9 ms·

New Ransomware Reporting Rules for US Financial Institutions

72 points by keydutch 5y ago

noduerme 5y ago
I think forced reporting is a great idea, and a payment ban is an excellent idea. Here's why. A rational and responsible company that had invested wisely in its own IT infrastructure should not be under threat of a ransomware attack. If proper measures have been taken and they do come under attack, they should call on law enforcement to track down the adversary and call on public resources to mitigate the attack, all of which costs taxpayer money. As it stands, companies have incentive to cover up attacks because they won't invest in proper security. To an individual company, that's shortsighted and costly; to the country, in aggregate, it's both a national security threat and a huge drain on public and private resources which end up going to the worst possible place - to bolster scammers abroad. The government is well within its right to prevent large cash or crypto transfers overseas, even in normal circumstances. Ringing this bell will force more companies to take measures to shore up their rickety systems. There are 6-figure jobs aplenty out there to go into ABC Valve Manufacturing, rip out all their Win95 boxen and tell them what to buy, set it up and secure it for them.
- ideksec 5y ago
  While I agree with the sentiment around not paying, I don't think it's as simple as that. Calling on law enforcement to "track down the adversary" is not easy, and when you track it back to a random Russian cybercrime group what can you do with that information? A lot of these payments are not fortune 500 companies with unlimited IT budget, it's small or medium businesses with a 3 person IT team. Should they have proper off-site backups? Yes. Should we just let these companies go out of business until organizations learn their lesson? I would say no. I really like the idea of making payment more difficult and mandating organizations to report these incidents. You're correct, companies do have the incentive to cover things up. Banning payment won't stop that. I'm interested to see how people will circumvent this if the bill passes. If you pay a third-party company who "deal with the issue" on your behalf, all under legal privilege of course, would you still need to report?
  - gopher_space 5y ago
    > Should they have proper off-site backups? Yes. Should we just let these companies go out of business until organizations learn their lesson? I would say no. Can you expand on that? Bad management leading to criminal interaction seems like something we'd be better off without.
    - ryanlol 5y ago
      How about you stop dressing so slutty?
    - ideksec 5y ago
      An organization going out of business isn't just a case of bad management being eliminated. I wrote that line thinking of the clients I've worked with who've been hit by ransomware and didn't realize IT were not doing their job until it was too late. In some cases it's a failure on their part - not investing enough time or resources and seeing IT as "the guy who installs windows". More often than not, they were assured it was taken care of. I don't expect a manager of a car dealership to know if their Exchange server is running recent patches. If companies like SolarWinds and Kaseya can get popped and compromise their downstream customers, think of the number of small MSPs causing that same issue every day. I don't think a business should go under with people losing their jobs because IT screwed up. We would be better off without leadership who take no interest in security, and once a company is hit with a 100k ransomware bill you can bet they'll care going forward.
      - throw0101a 5y ago
        > More often than not, they were assured it was taken care of. I don't expect a manager of a car dealership to know if their Exchange server is running recent patches. You're not wrong, but would the same dealership be as blasé about the assurances from their accountant that all their taxes are being paid? Certainly no one can be an expert in everything, but regular audits from third parties of one's business at semi-regular intervals is prudent. We call in an external IT security auditor regularly ourselves to make sure we're not missing things and still following best practices.
- ebiester 5y ago
  ABC Valve Manufacturing is running on a 6% profit margin. That cost wipes out their entire profit margin for the year. (They are competing against people in other countries without the same constraint.) Now, perhaps this is an upstream problem. Perhaps the problem is that we have built systems that are nigh impossible to secure for small businesses. Perhaps we need laptop computers with no USB slots (no external keyboards.. no external mice.. no external monitors..) and no ability to install anything without going through an app store. This company (that makes its own operating system) also will tell you exactly the systems you can use. Everything is certified by this company to be secure and you pay them a yearly protection racket fee to assume liability. In return, you have no control over your computer. Very strict internet filters are on these computers - no stack overflow, no hacker news, just the systems that the business has paid for. This sounds dystopian to me. I'd hate to work there. However, that's literally the only solution I see for many businesses, because the current IT system is failing us.
  - tantalor 5y ago
    > cost wipes out their entire profit margin Comment suggested "calling on public resources to mitigate the attack" implying some sort of government funded program to upgrade old IT.
KennyBlanken 5y ago
This is of no utility until the DoJ and courts start punishing corporations for breaking laws and regulations in some meaningful way. Right now, even egregious violation of regulations results in a trivial financial payment and the charges are put on the shelf - and forgotten about if the corporation "behaves." In theory. In reality, companies can keep breaking the law, violating those agreements to 'behave' - and the DoJ / courts never pursue the matter.
- pas 5y ago
  you seem to be mixing up reporting regulations with the "we both know you did something shady but it was likely not explicitly illegal back then, so let's not go to court and waste each other's time, but let's never try that, and for this courtesy you pay us a few billion USD, mmkay?" deferred prosecution agreements. reporting regs are clear (clearer at least) than the other stuff.
crate_barre 5y ago
The irony of all of this is that the finance industry is providing all the liquidity for bitcoin so that their ransomware payments are actually worth something.
- ryanlol 5y ago
  There’s no irony here. Ransomware would keep going if cryptocurrency disappeared tomorrow, these people have the infrastructure to receive and launder huge wire transfers. Even the far less sophisticated african groups manage that, read the Hushpuppi indictment for an example.
  - pas 5y ago
    can you please provide a tldr on that wire transfer laundering thing? :o
    - tata71 5y ago
      Everywhere not the US & allies
      - ryanlol 5y ago
        Bullshit, these people have US and Canadian corporate accounts capable of cashing out millions at a time. You can easily get thousands of US personal accounts at short notice if you need them.
    - ryanlol 5y ago
      There’s a vast industry of people supplying services to cash out illicit wire transfers. The complexity depends on the amount. For individual amounts below 20-30k (craigslist scams, etc) you’ll be looking at personal bank accounts, usually created with fake IDs, but also sometimes using victims of various hiring scams. The fees you pay will largely depend on the country around 50% for US accounts, 20% or so for EU/UK accounts. For slightly bigger amounts (fancier craigslist scams, BEC) up to a quarter million or so, you’ll see lots of pretty plain corporate accounts. The fees remain pretty much the same. For the huge amounts (pretty much just BEC) like 5 million usd or more it starts to get complicated. At this point you begin to see offshore accounts for the first time, Hong Kong or just straight up PRC. But anything is possible, even US accounts can be arranged. Often someone will take over an existing business and their bank accounts, and then quickly run millions through them. At this level it’s hard to give an estimate on the fees, they are negotiable.
indymike 5y ago
I like the idea of a payment ban because it will force most companies to look at the systems that should be in place to prevent attacks. So many companies don't have working backups, and have not partitioned their systems in ways that prevent an attack (or accident, or corruption) from spreading from system to system. The disappointment is real when you tell the ransomware guy, "We're not paying. We just restored from backup."
- RattleyCooper 5y ago
  >The disappointment is real when you tell the ransomware guy, "We're not paying. We just restored from backup." Worked at a trucking company as a software dev and this exact thing happened. Got hit with ransomware attack but our IT team had daily backups of EVERYTHING. This was when ransomware was first "taking off" and they weren't even 100% sure if the attack was real. I wish I got to see the ransomware's operator's reaction, but I honestly feel like they probably had enough people falling for it so I doubt they really got that upset.
aaomidi 5y ago
The US stole money and resources from developing countries to get to where it is. Now the US is realizing they can get fucked as well. On a far far far smaller scale. Watching the government and people freak out about this has been very amusing.

72 points by keydutch 5y ago

I think forced reporting is a great idea, and a payment ban is an excellent idea. Here's why. A rational and responsible company that had invested wisely in its own IT infrastructure should not be under threat of a ransomware attack. If proper measures have been taken and they do come under attack, they should call on law enforcement to track down the adversary and call on public resources to mitigate the attack, all of which costs taxpayer money. As it stands, companies have incentive to cover up attacks because they won't invest in proper security. To an individual company, that's shortsighted and costly; to the country, in aggregate, it's both a national security threat and a huge drain on public and private resources which end up going to the worst possible place - to bolster scammers abroad. The government is well within its right to prevent large cash or crypto transfers overseas, even in normal circumstances. Ringing this bell will force more companies to take measures to shore up their rickety systems. There are 6-figure jobs aplenty out there to go into ABC Valve Manufacturing, rip out all their Win95 boxen and tell them what to buy, set it up and secure it for them.

ideksec 5y ago
While I agree with the sentiment around not paying, I don't think it's as simple as that. Calling on law enforcement to "track down the adversary" is not easy, and when you track it back to a random Russian cybercrime group what can you do with that information? A lot of these payments are not fortune 500 companies with unlimited IT budget, it's small or medium businesses with a 3 person IT team. Should they have proper off-site backups? Yes. Should we just let these companies go out of business until organizations learn their lesson? I would say no. I really like the idea of making payment more difficult and mandating organizations to report these incidents. You're correct, companies do have the incentive to cover things up. Banning payment won't stop that. I'm interested to see how people will circumvent this if the bill passes. If you pay a third-party company who "deal with the issue" on your behalf, all under legal privilege of course, would you still need to report?
- gopher_space 5y ago
  > Should they have proper off-site backups? Yes. Should we just let these companies go out of business until organizations learn their lesson? I would say no. Can you expand on that? Bad management leading to criminal interaction seems like something we'd be better off without.
  - ryanlol 5y ago
    How about you stop dressing so slutty?
  - ideksec 5y ago
    An organization going out of business isn't just a case of bad management being eliminated. I wrote that line thinking of the clients I've worked with who've been hit by ransomware and didn't realize IT were not doing their job until it was too late. In some cases it's a failure on their part - not investing enough time or resources and seeing IT as "the guy who installs windows". More often than not, they were assured it was taken care of. I don't expect a manager of a car dealership to know if their Exchange server is running recent patches. If companies like SolarWinds and Kaseya can get popped and compromise their downstream customers, think of the number of small MSPs causing that same issue every day. I don't think a business should go under with people losing their jobs because IT screwed up. We would be better off without leadership who take no interest in security, and once a company is hit with a 100k ransomware bill you can bet they'll care going forward.
    - throw0101a 5y ago
      > More often than not, they were assured it was taken care of. I don't expect a manager of a car dealership to know if their Exchange server is running recent patches. You're not wrong, but would the same dealership be as blasé about the assurances from their accountant that all their taxes are being paid? Certainly no one can be an expert in everything, but regular audits from third parties of one's business at semi-regular intervals is prudent. We call in an external IT security auditor regularly ourselves to make sure we're not missing things and still following best practices.
ebiester 5y ago
ABC Valve Manufacturing is running on a 6% profit margin. That cost wipes out their entire profit margin for the year. (They are competing against people in other countries without the same constraint.) Now, perhaps this is an upstream problem. Perhaps the problem is that we have built systems that are nigh impossible to secure for small businesses. Perhaps we need laptop computers with no USB slots (no external keyboards.. no external mice.. no external monitors..) and no ability to install anything without going through an app store. This company (that makes its own operating system) also will tell you exactly the systems you can use. Everything is certified by this company to be secure and you pay them a yearly protection racket fee to assume liability. In return, you have no control over your computer. Very strict internet filters are on these computers - no stack overflow, no hacker news, just the systems that the business has paid for. This sounds dystopian to me. I'd hate to work there. However, that's literally the only solution I see for many businesses, because the current IT system is failing us.
- tantalor 5y ago
  > cost wipes out their entire profit margin Comment suggested "calling on public resources to mitigate the attack" implying some sort of government funded program to upgrade old IT.

KennyBlanken 5y ago

This is of no utility until the DoJ and courts start punishing corporations for breaking laws and regulations in some meaningful way. Right now, even egregious violation of regulations results in a trivial financial payment and the charges are put on the shelf - and forgotten about if the corporation "behaves." In theory. In reality, companies can keep breaking the law, violating those agreements to 'behave' - and the DoJ / courts never pursue the matter.

pas 5y ago
you seem to be mixing up reporting regulations with the "we both know you did something shady but it was likely not explicitly illegal back then, so let's not go to court and waste each other's time, but let's never try that, and for this courtesy you pay us a few billion USD, mmkay?" deferred prosecution agreements. reporting regs are clear (clearer at least) than the other stuff.

crate_barre 5y ago

The irony of all of this is that the finance industry is providing all the liquidity for bitcoin so that their ransomware payments are actually worth something.

ryanlol 5y ago
There’s no irony here. Ransomware would keep going if cryptocurrency disappeared tomorrow, these people have the infrastructure to receive and launder huge wire transfers. Even the far less sophisticated african groups manage that, read the Hushpuppi indictment for an example.
- pas 5y ago
  can you please provide a tldr on that wire transfer laundering thing? :o
  - tata71 5y ago
    Everywhere not the US & allies
    - ryanlol 5y ago
      Bullshit, these people have US and Canadian corporate accounts capable of cashing out millions at a time. You can easily get thousands of US personal accounts at short notice if you need them.
  - ryanlol 5y ago
    There’s a vast industry of people supplying services to cash out illicit wire transfers. The complexity depends on the amount. For individual amounts below 20-30k (craigslist scams, etc) you’ll be looking at personal bank accounts, usually created with fake IDs, but also sometimes using victims of various hiring scams. The fees you pay will largely depend on the country around 50% for US accounts, 20% or so for EU/UK accounts. For slightly bigger amounts (fancier craigslist scams, BEC) up to a quarter million or so, you’ll see lots of pretty plain corporate accounts. The fees remain pretty much the same. For the huge amounts (pretty much just BEC) like 5 million usd or more it starts to get complicated. At this point you begin to see offshore accounts for the first time, Hong Kong or just straight up PRC. But anything is possible, even US accounts can be arranged. Often someone will take over an existing business and their bank accounts, and then quickly run millions through them. At this level it’s hard to give an estimate on the fees, they are negotiable.

indymike 5y ago

I like the idea of a payment ban because it will force most companies to look at the systems that should be in place to prevent attacks. So many companies don't have working backups, and have not partitioned their systems in ways that prevent an attack (or accident, or corruption) from spreading from system to system. The disappointment is real when you tell the ransomware guy, "We're not paying. We just restored from backup."

RattleyCooper 5y ago
>The disappointment is real when you tell the ransomware guy, "We're not paying. We just restored from backup." Worked at a trucking company as a software dev and this exact thing happened. Got hit with ransomware attack but our IT team had daily backups of EVERYTHING. This was when ransomware was first "taking off" and they weren't even 100% sure if the attack was real. I wish I got to see the ransomware's operator's reaction, but I honestly feel like they probably had enough people falling for it so I doubt they really got that upset.

aaomidi 5y ago

The US stole money and resources from developing countries to get to where it is. Now the US is realizing they can get fucked as well. On a far far far smaller scale. Watching the government and people freak out about this has been very amusing.