3 ms·

A cyber ransom demand at one of the most important companies in the world, a lynchpin of digital manufacturing is not reassuring at all. Can their security real

A cyber ransom demand at one of the most important companies in the world, a lynchpin of digital manufacturing is not reassuring at all. Can their security really be that bad?

Veserv 3y ago
Yes. You would be hard pressed to find any company in the entire world that could prevent attackers with a mere $1M budget. Banks, power plants, car companys, cybersecurity companys, factorys, you name it, almost certainly less than $1M. In fact, probably under $100K, but $1M is a safe upper bound. At a $10M budget there are zero. In fact, no CISO I have ever heard from has ever said that is even possible for a perfect implementation (i.e. they have free reign to implement everything they want as long as it does not make the company non-functional, but they get to be judge, jury, and executioner in that analysis). So yeah, given “perfectly implemented” security a $70M ransom has a guaranteed 700% ROI, but in practice closer to a over 7000% ROI.
- lyu07282 3y ago
  I imagine many independent security researchers can live quite comfortably just selling 0days on the "free market".
  - Veserv 3y ago
    Not really if you live in a high cost-of-living (HCOL) country. Vulnerability weaponization is a very globalized industry and sufficiently easy that there is a oversupply from LCOL countrys. The real money is in deployment and usage as that requires the much rarer and more local criminal and money laundering skill sets.
    - _kbh_ 3y ago
      > Not really if you live in a high cost-of-living (HCOL) country. Vulnerability weaponization is a very globalized industry and sufficiently easy that there is a oversupply from LCOL countrys. The real money is in deployment and usage as that requires the much rarer and more local criminal and money laundering skill sets. A single iOS or Android full chain still goes for between, 2-2.5 million USD. https://zerodium.com/images/zerodium_prices_mobiles.png https://zerodium.com/images/zerodium_prices_mobiles.png https://zerodium.com/images/zerodium_prices.png https://zerodium.com/images/zerodium_prices.png if someone was skilled they could easily live in a HCOL area making 1-1.25 million USD a year.
      - pclmulqdq 3y ago
        A full chain is a difficult attack to create, and probably worth a lot more than $2.5 million - beyond the reach of one person. You need at least two novel, serious exploits. That's why they are so valuable.
        _kbh_ 3y ago
        > A full chain is a difficult attack to create, and probably worth a lot more than $2.5 million - beyond the reach of one person. You need at least two novel, serious exploits. That's why they are so valuable. Depends if you're publicly selling via Zerodium as much, but if you sell privately it might be worth more. > beyond the reach of one person It's going to be difficult but I don't think its beyond one person, but even if it was you could easily just go for a less difficult tier to make less money more often. The real problem would be how lumpy the payments would be, you'd effectively get nothing until you found something and most people cannot afford to that.
user3939382 3y ago
Not just their security, their backup policies too, right? Ransomware is completely powerless if you can delete and restore. You'd think investing in backup systems, policies, training, monitoring, which is best practice anyway, is cheaper than the horrible PR and costs of these ransoms.
- Veserv 3y ago
  They just hack the backups as well. Adds like 10% to their costs because those systems are also completely insecure. Even a perfect backup system is easy to beat. You just infiltrate the running system and encrypt the dataflow into the backup system after you get in, do that for a few months, then strike; now they have to restore from multiple month old backups which is basically just as good. Before you say that infiltrating for multiple months is unrealistic, that is actually industry average. It usually takes a few months to years to detect a active infiltration that is actively siphoning all data out of your systems as fast as it is being generated. That is not even a largely quiescent system like the backup encrypter, that is actual high bandwidth egress remaining undetected for months.
  - amelius 3y ago
    A perfect backup system would include testing on an airgapped system.
- j_walter 3y ago
  They have backups...most companies do. That is why these ransomware groups have turned to extortion instead...don't pay and we expose your sensitive info to the world. No amount of good backup policies can block a group from releasing this info.

A cyber ransom demand at one of the most important companies in the world, a lynchpin of digital manufacturing is not reassuring at all. Can their security really be that bad?

Veserv 3y ago

Yes. You would be hard pressed to find any company in the entire world that could prevent attackers with a mere $1M budget. Banks, power plants, car companys, cybersecurity companys, factorys, you name it, almost certainly less than $1M. In fact, probably under $100K, but $1M is a safe upper bound. At a $10M budget there are zero. In fact, no CISO I have ever heard from has ever said that is even possible for a perfect implementation (i.e. they have free reign to implement everything they want as long as it does not make the company non-functional, but they get to be judge, jury, and executioner in that analysis). So yeah, given “perfectly implemented” security a $70M ransom has a guaranteed 700% ROI, but in practice closer to a over 7000% ROI.

lyu07282 3y ago
I imagine many independent security researchers can live quite comfortably just selling 0days on the "free market".
- Veserv 3y ago
  Not really if you live in a high cost-of-living (HCOL) country. Vulnerability weaponization is a very globalized industry and sufficiently easy that there is a oversupply from LCOL countrys. The real money is in deployment and usage as that requires the much rarer and more local criminal and money laundering skill sets.
  - _kbh_ 3y ago
    > Not really if you live in a high cost-of-living (HCOL) country. Vulnerability weaponization is a very globalized industry and sufficiently easy that there is a oversupply from LCOL countrys. The real money is in deployment and usage as that requires the much rarer and more local criminal and money laundering skill sets. A single iOS or Android full chain still goes for between, 2-2.5 million USD. https://zerodium.com/images/zerodium_prices_mobiles.png https://zerodium.com/images/zerodium_prices_mobiles.png https://zerodium.com/images/zerodium_prices.png https://zerodium.com/images/zerodium_prices.png if someone was skilled they could easily live in a HCOL area making 1-1.25 million USD a year.
    - pclmulqdq 3y ago
      A full chain is a difficult attack to create, and probably worth a lot more than $2.5 million - beyond the reach of one person. You need at least two novel, serious exploits. That's why they are so valuable.
      - _kbh_ 3y ago
        > A full chain is a difficult attack to create, and probably worth a lot more than $2.5 million - beyond the reach of one person. You need at least two novel, serious exploits. That's why they are so valuable. Depends if you're publicly selling via Zerodium as much, but if you sell privately it might be worth more. > beyond the reach of one person It's going to be difficult but I don't think its beyond one person, but even if it was you could easily just go for a less difficult tier to make less money more often. The real problem would be how lumpy the payments would be, you'd effectively get nothing until you found something and most people cannot afford to that.

user3939382 3y ago

Not just their security, their backup policies too, right? Ransomware is completely powerless if you can delete and restore. You'd think investing in backup systems, policies, training, monitoring, which is best practice anyway, is cheaper than the horrible PR and costs of these ransoms.

Veserv 3y ago
They just hack the backups as well. Adds like 10% to their costs because those systems are also completely insecure. Even a perfect backup system is easy to beat. You just infiltrate the running system and encrypt the dataflow into the backup system after you get in, do that for a few months, then strike; now they have to restore from multiple month old backups which is basically just as good. Before you say that infiltrating for multiple months is unrealistic, that is actually industry average. It usually takes a few months to years to detect a active infiltration that is actively siphoning all data out of your systems as fast as it is being generated. That is not even a largely quiescent system like the backup encrypter, that is actual high bandwidth egress remaining undetected for months.
- amelius 3y ago
  A perfect backup system would include testing on an airgapped system.
j_walter 3y ago
They have backups...most companies do. That is why these ransomware groups have turned to extortion instead...don't pay and we expose your sensitive info to the world. No amount of good backup policies can block a group from releasing this info.