4 ms·

The leader of the world's most dangerous hacking syndicate is a minor? How did we get here exactly, in cyberspace security terms?

davikr 5y ago
I feel like companies have invested a lot in securing internal services from external actors, and the threat model has moved to compromise these organizations from the inside with underpaid disgruntled employees being promised riches. It should be important not only to punish those insiders involved, but also to have the least possible permissions for developers, support desk workers or anyone really.
- chockchocschoir 5y ago
  > but also to have the least possible permissions for developers, support desk workers or anyone really. Considering that Okta say they already do "Zero Trust security" and giving people least possible authorization (and also that they were never breached in the first place, still), I don't have a lot of fate in the industry realizing anything from this breach.
- dboreham 5y ago
  A single low paid employee shouldn't have the access rights to do serious damage. For example Okta probably has rate-limits on how many users a CSR can reset the password for.
phphphphp 5y ago
I don’t think we got here, we’ve always been here: most of us don’t want to go to prison and risk aversion increases with age. Regardless of how (in)secure systems are, the abundance of bad actors will be those with a high risk tolerance.
donkarma 5y ago
When you're an adult, you lead the syndicates that nobody knows about. I doubt there are many minors in Equation Group
bri3d 5y ago
I think we should expect this kind of thing from teenagers: there's a certain level of out of the box thinking and risk to reward inversion that comes from youth. Brazen solicitation of associates / operatives on public forums is certainly unique, and not a tactic which most other actors would pursue due to the risk involved. I also think that things aren't as bad as we think security wise. The attacker's lack of industry experience helps with marketing to media who also lack industry experience. Somehow "Lapsus$" are "the world's most dangerous hacking syndicate", but in reality they've fully compromised several Portuguese companies with poor information security to begin with, released a treasure trove of mostly only curiosity-interesting source code from some big names, and posted some screenshots of restricted-access customer support tools. Breathless excitement about each new discovery has whipped the media into a frenzy over disclosures which sound juicy but ultimately aren't altogether that impactful - another accidental benefit of youth, I think. To me the scariest thing in "cyberspace security terms" probably isn't that a minor has done all this - that seems reasonable to me - but what happens when an adult is inspired to adopt the same approaches? IMO this is the leading edge of something, an innovative approach pioneered by an outsider, less so than it is the trailing edge of "even a teenager could do this." I think the biggest insight here is the power of chat tools like Slack. These tools need much more robust controls than are currently present at most companies. At most large enterprise software companies I've seen, there is little-to-no role based or level based access control applied to chat, and a vast amount of information is accidentally available in messaging logs, even to employees like contractors or low-trust employee accounts which have been locked out and just "need to Slack someone to get back in." Chat apps need much more access control from both a role and trust level point of view.
- adolph 5y ago
  > I think we should expect this kind of thing from teenagers: there's a certain level of out of the box thinking and risk to reward inversion that comes from youth. Brazen solicitation of associates / operatives on public forums is certainly unique, and not a tactic which most other actors would pursue due to the risk involved. Reminds me of: https://en.wikipedia.org/wiki/Ender's_Game https://en.wikipedia.org/wiki/Ender's_Game Hoping to earn himself expulsion from the school for his ruthlessness, he sacrifices his entire fleet to fire a Molecular Disruption Device at the planet. The Device completely destroys the planet and the surrounding bugger fleet. He is shocked to hear the I.F. commanders cheering in celebration. Mazer informs Ender that the "simulations" he has been fighting were real battles, directing human spacecraft against Formic fleets via an ansible's instantaneous communication, and that Ender has won the war.
distantsounds 5y ago
oh dear, he's never seen Hackers
- rbanffy 5y ago
  Do you mean they are hot as well?

davikr 5y ago

I feel like companies have invested a lot in securing internal services from external actors, and the threat model has moved to compromise these organizations from the inside with underpaid disgruntled employees being promised riches. It should be important not only to punish those insiders involved, but also to have the least possible permissions for developers, support desk workers or anyone really.

chockchocschoir 5y ago
> but also to have the least possible permissions for developers, support desk workers or anyone really. Considering that Okta say they already do "Zero Trust security" and giving people least possible authorization (and also that they were never breached in the first place, still), I don't have a lot of fate in the industry realizing anything from this breach.
dboreham 5y ago
A single low paid employee shouldn't have the access rights to do serious damage. For example Okta probably has rate-limits on how many users a CSR can reset the password for.

phphphphp 5y ago

I don’t think we got here, we’ve always been here: most of us don’t want to go to prison and risk aversion increases with age. Regardless of how (in)secure systems are, the abundance of bad actors will be those with a high risk tolerance.

donkarma 5y ago

When you're an adult, you lead the syndicates that nobody knows about. I doubt there are many minors in Equation Group

bri3d 5y ago

I think we should expect this kind of thing from teenagers: there's a certain level of out of the box thinking and risk to reward inversion that comes from youth. Brazen solicitation of associates / operatives on public forums is certainly unique, and not a tactic which most other actors would pursue due to the risk involved. I also think that things aren't as bad as we think security wise. The attacker's lack of industry experience helps with marketing to media who also lack industry experience. Somehow "Lapsus$" are "the world's most dangerous hacking syndicate", but in reality they've fully compromised several Portuguese companies with poor information security to begin with, released a treasure trove of mostly only curiosity-interesting source code from some big names, and posted some screenshots of restricted-access customer support tools. Breathless excitement about each new discovery has whipped the media into a frenzy over disclosures which sound juicy but ultimately aren't altogether that impactful - another accidental benefit of youth, I think. To me the scariest thing in "cyberspace security terms" probably isn't that a minor has done all this - that seems reasonable to me - but what happens when an adult is inspired to adopt the same approaches? IMO this is the leading edge of something, an innovative approach pioneered by an outsider, less so than it is the trailing edge of "even a teenager could do this." I think the biggest insight here is the power of chat tools like Slack. These tools need much more robust controls than are currently present at most companies. At most large enterprise software companies I've seen, there is little-to-no role based or level based access control applied to chat, and a vast amount of information is accidentally available in messaging logs, even to employees like contractors or low-trust employee accounts which have been locked out and just "need to Slack someone to get back in." Chat apps need much more access control from both a role and trust level point of view.

adolph 5y ago
> I think we should expect this kind of thing from teenagers: there's a certain level of out of the box thinking and risk to reward inversion that comes from youth. Brazen solicitation of associates / operatives on public forums is certainly unique, and not a tactic which most other actors would pursue due to the risk involved. Reminds me of: https://en.wikipedia.org/wiki/Ender's_Game https://en.wikipedia.org/wiki/Ender's_Game Hoping to earn himself expulsion from the school for his ruthlessness, he sacrifices his entire fleet to fire a Molecular Disruption Device at the planet. The Device completely destroys the planet and the surrounding bugger fleet. He is shocked to hear the I.F. commanders cheering in celebration. Mazer informs Ender that the "simulations" he has been fighting were real battles, directing human spacecraft against Formic fleets via an ansible's instantaneous communication, and that Ender has won the war.

distantsounds 5y ago

oh dear, he's never seen Hackers

rbanffy 5y ago
Do you mean they are hot as well?