7 ms·

Actually federal government resources are pretty limited and finding hackers is hard. What's more after you find hackers you often can't do anything about them

Actually federal government resources are pretty limited and finding hackers is hard. What's more after you find hackers you often can't do anything about them as they are in China, Iran, Russia or some other non-US friendly country. Even if country if friendly, extradition is expensive and time consuming. After all that you may end up putting random 20 year old guy in jail for a few years without putting any dent into overall number of hacking attacks. True cost of each investigation is probably in the millions so investigating hacking of random small company is probably not high on the list of priorities. Evidence that can hold up in the court are hard to come by. With all the talk about Russian hackers hacking Dem Party, elections, etc, there are zero people in the jail and zero evidence presented that it was even Russians. So it's hard.

ocdtrekkie 5y ago
Ultimately the solution is probably to begin to firewall off parts of the Internet by national boundaries. We should allow cross-country traffic where countries follow the same rules of order as we do. You can remove a lot of threats by just blocking every country you have no desire to reach people in. And if major hosting and cloud providers were restricted similarly such that foreign actors can't just rent US servers to stage attacks from... I'm aware this is an unpopular opinion amongst tech crowds, but it's impossible to maintain order in an environment where some people have to obey the law and some people don't.
- deleted 5y ago
  [deleted]
- toomuchtodo 5y ago
  You’re not wrong. If you don’t have a business need to talk to some IP blocks and AS’, by all means, black hole traffic from jurisdictions who aren’t going to do diddly when someone causes you harm. I see this often with client WAF configurations depending on the endpoint use case and who is expected to be hitting that endpoint. “You’re blocking everyone outside of North America?” “Yes, we’re comfortable with that as a business decision.” (fintech) It doesn’t solve the problem, but it’s low hanging fruit, and a few checkboxes (or lines of Terraform) if you’re at a cloud provider and using the usual primitives.
  - ocdtrekkie 5y ago
    Yeah, there's businesses with global markets that can't afford such a shield, but if you've got a local/physical business or you ship product only to residents of specific countries, it's basically zero cost with great upsides.
  - aledalgrande 5y ago
    How does that protect you from VPNed traffic? Or residential proxies? Local botnets?
    - toomuchtodo 5y ago
      It doesn’t.
- arp242 5y ago
  Some services do this. I live in Indonesia at the moment and there are various Dutch websites I can't access: I can't view the website of a political party for example, and I can't access newyorkpizza.nl either to unsubscribe from their stupid newsletter emails (I just blackholed them, but still). I also couldn't view their data breach announcement from a few weeks ago. Some news websites block foreign access as well. ACM also blocked a lot of Indonesian IP addresses (because "infiltrated by sci-hub" according to their support, but since carried-grade NAT is ubiquitous here you end up blocking vast swaths of the country). All in all, it's really annoying. Yeah, you're going to stop various bad actors with this – no denying that – but you're also going to block your own nationals who happen to be abroad. Especially for a lot of critical services (banks, gov't, etc.) it's pretty much a non-starter.
- tkojames 5y ago
  No this is not the right approach at all in my opinion. What stops someone from one of the countries using IP's from another? Teenagers in USA are gonna try and hack your stuff as well... I was one of them in my youth. You can't just block china and half ass your setup. You will get attacked from everywhere always. Anything you put on the internet is a target. Always has been always will be.
  - ocdtrekkie 5y ago
    > What stops someone from one of the countries using IP's from another? That's why this approach is only really complete if supported at a national level. Cloud providers in the US shouldn't be allowing foreign actors to rent them, for instance.
    - tkojames 5y ago
      But how? How can US cloud providers stop this? I am really curious how from my understanding it is not possible with how things are currently setup.
      - ocdtrekkie 5y ago
        Of course it's possible: KYC. As it is, cloud providers already tend to require credit cards when setting up an account that can possibly generate any sort of billing.
kgeist 5y ago
>What's more after you find hackers you often can't do anything about them as they are in China, Iran, Russia or some other non-US friendly country. It's possible if US law enforcement bothers working with their counterparts in "unfriendly" countries (I doubt they even reach out to them). Case in point: 10 years ago a bunch of Russian scammers scammed Americans out of thousands of dollars pretending to be a valid mail order bride business. As far as I remember, because US police did nothing ("it's Russia! we can't do anything"), one of the Americans had to contact Russian police directly. A criminal case was opened and Russian police eventually busted a whole network of scammers. I know because they were based in my city, there was TV coverage. Those scammers targeted only foreigners so our police wasn't even aware they existed, because no one filed anything.
- pbhjpbhj 5y ago
  Why didn't USA police contact Russian police? Why was that left to citizens to do. It may be problematic, but Russia are part of Interpol, so surely a record of the crime should have at least been made. Sounds like apathetic policing.
wolverine876 5y ago
> federal government resources are pretty limited The resources are whatever Congress and the President makes them. The budget is typically over $2 trillion. Dedicating overwhelming resources - billions of dollars, far beyond any hacker group - to the purpose would be a rounding error. The potential access to expertise and equipment is far beyond any hacker group. The legal power is enormous - the government can access, through cooperation and compulsion, so many systems that the hackers would have to try to access at great expense. What major company is going to resist cooperating against these people? They may enthusiastically participate. Just think of the potential of backbone operators, cloud providers, etc. etc. cooperating. > zero evidence presented that it was even Russians I believe that's false. > (jurisdiction issues) It's a problem, but not impossible. The US has enormous power in the world if they want to use it.
vmception 5y ago
> With all the talk about Russian hackers hacking Dem Party, elections, etc, there are zero people in the jail and zero evidence presented that it was even Russians. So it's hard. couple that with the literal marketplaces of hacked Windows computers that you can remote desktop into by country, postal code and bandwidth metrics, the best case is that you end up framing someone
- deleted 5y ago
  [deleted]

ocdtrekkie 5y ago

Ultimately the solution is probably to begin to firewall off parts of the Internet by national boundaries. We should allow cross-country traffic where countries follow the same rules of order as we do. You can remove a lot of threats by just blocking every country you have no desire to reach people in. And if major hosting and cloud providers were restricted similarly such that foreign actors can't just rent US servers to stage attacks from... I'm aware this is an unpopular opinion amongst tech crowds, but it's impossible to maintain order in an environment where some people have to obey the law and some people don't.

deleted 5y ago
[deleted]
toomuchtodo 5y ago
You’re not wrong. If you don’t have a business need to talk to some IP blocks and AS’, by all means, black hole traffic from jurisdictions who aren’t going to do diddly when someone causes you harm. I see this often with client WAF configurations depending on the endpoint use case and who is expected to be hitting that endpoint. “You’re blocking everyone outside of North America?” “Yes, we’re comfortable with that as a business decision.” (fintech) It doesn’t solve the problem, but it’s low hanging fruit, and a few checkboxes (or lines of Terraform) if you’re at a cloud provider and using the usual primitives.
- ocdtrekkie 5y ago
  Yeah, there's businesses with global markets that can't afford such a shield, but if you've got a local/physical business or you ship product only to residents of specific countries, it's basically zero cost with great upsides.
- aledalgrande 5y ago
  How does that protect you from VPNed traffic? Or residential proxies? Local botnets?
  - toomuchtodo 5y ago
    It doesn’t.
arp242 5y ago
Some services do this. I live in Indonesia at the moment and there are various Dutch websites I can't access: I can't view the website of a political party for example, and I can't access newyorkpizza.nl either to unsubscribe from their stupid newsletter emails (I just blackholed them, but still). I also couldn't view their data breach announcement from a few weeks ago. Some news websites block foreign access as well. ACM also blocked a lot of Indonesian IP addresses (because "infiltrated by sci-hub" according to their support, but since carried-grade NAT is ubiquitous here you end up blocking vast swaths of the country). All in all, it's really annoying. Yeah, you're going to stop various bad actors with this – no denying that – but you're also going to block your own nationals who happen to be abroad. Especially for a lot of critical services (banks, gov't, etc.) it's pretty much a non-starter.
tkojames 5y ago
No this is not the right approach at all in my opinion. What stops someone from one of the countries using IP's from another? Teenagers in USA are gonna try and hack your stuff as well... I was one of them in my youth. You can't just block china and half ass your setup. You will get attacked from everywhere always. Anything you put on the internet is a target. Always has been always will be.
- ocdtrekkie 5y ago
  > What stops someone from one of the countries using IP's from another? That's why this approach is only really complete if supported at a national level. Cloud providers in the US shouldn't be allowing foreign actors to rent them, for instance.
  - tkojames 5y ago
    But how? How can US cloud providers stop this? I am really curious how from my understanding it is not possible with how things are currently setup.
    - ocdtrekkie 5y ago
      Of course it's possible: KYC. As it is, cloud providers already tend to require credit cards when setting up an account that can possibly generate any sort of billing.

kgeist 5y ago

>What's more after you find hackers you often can't do anything about them as they are in China, Iran, Russia or some other non-US friendly country. It's possible if US law enforcement bothers working with their counterparts in "unfriendly" countries (I doubt they even reach out to them). Case in point: 10 years ago a bunch of Russian scammers scammed Americans out of thousands of dollars pretending to be a valid mail order bride business. As far as I remember, because US police did nothing ("it's Russia! we can't do anything"), one of the Americans had to contact Russian police directly. A criminal case was opened and Russian police eventually busted a whole network of scammers. I know because they were based in my city, there was TV coverage. Those scammers targeted only foreigners so our police wasn't even aware they existed, because no one filed anything.

pbhjpbhj 5y ago
Why didn't USA police contact Russian police? Why was that left to citizens to do. It may be problematic, but Russia are part of Interpol, so surely a record of the crime should have at least been made. Sounds like apathetic policing.

wolverine876 5y ago

> federal government resources are pretty limited The resources are whatever Congress and the President makes them. The budget is typically over $2 trillion. Dedicating overwhelming resources - billions of dollars, far beyond any hacker group - to the purpose would be a rounding error. The potential access to expertise and equipment is far beyond any hacker group. The legal power is enormous - the government can access, through cooperation and compulsion, so many systems that the hackers would have to try to access at great expense. What major company is going to resist cooperating against these people? They may enthusiastically participate. Just think of the potential of backbone operators, cloud providers, etc. etc. cooperating. > zero evidence presented that it was even Russians I believe that's false. > (jurisdiction issues) It's a problem, but not impossible. The US has enormous power in the world if they want to use it.

vmception 5y ago

> With all the talk about Russian hackers hacking Dem Party, elections, etc, there are zero people in the jail and zero evidence presented that it was even Russians. So it's hard. couple that with the literal marketplaces of hacked Windows computers that you can remote desktop into by country, postal code and bandwidth metrics, the best case is that you end up framing someone

deleted 5y ago
[deleted]