14 ms·

I'm surprised at how dismissive the comments are. We need many angles of defense against these criminals. Dismissing this because companies should do better sec

by blast 5y ago

I'm surprised at how dismissive the comments are. We need many angles of defense against these criminals. Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise. That's silly. We need preventative care and treatment. I'm not surprised by this announcement because the way that the pipeline-company ransomware hackers beat a hasty retreat was noticeably unusual, and already seemed to telegraph that the state was getting involved more...actively. Good.

ncr100 5y ago
Well put. It is an absurd argument up to the point of "reasonableness" that it's the responsibility of the company to defend against 100% of theoretical security vulnerabilities, in my opinion. There will always be a vulnerability, unless some truly secure-by-design technology exists .. airgap, not vulnerable to social engineering .. ?
tracerbulletx 5y ago
Agreed. I'm a bit tired of the victim blaming with security. It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Crime is a social problem, we can't rely on a dream world of mathematically perfect zero trust security.
- Barrin92 5y ago
  nope but we also demand some due diligence from private entities. When you leave the garage, the windows and the front door open with a "here's the money" sign pointing at your safe you might have a problem if someone steals your customers stuff. Company private security and protection against these attacks is more than abysmal. Just take the pipeline hack as an example. There should be no way at all that infrastructure critical to the nations security is getting shut down because of a corporate hack. If the private sector wants to earn profit from these things they need to show they're competent enough to handle it.
  - tracerbulletx 5y ago
    That's fair. I'm sure there is a happy middle that can be found.
  - jliptzin 5y ago
    I don’t think that’s a fair comparison. I think a fair comparison would be 80,000 companies buy the same vault door from supplier X. But suddenly one criminal group has found a universal key to the vault that no one else knows about, and can now access all 80,000 vaults nearly simultaneously and clandestinely even though they still look closed and secure from outside observers.
    - Sebb767 5y ago
      ... but this was 5 years ago and everyone and their dog knows it by now, the company just didn't bother to change that door. Also, the criminal group doesn't hit doors with cameras, but nobody bothered to install one. --- What you described is a zero day, which is very rarely used - most ransomware simply uses the absolutely low hanging fruit of companies lagging behind years in security updates combined with highly insufficient backups.
      - beermonster 5y ago
        Companies generally do not have a sufficient tested backup strategy and plan (though backups have only one part to play). Those same companies have probably never suffered any major consequences as a result - which might explain why it’s so usual for this to be a common gap. Sloppy/incomplete backups can probably wing/firefight the more common ‘single server dies’ ‘single directory needs recovering from accidental deletion on file server’ ‘need to restore database following botched upgrade’ type scenarios creating a false sense of security. In the same way companies do not have sufficient HA for their critical systems or processes. HA means being actively resistant to events impacting availability by having (typically automated) redundancy to remove SPoFs. It doesn’t mean HA owing to luck the server hasn’t died in 10 years owing to lack of/poor maintenance. But both with HA and backups companies can dodge bullets (until a real emergency) and maybe never even have a major incident. Ransomware kind of exploits this lack of organisation level sufficient backing up of all critical information assets. It really is as you say, low hanging fruit.
- andreilys 5y ago
  If you leave your houses front door open and a giant sign that says "please come rob me" then yes you deserve some of the blame. That's the case with a lot of these companies who: a) Have pitiful/non-existent bug bounty programs (or even worst, prosecutes white hat hackers who raise issues) b) Prioritizing exec bonuses instead of investing in InfoSec
  - nkozyra 5y ago
    > If you leave your houses front door open and a giant sign that says "please come rob me" Sure, but as much as we might roll our eyes at the state of corporate security, this is a disingenuous metaphor. It's neglect and incompetence. It's repeatedly forgetting to lock the door even after every neighbor has been robbed.
  - ourmandave 5y ago
    I'll take Blaming the Victim for $200 Alex. (AKA: The "What was she wearing?" defense.)
- hpoe 5y ago
  You have a point, but I also can expect a minimum level of competance and caring about the data you have stewardship over. Sure, given enough time and motivation anyone can probably break into anything, but that isn't an excuse to let the password for the FTP server that pushes out updates be 'password123'. Here's the problem companies have absolutely no incentive to care about Security. Several years back some hackers stole a bunch of my information from Experian. You know what I got out of it, a free $10 subscription to their identity service, along with lifelong worry of wondering if someone has opened an account in my name and racked up a ton of debt that I'll be held responsible for. You know what Experian got, nothing, a slap on the wrist and now their stock is in the same place it was before. I am doing my Masters in Information Assurance and Cybersecurity right now, and the whole mindset of all of my classes is "you're going to be pwned eventually so figure out how to move the risk to some other poor sucker to take the blame when it happens." pisses me off so much. The entire industry basically uses this as an excuse to avoid responsibility and just make sure they aren't the ones held responsible when the manure hits the rotary oscillator, and that bugs me to no end. At the end of the day there are real people who are getting screwed and hurt by this, while the execs and security "consultants" spend their time trying to figure out how to make sure that when sh* hits the fan they can't be sued, and d** the customer and their well-being we've got to figure out how to make sure we keep the law away. EDIT: Clarity and formatting
  - andreilys 5y ago
    The concept of Moral Hazard is important here, which basically states that there is a lack of incentive to guard against risk where one is protected from its consequences. In a lot of cases the execs of these companies will continue to collect a large bonus, despite the fact that they utterly failed their customers.
    - hellbannedguy 5y ago
      Tieing the CEO pay to attacks should be as common as Poison pills, Golden Parachutes, and Stock incentives. Backups, and strict security, might be important? Put security right up their as important as their rediculious salaries.
- joe_the_user 5y ago
  I'm a bit tired of the victim blaming with security. The victims of these breaches are the end users. Companies are the beneficiaries of not having to pay for and especially not having to inconvenience themselves with much more secure systems. That said, it's true you can't ask for 100% security. You can instead set standards. You can especially set standards of security for any enterprise that the public dependents on. Since, there are no coherent standards now, just liability isn't useful. And the standards should involve actual topology, what kinds of information is allowed in and out at all.
  - xupybd 5y ago
    You have to enforce standards. Good security is expensive. If companies in competition don't have to pay for good security those that do have it will have higher costs and have trouble competing.
    - fsckboy 5y ago
      > "running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing" running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing
      - deleted 5y ago
        [deleted]
      - toomuchtodo 5y ago
        Texas? Winterization that wasn’t done and wasn’t required, and thereby those generators who didn’t had a more competitive edge? The similarities write themselves.
        xupybd 5y ago
        Thanks, that explains it.
- dylan604 5y ago
  It's not any different than the war on drugs. The gov't can't really think in a different manner than just black and white. The world is made up of shades of gray, and it's just too difficult to create legislation to handle shades of gray.
  - deleted 5y ago
    [deleted]
- User23 5y ago
  > It's physically impossible to build a house that can't be broken in to Obviously you're correct because impossible is a tall order, but it's possible to get close assuming the aspiring intruders don't have dynamite or artillery[1]. [1] https://en.wikipedia.org/wiki/Bastle_house https://en.wikipedia.org/wiki/Bastle_house
- SilverRed 5y ago
  > and even harder for computer systems Things are actually getting better in some ways. Modern OSs with automatic updates are more secure than OSs have ever been. The days where clicking a link on an email or plugging in a USB could infect your computer are almost gone outside of rare zerodays which get patched for everyone pretty quick. Things are getting even better with hypervisors, SELinux and secure languages rolling in. Significant portions of Android and in the future linux, will and are being rewritten in rust which wipes out entire classes of the worst bugs we are being faced with. The problem is that the attackers are also getting more sophisticated and the targets are becoming more valuable with more and more getting put online.
  - jtsiskin 5y ago
    Yes, but then you read things like https://googleprojectzero.blogspot.com/2021/01/introducing-in-wild-series.html https://googleprojectzero.blogspot.com/2021/01/introducing-i..., or look at the payments offered by https://zerodium.com/program.html… https://zerodium.com/program.html… the days of clicking a link -> persistence payload with escalated privileges are still here
    - SilverRed 5y ago
      From what I see on that page. It costs $500,000 to exploit chrome and your attack only lasts for a few days and then google pushes out a fix to all chrome users. This is so much better than the IE era where a teenager with some free time and skill could make something up and there would still be exploitable machines years later for the same bug.
      - beermonster 5y ago
        And yet have you seen how many zero day, patch now, actively explored in wild vulnerabilities there have been in Chrome just this year? It doesn’t feel like even Google are winning
- harikb 5y ago
  We have to think of this similar to how any other human or company behavior is monitored. Hold companies responsible and have a market sell ransomware insurance. (One exception to my solution is poor government and public institutions who run awful software. Not sure what we can do) If I have a habit of burning down my house by being sloppy with safety, my rates will go up. There should be something similar Let us take the case with Equifax mismanaging their servers, with running obsolete Java packages resulting in identity theft for millions of Americans. Credit score is controlled by 3 companies. Credit score determines mortgage rate and hence it literally controls if a US resident can afford to buy a house or get a job (in some states). Don’t the companies need to take some responsibility? Similarly dozens of companies leaving Elastic search installs and MySQL open to the internet. I mean.. how sloppy can one get? Fine, be sloppy, just pay $$$$$ to your insurance company. That $$ amount will indirectly decide whether we go to war with Russia or pay software engineers.
  - wellthisisgreat 5y ago
    > That $$ amount will indirectly decide whether we go to war with Russia or pay software engineers. Not related to the subject, but wow I wonder how alarming it is that "war with Russia" meme is having a strong comeback, as it's being casually brought up in online discussions about software.
    - harikb 5y ago
      I was being sarcastic in this instance. Meant to say there is more to do within software before blaming “user”/“hacker”. Russia reference is only based on recent news/claims
    - rejectedandsad 5y ago
      If that's what it takes to defend our sovereignty, it's what it takes. They elected one of ours, we can unelect one of theirs.
- hunter2_ 5y ago
  Oddly enough though, the analogy tends to diverge when scaled: the more material you put into your house, the less vulnerable it is; the more lines of code you put into your software, the more vulnerable it is. Taken to an extreme, anyone can take down a house made of straw with their fist, but nobody can exploit hello world. I despise seeing simple apps with ridiculous dependency trees (package.json with line counts in the 5-6 figures, for example) and other complexity that can't possibly be fully understood by whoever's responsible for operating it. But I suppose things would be in even worse shape if we reinvented the wheel instead of using well-known libraries and so forth.
  - mewpmewp2 5y ago
    Surely you mean lock files not package jsons?
    - hunter2_ 5y ago
      Oops, that's the big one. Maybe it's fine for that to be inhumanely large, as merely an artifact? Bad example then, but the point stands.
      - ehnto 5y ago
        Well the package.json only specifies the top level dependencies not all of the dependencies in the tree. So the .lock is probably a better representation of the actual dependency tree. It's not uncommon to include one library and get an extra 10, 20+ dependencies you don't even know about unless you care enough to check.
    - motoxpro 5y ago
      Haha I would hope so. A 5-6 figure package.json would be insane!
  - tluyben2 5y ago
    If you do not audit and are not willing, in case of emergency, to take over support of your dependencies, you are creating a mine field. Most people do not understand what this even means though. Solid libraries are boring and done: old, stable and active bug fix support. Not new features weekly. Java or .net vs the js ecosystem. In our client contracts we have responsibility for our deliveries; in .net and Java we use well supported libs of over a decade old which we can support ourselves if the maintainers quit. With js this is an issue. Things are generally just not set up for decades of runtime and yet, there we are: we now have node js projects of almost 10 years old with many libs we have to audit and support ourselves and they are not very good quality. I think modern web is only just seeing the tip of the iceberg security wise. It will get much worse.
- tw04 5y ago
  > It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Which is exactly why you don’t store your savings in your sock drawer, you put it in the bank. Companies not taking appropriate backups is akin to keeping all of your money in a dish by the front door. Sure your house may never get broken into but nobody is going to have sympathy for you if it does.
  - benjohnson 5y ago
    Backups are no longer sufficient - as the hackers now threaten to disclose stolen data to the public.
    - tw04 5y ago
      Which only works because they’re paying the ransom. The second the government introduces criminal penalties against the executives and boards for paying ransom, it will stop.
      - onion2k 5y ago
        Which only works because they’re paying the ransom. The second the government introduces criminal penalties against the executives and boards for paying ransom, it will stop. Making it a criminal offence to pay a ransom would eventually stop criminals ransoming the data they take to the company they took it from, but it wouldn't stop attacks and data breaches if there's some other way to profit. For example, attackers could sell the databases they steal. Or they could ransom individual's data directly to the individual. Or they short the stock of the company and then release the stolen database publicly to make the share price fall. It's important not to over-simplify the problem. There is no single, simple solution as long as there are many ways to profit from data thefts.
        tw04 5y ago
        >Or they could ransom individual's data directly to the individual. Or they short the stock of the company and then release the stolen database publicly to make the share price fall. You're listing a bunch of things that are almost assuredly already happening. If a company was dumb enough to keep social security numbers unencrypted in a database or spreadsheet, that data is going onto the dark web whether they paid a ransom or not. It's a LOT harder to find a buyer of proprietary data that will likely put the buyer in prison for a long time, than it is to get a ransom from one individual trying to keep the whole thing quiet. Once you advertise "I have Apple's top secret next gen laptop details!!" - when someone releases a strikingly similar laptop, or "leaks" the details on an Apple focused fansite, the feds will be all over them.
- kragen 5y ago
  It's surprising and disappointing to see this point of view here, particularly with so little evident dissent. Of course you can "break into" a typical computer system by gaining physical access to it, for example by breaking into the house that it's in and unscrewing the computer's case; but that's only metaphorically connected to what's going on here, which is that criminals are sending data over the internet to the computer systems in question. The software the owners previously installed on those systems then responds to that data by giving the criminals complete control over the system, as long as they care to maintain it, or unless the system is destroyed. This is dumb. Writing software that does not behave in this fashion is not only physically possible; it's actually the majority of software. Even in typical software, there is only one deployed exploitable security hole per thousand lines of code or so, and, until only about 25 years ago, it was reliably possible to recover from such an invasion by reinstalling the OS.† The best software, like seL4 or qmail, has orders of magnitude less, though we can quibble about whether the actual number is 0 bugs or 1 bug.‡ The problem is that our systems are architected so that even one exploitable bug anywhere in hundreds of millions of lines of code enables total and irreversible subversion of the system; our system complexity is growing much faster than existing code is getting audited and fixed; much of the code is not even open to auditing; and the people with the power to fix it have no incentive to do so, instead spreading pernicious misinformation claiming that usability and security are unavoidably in conflict (a concept obviously absurd to anyone who has had to use an OS without memory protection) and bulletproof security is impossible anyway. So, at any given time, there are somewhere between thousands and hundreds of thousands of exploitable vulnerabilities in our systems, any one of which is sufficient to enable the implantation of a persistent backdoor that cannot be reliably detected or removed. The solution to this has been known since the 01970s. At the systems design level, minimize the complexity of the trusted computing base (the hardware and software whose integrity every program in the system relies on) in complexity, audit it rigorously, and freeze it. At the hardware level, provide an easy incorruptible way to restore a known safe state. At the social level, ensure that the people who rely on the integrity of the computer system have the authority to audit it and fix any problems they find, and the technical competence either to do this themselves or to delegate these tasks to people who are competent to do it, rather than to charlatans. At the user-interface design level, ensure that users can understand the information they need to assess the risks they are taking in relying on any given piece of information, and decouple the system to eliminate their incentives to take risks, for example with memory protection and petnames. We know a lot more about how to achieve these things than we did 45 years ago, and in some ways we have enormously more resources. We have seL4, Bitcoin, ssh, Monte, elliptic-curve cryptography, BLAKE3, NaCl, LUKS, decades of SOUPS proceedings, RISC-V, yosys, and 16-MIPS microcontrollers§ that cost 3¢. But that future is not merely "not widely distributed"—it has become inaccessible except in isolated cases like Trezor, as economic incentives have driven our hardware and software down a path of boundlessly ballooning complexity and diminishing alternatives, while proprietary software licensing eliminates any possibility of assessing and controlling the risks. Meanwhile, the shallow pop culture of computing reduced users from creators to mere customers, and then "eyeballs", while conflating hacking—the only way out of this mess—with computer invasion. So, I fully expect that if I live long enough to need a pacemaker, I won't be allowed to secure it against ransomware, which will be rampant at that point. It doesn't have to be this way. This can all be made better. Ready? Begin. ______ † In fact, shortly before that, on most PCs you could recover from any kind of system corruption just by taking the floppy disk out, resetting the system, and inserting a new, uncorrupted floppy disk. Better hope that one's not stoned too... ‡ You might argue that the possibility that there's an undetected security bug in seL4 means that complete computer security, even against carefully crafted data sent over the internet rather than some dude running off with your cellphone while it's unlocked, is still impossible. But in fact I think there's a very real difference in kind between the possibility that I might currently have presymptomatic covid, and the certainty that I have a small amount of covid. Systems like qmail are analogous to the first case, because they might be secure or might contain an undiagnosed flaw; systems like Linux and Chrome are analogous to the second case, because they are certain to contain a small but fatal fraction of flaws, which are inexorably multiplying. § Unfortunately the whole line of Padauk microcontrollers is out of stock this week at LCSC.
- colechristensen 5y ago
  I have seen personally, heard first hand accounts, and read many a post-mortem for situations where the primary blame really should be on the "victim". There's another word for this: Negligence. Of course there are always 0days. There are always sophisticated attacks. There is always human error. Then there are people in leadership positions being given accurate information about basic security problems and possible outcomes over long periods of time flatly refusing to make security a priority or spend any time fixing dangerous situations. Many of these ransom situations aren't the result of targeted attacks, but "hey we have this exploit and ransom kit, let's scan the entire Internet and see if we get anything". Or the ever popular (ok maybe not so much any more) unsecured elasticsearch server on the public internet. I'm sorry but if you put your production data on a public IP on a standard port with zero security, it is positively your fault when your data gets stolen. (not much to do with ransom, but an example). There is a difference between being the victim of a sophisticated attack and being the victim of your own negligence (and a lot of grey area in between).
  - BrandoElFollito 5y ago
    And a lot of cases where around the table you have those who say "here is the risk that must be addressed" and then the others who say "if we do that we break production". Both are truthful and full of good will.
    - tremon 5y ago
      "Ok, that means our current business practices are a liability. Gather the process owners to see what can be done". What you're describing isn't (shouldn't be) the end of discussion. The trick is to get management to explicitly acknowledge the liabilities.
    - ClumsyPilot 5y ago
      "Here is the risk that 737 max will crash because of mcas" And then others say: " if we do that, we will have to redesign too much of the airligher" i.em break production. Youve got to have your priorities straight
- tluyben2 5y ago
  Crime needs to be dealt with but a lot of companies I worked with in the past 30 years are simply negligent. If you do not blame the victim, what is the incentive for spending money on even basic security? Not morality surely, so...
- im3w1l 5y ago
  You have a lot of replies but as far as I can see no one made this point, so let me add yet another reply. Victim blaming is a framing that makes it sound like it's about moral and ethics. But it's about practicality. There is a causal chain leading to a bad outcome and we simply break the weakest link. Sometimes it's easier to lock up the treasure and sometimes it's easier to lock up all the thieves. Consider the case of computer security. Locking up all the thieves is super duper hard, because they are located in places like Russia and China that wont cooperate with law enforcement.
  - bostik 5y ago
    > Locking up all the thieves is super duper hard, because they are located in places like Russia and China that wont cooperate with law enforcement. Oh, they do. With their local ones. Those thieves can operate with impunity as long as they don't hit their fellow countrymen.
- WalterBright 5y ago
  It's impossible to build a safe airliner, but we can get pretty damn close. Airline engineers know one cannot create a component or system that cannot fail. So the question then becomes, assume a system fails. Now how does the airplane survive? With software systems, instead of demanding a perfect defense against the root password being compromised, think "if the root password is compromised, how do we prevent that from bringing it all down?" In other words, think in terms of redundancy and isolation between systems. And the largest piece of hubris and madness in critical systems is allowing over-the-internet updates.
  - passwordqwe 5y ago
    But there is a big difference between airline safety and software safety. An airliner survives against the environment, it's PvE, a software system has to survive against hackers, it's PvP. If you shoot a rocket at an airliner, the airliner will fail, in that case we blame the person who shot the rocket.
    - jjk166 5y ago
      We design military aircraft to fly into warzones. They are very much PvP. We design them with various countermeasures to deal with rockets and ejector seats if those fail. Yeah, planes will be shot down and pilots may die despite these precautions, but skimping on the ejector seat because "hey they might die anyways" is totally unacceptable.
    - boc 5y ago
      This is a great way to frame the issue.
    - WalterBright 5y ago
      > But there is a big difference between airline safety and software safety I've worked professionally in both industries; they are not fundamentally different. Software practices can learn a lot from aviation practice, but they seem determined to spend decades rediscovering the methods the bitter, expensive way. For example, software is still stuck in the dark ages where the idea is better training / better programmers / more punishment will prevent these sorts of failures.
- perryizgr8 5y ago
  > It's physically impossible to build a house that can't be broken in to Specially if an entity with a nation's resources is trying to get in.
- mschuster91 5y ago
  > I'm a bit tired of the victim blaming with security. Why? Many of the companies who got hacked had massive IT issues of their own fault, the most common being: - full access for everything across the whole network, no subnetting with strict firewalls that limits the scope of an intrusion - outdated software/firmware stacks leading to avenues for compromise - no/ineffective/outdated virus scanners - no meaningful backup infrastructure and regular testing if said infrastructure is already working - lack of 2FA on administrative credentials - lack of monitoring on central file servers to detect if a compromised machine is encrypting the file server's contents piece by piece > It's physically impossible to build a house that can't be broken in to Indeed, but a burglary insurance will likely refuse service or jack up rates if you don't lock your door or not have an alarm system installed.
- blueblisters 5y ago
  Crime is a social problem but the US government is especially bad at fixing crime that originates from other countries. See war on drugs, terrorism, call center scams etc. On the other hand, a good team of security experts is very good at preventing computer systems from getting hacked into.
  - clarkevans 5y ago
    The problem with drug cartels does not originate from other countries. It is domestic demand, paying in dollars. Those dollars overwhelm local economies and police forces abroad.
- mcguire 5y ago
  On the other hand, we have known since the 1970s roughly how to make computer systems significantly more secure and resilient. However, we, as a society, have decided that it's costly and difficult and that we would prefer not to do anything about it. It's "move fast and break things" at the social level. I really, really hate reasoning by metaphor, but you do lock your doors, right?
th0ma5 5y ago
Usually people here want government to stay out of the way of business, or especially not to compete with business. I agree with you, but it isn't necessarily entirely a pure-business perspective.
Izkata 5y ago
> the way that the pipeline-company ransomware hackers beat a hasty retreat was noticeably unusual, and already seemed to telegraph that the state was getting involved more...actively. Uh, there was no retreat - the company paid the ransom the day after the hack. https://www.theguardian.com/technology/2021/may/19/colonial-pipeline-cyber-attack-ransom https://www.theguardian.com/technology/2021/may/19/colonial-...
- ineedasername 5y ago
  I think they meant the folks providing the ransomware as-a-service, who basically said "yeah we provide criminal services but we don't endorse their use for crimes that big, so we'll be more careful who we sell to."
2OEH8eoCRo0 5y ago
The HN crowd can sometimes have an issue with pragmatism. Sure, I'd love to live in a world where everyone follows best security practices 100% of the time, but this ain't it. Arguing how your imaginary perfect world should be gets us nowhere.
- Kalium 5y ago
  Something about security in particular brings out the puritanical streak many engineers have.
- chrisco255 5y ago
  How much of these hacks would be prevented by adoption of simple preventions like Yubikeys for login, backing up data and images regularly, and encrypting data by default?
  - Kalium 5y ago
    Sometimes simple preventative measures aren't as simple as they might sound. How would you go about integrating yubikeys for login into multi-decade-old SCADA hardware systems? I'm a security specialist and I honestly wouldn't know where to begin.
    - chrisco255 5y ago
      Is that the case with all of these hacks? How many would be prevented, is what I'm wondering? My mother's hospital was hacked this week and now they can't even clock in but they're not running SCADA
      - Kalium 5y ago
        SCADA's a good example of systems that are difficult to secure for complex reasons. There are many others. You ask a very wise question. Unfortunately, I think it's unknownable. The best we know is that the answer is more than none and less than all. The more you get towards "all" the more prevention measures cost to implement. For instance, managing a mature backup and imaging operation at scale may be conceptually simple but is both complex in practice and far from free. Hospitals in particular are the scene of some interesting conflicts between security and usability. There are a lot of stories about health staff doing things like jamming open medication dispensing machines so that they could get on with the job instead of dealing with security measures they experienced largely as obstacles. Can you imagine throwing yubikeys into a scenario like that, where people already have an adversarial relationship with IT and security measures? What do you think is going to happen when someone forgets their key and can't send an x-ray to the remote radiology center? I have my guesses.
lr4444lr 5y ago
I think this is an unfair false choice. I blame security "experts" who store private keys on public facing web servers or allow for SQL injection in the same way as I blame doctors who over-prescribed Oxycontin for way longer than was safe to avoid dependence. Sure, there will always be procedural mistakes and zero days, but gross dereliction of even basic level expertise deserves scorn.
- JBlue42 5y ago
  My anecdata is that the majority of times someone has gained access to a user's system somewhere that it has not been anything technical but purely social engineering. Whether that was a secretary at a medium-sized company or someone in medical records at a hospital. The latter case was more extreme - user received an email from the hospital's lawyer, replied saying she wasn't sure, "lawyer" emailed back to go ahead and access the website. Lawyer was the 'hacker' who had already broken into and taken over the lawyer's email. Luckily, it was phishing attack and not ransomware.
cyanydeez 5y ago
the zeitgeist the past 10 to 20 years heavily biases people to think government cant work and if it can, its too expensive, and if it does, it infringes someones right to profit at others expense.
grumple 5y ago
Would it be reasonable to demand every company hire a team of armed guards? No? So why is it reasonable to demand they each hire a cybersecurity team? It’s reasonable to tell companies to lock the doors. It’s reasonable to tell them to follow accepted best practices in tech too, but not that they be experts prepared for everything.
virtue3 5y ago
Anytime you can let a group of criminals get away with impunity it's going to run out of control until we get... the current situation. It's getting close to having China and Russia either start cooperating with us to flush these guys out, or we start having "fleet exercises" in their seas again. I think it would be prudent of said nation states to wash their hands of these folks.
crispyambulance 5y ago
> We need preventative care and treatment and everything in between. Not to mention the fact that the cybercriminals who do these attacks also get involved with state-sponsored offensives. The ransomware stuff might just be "training wheels" or resume bullet-points for something far worse in the future. If we're going to get serious about stopping the state-sponsored stuff and even bother to have the "US cyber-command" it makes sense to go after the relatively petty criminal elements as well. If they can't make a dent with these, why should we think that can go up against the FSB? Corporations can only ever view cybersecurity as yet another compliance exercise (and all the incurious checkbox tickers that entails). The smart ones will play "cops and robbers" (red-team/blue-team games) but they can't offensively go after cyber criminals. Unfortunately, that's what needs to be done to get ahead of this stuff.
demadog 5y ago
Imagine if all companies had to individually fight pirates in the heyday of pirate hood!
- andrewnicolalde 5y ago
  If I’m not mistaken, some like the British East India Company actually did!
- throwaway0a5e 5y ago
  That's exactly what happened. Ship owners invested in arming their ships to the point where the pirates would hopefully pick softer target which is exactly what they did. Incrementally over the 16th-18th centuries the profitability of piracy was highly reduced because the goods had fairly fixed relative value and the risk kept going up and it more or less went away on its own in the Western hemisphere over the course of the 18th century. Crime rarely pays at scale when every instance carries a high risk of a firefight. A few may make a good living in such an environment but it caps the maximum industry size at a very low level. Piracy persisted in the Mediterranean where it was more or less a state sponsored activity. They mostly avoided harassing the commerce of major powers (Britain, France, etc). Which worked well enough until the 2nd tier powers got pissed off enough to stomp them a few times (with the blessing of the first tier powers, think of it like a reverse Falklands). They still didn't tone it down sufficiently and they wound up speaking French for that mistake. If anyone has any good resources on the history of Indian ocean or east Asian piracy I'd be interested in reading them. As an aside, old school high seas piracy is an surprisingly good parallel to the variations of criminals in the current cyber-crime environment. You've got state sponsored theft of money and goods (privateers). You've got under the table cyber criminals who would be prosecuted by their home jurisdiction if found (traditional western pirates, the kind you typically see portrayed in pop culture). And you've got locally approved as long as they pay their dues professional cyber-criminals (north african pirates). The former groups mostly steal things of value they can use or fence. The latter mostly takes stuff hostage for ransom.
  - demadog 5y ago
    Yes, thanks for the details! The US fought them in the Barbary Wars as well - https://en.wikipedia.org/wiki/First_Barbary_War https://en.wikipedia.org/wiki/First_Barbary_War I think the statement I was hinting at was that essentially all these companies are on their own (vs pirates and hackers) until the problem is too big and dangerous and then the state steps in.
maerF0x0 5y ago
IMO the first step to fixing is to add liability. If a breach happens through a piece of software, then the vendor is liable. Same way cars get recalls. (sometimes)
- Txmm 5y ago
  Really? I don’t think this is at all similar to a car safety recall. That’s more like trying to issue a recall for a car because people can smash it’s windows and break in.
  - maerF0x0 5y ago
    yeah of course it's an analogy. But by adding liability we'll get more recalls (patches) done. Vendors will stop playing FUD and will focus on the real cost of their security flaws. And yes some will still not do patches, just like some car vendors are considered less trustworthy. But at least the risk of suit will loom over their heads.
    - tempestn 5y ago
      But the parent's point is that's still putting the liability on the vendor rather than the actual criminal. Perhaps it's more like if a car is sold without an immobilizer or an alarm, holding the manufacturer liable if it's stolen. But if that kind of fails, because it's pretty simple to mandate a handful of security additions to cars, whereas software is orders of magnitude more varied and complex. It would be hard for any vendor, let alone small companies, to prove they'd followed every conceivable best practice. Might even be impossible, as some likely conflict. And if you try to codify exactly what security practices should be followed, what do you do when those practices become obsolete?
      - maerF0x0 5y ago
        Yeah, I think it's just a fault in the analogy and in part demonstrating why reason from analogy is faulty. My point is this If vendors were liable (at least in part) for security faults in their products, then they would be more diligent about closing those gaps.
antonzabirko 5y ago
The problem is our govt money is subsidizing private company security policies instead of more directly helping people. This money should go to healthcare, infrastructure, or even be redistributed before it's used here.
- kube-system 5y ago
  We fund the police and military with our tax dollars to prevent bad actors from doing bad things that we don’t want. Why is this different?
  - deleted 5y ago
    [deleted]
- shshdueisn 5y ago
  Providing security and protecting property is one of the core functions of the state. Police protect businesses. The US Navy protects shipping lanes. I do not understand why this particular case could be so objectionable.
klyrs 5y ago
> I'm surprised at how dismissive the comments are. I've gotta ask: has the US's stance on terrorism been effective? Or did they merely use it as an excuse to militarize the police and erode human rights? Because I want the government to take effective action around ransomware, but "similar priority to terrorism" just doesn't fill me with hope.
- lupire 5y ago
  It's a bad comparison, becauSe organized "War on Terror" terrorism is extremely rare, because it's not very profitable. The news is PR fluff.
- unishark 5y ago
  The headline might be vague (though I'd personally love to see drone strikes on the scumbags that scam elderly people to of their meager savings) but the article itself talks in terms of priority and effort for investigations into malware attacks. E.g., they won't just shrug and do nothing because they care about other crimes more, like with my stolen GPS case.
  - makeworld 5y ago
    I'm astonished you would support drone strikes on civilians. Scammers are working a bad job out of necessity. They are not villains who deserve to be extrajudicially murdered.
    - deleted 5y ago
      [deleted]
    - tluyben2 5y ago
      The professional nature these scams are now (call from 'Microsoft', steal a little and then send properly dressed and documented people to the house to 'investigate the fraud' and steal more) is not desperate people scamming. Sure they do not have to be murdered, but removed from society is not a bad plan. These are pro organizations, not a handful of poor people anymore.
- 5y ago
fnord77 5y ago
same mentality as dismissing airbags in cars because "people should drive better/pay attention more"
- Thorrez 5y ago
  I don't understand. How is blast dismissing something similar to airbags? blast says >We need many angles of defense against these criminals. Whatever you're comparing airbags to would be one of the defenses that blast is saying we need.
pibechorro 5y ago
Most these hacks where done using leaked tools from the same alphabet peoples tools to fight terrorism in the first place. Horrible idea. We need companies to get their act together. Personal responsibility.
tluyben2 5y ago
> do better security is like dismissing doctors because people should get more exercise Not dismissing doctors but making fat people (or drug users etc) pay more is not that silly and happens. There need to be standards (ISO, PCI) for all companies. And if you get hacked, you get fined if you did not adhere to the standards. And yes, go after the criminals as well, but bit to easy to just ignore ancient Windows installs and users with passwords 1234 who have admin access etc. All these issues are stated in both ISO and PCI compliance: we just need to have all companies comply, not just banks etc.
TheRealPomax 5y ago
Sure, but terrorism has always been the blanket "fuck it, max charge it, we can't be bothered to ACTUALLY come up with legislation" so maybe don't fuck it and work out a proper set of laws.
Trias11 5y ago
>> Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise. That's silly. We need preventative care and treatment and everything in between. Not exactly. Executives are choosing to hire el-cheapo offshore middlemen to manage security, software development and to save money (latter is more important - more money in their own pockets) - and we all are on a hook for this behavior. Criminals and hackers are like viruses - they are always there. But we need to maintain the health of the whole body (country and it's entities) to make sure we're resilient. Execs and politicians selling our security and freedoms for profits and bribes need to be dealt with appropriately.
pfortuny 5y ago
Not exactly: their behaviour is more akin to a storage facility with faulty security cameras and sleepy guards (and cheap locks). They have a duty towards their customers (contracts to be honored) and this requires security.
hulitu 5y ago
> I'm surprised at how dismissive the comments are. We need many angles of defense against these criminals. Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise. No it is like increasing price of cigarettes and giving those money to the health system. >That's silly. We need preventative care and treatment and everything in between. No, we need secure by default. These things are already criminalised, this does not seem to stop anybody. Why is a child on a default Windows 10 account able to install a program by clicking a link ? Why is this program able to install itself as a service ? This is not security.
simonh 5y ago
IT security is hard, very hard, and a lot of the commercial products used by most companies are terribly insecure. The fact is our IT infrastructure has grown much faster than the global pool of talent who know how to effectively secure it. So faced with a deficit of expertise, and a constantly changing IT security landscape, it makes perfect sense for governments to support and co-ordinate cyber security efforts. We need to get maximum benefit from the resources we do have and that mans pooled effort, clear best practices, strong security standards, etc. Personally I see an additional significant benefit coming out of all of this. If governments and politicians skill up in understanding the seriousness of cyber security at a national level, hopefully they will come to understand the deep folly of insisting on backdoors and secret keys to everyone's systems for security and law enforcement agencies. Politicians keep talking some really dumb crap on this topic, but if we can get them to take the security of businesses and citizens seriously, I'm hopeful this will change.
notsureaboutpg 5y ago
Why are you surprised? The terrorism bogeyman led Americans to spend trillions in tax money only to have those funds eaten up by Boeing and Raytheon and the US end up humiliatingly defeated by the Taliban with nothing to show for 20 years of war. Why would saying the US is going to treat anything like they treated terrorism be a good thing?

by blast 5y ago

ncr100 5y ago

Well put. It is an absurd argument up to the point of "reasonableness" that it's the responsibility of the company to defend against 100% of theoretical security vulnerabilities, in my opinion. There will always be a vulnerability, unless some truly secure-by-design technology exists .. airgap, not vulnerable to social engineering .. ?

tracerbulletx 5y ago

Agreed. I'm a bit tired of the victim blaming with security. It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Crime is a social problem, we can't rely on a dream world of mathematically perfect zero trust security.

Barrin92 5y ago
nope but we also demand some due diligence from private entities. When you leave the garage, the windows and the front door open with a "here's the money" sign pointing at your safe you might have a problem if someone steals your customers stuff. Company private security and protection against these attacks is more than abysmal. Just take the pipeline hack as an example. There should be no way at all that infrastructure critical to the nations security is getting shut down because of a corporate hack. If the private sector wants to earn profit from these things they need to show they're competent enough to handle it.
- tracerbulletx 5y ago
  That's fair. I'm sure there is a happy middle that can be found.
- jliptzin 5y ago
  I don’t think that’s a fair comparison. I think a fair comparison would be 80,000 companies buy the same vault door from supplier X. But suddenly one criminal group has found a universal key to the vault that no one else knows about, and can now access all 80,000 vaults nearly simultaneously and clandestinely even though they still look closed and secure from outside observers.
  - Sebb767 5y ago
    ... but this was 5 years ago and everyone and their dog knows it by now, the company just didn't bother to change that door. Also, the criminal group doesn't hit doors with cameras, but nobody bothered to install one. --- What you described is a zero day, which is very rarely used - most ransomware simply uses the absolutely low hanging fruit of companies lagging behind years in security updates combined with highly insufficient backups.
    - beermonster 5y ago
      Companies generally do not have a sufficient tested backup strategy and plan (though backups have only one part to play). Those same companies have probably never suffered any major consequences as a result - which might explain why it’s so usual for this to be a common gap. Sloppy/incomplete backups can probably wing/firefight the more common ‘single server dies’ ‘single directory needs recovering from accidental deletion on file server’ ‘need to restore database following botched upgrade’ type scenarios creating a false sense of security. In the same way companies do not have sufficient HA for their critical systems or processes. HA means being actively resistant to events impacting availability by having (typically automated) redundancy to remove SPoFs. It doesn’t mean HA owing to luck the server hasn’t died in 10 years owing to lack of/poor maintenance. But both with HA and backups companies can dodge bullets (until a real emergency) and maybe never even have a major incident. Ransomware kind of exploits this lack of organisation level sufficient backing up of all critical information assets. It really is as you say, low hanging fruit.
andreilys 5y ago
If you leave your houses front door open and a giant sign that says "please come rob me" then yes you deserve some of the blame. That's the case with a lot of these companies who: a) Have pitiful/non-existent bug bounty programs (or even worst, prosecutes white hat hackers who raise issues) b) Prioritizing exec bonuses instead of investing in InfoSec
- nkozyra 5y ago
  > If you leave your houses front door open and a giant sign that says "please come rob me" Sure, but as much as we might roll our eyes at the state of corporate security, this is a disingenuous metaphor. It's neglect and incompetence. It's repeatedly forgetting to lock the door even after every neighbor has been robbed.
- ourmandave 5y ago
  I'll take Blaming the Victim for $200 Alex. (AKA: The "What was she wearing?" defense.)
hpoe 5y ago
You have a point, but I also can expect a minimum level of competance and caring about the data you have stewardship over. Sure, given enough time and motivation anyone can probably break into anything, but that isn't an excuse to let the password for the FTP server that pushes out updates be 'password123'. Here's the problem companies have absolutely no incentive to care about Security. Several years back some hackers stole a bunch of my information from Experian. You know what I got out of it, a free $10 subscription to their identity service, along with lifelong worry of wondering if someone has opened an account in my name and racked up a ton of debt that I'll be held responsible for. You know what Experian got, nothing, a slap on the wrist and now their stock is in the same place it was before. I am doing my Masters in Information Assurance and Cybersecurity right now, and the whole mindset of all of my classes is "you're going to be pwned eventually so figure out how to move the risk to some other poor sucker to take the blame when it happens." pisses me off so much. The entire industry basically uses this as an excuse to avoid responsibility and just make sure they aren't the ones held responsible when the manure hits the rotary oscillator, and that bugs me to no end. At the end of the day there are real people who are getting screwed and hurt by this, while the execs and security "consultants" spend their time trying to figure out how to make sure that when sh* hits the fan they can't be sued, and d** the customer and their well-being we've got to figure out how to make sure we keep the law away. EDIT: Clarity and formatting
- andreilys 5y ago
  The concept of Moral Hazard is important here, which basically states that there is a lack of incentive to guard against risk where one is protected from its consequences. In a lot of cases the execs of these companies will continue to collect a large bonus, despite the fact that they utterly failed their customers.
  - hellbannedguy 5y ago
    Tieing the CEO pay to attacks should be as common as Poison pills, Golden Parachutes, and Stock incentives. Backups, and strict security, might be important? Put security right up their as important as their rediculious salaries.
joe_the_user 5y ago
I'm a bit tired of the victim blaming with security. The victims of these breaches are the end users. Companies are the beneficiaries of not having to pay for and especially not having to inconvenience themselves with much more secure systems. That said, it's true you can't ask for 100% security. You can instead set standards. You can especially set standards of security for any enterprise that the public dependents on. Since, there are no coherent standards now, just liability isn't useful. And the standards should involve actual topology, what kinds of information is allowed in and out at all.
- xupybd 5y ago
  You have to enforce standards. Good security is expensive. If companies in competition don't have to pay for good security those that do have it will have higher costs and have trouble competing.
  - fsckboy 5y ago
    > "running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing" running power plants is expensive, if companies in competition don't have to run their own power plants then the ones that do will have higher costs and will have trouble competing
    - deleted 5y ago
      [deleted]
    - toomuchtodo 5y ago
      Texas? Winterization that wasn’t done and wasn’t required, and thereby those generators who didn’t had a more competitive edge? The similarities write themselves.
      - xupybd 5y ago
        Thanks, that explains it.
dylan604 5y ago
It's not any different than the war on drugs. The gov't can't really think in a different manner than just black and white. The world is made up of shades of gray, and it's just too difficult to create legislation to handle shades of gray.
- deleted 5y ago
  [deleted]
User23 5y ago
> It's physically impossible to build a house that can't be broken in to Obviously you're correct because impossible is a tall order, but it's possible to get close assuming the aspiring intruders don't have dynamite or artillery[1]. [1] https://en.wikipedia.org/wiki/Bastle_house https://en.wikipedia.org/wiki/Bastle_house
SilverRed 5y ago
> and even harder for computer systems Things are actually getting better in some ways. Modern OSs with automatic updates are more secure than OSs have ever been. The days where clicking a link on an email or plugging in a USB could infect your computer are almost gone outside of rare zerodays which get patched for everyone pretty quick. Things are getting even better with hypervisors, SELinux and secure languages rolling in. Significant portions of Android and in the future linux, will and are being rewritten in rust which wipes out entire classes of the worst bugs we are being faced with. The problem is that the attackers are also getting more sophisticated and the targets are becoming more valuable with more and more getting put online.
- jtsiskin 5y ago
  Yes, but then you read things like https://googleprojectzero.blogspot.com/2021/01/introducing-in-wild-series.html https://googleprojectzero.blogspot.com/2021/01/introducing-i..., or look at the payments offered by https://zerodium.com/program.html… https://zerodium.com/program.html… the days of clicking a link -> persistence payload with escalated privileges are still here
  - SilverRed 5y ago
    From what I see on that page. It costs $500,000 to exploit chrome and your attack only lasts for a few days and then google pushes out a fix to all chrome users. This is so much better than the IE era where a teenager with some free time and skill could make something up and there would still be exploitable machines years later for the same bug.
    - beermonster 5y ago
      And yet have you seen how many zero day, patch now, actively explored in wild vulnerabilities there have been in Chrome just this year? It doesn’t feel like even Google are winning
harikb 5y ago
We have to think of this similar to how any other human or company behavior is monitored. Hold companies responsible and have a market sell ransomware insurance. (One exception to my solution is poor government and public institutions who run awful software. Not sure what we can do) If I have a habit of burning down my house by being sloppy with safety, my rates will go up. There should be something similar Let us take the case with Equifax mismanaging their servers, with running obsolete Java packages resulting in identity theft for millions of Americans. Credit score is controlled by 3 companies. Credit score determines mortgage rate and hence it literally controls if a US resident can afford to buy a house or get a job (in some states). Don’t the companies need to take some responsibility? Similarly dozens of companies leaving Elastic search installs and MySQL open to the internet. I mean.. how sloppy can one get? Fine, be sloppy, just pay $$$$$ to your insurance company. That $$ amount will indirectly decide whether we go to war with Russia or pay software engineers.
- wellthisisgreat 5y ago
  > That $$ amount will indirectly decide whether we go to war with Russia or pay software engineers. Not related to the subject, but wow I wonder how alarming it is that "war with Russia" meme is having a strong comeback, as it's being casually brought up in online discussions about software.
  - harikb 5y ago
    I was being sarcastic in this instance. Meant to say there is more to do within software before blaming “user”/“hacker”. Russia reference is only based on recent news/claims
  - rejectedandsad 5y ago
    If that's what it takes to defend our sovereignty, it's what it takes. They elected one of ours, we can unelect one of theirs.
hunter2_ 5y ago
Oddly enough though, the analogy tends to diverge when scaled: the more material you put into your house, the less vulnerable it is; the more lines of code you put into your software, the more vulnerable it is. Taken to an extreme, anyone can take down a house made of straw with their fist, but nobody can exploit hello world. I despise seeing simple apps with ridiculous dependency trees (package.json with line counts in the 5-6 figures, for example) and other complexity that can't possibly be fully understood by whoever's responsible for operating it. But I suppose things would be in even worse shape if we reinvented the wheel instead of using well-known libraries and so forth.
- mewpmewp2 5y ago
  Surely you mean lock files not package jsons?
  - hunter2_ 5y ago
    Oops, that's the big one. Maybe it's fine for that to be inhumanely large, as merely an artifact? Bad example then, but the point stands.
    - ehnto 5y ago
      Well the package.json only specifies the top level dependencies not all of the dependencies in the tree. So the .lock is probably a better representation of the actual dependency tree. It's not uncommon to include one library and get an extra 10, 20+ dependencies you don't even know about unless you care enough to check.
  - motoxpro 5y ago
    Haha I would hope so. A 5-6 figure package.json would be insane!
- tluyben2 5y ago
  If you do not audit and are not willing, in case of emergency, to take over support of your dependencies, you are creating a mine field. Most people do not understand what this even means though. Solid libraries are boring and done: old, stable and active bug fix support. Not new features weekly. Java or .net vs the js ecosystem. In our client contracts we have responsibility for our deliveries; in .net and Java we use well supported libs of over a decade old which we can support ourselves if the maintainers quit. With js this is an issue. Things are generally just not set up for decades of runtime and yet, there we are: we now have node js projects of almost 10 years old with many libs we have to audit and support ourselves and they are not very good quality. I think modern web is only just seeing the tip of the iceberg security wise. It will get much worse.
tw04 5y ago
> It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Which is exactly why you don’t store your savings in your sock drawer, you put it in the bank. Companies not taking appropriate backups is akin to keeping all of your money in a dish by the front door. Sure your house may never get broken into but nobody is going to have sympathy for you if it does.
- benjohnson 5y ago
  Backups are no longer sufficient - as the hackers now threaten to disclose stolen data to the public.
  - tw04 5y ago
    Which only works because they’re paying the ransom. The second the government introduces criminal penalties against the executives and boards for paying ransom, it will stop.
    - onion2k 5y ago
      Which only works because they’re paying the ransom. The second the government introduces criminal penalties against the executives and boards for paying ransom, it will stop. Making it a criminal offence to pay a ransom would eventually stop criminals ransoming the data they take to the company they took it from, but it wouldn't stop attacks and data breaches if there's some other way to profit. For example, attackers could sell the databases they steal. Or they could ransom individual's data directly to the individual. Or they short the stock of the company and then release the stolen database publicly to make the share price fall. It's important not to over-simplify the problem. There is no single, simple solution as long as there are many ways to profit from data thefts.
      - tw04 5y ago
        >Or they could ransom individual's data directly to the individual. Or they short the stock of the company and then release the stolen database publicly to make the share price fall. You're listing a bunch of things that are almost assuredly already happening. If a company was dumb enough to keep social security numbers unencrypted in a database or spreadsheet, that data is going onto the dark web whether they paid a ransom or not. It's a LOT harder to find a buyer of proprietary data that will likely put the buyer in prison for a long time, than it is to get a ransom from one individual trying to keep the whole thing quiet. Once you advertise "I have Apple's top secret next gen laptop details!!" - when someone releases a strikingly similar laptop, or "leaks" the details on an Apple focused fansite, the feds will be all over them.
kragen 5y ago
It's surprising and disappointing to see this point of view here, particularly with so little evident dissent. Of course you can "break into" a typical computer system by gaining physical access to it, for example by breaking into the house that it's in and unscrewing the computer's case; but that's only metaphorically connected to what's going on here, which is that criminals are sending data over the internet to the computer systems in question. The software the owners previously installed on those systems then responds to that data by giving the criminals complete control over the system, as long as they care to maintain it, or unless the system is destroyed. This is dumb. Writing software that does not behave in this fashion is not only physically possible; it's actually the majority of software. Even in typical software, there is only one deployed exploitable security hole per thousand lines of code or so, and, until only about 25 years ago, it was reliably possible to recover from such an invasion by reinstalling the OS.† The best software, like seL4 or qmail, has orders of magnitude less, though we can quibble about whether the actual number is 0 bugs or 1 bug.‡ The problem is that our systems are architected so that even one exploitable bug anywhere in hundreds of millions of lines of code enables total and irreversible subversion of the system; our system complexity is growing much faster than existing code is getting audited and fixed; much of the code is not even open to auditing; and the people with the power to fix it have no incentive to do so, instead spreading pernicious misinformation claiming that usability and security are unavoidably in conflict (a concept obviously absurd to anyone who has had to use an OS without memory protection) and bulletproof security is impossible anyway. So, at any given time, there are somewhere between thousands and hundreds of thousands of exploitable vulnerabilities in our systems, any one of which is sufficient to enable the implantation of a persistent backdoor that cannot be reliably detected or removed. The solution to this has been known since the 01970s. At the systems design level, minimize the complexity of the trusted computing base (the hardware and software whose integrity every program in the system relies on) in complexity, audit it rigorously, and freeze it. At the hardware level, provide an easy incorruptible way to restore a known safe state. At the social level, ensure that the people who rely on the integrity of the computer system have the authority to audit it and fix any problems they find, and the technical competence either to do this themselves or to delegate these tasks to people who are competent to do it, rather than to charlatans. At the user-interface design level, ensure that users can understand the information they need to assess the risks they are taking in relying on any given piece of information, and decouple the system to eliminate their incentives to take risks, for example with memory protection and petnames. We know a lot more about how to achieve these things than we did 45 years ago, and in some ways we have enormously more resources. We have seL4, Bitcoin, ssh, Monte, elliptic-curve cryptography, BLAKE3, NaCl, LUKS, decades of SOUPS proceedings, RISC-V, yosys, and 16-MIPS microcontrollers§ that cost 3¢. But that future is not merely "not widely distributed"—it has become inaccessible except in isolated cases like Trezor, as economic incentives have driven our hardware and software down a path of boundlessly ballooning complexity and diminishing alternatives, while proprietary software licensing eliminates any possibility of assessing and controlling the risks. Meanwhile, the shallow pop culture of computing reduced users from creators to mere customers, and then "eyeballs", while conflating hacking—the only way out of this mess—with computer invasion. So, I fully expect that if I live long enough to need a pacemaker, I won't be allowed to secure it against ransomware, which will be rampant at that point. It doesn't have to be this way. This can all be made better. Ready? Begin. ______ † In fact, shortly before that, on most PCs you could recover from any kind of system corruption just by taking the floppy disk out, resetting the system, and inserting a new, uncorrupted floppy disk. Better hope that one's not stoned too... ‡ You might argue that the possibility that there's an undetected security bug in seL4 means that complete computer security, even against carefully crafted data sent over the internet rather than some dude running off with your cellphone while it's unlocked, is still impossible. But in fact I think there's a very real difference in kind between the possibility that I might currently have presymptomatic covid, and the certainty that I have a small amount of covid. Systems like qmail are analogous to the first case, because they might be secure or might contain an undiagnosed flaw; systems like Linux and Chrome are analogous to the second case, because they are certain to contain a small but fatal fraction of flaws, which are inexorably multiplying. § Unfortunately the whole line of Padauk microcontrollers is out of stock this week at LCSC.
colechristensen 5y ago
I have seen personally, heard first hand accounts, and read many a post-mortem for situations where the primary blame really should be on the "victim". There's another word for this: Negligence. Of course there are always 0days. There are always sophisticated attacks. There is always human error. Then there are people in leadership positions being given accurate information about basic security problems and possible outcomes over long periods of time flatly refusing to make security a priority or spend any time fixing dangerous situations. Many of these ransom situations aren't the result of targeted attacks, but "hey we have this exploit and ransom kit, let's scan the entire Internet and see if we get anything". Or the ever popular (ok maybe not so much any more) unsecured elasticsearch server on the public internet. I'm sorry but if you put your production data on a public IP on a standard port with zero security, it is positively your fault when your data gets stolen. (not much to do with ransom, but an example). There is a difference between being the victim of a sophisticated attack and being the victim of your own negligence (and a lot of grey area in between).
- BrandoElFollito 5y ago
  And a lot of cases where around the table you have those who say "here is the risk that must be addressed" and then the others who say "if we do that we break production". Both are truthful and full of good will.
  - tremon 5y ago
    "Ok, that means our current business practices are a liability. Gather the process owners to see what can be done". What you're describing isn't (shouldn't be) the end of discussion. The trick is to get management to explicitly acknowledge the liabilities.
  - ClumsyPilot 5y ago
    "Here is the risk that 737 max will crash because of mcas" And then others say: " if we do that, we will have to redesign too much of the airligher" i.em break production. Youve got to have your priorities straight
tluyben2 5y ago
Crime needs to be dealt with but a lot of companies I worked with in the past 30 years are simply negligent. If you do not blame the victim, what is the incentive for spending money on even basic security? Not morality surely, so...
im3w1l 5y ago
You have a lot of replies but as far as I can see no one made this point, so let me add yet another reply. Victim blaming is a framing that makes it sound like it's about moral and ethics. But it's about practicality. There is a causal chain leading to a bad outcome and we simply break the weakest link. Sometimes it's easier to lock up the treasure and sometimes it's easier to lock up all the thieves. Consider the case of computer security. Locking up all the thieves is super duper hard, because they are located in places like Russia and China that wont cooperate with law enforcement.
- bostik 5y ago
  > Locking up all the thieves is super duper hard, because they are located in places like Russia and China that wont cooperate with law enforcement. Oh, they do. With their local ones. Those thieves can operate with impunity as long as they don't hit their fellow countrymen.
WalterBright 5y ago
It's impossible to build a safe airliner, but we can get pretty damn close. Airline engineers know one cannot create a component or system that cannot fail. So the question then becomes, assume a system fails. Now how does the airplane survive? With software systems, instead of demanding a perfect defense against the root password being compromised, think "if the root password is compromised, how do we prevent that from bringing it all down?" In other words, think in terms of redundancy and isolation between systems. And the largest piece of hubris and madness in critical systems is allowing over-the-internet updates.
- passwordqwe 5y ago
  But there is a big difference between airline safety and software safety. An airliner survives against the environment, it's PvE, a software system has to survive against hackers, it's PvP. If you shoot a rocket at an airliner, the airliner will fail, in that case we blame the person who shot the rocket.
  - jjk166 5y ago
    We design military aircraft to fly into warzones. They are very much PvP. We design them with various countermeasures to deal with rockets and ejector seats if those fail. Yeah, planes will be shot down and pilots may die despite these precautions, but skimping on the ejector seat because "hey they might die anyways" is totally unacceptable.
  - boc 5y ago
    This is a great way to frame the issue.
  - WalterBright 5y ago
    > But there is a big difference between airline safety and software safety I've worked professionally in both industries; they are not fundamentally different. Software practices can learn a lot from aviation practice, but they seem determined to spend decades rediscovering the methods the bitter, expensive way. For example, software is still stuck in the dark ages where the idea is better training / better programmers / more punishment will prevent these sorts of failures.
perryizgr8 5y ago
> It's physically impossible to build a house that can't be broken in to Specially if an entity with a nation's resources is trying to get in.
mschuster91 5y ago
> I'm a bit tired of the victim blaming with security. Why? Many of the companies who got hacked had massive IT issues of their own fault, the most common being: - full access for everything across the whole network, no subnetting with strict firewalls that limits the scope of an intrusion - outdated software/firmware stacks leading to avenues for compromise - no/ineffective/outdated virus scanners - no meaningful backup infrastructure and regular testing if said infrastructure is already working - lack of 2FA on administrative credentials - lack of monitoring on central file servers to detect if a compromised machine is encrypting the file server's contents piece by piece > It's physically impossible to build a house that can't be broken in to Indeed, but a burglary insurance will likely refuse service or jack up rates if you don't lock your door or not have an alarm system installed.
blueblisters 5y ago
Crime is a social problem but the US government is especially bad at fixing crime that originates from other countries. See war on drugs, terrorism, call center scams etc. On the other hand, a good team of security experts is very good at preventing computer systems from getting hacked into.
- clarkevans 5y ago
  The problem with drug cartels does not originate from other countries. It is domestic demand, paying in dollars. Those dollars overwhelm local economies and police forces abroad.
mcguire 5y ago
On the other hand, we have known since the 1970s roughly how to make computer systems significantly more secure and resilient. However, we, as a society, have decided that it's costly and difficult and that we would prefer not to do anything about it. It's "move fast and break things" at the social level. I really, really hate reasoning by metaphor, but you do lock your doors, right?

th0ma5 5y ago

Usually people here want government to stay out of the way of business, or especially not to compete with business. I agree with you, but it isn't necessarily entirely a pure-business perspective.

Izkata 5y ago

> the way that the pipeline-company ransomware hackers beat a hasty retreat was noticeably unusual, and already seemed to telegraph that the state was getting involved more...actively. Uh, there was no retreat - the company paid the ransom the day after the hack. https://www.theguardian.com/technology/2021/may/19/colonial-pipeline-cyber-attack-ransom https://www.theguardian.com/technology/2021/may/19/colonial-...

ineedasername 5y ago
I think they meant the folks providing the ransomware as-a-service, who basically said "yeah we provide criminal services but we don't endorse their use for crimes that big, so we'll be more careful who we sell to."

2OEH8eoCRo0 5y ago

The HN crowd can sometimes have an issue with pragmatism. Sure, I'd love to live in a world where everyone follows best security practices 100% of the time, but this ain't it. Arguing how your imaginary perfect world should be gets us nowhere.

Kalium 5y ago
Something about security in particular brings out the puritanical streak many engineers have.
chrisco255 5y ago
How much of these hacks would be prevented by adoption of simple preventions like Yubikeys for login, backing up data and images regularly, and encrypting data by default?
- Kalium 5y ago
  Sometimes simple preventative measures aren't as simple as they might sound. How would you go about integrating yubikeys for login into multi-decade-old SCADA hardware systems? I'm a security specialist and I honestly wouldn't know where to begin.
  - chrisco255 5y ago
    Is that the case with all of these hacks? How many would be prevented, is what I'm wondering? My mother's hospital was hacked this week and now they can't even clock in but they're not running SCADA
    - Kalium 5y ago
      SCADA's a good example of systems that are difficult to secure for complex reasons. There are many others. You ask a very wise question. Unfortunately, I think it's unknownable. The best we know is that the answer is more than none and less than all. The more you get towards "all" the more prevention measures cost to implement. For instance, managing a mature backup and imaging operation at scale may be conceptually simple but is both complex in practice and far from free. Hospitals in particular are the scene of some interesting conflicts between security and usability. There are a lot of stories about health staff doing things like jamming open medication dispensing machines so that they could get on with the job instead of dealing with security measures they experienced largely as obstacles. Can you imagine throwing yubikeys into a scenario like that, where people already have an adversarial relationship with IT and security measures? What do you think is going to happen when someone forgets their key and can't send an x-ray to the remote radiology center? I have my guesses.

lr4444lr 5y ago

I think this is an unfair false choice. I blame security "experts" who store private keys on public facing web servers or allow for SQL injection in the same way as I blame doctors who over-prescribed Oxycontin for way longer than was safe to avoid dependence. Sure, there will always be procedural mistakes and zero days, but gross dereliction of even basic level expertise deserves scorn.

JBlue42 5y ago
My anecdata is that the majority of times someone has gained access to a user's system somewhere that it has not been anything technical but purely social engineering. Whether that was a secretary at a medium-sized company or someone in medical records at a hospital. The latter case was more extreme - user received an email from the hospital's lawyer, replied saying she wasn't sure, "lawyer" emailed back to go ahead and access the website. Lawyer was the 'hacker' who had already broken into and taken over the lawyer's email. Luckily, it was phishing attack and not ransomware.

cyanydeez 5y ago

the zeitgeist the past 10 to 20 years heavily biases people to think government cant work and if it can, its too expensive, and if it does, it infringes someones right to profit at others expense.

grumple 5y ago

Would it be reasonable to demand every company hire a team of armed guards? No? So why is it reasonable to demand they each hire a cybersecurity team? It’s reasonable to tell companies to lock the doors. It’s reasonable to tell them to follow accepted best practices in tech too, but not that they be experts prepared for everything.

virtue3 5y ago

Anytime you can let a group of criminals get away with impunity it's going to run out of control until we get... the current situation. It's getting close to having China and Russia either start cooperating with us to flush these guys out, or we start having "fleet exercises" in their seas again. I think it would be prudent of said nation states to wash their hands of these folks.

crispyambulance 5y ago

> We need preventative care and treatment and everything in between. Not to mention the fact that the cybercriminals who do these attacks also get involved with state-sponsored offensives. The ransomware stuff might just be "training wheels" or resume bullet-points for something far worse in the future. If we're going to get serious about stopping the state-sponsored stuff and even bother to have the "US cyber-command" it makes sense to go after the relatively petty criminal elements as well. If they can't make a dent with these, why should we think that can go up against the FSB? Corporations can only ever view cybersecurity as yet another compliance exercise (and all the incurious checkbox tickers that entails). The smart ones will play "cops and robbers" (red-team/blue-team games) but they can't offensively go after cyber criminals. Unfortunately, that's what needs to be done to get ahead of this stuff.

demadog 5y ago

Imagine if all companies had to individually fight pirates in the heyday of pirate hood!

andrewnicolalde 5y ago
If I’m not mistaken, some like the British East India Company actually did!
throwaway0a5e 5y ago
That's exactly what happened. Ship owners invested in arming their ships to the point where the pirates would hopefully pick softer target which is exactly what they did. Incrementally over the 16th-18th centuries the profitability of piracy was highly reduced because the goods had fairly fixed relative value and the risk kept going up and it more or less went away on its own in the Western hemisphere over the course of the 18th century. Crime rarely pays at scale when every instance carries a high risk of a firefight. A few may make a good living in such an environment but it caps the maximum industry size at a very low level. Piracy persisted in the Mediterranean where it was more or less a state sponsored activity. They mostly avoided harassing the commerce of major powers (Britain, France, etc). Which worked well enough until the 2nd tier powers got pissed off enough to stomp them a few times (with the blessing of the first tier powers, think of it like a reverse Falklands). They still didn't tone it down sufficiently and they wound up speaking French for that mistake. If anyone has any good resources on the history of Indian ocean or east Asian piracy I'd be interested in reading them. As an aside, old school high seas piracy is an surprisingly good parallel to the variations of criminals in the current cyber-crime environment. You've got state sponsored theft of money and goods (privateers). You've got under the table cyber criminals who would be prosecuted by their home jurisdiction if found (traditional western pirates, the kind you typically see portrayed in pop culture). And you've got locally approved as long as they pay their dues professional cyber-criminals (north african pirates). The former groups mostly steal things of value they can use or fence. The latter mostly takes stuff hostage for ransom.
- demadog 5y ago
  Yes, thanks for the details! The US fought them in the Barbary Wars as well - https://en.wikipedia.org/wiki/First_Barbary_War https://en.wikipedia.org/wiki/First_Barbary_War I think the statement I was hinting at was that essentially all these companies are on their own (vs pirates and hackers) until the problem is too big and dangerous and then the state steps in.

maerF0x0 5y ago

IMO the first step to fixing is to add liability. If a breach happens through a piece of software, then the vendor is liable. Same way cars get recalls. (sometimes)

Txmm 5y ago
Really? I don’t think this is at all similar to a car safety recall. That’s more like trying to issue a recall for a car because people can smash it’s windows and break in.
- maerF0x0 5y ago
  yeah of course it's an analogy. But by adding liability we'll get more recalls (patches) done. Vendors will stop playing FUD and will focus on the real cost of their security flaws. And yes some will still not do patches, just like some car vendors are considered less trustworthy. But at least the risk of suit will loom over their heads.
  - tempestn 5y ago
    But the parent's point is that's still putting the liability on the vendor rather than the actual criminal. Perhaps it's more like if a car is sold without an immobilizer or an alarm, holding the manufacturer liable if it's stolen. But if that kind of fails, because it's pretty simple to mandate a handful of security additions to cars, whereas software is orders of magnitude more varied and complex. It would be hard for any vendor, let alone small companies, to prove they'd followed every conceivable best practice. Might even be impossible, as some likely conflict. And if you try to codify exactly what security practices should be followed, what do you do when those practices become obsolete?
    - maerF0x0 5y ago
      Yeah, I think it's just a fault in the analogy and in part demonstrating why reason from analogy is faulty. My point is this If vendors were liable (at least in part) for security faults in their products, then they would be more diligent about closing those gaps.

antonzabirko 5y ago

The problem is our govt money is subsidizing private company security policies instead of more directly helping people. This money should go to healthcare, infrastructure, or even be redistributed before it's used here.

kube-system 5y ago
We fund the police and military with our tax dollars to prevent bad actors from doing bad things that we don’t want. Why is this different?
- deleted 5y ago
  [deleted]
shshdueisn 5y ago
Providing security and protecting property is one of the core functions of the state. Police protect businesses. The US Navy protects shipping lanes. I do not understand why this particular case could be so objectionable.

klyrs 5y ago

> I'm surprised at how dismissive the comments are. I've gotta ask: has the US's stance on terrorism been effective? Or did they merely use it as an excuse to militarize the police and erode human rights? Because I want the government to take effective action around ransomware, but "similar priority to terrorism" just doesn't fill me with hope.

lupire 5y ago
It's a bad comparison, becauSe organized "War on Terror" terrorism is extremely rare, because it's not very profitable. The news is PR fluff.
unishark 5y ago
The headline might be vague (though I'd personally love to see drone strikes on the scumbags that scam elderly people to of their meager savings) but the article itself talks in terms of priority and effort for investigations into malware attacks. E.g., they won't just shrug and do nothing because they care about other crimes more, like with my stolen GPS case.
- makeworld 5y ago
  I'm astonished you would support drone strikes on civilians. Scammers are working a bad job out of necessity. They are not villains who deserve to be extrajudicially murdered.
  - deleted 5y ago
    [deleted]
  - tluyben2 5y ago
    The professional nature these scams are now (call from 'Microsoft', steal a little and then send properly dressed and documented people to the house to 'investigate the fraud' and steal more) is not desperate people scamming. Sure they do not have to be murdered, but removed from society is not a bad plan. These are pro organizations, not a handful of poor people anymore.
5y ago

fnord77 5y ago

same mentality as dismissing airbags in cars because "people should drive better/pay attention more"

Thorrez 5y ago
I don't understand. How is blast dismissing something similar to airbags? blast says >We need many angles of defense against these criminals. Whatever you're comparing airbags to would be one of the defenses that blast is saying we need.

pibechorro 5y ago

Most these hacks where done using leaked tools from the same alphabet peoples tools to fight terrorism in the first place. Horrible idea. We need companies to get their act together. Personal responsibility.

tluyben2 5y ago

> do better security is like dismissing doctors because people should get more exercise Not dismissing doctors but making fat people (or drug users etc) pay more is not that silly and happens. There need to be standards (ISO, PCI) for all companies. And if you get hacked, you get fined if you did not adhere to the standards. And yes, go after the criminals as well, but bit to easy to just ignore ancient Windows installs and users with passwords 1234 who have admin access etc. All these issues are stated in both ISO and PCI compliance: we just need to have all companies comply, not just banks etc.

TheRealPomax 5y ago

Sure, but terrorism has always been the blanket "fuck it, max charge it, we can't be bothered to ACTUALLY come up with legislation" so maybe don't fuck it and work out a proper set of laws.

Trias11 5y ago

>> Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise. That's silly. We need preventative care and treatment and everything in between. Not exactly. Executives are choosing to hire el-cheapo offshore middlemen to manage security, software development and to save money (latter is more important - more money in their own pockets) - and we all are on a hook for this behavior. Criminals and hackers are like viruses - they are always there. But we need to maintain the health of the whole body (country and it's entities) to make sure we're resilient. Execs and politicians selling our security and freedoms for profits and bribes need to be dealt with appropriately.

pfortuny 5y ago

Not exactly: their behaviour is more akin to a storage facility with faulty security cameras and sleepy guards (and cheap locks). They have a duty towards their customers (contracts to be honored) and this requires security.

hulitu 5y ago

> I'm surprised at how dismissive the comments are. We need many angles of defense against these criminals. Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise. No it is like increasing price of cigarettes and giving those money to the health system. >That's silly. We need preventative care and treatment and everything in between. No, we need secure by default. These things are already criminalised, this does not seem to stop anybody. Why is a child on a default Windows 10 account able to install a program by clicking a link ? Why is this program able to install itself as a service ? This is not security.

simonh 5y ago

IT security is hard, very hard, and a lot of the commercial products used by most companies are terribly insecure. The fact is our IT infrastructure has grown much faster than the global pool of talent who know how to effectively secure it. So faced with a deficit of expertise, and a constantly changing IT security landscape, it makes perfect sense for governments to support and co-ordinate cyber security efforts. We need to get maximum benefit from the resources we do have and that mans pooled effort, clear best practices, strong security standards, etc. Personally I see an additional significant benefit coming out of all of this. If governments and politicians skill up in understanding the seriousness of cyber security at a national level, hopefully they will come to understand the deep folly of insisting on backdoors and secret keys to everyone's systems for security and law enforcement agencies. Politicians keep talking some really dumb crap on this topic, but if we can get them to take the security of businesses and citizens seriously, I'm hopeful this will change.

notsureaboutpg 5y ago

Why are you surprised? The terrorism bogeyman led Americans to spend trillions in tax money only to have those funds eaten up by Boeing and Raytheon and the US end up humiliatingly defeated by the Taliban with nothing to show for 20 years of war. Why would saying the US is going to treat anything like they treated terrorism be a good thing?