5 ms·

People are worried about the wrong stuff. SolarWinds was bad but it was likely intel operation. They wanted access to networks for intelligence purposes. They j

People are worried about the wrong stuff. SolarWinds was bad but it was likely intel operation. They wanted access to networks for intelligence purposes. They jacked it so they could access assets behind corp firewalls. Spys will always try to spy. IMHO the Kaseya hack was far worse, maybe worse than WannaCry but with better outcomes. This was a criminal operation, provided by criminal software suppliers that really was only resolved when the keys were leaked on a forum. The rumor is that local intelligence forced the disclosure of the keys (eg: guns to heads), because this is pretty much the destroy the world scenario that is unstoppable. It is easy easy for attackers to cause billions of dollars of damage in a day. Its not getting better. It can't. Our systems are designed for large scope of trust with massive surface areas. Security is a game where the defenders cannot mess up once. Its hopelessly asymmetric and can never be better.

ep103 5y ago
we can start by repealing laws that give corporate entities immunity when data is leaked. Make them liable for lawsuits with set minimum damage amounts for exposed data, and one would be able to watch the money flow into better tech security on a society-wide scale.
- ClumsyPilot 5y ago
  We can also add a prohibition on three-letter agencies installing purposeful backdoors which are later exploited by criminals. Maybe it's time they actually were helping regular citizen protect themselves and their privacy, instead of playing chicken with their counterparts abroad.
  - acdha 5y ago
    I support that but … how often has that happened? That Juniper incident didn’t seem to be widespread and it certainly doesn’t appear that a notable percentage of breaches are due that kind of thing.
    - fragmede 5y ago
      Except we don't know most of the hacks going on, so we definitely don't know how they happened. Eg we'll never know how many hacks were due to Debian's SSH fiasco but I bet you it's far from zero.
      - acdha 5y ago
        We don’t know everything but think about how many we do get details about showing nothing of the sort. It seems conspiratorial to assume that this happens often but is always hushed up.
  - willcipriano 5y ago
    Simpler and more effective solution: Do as JFK suggested and "splinter the CIA into a thousand pieces and scatter it into the winds".
    - arminiusreturns 5y ago
      ...and we saw what happened to him. JFK and RFK's death together were a foreign and domestic policy coup. Ask yourself, by whom? Coincidence theorists are the real crazies.
- AmericanChopper 5y ago
  What laws do you imagine grant corporate entities immunity? The companies are victims of the crime in this case, along with their customers. There is no special law that grants corporations criminal immunity from falling victim to a crime, because that’s not illegal. If you look at how this sort of thing is regulated, there’s two general approaches. The first is creating a category of data that requires special protections, and defining a standard for protecting it. Either through legislation (like HIPAA), or self-regulation (like PCI). The other is to specify a requirement to protect all PII, but not define any specific standard for protecting it, only prescribing penalties for failing to do so (when seems to be what the EUs regulatory approach is). Both of these approaches are problematic. Is it self-evident that any breached data was not sufficiently protected? I don’t think any experienced professional would agree. It is impossible to build a system that is completely protected from being potentially compromised, and it’s possible for a largely unprotected system to last its entire lifespan without being compromised. So the simple fact that a system has been compromised doesn’t necessarily reveal any information about how adequately protected it was. On the other hand, is there a single security standard that’s widely regarded as being good? I don’t think there is. The ones that are generally regarded as the best I would personally consider to be not bad, but not great. One size fits all solutions tend to find a lot of not fit for purpose use cases as well. It’s also not apparent to me at all that spending more money on security achieves better security outcomes. I’ve worked in numerous large enterprises that spend enormous sums of money on security budgets, and manage to achieve very little with it. So I don’t think you’re going to get much consensus on that being a suitable metric for how adequate a company’s security systems are either. You could easily devise a system that punishes companies for falling victims to these attacks. But that’s the only outcome it’s going to achieve. A punishment for being the victim of a crime.
sherr 5y ago
Thanks for the Kaseya reminder - it had vanished from my memory. For a period, these attacks seemed to be coming thick and fast. According to wikipedia [1] : 9 July 2021 - phone call between Joe Biden and Vladimir Putin. ... Biden later added that the United States would take the group's servers down if Putin did not 13 July 2021 - REvil websites and other infrastructure vanished from the internet 23 July, Kaseya announced it had received a universal decryptor tool I'd love to read the real story behind that. Perhaps "guns to heads" did happen. [1] https://en.wikipedia.org/wiki/Kaseya_VSA_ransomware_attack https://en.wikipedia.org/wiki/Kaseya_VSA_ransomware_attack
bostik 5y ago
> SolarWinds was bad but it was likely intel operation. s/likely/definitely/ Yes, tens of thousands of companies were hit by the trojaned update. IIRC, only 30 or so companies were then exposed to the second- and third-stage malware. The attackers were very careful: for grand majority of affected companies the functionality was disabled shortly after infection. I have heard two plausible theories why this might have been the case. One is that the attackers wanted to avoid detection as long as possible, and the ongoing additional egress traffic would have been easy to detect. Another is that they wanted to protect their infrastructure from being flooded and their collection systems from getting overwhelmed. Personally, I think it's a bit of both. If you're after intel and want to find needles in a haystack, the last thing you want is truckloads of more hay.

ep103 5y ago

we can start by repealing laws that give corporate entities immunity when data is leaked. Make them liable for lawsuits with set minimum damage amounts for exposed data, and one would be able to watch the money flow into better tech security on a society-wide scale.

ClumsyPilot 5y ago
We can also add a prohibition on three-letter agencies installing purposeful backdoors which are later exploited by criminals. Maybe it's time they actually were helping regular citizen protect themselves and their privacy, instead of playing chicken with their counterparts abroad.
- acdha 5y ago
  I support that but … how often has that happened? That Juniper incident didn’t seem to be widespread and it certainly doesn’t appear that a notable percentage of breaches are due that kind of thing.
  - fragmede 5y ago
    Except we don't know most of the hacks going on, so we definitely don't know how they happened. Eg we'll never know how many hacks were due to Debian's SSH fiasco but I bet you it's far from zero.
    - acdha 5y ago
      We don’t know everything but think about how many we do get details about showing nothing of the sort. It seems conspiratorial to assume that this happens often but is always hushed up.
- willcipriano 5y ago
  Simpler and more effective solution: Do as JFK suggested and "splinter the CIA into a thousand pieces and scatter it into the winds".
  - arminiusreturns 5y ago
    ...and we saw what happened to him. JFK and RFK's death together were a foreign and domestic policy coup. Ask yourself, by whom? Coincidence theorists are the real crazies.
AmericanChopper 5y ago
What laws do you imagine grant corporate entities immunity? The companies are victims of the crime in this case, along with their customers. There is no special law that grants corporations criminal immunity from falling victim to a crime, because that’s not illegal. If you look at how this sort of thing is regulated, there’s two general approaches. The first is creating a category of data that requires special protections, and defining a standard for protecting it. Either through legislation (like HIPAA), or self-regulation (like PCI). The other is to specify a requirement to protect all PII, but not define any specific standard for protecting it, only prescribing penalties for failing to do so (when seems to be what the EUs regulatory approach is). Both of these approaches are problematic. Is it self-evident that any breached data was not sufficiently protected? I don’t think any experienced professional would agree. It is impossible to build a system that is completely protected from being potentially compromised, and it’s possible for a largely unprotected system to last its entire lifespan without being compromised. So the simple fact that a system has been compromised doesn’t necessarily reveal any information about how adequately protected it was. On the other hand, is there a single security standard that’s widely regarded as being good? I don’t think there is. The ones that are generally regarded as the best I would personally consider to be not bad, but not great. One size fits all solutions tend to find a lot of not fit for purpose use cases as well. It’s also not apparent to me at all that spending more money on security achieves better security outcomes. I’ve worked in numerous large enterprises that spend enormous sums of money on security budgets, and manage to achieve very little with it. So I don’t think you’re going to get much consensus on that being a suitable metric for how adequate a company’s security systems are either. You could easily devise a system that punishes companies for falling victims to these attacks. But that’s the only outcome it’s going to achieve. A punishment for being the victim of a crime.

sherr 5y ago

Thanks for the Kaseya reminder - it had vanished from my memory. For a period, these attacks seemed to be coming thick and fast. According to wikipedia [1] : 9 July 2021 - phone call between Joe Biden and Vladimir Putin. ... Biden later added that the United States would take the group's servers down if Putin did not 13 July 2021 - REvil websites and other infrastructure vanished from the internet 23 July, Kaseya announced it had received a universal decryptor tool I'd love to read the real story behind that. Perhaps "guns to heads" did happen. [1] https://en.wikipedia.org/wiki/Kaseya_VSA_ransomware_attack https://en.wikipedia.org/wiki/Kaseya_VSA_ransomware_attack

bostik 5y ago

> SolarWinds was bad but it was likely intel operation. s/likely/definitely/ Yes, tens of thousands of companies were hit by the trojaned update. IIRC, only 30 or so companies were then exposed to the second- and third-stage malware. The attackers were very careful: for grand majority of affected companies the functionality was disabled shortly after infection. I have heard two plausible theories why this might have been the case. One is that the attackers wanted to avoid detection as long as possible, and the ongoing additional egress traffic would have been easy to detect. Another is that they wanted to protect their infrastructure from being flooded and their collection systems from getting overwhelmed. Personally, I think it's a bit of both. If you're after intel and want to find needles in a haystack, the last thing you want is truckloads of more hay.