/06/03/1002881337/officer-who-sold-police-computer-data-gets-a-pass-from-the-supreme-court https://www.npr.org/2021/06/03/1002881337/officer-who-sold-p...
- rho4 5y agoFinally. State protects me from being murdered on the street. I expect the same for being bankrupted on the net.
- hoppyhoppy2 5y agoRelated: "White House Warns Companies to Act Now on Ransomware Defenses" https://www.nytimes.com/2021/06/03/us/politics/ransomware-cybersecurity-infrastructure.html https://www.nytimes.com/2021/06/03/us/politics/ransomware-cy... or https://web.archive.org/web/https://www.nytimes.com/2021/06/03/us/politics/ransomware-cybersecurity-infrastructure.html https://web.archive.org/web/https://www.nytimes.com/2021/06/...
- wilco4 5y agoAs someone who has mainly done web apps and desktop development for near a decade, I am interested in maybe a career in cyber security. Any tips or ideas?
- dredmorbius 5y agoYou might try submitting that as an "Ask HN". There are a number of cybersecurity folk here (tptacek, nickpsecurity, etc.) And a few earlier threads: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=career%20in%20security&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- th0ma5 5y agoI find it wild that the "run government like a business" crowd now wants government to run business. No one in this thread is really discussing what, if anything, the government can really do. Meanwhile, business is more than happy to be a toddler wielding a gun of computer security literacy, or to take the money of such companies and not truly helping.
- refulgentis 5y agoAs others are pointing out it various ways in this thread, to put it bluntly, this viewpoint treats it as a 100% computer science theoretical question, there are many many angles to making this more painful, even just via signalling. Ex. the pipeline hackers backing off and creating a code of conduct for themselves, then disappearing altogether
- th0ma5 5y agoWTF does computer science have to do with training people not to be phished?
- young_unixer 5y agoThere's no good reason for hacking to be illegal.
- Taylor_OD 5y agoDoes that mean I'm going to have to take my shoes off to go into Bestbuy now?
- 2Gkashmiri 5y agouh... next time when the US targets Iran for example with stuxnet, will that mean they will call themselves terrorists now.... great. i didn't know that
- Ekaros 5y agoIsn't that by definition terrorism? It's unlawful use of violence in pursuit of political aims. I think we should punish the responsible...
- nowaysafe 5y agoThe government should regulate software the same as car seats. If you produce a faulty product you should be subject to common neglance(USA) laws.
- csense 5y agoResponse to terrorist attack from Afghanistan: Invade Afghanistan. Response to terrorist-equivalent cyberattack from Russia: Invade Russia? I hope not. I don't want World War 3 to be in my lifetime.
- aronswartz 5y agohttps://www.youtube.com/watch?v=dQw4w9WgXcQ https://www.youtube.com/watch?v=dQw4w9WgXcQ
- z0ltan 5y agoComing from the greatest terrorist state to have ever existed, that's funny.
- valprop1 5y agoThis article reminds me about another published by The Harvard Gazette, Government can't keep up with the technology. The article argues that big techs are keeping larger and larger for government to keep up with the pace. In case of ransomeware, government and the Supreme Court are trying to keep up but in my opinion, it will be long before government and bureaucracy could address the problem. Same happened in case of Bitcoin. Sure now everyone wants regulations around Cryptocurrency but it seems governments are investing in lost causes of catching up with these growing uncertainties. I don't mean that government shouldn't be engaging in these talks and try to regulate these markets, my only concern is the pace of these two entities. Instead of using the same old frameworks of regulations and same old mentalities, unorthodox approaches can better address these issues. P.S Link to The Harvard Gazette article: https://news.harvard.edu/gazette/story/2019/02/government-cant-keep-up-with-technologys-growth/ https://news.harvard.edu/gazette/story/2019/02/government-ca...
- fangorn 5y agoAll this talk about software (in)security within companies reminds me of a typical conclusion after a data leak. When it's a large company, the conclusion is they may, and should, have done better, but it's inherently impossible for a large company to secure everything well enough. When it's a small company, the conclusion is they should have done better, but it's inherently impossible for a small company to, well, do better, they are too small. Now, I'm all for treating ransomware, and generally all the large scale and/or state-sponsored hacks with a much higher priority, send the drones and whatnot. But this MUST be accompanied by more accountability on the commercial entities. You're too small to secure sensitive data of hundreds of millions of people? Maybe you shouldn't have amassed this data in the first place. You're too big to secure everything? Well, did you secure ANYTHING? Did you follow reasonable procedures, did you, crazy idea, make sure you can't access critical systems from the internet and/or with a default password, etc.? And if you fail, and fail you will, there's no perfect system, I believe there should be penalties not for failing, but for not doing enough to prevent it. To refer to all the plane analogies, if your wings are made of cardboard and everybody knew but pretended it's OK, because otherwise it would slightly diminish shareholder value, well, there will be consequences. In aviation, you could go to jail for signing off on something that you know is not secure, if it causes an accident and people die. Specifically not for accidents, but for neglecting your duty to make sure that you've done all you could. For lying, deceiving, ignoring, faking, for being too lazy or too greedy to do things properly. Sounds familiar? With large scale infrastructure under constant attacks, people dying because someone couldn't be bothered to do things properly is not an "if" any more. And better hope those autonomous trucks are very, very hard to hack.
- shp0ngle 5y agoJust ban cryptocurrencies.
- Jolter 5y agoAnd to think all it took was to attack the oil industry.
- nathias 5y agodoes this mean suspects of hacking and ransomware will now join suspected terrorists in Guantanamo?
- MeinBlutIstBlau 5y agoThe free market needs to start punishing these companies reputation wise for not paying for backups. If you can't afford that, why should I have faith your IT department is even competent? This is data hoarder 101.
- btbuildem 5y ago> penetrated the pipeline operator on the U.S. East Coast, locking its systems and demanding a ransom. The hack caused a shutdown lasting several days This rings a little disingenuous, since (IIRC) the shutdown wasn't caused by the hack, the interruption of service was a deliberate choice by Colonial because (in brief) they wouldn't be able to charge their customers until they got their accounting systems working again. The company, providing arguably an essential service, chose to stop the flow instead of estimating / approximating / using past averages to bill their customers. They likely lost much more revenue this way. Do correct me if I got this story wrong.
- stewx 5y agoThe government should make it a criminal offence to pay a ransom to hackers. Just as with kidnappings, when you pay ransoms, you reward the criminals.
- xvector 5y agoThe government should also cover any damages, then, for failing to protect its citizens, if it will prevent them from remedying the situation themselves.
- snowflake_ptr 5y agoGiven the borderline compliance with JPMorgan Chase that the DoJ engaged in[1], I'm not hopeful that this is going to go anywhere. [1] https://www.rollingstone.com/politics/politics-news/the-9-billion-witness-meet-jpmorgan-chases-worst-nightmare-242414/ https://www.rollingstone.com/politics/politics-news/the-9-bi...
- patrick451 5y agoThis headline absolutely terrifies me. The federal government has been pushing to ban different encryption standards for years, or at least require a governmental backdoor. If we get a 9/11 size cyber attack, they will ruthlessly weaponize it, and whatever semblance of internet privacy we had will be gone.