28 ms·

Major Swedish supermarket chain hit by cyberattack

160 points by jnieminen 5y ago

MattGaiser 5y ago
For you security folks out there, are salaries spiking yet? His this impacted the market at all?
- batch12 5y ago
  Yeah, rates are going up. There is a deficit of talent. There are plenty of people with relevant degrees, but they lack fundamental knowledge related to systems and code.
  - swarnie_ 5y ago
    Is it easy dealing with the hate from everyone else in your org? I understand why security is important but the majority of staff (particularly non-technical) see you as a blocker.
    - batch12 5y ago
      No hate. I am an enabler. I help our teams do what they need to do to move forward securely. When there is an issue, I respond to the event then quickly contain and remediate so business can continue. It is part of my job to help them understand this.
    - tjpnz 5y ago
      I'm a developer in an organisation with a large dedicated security team. I've been given advice but can't think of a time when I've been blocked.
    - beermonster 5y ago
      If the security team is a blocker it might be that they’ve been brought in too late. Security is everyone’s responsibility and creating an environment where it’s like this, and making it as easy as possible to get people to report stuff they see without playing the blame game is key to getting trust and demonstrating that togetherness. There’s only really hate in them v us type environments (I’ve seen it also in other cross team interactions like Dev v Ops for e.g.) or security teams blindly giving teams lists of controls to implement without having even done any kind of risk assessment with the asset owner (and quite possibly without taking other business risk priorities into account). As for convincing non-technical staff of the importance: The technical vulnerability (or whatever) needs relaying in business risk terms they can understand.
    - csydas 5y ago
      Really? What kind of staff are you talking about and what new implementations did they resist you on? And why? I'm curious cause while I'm not on my company's security team, due to heightened awareness and wanting to ensure we're protecting our trade secrets, etc, we've ramped up security in basically every way across the entire organization, and it's been basically a pleasant ride internally for all few thousand members of the company across the globe. The technical teams (dev, support) had some speed bumps, but a frank discussion with IT Security to discuss what our need was and why it wasn't being met, we found acceptable new routes. If anything, we've used the locking down of potential security risks as a leap-board to overhaul and optimize a LOT of workflows for the better. Our customers now, that's another story, and it's like trying to make a pet take medicine. Our largest customers are fine and understand (even appreciating) the security changes we made for our interactions, but a lot of the small business customers only care about the fact that they can't do what they previously used to in some cases. But I'm fairly curious what resistance people are seeing from their implementations and what these implementations are.
      - zdragnar 5y ago
        Like any other department, when security is too isolated from others, it creates a culture of perverse incentives and competition rather than collaboration to a shared goal. For example, try building a new website for a company, only to have the security team insist that you fix "defects" such as not tying sessions to IP addresses. Yeah, fuck all the people on mobile phones hopping between networks. It would make sense for accessing internal data, but not for what amounted to a marketing site for public consumption. Like I said at the open, this can happen with any department or team- security, I think, might tend to happen a little more frequently, if only because it is logical that they do need a certain amount of autonomy to do their jobs well.
    - Nursie 5y ago
      I love working with good Infosec people, I want to deliver secure software. Good Infosec people are as rare as hen’s teeth.
    - the8472 5y ago
      Hate is reserved for the "if checkbox is not checked we kill your project by end of week" and "the form doesn't have (client-side) validation, that's a OWASP vulnerability" kind of "pentest" teams. People who don't even reply when you're asking which threat model we're defending against.
  - generated 5y ago
    Best way to capitalize on this? Infosec employees follow the same anemic HR compensation song and dance, often lumped in with all engineering as a category. Security startups are known as "cockroaches," they never die but are a hard bunch to grow into unicorns. Contracting really only seems amenable to a small bump in lifestyle business level rates.
    - batch12 5y ago
      A method to transition people from related fields would be the most beneficial. Taking someone with a background in systems administration or programming and nailing on the security skillset would be more effective than taking someone who knows all security concepts and thats it. The best way for a practitioner to personally capitalize depends on their background. For instance, someone with infrastructure support experience may make an excellent incident responder. Someone who deeply understands how systems would could be a talented pentester. Edit: From a compensation perspective the solution is to take your growing experience to the next company willing to pay for it.
      - randmeerkat 5y ago
        The problem is it isn’t about nailing on the security skillset. It’s about executive motivation.“Security” is all about doing enough to shift liability and nothing more. Until executives are liable for security breaches this will continue.
        CrazyCatDog 5y ago
        Actually, this smells a lot like a financing decision. Delay near term revenue to ultimately land a bigger purse down the line with additional features or bugs squashed provided the competition doesn’t beat us to the finish line. As the enterprise grows (customers/features -> lines of code) the liability associated with an attack increases—suggesting more care is needed with every release. And, knowing that you cannot keep up with scale by adding workers in parallel implies the following unsubstantiated claim: As a piece of software grows in length, the releases must be fewer and further apart. Otherwise, the team is taking shortcuts and the liability will eventually catch up with them. With that framework in mind: if large software company X stretches out their release schedule, their share price will fall, eventually appealing to activists who want to control/replace leadership (ironically for doing the right thing). I’m a true and through capitalist—please don’t get me wrong, but this is creative destruction at its finest!
  - tremon 5y ago
    I think the talent is there, but the pay is lacking. Besides, no one has ever gotten a raise for carefully avoiding even the most common of vulnerabilities because that would only delay "the product".
    - runeks 5y ago
      How would a random hiring manager know who to hire? There are surely people out there who know security, but how does someone who doesn’t know security choose the right people to hire? The very software that was the vector of this attack is produced by a company claiming to improve security.
    - cpach 5y ago
      When you say the pay is lacking then I’m curious what region you refer to. I’m pretty certain that the pay isn’t lacking in Silicon Valley for example.
      - heurisko 5y ago
        In my experience, in practice a software engineer salary in England is usually advertised in the range, or just below, other middle-class jobs, such as a solicitor.
        cpach 5y ago
        I can imagine so. That is probably true for many regions in Europe. But I would betcha it’s not true for London though.
    - username90 5y ago
      Increasing pay might protect your company, but every security expert you hire is a security expert that just quit another company. So in the end the world lacks security experts right now. The main way increasing pay would help is that more people would try to get into the field and supply of talent might be better in a few years, but it wont do much for supply today.
    - ethbr0 5y ago
  - px43 5y ago
    This really isn't all that hard, technically. (I've been in infosec for about 20 years now) 1. MFA all the things 2. don't disable windows updates 3. don't give Domain Admin rights to half the company 4. don't use shitty software For some reason, companies refuse to do these simple steps, and then they get hacked. It's not a technical problem, it's a political problem. Sysadmins naturally want to run their networks in the least secure way possible, and in shitty orgs, there's no one there to stop them. Over and over again, it's the same thing, and it's hard to have sympathy when standard security posture seems to be getting more and more lax as time goes on.
    - belter 5y ago
      You do realize the implication given by step 2 and point 4 are a contradiction in itself :-) ? Most large corporate ransomware attacks spread by hosting into the Active Directory Domain server. It will slowly spread to each corporate machine as the users log in. It seems this was the way Software AG, the second largest German software company, was hit by Clop. As they did not pay the ransom their private emails are available on the internet, scans of their CEO passport etc... https://www.cpomagazine.com/cyber-security/clop-ransomware-attack-hits-german-software-giant-software-ag-confidential-documents-stolen-23-million-ransom-demanded/ https://www.cpomagazine.com/cyber-security/clop-ransomware-a... Maybe ransomware gangs will finally prompt the industry to fix security practices...Also, maybe the technical stack that most companies hit by these ransomware attacks use, should be mentioned every time we see these news ;-)
      - px43 5y ago
        > You do realize the implication given by step 2 and point 4 are a contradiction in itself :-) ? Absolutely. Microsoft is a mess. I could go on for hours about how Windows networks are fundamentally insecure, and cannot be fixed without a massive psychological shift. Sysadmins love it though for some reason, probabally because it gives them way more power than they should ever need over their users. I love hearing war stories from people who worked offense at places like Google, with almost zero AD footprint. Even the most basic attacks take SOOO much more effort. I would love it if a ChromeOS centric Zero Trust model actually became a thing, but it's not going to happen naturally. Maybe if we let all these ransomwared companies fail spectacularly, and refuse to bail them out, then the only companies that will be left will be those who care. Unfortunately telling people not to use Windows rarely goes over well. To that main point, as bad as Microsoft is, there are so many companies that are so much worse. This Kaseya thing is essentially a rootkit with shitty authentication. Installing this thing on endpoints is a fundamentally flawed concept, yet here we are.
  - seventytwo 5y ago
    I’m interested in transitioning from electrical hardware design to an info sec role. Any tips? I’m already doing some coursera work and going through everything on tryhackme. My goal is to get a few industry certa under my belt and then start applying for jobs. Thoughts?
    - djrogers 5y ago
      That sounds about right - don’t despise small beginnings, you will likely need to work a few stints as an L1 SOC analyst to start getting a feel for what the problem set and processes are really like, but the smart L1s can usually progress rapidly. If you find yourself in a SOC a where everyone is stressed out and nobody has any mobility, learn what you can then move on.
      - seventytwo 5y ago
        Thanks! It will be a little strange to go from a senior role to an entry role, but I’d assumed that would be the case!
  - anoncake 5y ago
    So there are plenty of people who can "prove" they are qualified, but few who actually are?
- amelius 5y ago
  Sadly, security will always be last on the budget list.
rightbyte 5y ago
Having cashier machines that does not work offline is a bad idea. Closing almost all stores sounds expensive.
- swarnie_ 5y ago
  How would you propose recording electronic payments and linking data back to restock/procurement while offline?
  - atatatat 5y ago
    Couch/Pouch offline-first PWA Manual fallback option when the most predictable failure scenario happens (only backend server fails)
  - rightbyte 5y ago
    Like they used to do it? Store the transactions locally and send them later. Taxis still do that with their terminals.
  - gpm 5y ago
    A credit card imprinting machine [1], and paper records of inventory change that can be uploaded afterwards. [1] https://www.youtube.com/watch?v=a7wutgAlNHk https://www.youtube.com/watch?v=a7wutgAlNHk A few years ago, during a power outage, a stores clerk actually used one of these for/on me. I was pretty shocked ;)
    - ceejayoz 5y ago
      Most of my cards don’t have embossed numbers these days.
      - gpm 5y ago
        Strange, I think all credit (not debit) cards here do. Might be regional.
        5y ago
moogly 5y ago
Swedish media is reporting that this is part of the Kaseya hack; Coop's hosting partner Visma Esscom was using Kaseya's remote management tool.
barbarbar 5y ago
How do the attackers get into their network? Is it due to compromised Windows servers?
- dadver 5y ago
  Kaseya VSA, an RMM tool, have been attacked, creating a supply-chain attack against many, many MSPs and other customers using Kaseya. In part you could say that this is due to compromised Windows servers, but IMO that's a sloppy description that invites theories about the problem being Windows security. The problem here is Kaseya's security and a supply-chain attack isn't unique to Windows. More information: * https://news.ycombinator.com/item?id=27718529 https://news.ycombinator.com/item?id=27718529 * https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689 https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689 * https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransomware_incident_in_progress/ https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransom...
  - barbarbar 5y ago
    That was very informative. So there is more to it than what I thought. Thank you.
  - wrycoder 5y ago
    [An MSP (Managed Service Provider)] makes experts in lower-wage locations available to companies in high-cost place. An MSP can replace a company's IT department entirely, or provide a single niche service. The industry is evolving to provide expertise to all points of the globe and makes cutting-edge technology available at a low price. [0] How's that working for you? [0] https://www.atera.com/what-is-an-msp/ https://www.atera.com/what-is-an-msp/ Note: It's interesting that the above quote, copied directly from the DDG search for "MSP", differs from what is currently at the url listed in the search item.
l33tman 5y ago
The impact is that 20% of Sweden's food supply is locked out. This is larger than what it seems, not just for Swedish meatballs - the underlying Kaseya hack is global. It's truly scary that you can get into these kinds of situations (completely relying on a 3rd party IT), but it's also very costly to have a doubled setup :/
- Scoundreller 5y ago
  It’s less about doubled setups and more about downtime procedures that don’t have to be perfect but get you by to stay functioning at some level.
  - Taek 5y ago
    Agreed, pretty much every physical operation (stores, logistics, etc) should have plans to continue operating when their IT is down. Losing access to dynamic pricing and loyalty discounts is better than closing up entirely.
    - miohtama 5y ago
      This gets hard in no cash society, like what Sweden is already.
      - haskellandchill 5y ago
        with pen and paper books can be kept
        miohtama 5y ago
        But you cannot pay with a pen at a cash registry
        Scoundreller 5y ago
        It’s a co-op store. They know who you are.
Scoundreller 5y ago
A less horrible link with more content and less ads: https://www.voanews.com/europe/major-swedish-supermarket-chain-hit-cyberattack https://www.voanews.com/europe/major-swedish-supermarket-cha...
ArkanExplorer 5y ago
Cryptocurrencies need to be banned to help stop these attacks. If corporations in the West cannot buy the coins legally, they will not be able to pay the ransoms, and the attack frequency and intensity will fall. On top of that, we'll also reduce electricity and computer chip waste, since mining activity will decrease as the price plummets. Its a lot harder to justify huge attacks when your payment is in gift cards, compared to semi-anonymous crypto that can be cashed out in your 2nd world country of choice.
- sumedh 5y ago
  > they will not be able to pay the ransoms Why cant the hackers tell the victims to transfer dollars/ruble to a Russian bank or some other bank in a country which is not friendly to the US?
  - likecarter 5y ago
    Because then you could directly implicate Russia. Russia Gov is involved, but not publicly.
    - sumedh 5y ago
      What is the US going to if it directly implicates Russia?
  - pjc50 5y ago
    Financial sanctions?
    - sumedh 5y ago
      Russia is already under sanctions, what more can US do?
- kube-system 5y ago
  It’s already of dubious legality in some situations, like in the instance that the criminal organization is sanctioned. But, corporations are often not paying these ransoms directly, they hire an intermediary to pay it for them. If the west bans crypto, those intermediaries will just fly an employee to wherever they can send it.
cpach 5y ago
This is not good. OTOH until the incident is resolved one could instead go shopping at ICA, Hemköp, City Gross, ÖoB, Tempo or independent stores. I guess the customers that are hit the hardest are the ones who aren’t mobile and only have a Coop store nearby.
- 88840-8855 5y ago
  What is a the Coop store and why is it bad? Edit: I really think I am surrounded by huge arrogant morons sometimes. Why do you downvote a fucking question? I got that this fucking shop is the hero of the story, but I do want to know about the concept. Fucking idiots - at least comment when you vote.
  - tazjin 5y ago
    Coop is the chain the article we're commenting on is about.
  - cpach 5y ago
    “Coop” is the supermarket chain that TFA is referring to. It’s bad because they will lose revenue and the customers can’t shop there currently.
  - deleted 5y ago
    [deleted]
  - ncallaway 5y ago
    I downvoted this comment, mostly for the tone and attitude of the edit. I get that downvotes are frustrating, especially when you don’t understand why you’re receiving them. I think your edit is generally not a constructive or helpful response to that.
    - wrycoder 5y ago
      If the original comment was "What is a the Coop store and why is it bad?", that's just a reasonable question. The answer being, "Sometimes they are the only nearby store." But I also downvoted the egregious edit.
temptemptemp111 5y ago
The real issue is how everyone in the comments is actually more of an issue than the attacker. You all refuse to stop censoring and ignoring and shunning the thousands of people who publicly predicted these attacks... The WEF told us this "would happen" - but anything that is a "conspiracy theory" turns into the only story you're not allowed to tell.
cpach 5y ago
Related Ask HN thread – “What is your ransomware mitigation strategy?” https://news.ycombinator.com/item?id=27718990 https://news.ycombinator.com/item?id=27718990
kzrdude 5y ago
Interesting detail (swedish language) https://www.dn.se/ekonomi/global-utpressningsattack-bakom-stangda-coop-butiker/ https://www.dn.se/ekonomi/global-utpressningsattack-bakom-st... They are victims of a ransom attack, it's spread through the software in the checkout tills. There is a message on the client, for example on the till when you log in. This sounds a bit weird, but..
- hanche 5y ago
  Paywalled, unfortunately.
zibzab 5y ago
Doesn't Visma have pretty good security in general? They are big on intigrity att least.
deleted 5y ago
[deleted]
teddyh 5y ago
Another source in English: https://www.thelocal.se/20210703/major-swedish-supermarket-chain-hit-by-cyberattack/ https://www.thelocal.se/20210703/major-swedish-supermarket-c...
deleted 5y ago
[deleted]
dln_eintr 5y ago
Maybe using Windows + associated ecosystem for critical, embedded and control systems isn't and has never been a particularly stellar idea.
briefcomment 5y ago
Why was this predicted a year ago by NGOs [1]? Do they have some special insight into this that cyber security specialists didn't? Are these kinds of supply-chain attacks at this scale new, or newly enabled? Is this a technically impressive attack, or is this just a bunch of backdoors? [1] https://unlimitedhangout.com/2021/02/investigative-reports/from-event-201-to-cyber-polygon-the-wefs-simulation-of-a-coming-cyber-pandemic/ https://unlimitedhangout.com/2021/02/investigative-reports/f... Quotes below are from a different article from a source that HN won't let me post. Looks like only conspiracy theory sites are applying any scrutiny to this. > "The simulation, called Cyber Polygon 2021, was announced by Russia’s largest state-run bank Sberbank in February. > “The key message voiced by experts at WEF and other international platforms is that supply chain security is to become a major cybersecurity issue in 2021,” Sberbank stated. "
- number6 5y ago
  always thougt this to be an attempt to tap into a wider market, but maybe this is the next step after making the main target less attractive for attackers
amelius 5y ago
When is the government going to do pentesting on a large scale? It seems the only way to protect against these attacks.
- betaby 5y ago
  Governments of Canada and Hong Kong do tests against public IP space with the same country code. Results are not what one would expect - just a bunch of noise is send to CISOs, mostly about uh-oh your NTP server is wide open (it is not in fact). Usefulness of those test is very questionable.
  - corin_ 5y ago
    It's equally possible for a company's security team to do a shit job, that doesn't mean companies should not think about security. If those governments are doing a shit job it's an argument against doing it badly, not against doing it.
    - thatguy0900 5y ago
      I wonder if you could have some kind of mandated enrollment into a but bounty program
- user-the-name 5y ago
  A pretty good way to protect against them is to make them unprofitable. Ban cryptocurrency.
  - amelius 5y ago
    I've said it many times before, but nobody seems to listen.
mellosouls 5y ago
Beeb link fwiw (I assume this is the same co-operative movement as in the UK) https://www.bbc.co.uk/news/technology-57707530 https://www.bbc.co.uk/news/technology-57707530
xrayarx 5y ago
Related Ask HN: https://news.ycombinator.com/item?id=27415813 https://news.ycombinator.com/item?id=27415813
xrayarx 5y ago
Why is MFA supposed to be so much more secure? Aren’t they just sending an authentication hash just like password only? Haven’t these solutions been hacked too? Or am I missing something?

160 points by jnieminen 5y ago

MattGaiser 5y ago

For you security folks out there, are salaries spiking yet? His this impacted the market at all?

batch12 5y ago
Yeah, rates are going up. There is a deficit of talent. There are plenty of people with relevant degrees, but they lack fundamental knowledge related to systems and code.
- swarnie_ 5y ago
  Is it easy dealing with the hate from everyone else in your org? I understand why security is important but the majority of staff (particularly non-technical) see you as a blocker.
  - batch12 5y ago
    No hate. I am an enabler. I help our teams do what they need to do to move forward securely. When there is an issue, I respond to the event then quickly contain and remediate so business can continue. It is part of my job to help them understand this.
  - tjpnz 5y ago
    I'm a developer in an organisation with a large dedicated security team. I've been given advice but can't think of a time when I've been blocked.
  - beermonster 5y ago
    If the security team is a blocker it might be that they’ve been brought in too late. Security is everyone’s responsibility and creating an environment where it’s like this, and making it as easy as possible to get people to report stuff they see without playing the blame game is key to getting trust and demonstrating that togetherness. There’s only really hate in them v us type environments (I’ve seen it also in other cross team interactions like Dev v Ops for e.g.) or security teams blindly giving teams lists of controls to implement without having even done any kind of risk assessment with the asset owner (and quite possibly without taking other business risk priorities into account). As for convincing non-technical staff of the importance: The technical vulnerability (or whatever) needs relaying in business risk terms they can understand.
  - csydas 5y ago
    Really? What kind of staff are you talking about and what new implementations did they resist you on? And why? I'm curious cause while I'm not on my company's security team, due to heightened awareness and wanting to ensure we're protecting our trade secrets, etc, we've ramped up security in basically every way across the entire organization, and it's been basically a pleasant ride internally for all few thousand members of the company across the globe. The technical teams (dev, support) had some speed bumps, but a frank discussion with IT Security to discuss what our need was and why it wasn't being met, we found acceptable new routes. If anything, we've used the locking down of potential security risks as a leap-board to overhaul and optimize a LOT of workflows for the better. Our customers now, that's another story, and it's like trying to make a pet take medicine. Our largest customers are fine and understand (even appreciating) the security changes we made for our interactions, but a lot of the small business customers only care about the fact that they can't do what they previously used to in some cases. But I'm fairly curious what resistance people are seeing from their implementations and what these implementations are.
    - zdragnar 5y ago
      Like any other department, when security is too isolated from others, it creates a culture of perverse incentives and competition rather than collaboration to a shared goal. For example, try building a new website for a company, only to have the security team insist that you fix "defects" such as not tying sessions to IP addresses. Yeah, fuck all the people on mobile phones hopping between networks. It would make sense for accessing internal data, but not for what amounted to a marketing site for public consumption. Like I said at the open, this can happen with any department or team- security, I think, might tend to happen a little more frequently, if only because it is logical that they do need a certain amount of autonomy to do their jobs well.
  - Nursie 5y ago
    I love working with good Infosec people, I want to deliver secure software. Good Infosec people are as rare as hen’s teeth.
  - the8472 5y ago
    Hate is reserved for the "if checkbox is not checked we kill your project by end of week" and "the form doesn't have (client-side) validation, that's a OWASP vulnerability" kind of "pentest" teams. People who don't even reply when you're asking which threat model we're defending against.
- generated 5y ago
  Best way to capitalize on this? Infosec employees follow the same anemic HR compensation song and dance, often lumped in with all engineering as a category. Security startups are known as "cockroaches," they never die but are a hard bunch to grow into unicorns. Contracting really only seems amenable to a small bump in lifestyle business level rates.
  - batch12 5y ago
    A method to transition people from related fields would be the most beneficial. Taking someone with a background in systems administration or programming and nailing on the security skillset would be more effective than taking someone who knows all security concepts and thats it. The best way for a practitioner to personally capitalize depends on their background. For instance, someone with infrastructure support experience may make an excellent incident responder. Someone who deeply understands how systems would could be a talented pentester. Edit: From a compensation perspective the solution is to take your growing experience to the next company willing to pay for it.
    - randmeerkat 5y ago
      The problem is it isn’t about nailing on the security skillset. It’s about executive motivation.“Security” is all about doing enough to shift liability and nothing more. Until executives are liable for security breaches this will continue.
      - CrazyCatDog 5y ago
        Actually, this smells a lot like a financing decision. Delay near term revenue to ultimately land a bigger purse down the line with additional features or bugs squashed provided the competition doesn’t beat us to the finish line. As the enterprise grows (customers/features -> lines of code) the liability associated with an attack increases—suggesting more care is needed with every release. And, knowing that you cannot keep up with scale by adding workers in parallel implies the following unsubstantiated claim: As a piece of software grows in length, the releases must be fewer and further apart. Otherwise, the team is taking shortcuts and the liability will eventually catch up with them. With that framework in mind: if large software company X stretches out their release schedule, their share price will fall, eventually appealing to activists who want to control/replace leadership (ironically for doing the right thing). I’m a true and through capitalist—please don’t get me wrong, but this is creative destruction at its finest!
- tremon 5y ago
  I think the talent is there, but the pay is lacking. Besides, no one has ever gotten a raise for carefully avoiding even the most common of vulnerabilities because that would only delay "the product".
  - runeks 5y ago
    How would a random hiring manager know who to hire? There are surely people out there who know security, but how does someone who doesn’t know security choose the right people to hire? The very software that was the vector of this attack is produced by a company claiming to improve security.
  - cpach 5y ago
    When you say the pay is lacking then I’m curious what region you refer to. I’m pretty certain that the pay isn’t lacking in Silicon Valley for example.
    - heurisko 5y ago
      In my experience, in practice a software engineer salary in England is usually advertised in the range, or just below, other middle-class jobs, such as a solicitor.
      - cpach 5y ago
        I can imagine so. That is probably true for many regions in Europe. But I would betcha it’s not true for London though.
  - username90 5y ago
    Increasing pay might protect your company, but every security expert you hire is a security expert that just quit another company. So in the end the world lacks security experts right now. The main way increasing pay would help is that more people would try to get into the field and supply of talent might be better in a few years, but it wont do much for supply today.
  - ethbr0 5y ago
- px43 5y ago
  This really isn't all that hard, technically. (I've been in infosec for about 20 years now) 1. MFA all the things 2. don't disable windows updates 3. don't give Domain Admin rights to half the company 4. don't use shitty software For some reason, companies refuse to do these simple steps, and then they get hacked. It's not a technical problem, it's a political problem. Sysadmins naturally want to run their networks in the least secure way possible, and in shitty orgs, there's no one there to stop them. Over and over again, it's the same thing, and it's hard to have sympathy when standard security posture seems to be getting more and more lax as time goes on.
  - belter 5y ago
    You do realize the implication given by step 2 and point 4 are a contradiction in itself :-) ? Most large corporate ransomware attacks spread by hosting into the Active Directory Domain server. It will slowly spread to each corporate machine as the users log in. It seems this was the way Software AG, the second largest German software company, was hit by Clop. As they did not pay the ransom their private emails are available on the internet, scans of their CEO passport etc... https://www.cpomagazine.com/cyber-security/clop-ransomware-attack-hits-german-software-giant-software-ag-confidential-documents-stolen-23-million-ransom-demanded/ https://www.cpomagazine.com/cyber-security/clop-ransomware-a... Maybe ransomware gangs will finally prompt the industry to fix security practices...Also, maybe the technical stack that most companies hit by these ransomware attacks use, should be mentioned every time we see these news ;-)
    - px43 5y ago
      > You do realize the implication given by step 2 and point 4 are a contradiction in itself :-) ? Absolutely. Microsoft is a mess. I could go on for hours about how Windows networks are fundamentally insecure, and cannot be fixed without a massive psychological shift. Sysadmins love it though for some reason, probabally because it gives them way more power than they should ever need over their users. I love hearing war stories from people who worked offense at places like Google, with almost zero AD footprint. Even the most basic attacks take SOOO much more effort. I would love it if a ChromeOS centric Zero Trust model actually became a thing, but it's not going to happen naturally. Maybe if we let all these ransomwared companies fail spectacularly, and refuse to bail them out, then the only companies that will be left will be those who care. Unfortunately telling people not to use Windows rarely goes over well. To that main point, as bad as Microsoft is, there are so many companies that are so much worse. This Kaseya thing is essentially a rootkit with shitty authentication. Installing this thing on endpoints is a fundamentally flawed concept, yet here we are.
- seventytwo 5y ago
  I’m interested in transitioning from electrical hardware design to an info sec role. Any tips? I’m already doing some coursera work and going through everything on tryhackme. My goal is to get a few industry certa under my belt and then start applying for jobs. Thoughts?
  - djrogers 5y ago
    That sounds about right - don’t despise small beginnings, you will likely need to work a few stints as an L1 SOC analyst to start getting a feel for what the problem set and processes are really like, but the smart L1s can usually progress rapidly. If you find yourself in a SOC a where everyone is stressed out and nobody has any mobility, learn what you can then move on.
    - seventytwo 5y ago
      Thanks! It will be a little strange to go from a senior role to an entry role, but I’d assumed that would be the case!
- anoncake 5y ago
  So there are plenty of people who can "prove" they are qualified, but few who actually are?
amelius 5y ago
Sadly, security will always be last on the budget list.

rightbyte 5y ago

Having cashier machines that does not work offline is a bad idea. Closing almost all stores sounds expensive.

swarnie_ 5y ago
How would you propose recording electronic payments and linking data back to restock/procurement while offline?
- atatatat 5y ago
  Couch/Pouch offline-first PWA Manual fallback option when the most predictable failure scenario happens (only backend server fails)
- rightbyte 5y ago
  Like they used to do it? Store the transactions locally and send them later. Taxis still do that with their terminals.
- gpm 5y ago
  A credit card imprinting machine [1], and paper records of inventory change that can be uploaded afterwards. [1] https://www.youtube.com/watch?v=a7wutgAlNHk https://www.youtube.com/watch?v=a7wutgAlNHk A few years ago, during a power outage, a stores clerk actually used one of these for/on me. I was pretty shocked ;)
  - ceejayoz 5y ago
    Most of my cards don’t have embossed numbers these days.
    - gpm 5y ago
      Strange, I think all credit (not debit) cards here do. Might be regional.
      - 5y ago

moogly 5y ago

Swedish media is reporting that this is part of the Kaseya hack; Coop's hosting partner Visma Esscom was using Kaseya's remote management tool.

barbarbar 5y ago

How do the attackers get into their network? Is it due to compromised Windows servers?

dadver 5y ago
Kaseya VSA, an RMM tool, have been attacked, creating a supply-chain attack against many, many MSPs and other customers using Kaseya. In part you could say that this is due to compromised Windows servers, but IMO that's a sloppy description that invites theories about the problem being Windows security. The problem here is Kaseya's security and a supply-chain attack isn't unique to Windows. More information: * https://news.ycombinator.com/item?id=27718529 https://news.ycombinator.com/item?id=27718529 * https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689 https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689 * https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransomware_incident_in_progress/ https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransom...
- barbarbar 5y ago
  That was very informative. So there is more to it than what I thought. Thank you.
- wrycoder 5y ago
  [An MSP (Managed Service Provider)] makes experts in lower-wage locations available to companies in high-cost place. An MSP can replace a company's IT department entirely, or provide a single niche service. The industry is evolving to provide expertise to all points of the globe and makes cutting-edge technology available at a low price. [0] How's that working for you? [0] https://www.atera.com/what-is-an-msp/ https://www.atera.com/what-is-an-msp/ Note: It's interesting that the above quote, copied directly from the DDG search for "MSP", differs from what is currently at the url listed in the search item.

l33tman 5y ago

The impact is that 20% of Sweden's food supply is locked out. This is larger than what it seems, not just for Swedish meatballs - the underlying Kaseya hack is global. It's truly scary that you can get into these kinds of situations (completely relying on a 3rd party IT), but it's also very costly to have a doubled setup :/

Scoundreller 5y ago
It’s less about doubled setups and more about downtime procedures that don’t have to be perfect but get you by to stay functioning at some level.
- Taek 5y ago
  Agreed, pretty much every physical operation (stores, logistics, etc) should have plans to continue operating when their IT is down. Losing access to dynamic pricing and loyalty discounts is better than closing up entirely.
  - miohtama 5y ago
    This gets hard in no cash society, like what Sweden is already.
    - haskellandchill 5y ago
      with pen and paper books can be kept
      - miohtama 5y ago
        But you cannot pay with a pen at a cash registry
        Scoundreller 5y ago
        It’s a co-op store. They know who you are.

Scoundreller 5y ago

A less horrible link with more content and less ads: https://www.voanews.com/europe/major-swedish-supermarket-chain-hit-cyberattack https://www.voanews.com/europe/major-swedish-supermarket-cha...

ArkanExplorer 5y ago

Cryptocurrencies need to be banned to help stop these attacks. If corporations in the West cannot buy the coins legally, they will not be able to pay the ransoms, and the attack frequency and intensity will fall. On top of that, we'll also reduce electricity and computer chip waste, since mining activity will decrease as the price plummets. Its a lot harder to justify huge attacks when your payment is in gift cards, compared to semi-anonymous crypto that can be cashed out in your 2nd world country of choice.

sumedh 5y ago
> they will not be able to pay the ransoms Why cant the hackers tell the victims to transfer dollars/ruble to a Russian bank or some other bank in a country which is not friendly to the US?
- likecarter 5y ago
  Because then you could directly implicate Russia. Russia Gov is involved, but not publicly.
  - sumedh 5y ago
    What is the US going to if it directly implicates Russia?
- pjc50 5y ago
  Financial sanctions?
  - sumedh 5y ago
    Russia is already under sanctions, what more can US do?
kube-system 5y ago
It’s already of dubious legality in some situations, like in the instance that the criminal organization is sanctioned. But, corporations are often not paying these ransoms directly, they hire an intermediary to pay it for them. If the west bans crypto, those intermediaries will just fly an employee to wherever they can send it.

cpach 5y ago

This is not good. OTOH until the incident is resolved one could instead go shopping at ICA, Hemköp, City Gross, ÖoB, Tempo or independent stores. I guess the customers that are hit the hardest are the ones who aren’t mobile and only have a Coop store nearby.

88840-8855 5y ago
What is a the Coop store and why is it bad? Edit: I really think I am surrounded by huge arrogant morons sometimes. Why do you downvote a fucking question? I got that this fucking shop is the hero of the story, but I do want to know about the concept. Fucking idiots - at least comment when you vote.
- tazjin 5y ago
  Coop is the chain the article we're commenting on is about.
- cpach 5y ago
  “Coop” is the supermarket chain that TFA is referring to. It’s bad because they will lose revenue and the customers can’t shop there currently.
- deleted 5y ago
  [deleted]
- ncallaway 5y ago
  I downvoted this comment, mostly for the tone and attitude of the edit. I get that downvotes are frustrating, especially when you don’t understand why you’re receiving them. I think your edit is generally not a constructive or helpful response to that.
  - wrycoder 5y ago
    If the original comment was "What is a the Coop store and why is it bad?", that's just a reasonable question. The answer being, "Sometimes they are the only nearby store." But I also downvoted the egregious edit.

temptemptemp111 5y ago

The real issue is how everyone in the comments is actually more of an issue than the attacker. You all refuse to stop censoring and ignoring and shunning the thousands of people who publicly predicted these attacks... The WEF told us this "would happen" - but anything that is a "conspiracy theory" turns into the only story you're not allowed to tell.

cpach 5y ago

Related Ask HN thread – “What is your ransomware mitigation strategy?” https://news.ycombinator.com/item?id=27718990 https://news.ycombinator.com/item?id=27718990

kzrdude 5y ago

Interesting detail (swedish language) https://www.dn.se/ekonomi/global-utpressningsattack-bakom-stangda-coop-butiker/ https://www.dn.se/ekonomi/global-utpressningsattack-bakom-st... They are victims of a ransom attack, it's spread through the software in the checkout tills. There is a message on the client, for example on the till when you log in. This sounds a bit weird, but..

hanche 5y ago
Paywalled, unfortunately.

zibzab 5y ago

Doesn't Visma have pretty good security in general? They are big on intigrity att least.

deleted 5y ago

[deleted]

teddyh 5y ago

Another source in English: https://www.thelocal.se/20210703/major-swedish-supermarket-chain-hit-by-cyberattack/ https://www.thelocal.se/20210703/major-swedish-supermarket-c...

deleted 5y ago

[deleted]

dln_eintr 5y ago

Maybe using Windows + associated ecosystem for critical, embedded and control systems isn't and has never been a particularly stellar idea.

briefcomment 5y ago

Why was this predicted a year ago by NGOs [1]? Do they have some special insight into this that cyber security specialists didn't? Are these kinds of supply-chain attacks at this scale new, or newly enabled? Is this a technically impressive attack, or is this just a bunch of backdoors? [1] https://unlimitedhangout.com/2021/02/investigative-reports/from-event-201-to-cyber-polygon-the-wefs-simulation-of-a-coming-cyber-pandemic/ https://unlimitedhangout.com/2021/02/investigative-reports/f... Quotes below are from a different article from a source that HN won't let me post. Looks like only conspiracy theory sites are applying any scrutiny to this. > "The simulation, called Cyber Polygon 2021, was announced by Russia’s largest state-run bank Sberbank in February. > “The key message voiced by experts at WEF and other international platforms is that supply chain security is to become a major cybersecurity issue in 2021,” Sberbank stated. "

number6 5y ago
always thougt this to be an attempt to tap into a wider market, but maybe this is the next step after making the main target less attractive for attackers

amelius 5y ago

When is the government going to do pentesting on a large scale? It seems the only way to protect against these attacks.

betaby 5y ago
Governments of Canada and Hong Kong do tests against public IP space with the same country code. Results are not what one would expect - just a bunch of noise is send to CISOs, mostly about uh-oh your NTP server is wide open (it is not in fact). Usefulness of those test is very questionable.
- corin_ 5y ago
  It's equally possible for a company's security team to do a shit job, that doesn't mean companies should not think about security. If those governments are doing a shit job it's an argument against doing it badly, not against doing it.
  - thatguy0900 5y ago
    I wonder if you could have some kind of mandated enrollment into a but bounty program
user-the-name 5y ago
A pretty good way to protect against them is to make them unprofitable. Ban cryptocurrency.
- amelius 5y ago
  I've said it many times before, but nobody seems to listen.

mellosouls 5y ago

Beeb link fwiw (I assume this is the same co-operative movement as in the UK) https://www.bbc.co.uk/news/technology-57707530 https://www.bbc.co.uk/news/technology-57707530

xrayarx 5y ago

Related Ask HN: https://news.ycombinator.com/item?id=27415813 https://news.ycombinator.com/item?id=27415813

xrayarx 5y ago

Why is MFA supposed to be so much more secure? Aren’t they just sending an authentication hash just like password only? Haven’t these solutions been hacked too? Or am I missing something?