17 ms·
Insurers run from ransomware cover as losses mount
- VHRanger 5y agoThanks, crypto!
- chiph 5y agoTBF, ransomware existed before crypto. Crypto just made it easier for the criminals to get paid, and is somewhat anonymous.
- vmception 5y agoBut these ransomware operators are so comfortable in their country that they don't even bother trying to leverage the anonymity and just simply like the convenience of crypto
- Oddskar 5y agoI think you underestimate the influence corporations exert on governments.
- vmception 5y agooh not at all, just reinforcing how little the crypto asset existence matters in creating this reality. they would be perfectly fine with using Western Union as they don't care about the investigation. crypto does reduce friction though in acquiring and sending arbitrary amounts, but people still just can't imagine that recipients simply want crypto for the sake of having crypto instead of their local currency.
- Oddskar 5y agoI don't think you can transfer millions of euros via Western Union and keep it anonymous. No way.
- vmception 5y agoYou're missing that nobody is caring about anonymity here, that's what I've been saying the other two posts The major ransomware operators are not caring about anonymity and are not using that aspect from any payment method they allow including crypto There is simply no cooperation with local law enforcement What were you referring to regarding corporations exerting power on governments?
- ManuelKiessling 5y agoWell, instead of repeating it again and again, how about just stating it once, but this time with something like, you know, a proof? Or at least a source for the claim?
- vmception 5y agoyou want to me to prove what exactly? that russian federal and municipal government isnt going after ransomware operators despite having capability to know who they are? I’m trying to think of the best source for this? The assumptions themselves seem to arbitrary for me to bother disproving, the assumptions being: they’re anonymous they’re trying to be anonymous they’re using crypto to bolster their anonymity they need to convert the crypto to cash as opposed to just accumulating crypto because they prefer it This all relies on a complete misunderstanding of ransomware operations and why people in general like crypto that no single article will help. The best articles talk about negotiations with ransomware customer support, which simply show how brazen they are. Doesnt seem a satisfactory sourcr for anyone that has already created a negative assumption that needs to be disproven. What do you think? I’m completely fine with being at an impasse here, take it up with the ransomware SaaS providers they might even have an address listed at this point
- goatsi 5y agoRansomware before crypto was locking down individual desktops until they went to a gas station to buy $500 in Ukash or paysafecard vouchers. The ability to demand millions at once (and to actually receive it) is a huge change that has massively expanded the industry.
- miohtama 5y ago> Insurers say some attackers may even check whether potential victims have policies that would make them more likely to pay out. > Dickson said one technology client had previously bought 130 million pounds of professional indemnity and cyber cover for 250,000 pounds. Now the client could only get 55 million pounds of cover and the price was 500,000 pounds. As just relying on insurance payments is not sustainable, I hope we soon get to the point where companies that do not properly invest in cyber security get wiped out and ones that take matters seriously survive and increase their market share and profit margins. The same holes will be exploited by nationstate and identity fraud hackers, in this case it is just the consumer who ends up paying the bill.
- fisherjeff 5y agoI don’t think the businesses that are buying insurance (my own included) are “just relying on insurance payments.” It’s just an additional layer of risk mitigation - not sure why there’s so much derision in many of the comments here.
- c21h30o2 5y agoBecause there are so many companies who deserve derision. Not all companies of course.
- fisherjeff 5y agoSure, but I would be surprised if those businesses are buying this insurance.
- zizee 5y ago> I hope we soon get to the point where companies that do not properly invest in cyber security get wiped out How do you determine this objectively?
- azemetre 5y agoWell I suppose them continuing to get hit by ransomware attacks is the only legitimate metric.
- dorianmariefr 5y agoIsn’t it like natural selection but for tech skills?
- outside1234 5y agoMore dividends from crypto!!! (NOTE: We are all paying for this with higher prices to cover the extortion schemes.)
- varjag 5y agoJust stop using Windows already.
- fortran77 5y agohttps://www.bleepingcomputer.com/news/security/hive-ransomware-now-encrypts-linux-and-freebsd-systems/ https://www.bleepingcomputer.com/news/security/hive-ransomwa...
- varjag 5y agoHowever, as Slovak internet security firm ESET discovered, Hive's new encryptors are still in development and still lack functionality. The Linux variant also proved to be quite buggy during ESET's analysis, with the encryption completely failing when the malware was executed with an explicit path. Not a surprise really to anyone who tried to update GRUB on an unfamiliar system.
- DonHopkins 5y agohttps://news.ycombinator.com/item?id=29288884 https://news.ycombinator.com/item?id=29288884 "Seriously"? You're a real nut job, dude. You're the one making absolute judgements, then in the next sentence claiming absolute judgements are invalid. I posted objectively true facts that aren't in dispute, not judgements. Do you love Donald Trump as much as you hate Jimmy Carter? And what is the basis for your absolute judgement that Carter's "pure evil"? "Pure", really? "Evil", really? Are those absolute religiously defined terms you truly and faithfully believe in your heart without any evidence, or are you histrionically exaggerating a wee bit, and being overly judgemental? Are you saying that absolutely everything Carter's done you hate, he's never done anything good that you like, and every mistake he ever made was malicious, so he's the worst president ever? What pure evil assault did Jimmy Carter ever do to you, that Trump wouldn't gleefully do in a New York minute just to spite you, and then laugh and brag about your misfortune that he caused? Do you despise middle east peace negotiations, and free housing for poor people, and love guinea worms and Ronald Reagan? Citations, please.
- fortran77 5y ago
- notpachet 5y agoThe ENISA Threat Landscape report¹, which this article cites in an offhand way, is worth reading in its own right. [1] https://www.enisa.europa.eu/publications/enisa-threat-landscape-2021 https://www.enisa.europa.eu/publications/enisa-threat-landsc...
- CharlieMunger 5y agoBuffett's Berkshire Hathaway has a large insurance conglomerate (GenRE, National Indemnity, GEICO, Guard, etc.) and a policy of: "No CNBC coverage." CNBC stands for Chemical Nuclear Biological Cyber. This policy has been in effect for twenty years, thanks to Buffett's foresight. If you want to learn more about Berkshire, join us on Reddit: https://old.reddit.com/r/brkb/ https://old.reddit.com/r/brkb/
- elliekelly 5y agoDid you know you can comment on HN without linking to that subreddit?
- jonwachob91 5y agoan hour or so ago there was another comment on this article by user 'HenryKissinger' advocating for assassinating hackers and declaring war on nation states that protect hackers. The comment has since been deleted, but it feels like a bunch of troll accounts making statements to stir up the comments. :(
- dang 5y agoSingle-purpose accounts aren't allowed here, and neither are trollish usernames (which celebrity names usually are), and neither is using the site primarily for promotion, so I've banned this account. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- aejnsn 5y agoThe insurers should require policyholders to go through training or an audit process before writing said coverage. God forbid an insurance company and policyholder share the interest in safety.
- notesinthefield 5y agoThey often do! I dont know a single colleague who hasnt had at least two infosec policy driven projects on their plate this year.
- balgan 5y agoWe do: https://www.balgan.world/cyber/cyberinsurance/cybersecurity/2021/08/31/debunkingcyber.html https://www.balgan.world/cyber/cyberinsurance/cybersecurity/...
- mcot2 5y agoI think we look at this all wrong. Cybersecurity is not only a technology problem but a human problem. We need to spend a lot more resources tracking down the sources of these attacks from a human perspective and treating it like a military/diplomatic issue if stonewalled by foreign governments. Domestically we need to really increase the punishments for these and other computer crimes and step up enforcement significantly.
- throwaway1777 5y agoWe need politicians who understand computers at all first or the laws are going to make zero sense like the current ones.
- dredmorbius 5y agoYou'd probably want fraud and audit controls as well. The problem here is that the attacks are so easily perpetrated. My approach would be: - Reduce risks: change practices, increase system security,decrease holdings of vulnerable data. - Increase monitoring: watch for specific patterns of behaviour. - Increase checks and balances and procedures within and between organisations and firms: one of the simplest anti-fraud actions is to increase the number of individuals required to make a specific action. For automated data processing, that poses obvious challenges, though multiple paths and validations of requests is one option. 2FA is in one sense a form of this. - Changes in law and regulation such that individuals are not obligated to provide or agree to collection or submission of personal information and behavioural data in order to participate in the normal everyday business of life: communications, commerce, travel, work, education, and more. - Strict and biting consequences for firms which fail to reduce risks and protect individuals privacy and confidentiality.
- null_object 5y agoJust ban cryptocurrency
- buttonpusher 5y agoProhibition is not very effective against distributed anonymous protocols.
- goldenkey 5y agoA ship isn't very useful without a dock. Nor crypto without user-friendly exchanges.
- buttonpusher 5y agoThere are already several unauthorized exchanges, despite the popularity of the authorized ones. Banning the authorized ones would be a big boon for the illegal ones.
- jopsen 5y agoI'm curious... how is cryptocurrency not just a big money laundry machine? If you can put earnings from cryptocurrency trading into the banking system without explaining where the earnings came from, other than saying you bought bitcoin low and sold high, then how is this not a massive money laundry loophole? I guess it's not trivial to buy bitcoin with a suitcase full of cash, but it's probably not that hard. It's certainly hard/impossible to walk into a bank with a suitcase full of cash, without explaining where it came from.
- waihtis 5y agoI thought there was a blooming cyber risk scoring industry insurers could tap into? Wait, are you saying pulling and scoring Shodan data doesn’t give an accurate idea of the vulnerability of your internal infrastructure? ;-)
- deleted 5y ago[deleted]
- babyshake 5y agoI would imagine insurance fraud would be a big problem when it comes to anonymous cryptocurrency based ransomware coverage.
- LatteLazy 5y agoA few thoughts in no particular order: It's pretty standard for human ransom (aka kidnapping) policies to require the insured to deny they're covered to anyone who asks. So who is covered and how much for is never really public. I assume the same applies here. Ransomware is a new threat. So there isn't a good data set to do statistical analysis on yet. Doubly so as these events aren't reportable etc. Ransomware threat risk is quite client specific. How good is infosec etc? How much do you rely on these systems? Is your company an obvious target? And none of these factors can be easily assessed by an insurer. There are national political concerns around both the general risk and specific ones. And insurers hate anything like that. They won't cover acts of war, what about "acts of cyberwar"?
- gumby 5y agoInsurers have been responsible for numerous advances over the years, most famously fire safety and fire code, but also bank vault security and the like. Shouldn’t they be stepping up here to work on preventing these attacks instead of cowardly just running away from them? With the mountains of cash they have at hand they could invest and then make more money by selling surname for would by then by an uncommon event.