3 ms·

I wonder how long these vulnerabilities have been exploited, with the attackers waiting for specific—possibly political—timing to actually execute the attack an

I wonder how long these vulnerabilities have been exploited, with the attackers waiting for specific—possibly political—timing to actually execute the attack and demand ransom. there could be plenty more exploited systems out there, just waiting for the ransom attack to execute when the attacker sees fit.

hn_throwaway_99 5y ago
> with the attackers waiting for specific—possibly political—timing to actually execute the attack and demand ransom Your "possibly political" statement is conspiracy theory nonsense. It's entirely unsurprising that they launched the attack at the beginning of a long holiday weekend when there would be fewer eyes monitoring systems and able to pull plugs/remediate in the moment.
- adamrezich 5y ago
  > Your "possibly political" statement is conspiracy theory nonsense. what does this mean exactly? could you (or anyone else who shares this sentiment) elaborate?
  - runeks 5y ago
    What makes you think this attack was politically motivated?
    - adamrezich 5y ago
      nothing, especially because I haven't looked into it at all, and there probably is no reported evidence anyway. hence, my comment referring broadly to this wave of attacks, and my use of the qualifying "possibly." why is everyone (mainstream news, etc.) so quick to refer to any attack originating from a Russian IP address as "Russian" (either implied or directly stated to mean "Russian government")—yet positing that these attacks might have political motivations behind them is a "conspiracy theory"?
  - mc32 5y ago
    To me it means that the main motivator is maximizing financial success (by the perps). That means do it at a time where you get the best return. On the other hand, if they would try to make an administration look bad, then they would pick other times and targets. It’s like when people attack old ladies and other people known to carry cash and instead of looking first at criminal opportunism attribute it to people hating old ladies going to the ATM.
  - malfist 5y ago
    Simple. Things asserted without evidence can be dismissed without evidence.
    - adamrezich 5y ago
      right. if the replier above had said "you have no evidence for that claim" I would reply by saying "you are correct, it is however a possibility, surely we can agree on that?" but instead the replier used the term "conspiracy theory nonsense" to characterize my words, which is, to say the very least, a highly loaded term with built-in connotations. I personally believe that dismissing any sort of theorizing as being "conspiracy theory nonsense" is more harmful than any sort of benign theorizing itself. this line of thinking seems to assert that in reality, nothing ever happens with ulterior motives, people and groups in seats of power wouldn't do anything and everything to maintain said power under any circumstances, everything is just an isolated, random occurrence, geopolitics don't exist, and that looking for patterns and connections is something that only delusional people engage in. many people have been programmed to react to anything not commonly-accepted in the mainstream "narrative" by immediately labeling it a "conspiracy theory" and then refusing to think any more critically about it. I believe the rapid spread of this way of thinking to be incredibly dangerous to society as a whole. I am not saying that theorizing should be taken as fact, merely that theories shouldn't be dismissed entirely out of hand using a stock phrase. in fact, when discussing such things, or anything really, any sort of kneejerk word/phrase association-type response should give one pause, because these word/phrase associations are learned behavior, and it may be enlightening to determine the source of this learned behavior.
  - NaturalPhallacy 5y ago
    > Your "possibly political" statement is conspiracy theory nonsense. Back in my day we just called it FUD: Fear, Uncertainty, and Doubt When did FUD go out of style?
- 1e-9 5y ago
  Raising the possibility of political timing constitutes conspiracy theory nonsense? That seems extreme given the long history of state-sponsored attacks.
vmception 5y ago
Likely a long time One look at RDP markets show that reality Computers that you can remote desktop into are listed by location and bandwidth and price. UAS had over a million to choose from, blanketing the globe.
- KirillPanov 5y ago
  Why do people assume these aren't honeypot operations? Millions of compromised windows hosts rented out for $5 each to anybody who shows up at some onion site? Hard to believe. At those prices buckshot randomware and cryptomining would be profitable. What's easier to believe is that there are millions of SOCKS5 proxies out there (IoT/router/ancient-android-phone exploits) and a honeypot operation that will gladly spin up a Windows VM and let you pick which SOCKS5 proxy to use as an exit IP. And then observe everything the badguy-wannabe does with that VM.
iNane9000 5y ago
But the company said, "We don't believe that they were in our network," They wouldn’t say that if they weren’t 100% certain right? /s
lephty 5y ago
From the Reuters article: > "Because Voccola's firm was in the process of fixing a vulnerability in the software that was exploited by the hackers when the ransomware attack was executed, some information security professionals have speculated that the hackers might've been monitoring his company's communications from the inside." They might have rushed to exploit it before it was closed. Plus the long weekend. Or competitive pressure to exploit before someone else gets there first.

hn_throwaway_99 5y ago

> with the attackers waiting for specific—possibly political—timing to actually execute the attack and demand ransom Your "possibly political" statement is conspiracy theory nonsense. It's entirely unsurprising that they launched the attack at the beginning of a long holiday weekend when there would be fewer eyes monitoring systems and able to pull plugs/remediate in the moment.

adamrezich 5y ago
> Your "possibly political" statement is conspiracy theory nonsense. what does this mean exactly? could you (or anyone else who shares this sentiment) elaborate?
- runeks 5y ago
  What makes you think this attack was politically motivated?
  - adamrezich 5y ago
    nothing, especially because I haven't looked into it at all, and there probably is no reported evidence anyway. hence, my comment referring broadly to this wave of attacks, and my use of the qualifying "possibly." why is everyone (mainstream news, etc.) so quick to refer to any attack originating from a Russian IP address as "Russian" (either implied or directly stated to mean "Russian government")—yet positing that these attacks might have political motivations behind them is a "conspiracy theory"?
- mc32 5y ago
  To me it means that the main motivator is maximizing financial success (by the perps). That means do it at a time where you get the best return. On the other hand, if they would try to make an administration look bad, then they would pick other times and targets. It’s like when people attack old ladies and other people known to carry cash and instead of looking first at criminal opportunism attribute it to people hating old ladies going to the ATM.
- malfist 5y ago
  Simple. Things asserted without evidence can be dismissed without evidence.
  - adamrezich 5y ago
    right. if the replier above had said "you have no evidence for that claim" I would reply by saying "you are correct, it is however a possibility, surely we can agree on that?" but instead the replier used the term "conspiracy theory nonsense" to characterize my words, which is, to say the very least, a highly loaded term with built-in connotations. I personally believe that dismissing any sort of theorizing as being "conspiracy theory nonsense" is more harmful than any sort of benign theorizing itself. this line of thinking seems to assert that in reality, nothing ever happens with ulterior motives, people and groups in seats of power wouldn't do anything and everything to maintain said power under any circumstances, everything is just an isolated, random occurrence, geopolitics don't exist, and that looking for patterns and connections is something that only delusional people engage in. many people have been programmed to react to anything not commonly-accepted in the mainstream "narrative" by immediately labeling it a "conspiracy theory" and then refusing to think any more critically about it. I believe the rapid spread of this way of thinking to be incredibly dangerous to society as a whole. I am not saying that theorizing should be taken as fact, merely that theories shouldn't be dismissed entirely out of hand using a stock phrase. in fact, when discussing such things, or anything really, any sort of kneejerk word/phrase association-type response should give one pause, because these word/phrase associations are learned behavior, and it may be enlightening to determine the source of this learned behavior.
- NaturalPhallacy 5y ago
  > Your "possibly political" statement is conspiracy theory nonsense. Back in my day we just called it FUD: Fear, Uncertainty, and Doubt When did FUD go out of style?
1e-9 5y ago
Raising the possibility of political timing constitutes conspiracy theory nonsense? That seems extreme given the long history of state-sponsored attacks.

vmception 5y ago

Likely a long time One look at RDP markets show that reality Computers that you can remote desktop into are listed by location and bandwidth and price. UAS had over a million to choose from, blanketing the globe.

KirillPanov 5y ago
Why do people assume these aren't honeypot operations? Millions of compromised windows hosts rented out for $5 each to anybody who shows up at some onion site? Hard to believe. At those prices buckshot randomware and cryptomining would be profitable. What's easier to believe is that there are millions of SOCKS5 proxies out there (IoT/router/ancient-android-phone exploits) and a honeypot operation that will gladly spin up a Windows VM and let you pick which SOCKS5 proxy to use as an exit IP. And then observe everything the badguy-wannabe does with that VM.

iNane9000 5y ago

But the company said, "We don't believe that they were in our network," They wouldn’t say that if they weren’t 100% certain right? /s

lephty 5y ago

From the Reuters article: > "Because Voccola's firm was in the process of fixing a vulnerability in the software that was exploited by the hackers when the ransomware attack was executed, some information security professionals have speculated that the hackers might've been monitoring his company's communications from the inside." They might have rushed to exploit it before it was closed. Plus the long weekend. Or competitive pressure to exploit before someone else gets there first.