7 ms·

Is it just me, or does it seem crazy that we all just accept that private businesses are obligated to protect themselves from state-sponsored hacking? Imagine i

by frays 5y ago

Is it just me, or does it seem crazy that we all just accept that private businesses are obligated to protect themselves from state-sponsored hacking? Imagine if Wal-Mart had to fund a private air force and patrol over their stores in order to combat foreign bombers coming in and everyone was like, "Yeah, that's just how it goes." Isn't a primary responsibility of government to protect its citizens and businesses from other states' militaries?

tyingq 5y ago
I guess it depends on the analogy, and whether physical location means anything for the internet. Piracy of commercial ships, for example.
- rocqua 5y ago
  That is also very much a problem where states are expected to intervene.
  - tyingq 5y ago
    It seems similar to me. They sometimes intervene, but often don't.
avereveard 5y ago
so, china's internet? because that's what you're actually asking when you ask a policed internet.
black_puppydog 5y ago
Sorry but Walmart has cameras, guards, and most importantly locked windows and doors. Just because nobody has figured out (or bothered to invest into) building the equivalent of basic security doesn't mean it's the state's responsibility. It is the government's responsibility to make sure companies take their responsibilities of protecting their customers' data, and the internet more broadly from the impact of the company's decisions.
- sp332 5y ago
  I think the question is about foreign government operations. If North Korean agents threw up some graffiti on a Wal-Mart and stole some soda, the private security would not be expected to handle the situation on their own. Even if the stakes seem low, that's an international incident.
  - Cthulhu_ 5y ago
    That's... a very weird, reaching argument to make. And also not an international incident, since it's just some graffiti, not espionage or assassination or whatever. I'm not sure what point you're trying to make here.
    - ehnto 5y ago
      The original argument is that it's weird private businesses have to protect themselves against state actors such as foreign governments. The equivalent would be if Walmart was expected to protect itself while a foreign governments special forces raided their stores. Of course I'm not sure that's how it's playing out anyway, as I'm certain that the relevant three letter agencies are interested in foreign state actors digital incursions, it's just a very delicate situation and not as simple or clear cut as the Walmart example.
    - Steltek 5y ago
      It doesn't seem that far reaching. There's a difference between "foreign citizen action" and "foreign government action". If another government comes to your territory, to break your laws and deprive one of your businesses of their property or rights, that's a big deal. But because it happens online, it's given a pass and pushed on to private individuals to deal with.
  - theamk 5y ago
    I am pretty sure that it does not matter who stole the soda - North Koreans or locals. Either way it is up to store security to catch them and hand over to police. Police may then hand NKs over to someone else, but this doesn't change what store security must do.
kevincox 5y ago
While your logic is solid and I do think this would be ideal I struggle to see how this would work. Dropping bombs on a walmart store is clearly unwelcome, sending traffic to walmart's website? Much less clear. You can guess based on the traffic pattern but the only way to really know is to ask walmart if this is welcome traffic (not just a burst because some new product came out). Especially since many cases are DoS with encrypted TLS traffic that looks much like any other traffic to an outside observer. However much of the protection is threat of retaliation ("if you drop bombs on us we will flatten your country"). So maybe that is the solution here, the government should treat these attacks as real threats and punish those responsible.
- marcosdumay 5y ago
  Well, a government could start by mandating that internet peers authenticate their packages, and cutting the access of bad actors. People can't do that, and it's a very basic defense.
  - kevincox 5y ago
    "Mandate private companies protect their customers" sounds very different than "the government should protect everyone" even if the result is similar.
  - teddyh 5y ago
    Start by mandating BCP38 (RFC2827).
    - asplake 5y ago
      What stops that? (Both its widespread implementation and making it mandatory)
      - marcosdumay 5y ago
        You mean what that protects against? It provides the first part of my post, authenticating the packages. The second part is cutting out misbehaving connections. On this case on the article, it would be trivial, and governments should be on the ISP shoulders making them make call everywhere and cutting some of their clients. But there are many attacks where the ISPs don't have enough information to act if they implement something like BCP38.
kube-system 5y ago
The US government does do quite a bit to protect their citizens from electronic attacks. There are organizations like CISA and NIST that do a lot of work to help prevent attacks, and the FBI and DOJ do a lot of investigate and enforcement work after the fact. For example: https://www.fbi.gov/investigate/cyber/partnerships https://www.fbi.gov/investigate/cyber/partnerships https://www.cisa.gov/stopransomware/ransomware-guide https://www.cisa.gov/stopransomware/ransomware-guide
mschuster91 5y ago
Indeed. We definitely need laws to hold companies accountable for their IT-related activity. For one, we need to hold commercial vendors accountable - that means especially to refuse to provide security updates for the reasonably expected life time of a piece of software or hardware. But especially, we need the companies using IT systems to be held accountable. The magic word is "defense in depth" - the scenario of the post we're talking about is a piece of equipment that was not supposed to be reachable from the Internet and despite that knowledge it was made accessible to the Internet. Seriously, anyone caught exposing dangerous stuff to Shodan should be fined to hell and back. Or to continue using your military comparison: most governments have laws that call for harsh punishment for "aid to the enemy" or similar. Time to update the law to the new digital world.
- dahfizz 5y ago
  A failure to defend yourself is not aiding the enemy. That is insane. The government provides for the common security. That's one of it's most fundamental jobs. Imagine if your house was destroyed by a Russian drone and you were thrown in jail for not having enough "defense in depth" against drone strikes.
  - mschuster91 5y ago
    > A failure to defend yourself is not aiding the enemy. That is insane. Let's say you are the leader of a border post, and you leave your post unmanned allowing the enemy in - of course you will be held accountable. Exposing stuff to the Internet despite the manufacturer warning against it is at least grossly negligent and should be punished. We are at war with Russia and China on a nation-state level and on top of that we also have cybercrime gangs.
    - wyattpeak 5y ago
      > Let's say you are the leader of a border post Let's not say that. Suggesting that civilians have defence duties on par with members of the military is ridiculous.
    - 5y ago
gostsamo 5y ago
It is just you. In the physical world a military can observe an attack, can announce that it is not cool, and can drive a tank through most intruders. Now ask yourself this question, would you like to give your military the full access to your infrastructure together with command and control capabilities to do with your devices and the software on them as it pleases according to the situation? If you actually think that in fact you are not okay with 24/7 monitoring and management from a centralized government institution, you should own up to your desires and get your defense together. Of course, this is a simplistic and extreme scenario. Much of the missed part is about availability and basic institutional capability for military cyber operations, but the fundamental question is: when one demands something from the government, what exactly they wish to give up as a consequence of the proposed solution.
Cthulhu_ 5y ago
Depends. Do you want the government to control the internet?
jameshart 5y ago
Well stated. We also have a tendency to conflate the requirements on software systems with respect to security threats as being somewhat similar to the requirements on other kinds of engineering with respect to safety and environmental threats, and I think that does a disservice to the vastly different scope of responsibility involved. When I see people arguing that software engineers need to treat security as seriously as, say civil engineers treat structural stability when designing a bridge, or mechanical engineers treat vehicle crash safety, I agree to an extent, but I also think it’s worth considering: Most bridges are not designed to actually survive being deliberately attacked with the kinds of weapons nation states can bring to bear on them. When militaries get involved, bridges tend to fail. Likewise, civilian car safety testing does not make cars that are able to survive attacks that nation state actors can carry out with things like tanks, mines, or drones. We need to be realistic in our expectations for what level of military threat civilian systems can reasonably be expected to deal with unaided.
wilde 5y ago
We rolled over to state-sponsored election meddling. There’s no way we’re going to care about this.
MereInterest 5y ago
In principle, that's what the NSA would be doing. When DES was developed and standardized in 1976, the NSA had input in selecting some of the constants that were chosen for it [0]. It wasn't until the late 80s when independent development of differential cryptanalysis [1] came out, and people realized that the DES constants were deliberately chosen to be resistant to this attack. The NSA has since turned away from this responsibility, and has done the exact opposite. When Dual_EC_DRBG was developed [2], there was a similar choice of constants, with the final values having been chosen by the NSA. In this case, rather than protecting against a attack method known only by the NSA, the constants were chosen to allow an attack method known only by the NSA. [0] https://en.wikipedia.org/wiki/Data_Encryption_Standard https://en.wikipedia.org/wiki/Data_Encryption_Standard [1] https://en.wikipedia.org/wiki/Differential_cryptanalysis https://en.wikipedia.org/wiki/Differential_cryptanalysis [2] https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
- helloooooooo 5y ago
  Or maybe the choice of Dual EC DRBG constants are intended to protect against a new cryptanalysis technique known only to the NSA
  - ruined 5y ago
    internal documents leaked by Snowden and reported by the NYT confirmed the intent of the program https://en.m.wikipedia.org/wiki/Bullrun_(decryption_program) https://en.m.wikipedia.org/wiki/Bullrun_(decryption_program) stop simping for the nsa
  - vengefulduck 5y ago
    I highly doubt it. Dual EC DRBG basically works by encrypting your seed value with a NSA provided public key. It’s kinda amazing how blatant the back door is.
g_p 5y ago
Many private businesses already are expected to protect themselves from state (and similar capability) physical interference and attacks, especially if they are in the supply chain of critical infrastructure. It's one of the things you have to do effectively to earn profits in that sector.
YetAnotherNick 5y ago
Yes, it's walmart responsibility to protect their customers. It's their responsibility that their supply chain is not hacked to say distribute poison, it's their responsibility that the cameras they use in store are theirs and only they have access, it's their responsibility that the card I use in their terminal is safe. The example you gave won't be hurting the people, otherwise yes if they want to gain trust in dangerous land they have to ensure safety of people.
- jameshart 5y ago
  23 people were killed and 23 more injured in a Walmart in El Paso in 2019 in a mass shooting. Is it your position that Walmart has sole responsibility for failing to prevent those deaths?
- ActionHank 5y ago
  I feel like it more broadly boils down to, if you put it on the internet you are responsible for securing it. If you can't or don't want to secure it, don't put it online.
deleted 5y ago
[deleted]
BigComrade 5y ago
It very much is the responsibility of the NSA, but they mostly fail at their primary job, and conduct illegal activities such as mass surveillance instead. Another example of a government agency that fails at their job: the FDA. The FDA is supposed to protect consumers from harmful foods and medications, but the fact that you can walk into any store and grab a can of food or bottle of vitamins/supplements contaminated with heavy metals is a huge red flag [0][1][2][3][4][5]. The FDA does 0 product screening whatsoever. If the FDA actually did their job, healthcare revenues would be at an all time low in America. It pays off big time to have a diseased population. [0] https://www.consumerlab.com/answers/supplements-and-foods-that-may-be-contaminated-with-lead/lead-contamination-supplements/ https://www.consumerlab.com/answers/supplements-and-foods-th... [1] https://www.consumerlab.com/answers/do-zinc-supplements-contain-lead/lead-contamination-in-zinc/ https://www.consumerlab.com/answers/do-zinc-supplements-cont... [2] https://www.consumerlab.com/news/metals-in-seaweed-snacks/12-20-2021/ https://www.consumerlab.com/news/metals-in-seaweed-snacks/12... [3] https://www.consumerlab.com/recalls/11882/herbal-supplements-linked-to-heavy-metal-poisoning/ https://www.consumerlab.com/recalls/11882/herbal-supplements... [4] https://www.consumerlab.com/news/contamination-in-greens-whole-food-powders-capsules/01-31-2019/ https://www.consumerlab.com/news/contamination-in-greens-who... [5] https://www.consumerlab.com/news/caution-with-spirulina-supplements/02-09-2022/ https://www.consumerlab.com/news/caution-with-spirulina-supp...
deleted 5y ago
[deleted]
- deleted 5y ago
  [deleted]
freeflight 5y ago
What I find much more crazy is how this is made out as "state-sponsored hacking", even tho the article doesn't mention with a single sentence who or what the attackers are. In that context instantly jumping to "state-sponsored!" strikes me not only as a needless, but particularly dangerous escalation. It's like people forget that "cyber" is most of all asymmetrical and attribution is usually more of a guessing game than an exact science. Yet nearly every larger hack is very quickly labeled as some kind of "state sponsored offense!" to serve foreign policy narratives, and most of all; Excuse the incompetence that often enabled such attacks in the very first place.
make3 5y ago
maybe one day when the people in charge are at least somewhat technically litterate

by frays 5y ago

tyingq 5y ago

I guess it depends on the analogy, and whether physical location means anything for the internet. Piracy of commercial ships, for example.

rocqua 5y ago
That is also very much a problem where states are expected to intervene.
- tyingq 5y ago
  It seems similar to me. They sometimes intervene, but often don't.

avereveard 5y ago

so, china's internet? because that's what you're actually asking when you ask a policed internet.

black_puppydog 5y ago

Sorry but Walmart has cameras, guards, and most importantly locked windows and doors. Just because nobody has figured out (or bothered to invest into) building the equivalent of basic security doesn't mean it's the state's responsibility. It is the government's responsibility to make sure companies take their responsibilities of protecting their customers' data, and the internet more broadly from the impact of the company's decisions.

sp332 5y ago
I think the question is about foreign government operations. If North Korean agents threw up some graffiti on a Wal-Mart and stole some soda, the private security would not be expected to handle the situation on their own. Even if the stakes seem low, that's an international incident.
- Cthulhu_ 5y ago
  That's... a very weird, reaching argument to make. And also not an international incident, since it's just some graffiti, not espionage or assassination or whatever. I'm not sure what point you're trying to make here.
  - ehnto 5y ago
    The original argument is that it's weird private businesses have to protect themselves against state actors such as foreign governments. The equivalent would be if Walmart was expected to protect itself while a foreign governments special forces raided their stores. Of course I'm not sure that's how it's playing out anyway, as I'm certain that the relevant three letter agencies are interested in foreign state actors digital incursions, it's just a very delicate situation and not as simple or clear cut as the Walmart example.
  - Steltek 5y ago
    It doesn't seem that far reaching. There's a difference between "foreign citizen action" and "foreign government action". If another government comes to your territory, to break your laws and deprive one of your businesses of their property or rights, that's a big deal. But because it happens online, it's given a pass and pushed on to private individuals to deal with.
- theamk 5y ago
  I am pretty sure that it does not matter who stole the soda - North Koreans or locals. Either way it is up to store security to catch them and hand over to police. Police may then hand NKs over to someone else, but this doesn't change what store security must do.

kevincox 5y ago

While your logic is solid and I do think this would be ideal I struggle to see how this would work. Dropping bombs on a walmart store is clearly unwelcome, sending traffic to walmart's website? Much less clear. You can guess based on the traffic pattern but the only way to really know is to ask walmart if this is welcome traffic (not just a burst because some new product came out). Especially since many cases are DoS with encrypted TLS traffic that looks much like any other traffic to an outside observer. However much of the protection is threat of retaliation ("if you drop bombs on us we will flatten your country"). So maybe that is the solution here, the government should treat these attacks as real threats and punish those responsible.

marcosdumay 5y ago
Well, a government could start by mandating that internet peers authenticate their packages, and cutting the access of bad actors. People can't do that, and it's a very basic defense.
- kevincox 5y ago
  "Mandate private companies protect their customers" sounds very different than "the government should protect everyone" even if the result is similar.
- teddyh 5y ago
  Start by mandating BCP38 (RFC2827).
  - asplake 5y ago
    What stops that? (Both its widespread implementation and making it mandatory)
    - marcosdumay 5y ago
      You mean what that protects against? It provides the first part of my post, authenticating the packages. The second part is cutting out misbehaving connections. On this case on the article, it would be trivial, and governments should be on the ISP shoulders making them make call everywhere and cutting some of their clients. But there are many attacks where the ISPs don't have enough information to act if they implement something like BCP38.

kube-system 5y ago

The US government does do quite a bit to protect their citizens from electronic attacks. There are organizations like CISA and NIST that do a lot of work to help prevent attacks, and the FBI and DOJ do a lot of investigate and enforcement work after the fact. For example: https://www.fbi.gov/investigate/cyber/partnerships https://www.fbi.gov/investigate/cyber/partnerships https://www.cisa.gov/stopransomware/ransomware-guide https://www.cisa.gov/stopransomware/ransomware-guide

mschuster91 5y ago

Indeed. We definitely need laws to hold companies accountable for their IT-related activity. For one, we need to hold commercial vendors accountable - that means especially to refuse to provide security updates for the reasonably expected life time of a piece of software or hardware. But especially, we need the companies using IT systems to be held accountable. The magic word is "defense in depth" - the scenario of the post we're talking about is a piece of equipment that was not supposed to be reachable from the Internet and despite that knowledge it was made accessible to the Internet. Seriously, anyone caught exposing dangerous stuff to Shodan should be fined to hell and back. Or to continue using your military comparison: most governments have laws that call for harsh punishment for "aid to the enemy" or similar. Time to update the law to the new digital world.

dahfizz 5y ago
A failure to defend yourself is not aiding the enemy. That is insane. The government provides for the common security. That's one of it's most fundamental jobs. Imagine if your house was destroyed by a Russian drone and you were thrown in jail for not having enough "defense in depth" against drone strikes.
- mschuster91 5y ago
  > A failure to defend yourself is not aiding the enemy. That is insane. Let's say you are the leader of a border post, and you leave your post unmanned allowing the enemy in - of course you will be held accountable. Exposing stuff to the Internet despite the manufacturer warning against it is at least grossly negligent and should be punished. We are at war with Russia and China on a nation-state level and on top of that we also have cybercrime gangs.
  - wyattpeak 5y ago
    > Let's say you are the leader of a border post Let's not say that. Suggesting that civilians have defence duties on par with members of the military is ridiculous.
  - 5y ago

gostsamo 5y ago

It is just you. In the physical world a military can observe an attack, can announce that it is not cool, and can drive a tank through most intruders. Now ask yourself this question, would you like to give your military the full access to your infrastructure together with command and control capabilities to do with your devices and the software on them as it pleases according to the situation? If you actually think that in fact you are not okay with 24/7 monitoring and management from a centralized government institution, you should own up to your desires and get your defense together. Of course, this is a simplistic and extreme scenario. Much of the missed part is about availability and basic institutional capability for military cyber operations, but the fundamental question is: when one demands something from the government, what exactly they wish to give up as a consequence of the proposed solution.

Cthulhu_ 5y ago

Depends. Do you want the government to control the internet?

jameshart 5y ago

Well stated. We also have a tendency to conflate the requirements on software systems with respect to security threats as being somewhat similar to the requirements on other kinds of engineering with respect to safety and environmental threats, and I think that does a disservice to the vastly different scope of responsibility involved. When I see people arguing that software engineers need to treat security as seriously as, say civil engineers treat structural stability when designing a bridge, or mechanical engineers treat vehicle crash safety, I agree to an extent, but I also think it’s worth considering: Most bridges are not designed to actually survive being deliberately attacked with the kinds of weapons nation states can bring to bear on them. When militaries get involved, bridges tend to fail. Likewise, civilian car safety testing does not make cars that are able to survive attacks that nation state actors can carry out with things like tanks, mines, or drones. We need to be realistic in our expectations for what level of military threat civilian systems can reasonably be expected to deal with unaided.

wilde 5y ago

We rolled over to state-sponsored election meddling. There’s no way we’re going to care about this.

MereInterest 5y ago

In principle, that's what the NSA would be doing. When DES was developed and standardized in 1976, the NSA had input in selecting some of the constants that were chosen for it [0]. It wasn't until the late 80s when independent development of differential cryptanalysis [1] came out, and people realized that the DES constants were deliberately chosen to be resistant to this attack. The NSA has since turned away from this responsibility, and has done the exact opposite. When Dual_EC_DRBG was developed [2], there was a similar choice of constants, with the final values having been chosen by the NSA. In this case, rather than protecting against a attack method known only by the NSA, the constants were chosen to allow an attack method known only by the NSA. [0] https://en.wikipedia.org/wiki/Data_Encryption_Standard https://en.wikipedia.org/wiki/Data_Encryption_Standard [1] https://en.wikipedia.org/wiki/Differential_cryptanalysis https://en.wikipedia.org/wiki/Differential_cryptanalysis [2] https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG

helloooooooo 5y ago
Or maybe the choice of Dual EC DRBG constants are intended to protect against a new cryptanalysis technique known only to the NSA
- ruined 5y ago
  internal documents leaked by Snowden and reported by the NYT confirmed the intent of the program https://en.m.wikipedia.org/wiki/Bullrun_(decryption_program) https://en.m.wikipedia.org/wiki/Bullrun_(decryption_program) stop simping for the nsa
- vengefulduck 5y ago
  I highly doubt it. Dual EC DRBG basically works by encrypting your seed value with a NSA provided public key. It’s kinda amazing how blatant the back door is.

g_p 5y ago

Many private businesses already are expected to protect themselves from state (and similar capability) physical interference and attacks, especially if they are in the supply chain of critical infrastructure. It's one of the things you have to do effectively to earn profits in that sector.

YetAnotherNick 5y ago

Yes, it's walmart responsibility to protect their customers. It's their responsibility that their supply chain is not hacked to say distribute poison, it's their responsibility that the cameras they use in store are theirs and only they have access, it's their responsibility that the card I use in their terminal is safe. The example you gave won't be hurting the people, otherwise yes if they want to gain trust in dangerous land they have to ensure safety of people.

jameshart 5y ago
23 people were killed and 23 more injured in a Walmart in El Paso in 2019 in a mass shooting. Is it your position that Walmart has sole responsibility for failing to prevent those deaths?
ActionHank 5y ago
I feel like it more broadly boils down to, if you put it on the internet you are responsible for securing it. If you can't or don't want to secure it, don't put it online.

deleted 5y ago

[deleted]

BigComrade 5y ago

It very much is the responsibility of the NSA, but they mostly fail at their primary job, and conduct illegal activities such as mass surveillance instead. Another example of a government agency that fails at their job: the FDA. The FDA is supposed to protect consumers from harmful foods and medications, but the fact that you can walk into any store and grab a can of food or bottle of vitamins/supplements contaminated with heavy metals is a huge red flag [0][1][2][3][4][5]. The FDA does 0 product screening whatsoever. If the FDA actually did their job, healthcare revenues would be at an all time low in America. It pays off big time to have a diseased population. [0] https://www.consumerlab.com/answers/supplements-and-foods-that-may-be-contaminated-with-lead/lead-contamination-supplements/ https://www.consumerlab.com/answers/supplements-and-foods-th... [1] https://www.consumerlab.com/answers/do-zinc-supplements-contain-lead/lead-contamination-in-zinc/ https://www.consumerlab.com/answers/do-zinc-supplements-cont... [2] https://www.consumerlab.com/news/metals-in-seaweed-snacks/12-20-2021/ https://www.consumerlab.com/news/metals-in-seaweed-snacks/12... [3] https://www.consumerlab.com/recalls/11882/herbal-supplements-linked-to-heavy-metal-poisoning/ https://www.consumerlab.com/recalls/11882/herbal-supplements... [4] https://www.consumerlab.com/news/contamination-in-greens-whole-food-powders-capsules/01-31-2019/ https://www.consumerlab.com/news/contamination-in-greens-who... [5] https://www.consumerlab.com/news/caution-with-spirulina-supplements/02-09-2022/ https://www.consumerlab.com/news/caution-with-spirulina-supp...

deleted 5y ago

[deleted]

deleted 5y ago
[deleted]

freeflight 5y ago

What I find much more crazy is how this is made out as "state-sponsored hacking", even tho the article doesn't mention with a single sentence who or what the attackers are. In that context instantly jumping to "state-sponsored!" strikes me not only as a needless, but particularly dangerous escalation. It's like people forget that "cyber" is most of all asymmetrical and attribution is usually more of a guessing game than an exact science. Yet nearly every larger hack is very quickly labeled as some kind of "state sponsored offense!" to serve foreign policy narratives, and most of all; Excuse the incompetence that often enabled such attacks in the very first place.

make3 5y ago

maybe one day when the people in charge are at least somewhat technically litterate