42 ms·

MOVEit global security incident

110 points by toss1 3y ago

rootusrootus 3y ago
IMO the real problem is treating "ID theft" as a real thing. You can't really steal someone's ID, per se. If a bank opens an fraudulent account without due diligence, that's on them. The law should be that as a consumer, I am the authority on what debt/etc is attributable to me and the burden of proving otherwise is on the company making the claim.
lupusreal 3y ago
[dead]
brandensilva 3y ago
At this rate is there any data on Americans that hasn't leaked? I don't feel like it's far fetched request to allow a one time change of SSNs given how poorly companies and the government have handled our data.
- sonicanatidae 3y ago
  What would be the point of changing a social security number that will be breached again in a few years? Equifax provided 140 million people's information to the world. It was "shielded" behind a default password that was never changed. Their penalty? Profits, because they bought an identity protection firm, provided 2 years of free monitoring, for a lifetime problem, then gleefully charged fees for the protection, that their own malfeasance literally caused.
- oxygen_crisis 3y ago
  By now everyone needs to just abandon the fantasy that SSNs are private information. At this point it's obviously not much better protected than your street address. The fact that a criminal knows your SSN doesn't absolve companies of being defrauded by those criminals through their own lax verification. You should not be liable when entity-A leaks your data and entity-B suffers a loss to someone who has your data. There is no way you could have prevented that eventuality and none of the responsibility should fall on you. Data security and identity verification will not improve so long as we tolerate laws that pretend we are the victims of these attacks and should suffer the losses, instead of recognizing that the entity that failed to properly identify a criminal is the actual victim. The losses must be borne by the parties that are truly capable of preventing "identity theft," or nothing will change.
  - alistairSH 3y ago
    This leak apparently also included medical records and insurance information.
  - calamari4065 3y ago
    This nine digit number is unique to you and is the password to all of your financial, medical, and legal information. No, you can't change it and no, there's no security. Here it is on an un-laminated paper card. You only get one to keep for your whole life, so keep it safe. You're not allowed to laminate it either. Honestly sounds like a great system. Not a single flaw here.
    - fullspectrumdev 3y ago
      > you only get one I wish that was a joke. My wife (American) has found it utterly impossible to replace her social security card that went missing at least 7 years ago, despite several attempts. It would be nice to have so she can interact with the DMV when back in the US, and suchlike. At least where we live now, the equivalent card is infinitely replaceable within days with a simple online form, and the person number is of extremely limited value to fraudsters.
      - qup 3y ago
        That's weird. I have three copies of mine. Admittedly, I got the last one close to 20 years ago, but it was an easy process then (I walked into a building, requested it, they mailed it). My parents gave me the other two.
      - warner25 3y ago
        I've never needed mine to "interact with the DMV" or any other entity. Has she? It doesn't usually count as a primary form of identification like a passport, driver's license, or other government-issued ID card with a photo. I once looked into getting a replacement card because I'm not sure where mine is, and I didn't bother after reading this (https://www.ssa.gov/number-card/replace-card https://www.ssa.gov/number-card/replace-card): "You may not need to replace your card if you know your Social Security number. In most cases, a physical card isn't necessary." I thought, yeah, I guess I've never actually needed it, so if SSA isn't worried then I won't worry either.
- LanternLight83 3y ago
  I won't name names because it seems like an honest mistake, but i once recieved an apology letter (amoung other legal notifications) that a piece of mail had previously been sent to me with my full SSN on the outside of the envelope Not actually the wort breach of a reasonable threat model, i think it's a great whoops story
- adolph 3y ago
  > one-time change of SSNs Ok, chances are good you’d just get some other compromised ID, what’s the upside? Maybe there is something better than some numeric characters?
  - 8n4vidtmkvmk 3y ago
    Can we not make SSNs just less sensitive? They're supposed to be for social security no? Why are they using them for so much other crap first of all. And then secondly.. just stop using it as a form of IDing me. Use my govt ID or something. Or that thing that openai or whoever did recently.
- anonymouskimmer 3y ago
  I believe my favorite drink is still secure. Possibly my favorite movie, but that's too easy to guess. My elementary school mascot has changed over the years, so that might be safe too.
tedunangst 3y ago
[flagged]
- sexy_seedbox 3y ago
  Don't worry, the police will find the data and will be kept safe on the Police Captain's computer.
  - Waterluvian 3y ago
    The folder on Chief’s laptop is named Evidence Locker and they tagged it with a red background.
VyseofArcadia 3y ago
Here's an idea: how about we stop putting sensitive data out on the internet? It's ok if some things stay off computers, or at least airgapped.
- deleted 3y ago
  [deleted]
- __loam 3y ago
  This is incredibly impractical
  - Dalewyn 3y ago
    That attitude is how data breaches keep on happening. We have the means to properly secure data, barring internal absolute human malice or incompetence which nothing can defend against anyway. The problem is most people simply don't want to.
    - __loam 3y ago
      No, the problem is that this kind of airgapped systems are far harder to work with or make useful. You don't need to sacrifice convenience for security. It's quite possible to build secure systems without draconian (and largely useless) security measures.
- sethherr 3y ago
  Hard pass. You can go back to sending letters with your SSN for employment, taxes, etc and ideally that should mean that your information doesn’t go on the internet. But you’re in the minority in wanting that hassle.
  - ethbr1 3y ago
    Air gapping doesn't preclude electronic communication, only that the data at rest isn't accessible from a system with network connectivity. 1. Email / web-submit forms 2. Someone saves requests onto a disc and swivel chairs to load them into the offline system for processing 3. Results are written back to disc, which is swivel chaired back to net-connected systems Congratulations. You've just made physical access (or a much more difficult poisoned data bug) a requirement for data leaks.
deleted 3y ago
[deleted]
drekipus 3y ago
I know "right to repair" has been discussed in Maine, is there a possibility that this will affect the right to repair movement? I can't remember if it was approved or denied, but I have strong suspicion that there's going to be some politicking about this, because people don't understand technology.
- drekipus 3y ago
  I don't understand why I'm getting downvoted It's just a thought, people, relax.
  - Pixie_Dust 3y ago
    > I don't understand why I'm getting downvoted It's easier to downvote you than engage in dialog. >> I have strong suspicion that there's going to be some politicking about this Presumably the decision to use MOVEit had to do with political donations /s Lucky the Director and CIO had traded-out before the hack became public /s > people don't understand technology. The people making the technical decisions don't understand the technology /s
alistairSH 3y ago
tl;dr - this is the MoveIt (file transfer automation software) hack that’s been known since summer. More than just Maine impacted. The news here is just the state acknowledging the impact.
- fullspectrumdev 3y ago
  The gang involved in that is still sifting data and posting victims from that run of exploitation, and has since targeted other software with 0days. Their whole pattern is “find 0day in some shit -> mass exploitation -> massive data theft -> extortion”.
- deleted 3y ago
  [deleted]
james_david 3y ago
Officials say only 40% of the 1.3 million people whose data were exposed are Maine residents. The title is misleading.
- deleted 3y ago
  [deleted]
mensetmanusman 3y ago
Don’t they know we don’t pay ransoms anymore?
zzzeek 3y ago
Whats the "ransom" here? Pay us and we'll delete the data ? Or just the "ransomware group" is going to use this data to actually initiate new ransoms ?
yieldcrv 3y ago
> includes their name, Social Security number, date of birth, driver’s license or state ID number, and taxpayer ID number. Medical information as well has health insurance information may also have been affected monthly reminder that AML/KYC is a joke if all the banks only think they are dealing with people that would pass AML/KYC
carabiner 3y ago
Of Maine. Don't need the 's.
- Dalewyn 3y ago
  "He's been robbed." English here to slap you with the Correct Use of the Incorrect.
  - philipov 3y ago
    In both cases, the 's does not indicate plurality. It is a contraction of "He has been robbed." "Maine has just had its data stolen." In the second case, depending on your dialect, you could remove either 'has' or 'just', but not both. In the first case, you can't substitute 'has' with 'just', but you can use both. That's because "(has|just) had" is an idiomatic expression with different rules than "has (just) been".
    - Dalewyn 3y ago
      In case I wasn't clear, I agree that this grammar is correct despite looking very wrong to non-native speakers.
  - adolph 3y ago
    In the example given, the “apostrophe S” is a contraction of “he has” not a possession indicator. The word “of” established the relationship between “Entire Population” and “Maine.” The apostrophe S is redundant to the point of confusion, as if a word describing a class of things related to Maine were omitted in error, like maybe it was supposed to be “Entire Population of Maine’s Bricklayers and Sitar Players.” If one wanted to use a possessive noun then “Maine’s Entire Population.” https://www.grammarly.com/blog/possessive-nouns/ https://www.grammarly.com/blog/possessive-nouns/
strangesmells06 3y ago
Louisiana Resident here. Welcome to the "hacked government records club" Maine friends.
olliej 3y ago
Remember this kind of BS when governments and police talk about how there secret access won't be exploited by criminals.
mfa1999 3y ago
It’s frustrating that there are no consequences for companies and organizations that don’t have enough security/know-how/motivation to prevent data theft. Would it make sense to have a law that would penalize leaks and theft?
- twunde 3y ago
  There are financial consequences for healthcare data leaking (actual monetary fines) and some consequences for payment data leaking (primarily in the form of higher rates) but there's no significant penalties for leaking SSNs. So every adult feels like they get their data leaked on an annual basis and only get free credit monitoring. I think adding penalties for SSNs leaking would help. Admittedly there are some macro effects that are causing security to be taken more seriously by companies in general. The proliferation of compliance programs especially SOC2 had made basic security the default for a large portion of b2b tech companies. Cyber insurance requirements are increasing. Newer state regulations and SEC regulations have pushed other companies to increase resources dedicated to security. That said this is an uphill battle after a decade or so of companies having no security with passwords or SSNs in plaintext and everyone having access permissions.
  - two_handfuls 3y ago
    There should be consequences for using ssn as an authentication mechanism.
- sofixa 3y ago
  > Would it make sense to have a law that would penalize leaks and theft? GDPR has such provisions, if the company didn't do enough to protect the data. E.g. British Airways were fined for bad practices and because their website had a card scraper for multiple days which they should have detected.
RecycledEle 3y ago
We either need to realize that secret numbers are not a way to idnentify someone, or we need to allow those whose data is stolen to sue the companies that made insecure software.
somat 3y ago
Was it stolen or was it ransomware? the article sort of mushes the two together into one thing. did both happen? Now I am not saying it was not stolen, it probably was, seeing as it was a third party service that was compromised. But stealing data(getting an illegal copy of it) is a very different thing than ransomware (the data may have never been copied. but access to it has been lost) ransomware is the term usually reserved for when the data was not leaked but the owner is unable to access it anymore(unless they pay the ransom). update: the link was changed to a much better article, so this question no longer makes sense. The data was stolen.
- yieldcrv 3y ago
  ransomware campaigns can be a distraction from a parallel exploit
- alphager 3y ago
  Ransomware groups have changed their approach and now routinely steal the data before encrypting it. They then offer two tiers of payment: pay X and they won't leak the data or opt for the premium plan and get the key to decrypt the data.
emptybits 3y ago
Just a Canadian here with a snarky idea... Start an activism movement to draw big ugly expensive attention to this whole Social Security Number misuse situation. My understanding is Americans can get new Social Security Numbers. There is a process for this, requiring at least evidence that their SSN is being used by someone.[1] So take a reasonable interpretation of "used by" ... leaked and/or stolen recently in Maine, now in nefarious hands. Sounds like they "know" a cybercriminal group has this data. Intent to use? Not a stretch, so run with it. Good enough for common sense and popular support. Yes, maybe this doesn't stand up to courts or IRS judgement but it's not an unreasonable request and an application from every taxpayer in Maine might stir up useful attention or change. i.e. question the half-baked status quo of "let's use SSNs for everyone's key in every database" The media might enjoy it and keep this issue alive a little longer before it's yet another massive event quickly forgotten. Or wishful thinking on my part. Sorry, Maine, this sucks. [1] https://www.ssa.gov/pubs/EN-05-10064.pdf https://www.ssa.gov/pubs/EN-05-10064.pdf
- somat 3y ago
  The worst part is the social security number is not supposed to be secret. Really it should be no more secret or effective than your name(which it represents). But some how it is treated as a password, a magical key that opens doors. Yeah, the situation sucks.
  - Thorrez 3y ago
    Old social security cards said "carry this in your wallet". New social security cards say "don't carry this in your wallet". https://i.redd.it/p7o3pq6fuwa91.jpg https://i.redd.it/p7o3pq6fuwa91.jpg
    - mey 3y ago
      Yet they still don't want to laminate the damn thing
      - Obscurity4340 3y ago
yieldcrv 3y ago
web2isgoinggreat
cookiengineer 3y ago
Note that this vulnerability was disclosed in March this year. They had 7 months to fix this, if the cyber security providers and SOCs would do their job correctly. How can this happen if all of their EDR tech stack, firewall subscriptions and overpriced data enrichment pipelines are supposed to warn about this?
- thedougd 3y ago
  March? The MoveIT vulnerability was a zero day with a coordinated attack on Memorial Day weekend. "On May 31, 2023, the State of Maine became aware of a software vulnerability in MOVEit... The software vulnerability was exploited by a group of cybercriminals and allowed them to access and download files belonging to certain agencies in the State of Maine between May 28, 2023, and May 29, 2023." "Why Am I Hearing About This Now? The State of Maine carried out an extensive evaluation to identify the individuals whose information may have been impacted."
  - cookiengineer 3y ago
    Come on, man. It's not like cl0p was quiet about this. Pretty much any hacking related channel was making fun of the RCE and bypass when "thenoc" was hacked, their and all their customers' (mostly lawyers) stuff was leaked, and cl0p devs bragged about it everywhere on Telegram. Maybe you should change your cyber intelligence provider if it's just as good as the NVD/NIST databases. Zero days like this can be easily caught if you have the right sources and don't rely solely on your splunk and fortinet tech stack, you know.
    - thedougd 3y ago
      Whose NOC was hacked? Or what does “thenoc” refer to? We’re talking about hundreds of organizations running MoveIt. Are they all culpable for not having threat intelligence better than disclosed vulnerabilities in COTS software? Or worse, in their vendors’ software? What should they subscribe to?
      - 3y ago
Animats 3y ago
So, the solution the State of Maine has chosen is to become a reseller of Pango/Identity Defense. People get the free trial with, probably, the paid auto-renew deal.
deleted 3y ago
[deleted]
egberts1 3y ago
First law that needs to pass is to prohibit transferring of SSN between any two parties.

110 points by toss1 3y ago

IMO the real problem is treating "ID theft" as a real thing. You can't really steal someone's ID, per se. If a bank opens an fraudulent account without due diligence, that's on them. The law should be that as a consumer, I am the authority on what debt/etc is attributable to me and the burden of proving otherwise is on the company making the claim.

lupusreal 3y ago

[dead]

brandensilva 3y ago

At this rate is there any data on Americans that hasn't leaked? I don't feel like it's far fetched request to allow a one time change of SSNs given how poorly companies and the government have handled our data.

sonicanatidae 3y ago
What would be the point of changing a social security number that will be breached again in a few years? Equifax provided 140 million people's information to the world. It was "shielded" behind a default password that was never changed. Their penalty? Profits, because they bought an identity protection firm, provided 2 years of free monitoring, for a lifetime problem, then gleefully charged fees for the protection, that their own malfeasance literally caused.
oxygen_crisis 3y ago
By now everyone needs to just abandon the fantasy that SSNs are private information. At this point it's obviously not much better protected than your street address. The fact that a criminal knows your SSN doesn't absolve companies of being defrauded by those criminals through their own lax verification. You should not be liable when entity-A leaks your data and entity-B suffers a loss to someone who has your data. There is no way you could have prevented that eventuality and none of the responsibility should fall on you. Data security and identity verification will not improve so long as we tolerate laws that pretend we are the victims of these attacks and should suffer the losses, instead of recognizing that the entity that failed to properly identify a criminal is the actual victim. The losses must be borne by the parties that are truly capable of preventing "identity theft," or nothing will change.
- alistairSH 3y ago
  This leak apparently also included medical records and insurance information.
- calamari4065 3y ago
  This nine digit number is unique to you and is the password to all of your financial, medical, and legal information. No, you can't change it and no, there's no security. Here it is on an un-laminated paper card. You only get one to keep for your whole life, so keep it safe. You're not allowed to laminate it either. Honestly sounds like a great system. Not a single flaw here.
  - fullspectrumdev 3y ago
    > you only get one I wish that was a joke. My wife (American) has found it utterly impossible to replace her social security card that went missing at least 7 years ago, despite several attempts. It would be nice to have so she can interact with the DMV when back in the US, and suchlike. At least where we live now, the equivalent card is infinitely replaceable within days with a simple online form, and the person number is of extremely limited value to fraudsters.
    - qup 3y ago
      That's weird. I have three copies of mine. Admittedly, I got the last one close to 20 years ago, but it was an easy process then (I walked into a building, requested it, they mailed it). My parents gave me the other two.
    - warner25 3y ago
      I've never needed mine to "interact with the DMV" or any other entity. Has she? It doesn't usually count as a primary form of identification like a passport, driver's license, or other government-issued ID card with a photo. I once looked into getting a replacement card because I'm not sure where mine is, and I didn't bother after reading this (https://www.ssa.gov/number-card/replace-card https://www.ssa.gov/number-card/replace-card): "You may not need to replace your card if you know your Social Security number. In most cases, a physical card isn't necessary." I thought, yeah, I guess I've never actually needed it, so if SSA isn't worried then I won't worry either.
LanternLight83 3y ago
I won't name names because it seems like an honest mistake, but i once recieved an apology letter (amoung other legal notifications) that a piece of mail had previously been sent to me with my full SSN on the outside of the envelope Not actually the wort breach of a reasonable threat model, i think it's a great whoops story
adolph 3y ago
> one-time change of SSNs Ok, chances are good you’d just get some other compromised ID, what’s the upside? Maybe there is something better than some numeric characters?
- 8n4vidtmkvmk 3y ago
  Can we not make SSNs just less sensitive? They're supposed to be for social security no? Why are they using them for so much other crap first of all. And then secondly.. just stop using it as a form of IDing me. Use my govt ID or something. Or that thing that openai or whoever did recently.
anonymouskimmer 3y ago
I believe my favorite drink is still secure. Possibly my favorite movie, but that's too easy to guess. My elementary school mascot has changed over the years, so that might be safe too.

tedunangst 3y ago

[flagged]

sexy_seedbox 3y ago
Don't worry, the police will find the data and will be kept safe on the Police Captain's computer.
- Waterluvian 3y ago
  The folder on Chief’s laptop is named Evidence Locker and they tagged it with a red background.

VyseofArcadia 3y ago

Here's an idea: how about we stop putting sensitive data out on the internet? It's ok if some things stay off computers, or at least airgapped.

deleted 3y ago
[deleted]
__loam 3y ago
This is incredibly impractical
- Dalewyn 3y ago
  That attitude is how data breaches keep on happening. We have the means to properly secure data, barring internal absolute human malice or incompetence which nothing can defend against anyway. The problem is most people simply don't want to.
  - __loam 3y ago
    No, the problem is that this kind of airgapped systems are far harder to work with or make useful. You don't need to sacrifice convenience for security. It's quite possible to build secure systems without draconian (and largely useless) security measures.
sethherr 3y ago
Hard pass. You can go back to sending letters with your SSN for employment, taxes, etc and ideally that should mean that your information doesn’t go on the internet. But you’re in the minority in wanting that hassle.
- ethbr1 3y ago
  Air gapping doesn't preclude electronic communication, only that the data at rest isn't accessible from a system with network connectivity. 1. Email / web-submit forms 2. Someone saves requests onto a disc and swivel chairs to load them into the offline system for processing 3. Results are written back to disc, which is swivel chaired back to net-connected systems Congratulations. You've just made physical access (or a much more difficult poisoned data bug) a requirement for data leaks.

deleted 3y ago

[deleted]

drekipus 3y ago

I know "right to repair" has been discussed in Maine, is there a possibility that this will affect the right to repair movement? I can't remember if it was approved or denied, but I have strong suspicion that there's going to be some politicking about this, because people don't understand technology.

drekipus 3y ago
I don't understand why I'm getting downvoted It's just a thought, people, relax.
- Pixie_Dust 3y ago
  > I don't understand why I'm getting downvoted It's easier to downvote you than engage in dialog. >> I have strong suspicion that there's going to be some politicking about this Presumably the decision to use MOVEit had to do with political donations /s Lucky the Director and CIO had traded-out before the hack became public /s > people don't understand technology. The people making the technical decisions don't understand the technology /s

alistairSH 3y ago

tl;dr - this is the MoveIt (file transfer automation software) hack that’s been known since summer. More than just Maine impacted. The news here is just the state acknowledging the impact.

fullspectrumdev 3y ago
The gang involved in that is still sifting data and posting victims from that run of exploitation, and has since targeted other software with 0days. Their whole pattern is “find 0day in some shit -> mass exploitation -> massive data theft -> extortion”.
deleted 3y ago
[deleted]

james_david 3y ago

Officials say only 40% of the 1.3 million people whose data were exposed are Maine residents. The title is misleading.

deleted 3y ago
[deleted]

mensetmanusman 3y ago

Don’t they know we don’t pay ransoms anymore?

zzzeek 3y ago

Whats the "ransom" here? Pay us and we'll delete the data ? Or just the "ransomware group" is going to use this data to actually initiate new ransoms ?

yieldcrv 3y ago

> includes their name, Social Security number, date of birth, driver’s license or state ID number, and taxpayer ID number. Medical information as well has health insurance information may also have been affected monthly reminder that AML/KYC is a joke if all the banks only think they are dealing with people that would pass AML/KYC

carabiner 3y ago

Of Maine. Don't need the 's.

Dalewyn 3y ago
"He's been robbed." English here to slap you with the Correct Use of the Incorrect.
- philipov 3y ago
  In both cases, the 's does not indicate plurality. It is a contraction of "He has been robbed." "Maine has just had its data stolen." In the second case, depending on your dialect, you could remove either 'has' or 'just', but not both. In the first case, you can't substitute 'has' with 'just', but you can use both. That's because "(has|just) had" is an idiomatic expression with different rules than "has (just) been".
  - Dalewyn 3y ago
    In case I wasn't clear, I agree that this grammar is correct despite looking very wrong to non-native speakers.
- adolph 3y ago
  In the example given, the “apostrophe S” is a contraction of “he has” not a possession indicator. The word “of” established the relationship between “Entire Population” and “Maine.” The apostrophe S is redundant to the point of confusion, as if a word describing a class of things related to Maine were omitted in error, like maybe it was supposed to be “Entire Population of Maine’s Bricklayers and Sitar Players.” If one wanted to use a possessive noun then “Maine’s Entire Population.” https://www.grammarly.com/blog/possessive-nouns/ https://www.grammarly.com/blog/possessive-nouns/

strangesmells06 3y ago

Louisiana Resident here. Welcome to the "hacked government records club" Maine friends.

olliej 3y ago

Remember this kind of BS when governments and police talk about how there secret access won't be exploited by criminals.

mfa1999 3y ago

It’s frustrating that there are no consequences for companies and organizations that don’t have enough security/know-how/motivation to prevent data theft. Would it make sense to have a law that would penalize leaks and theft?

twunde 3y ago
There are financial consequences for healthcare data leaking (actual monetary fines) and some consequences for payment data leaking (primarily in the form of higher rates) but there's no significant penalties for leaking SSNs. So every adult feels like they get their data leaked on an annual basis and only get free credit monitoring. I think adding penalties for SSNs leaking would help. Admittedly there are some macro effects that are causing security to be taken more seriously by companies in general. The proliferation of compliance programs especially SOC2 had made basic security the default for a large portion of b2b tech companies. Cyber insurance requirements are increasing. Newer state regulations and SEC regulations have pushed other companies to increase resources dedicated to security. That said this is an uphill battle after a decade or so of companies having no security with passwords or SSNs in plaintext and everyone having access permissions.
- two_handfuls 3y ago
  There should be consequences for using ssn as an authentication mechanism.
sofixa 3y ago
> Would it make sense to have a law that would penalize leaks and theft? GDPR has such provisions, if the company didn't do enough to protect the data. E.g. British Airways were fined for bad practices and because their website had a card scraper for multiple days which they should have detected.

RecycledEle 3y ago

We either need to realize that secret numbers are not a way to idnentify someone, or we need to allow those whose data is stolen to sue the companies that made insecure software.

somat 3y ago

Was it stolen or was it ransomware? the article sort of mushes the two together into one thing. did both happen? Now I am not saying it was not stolen, it probably was, seeing as it was a third party service that was compromised. But stealing data(getting an illegal copy of it) is a very different thing than ransomware (the data may have never been copied. but access to it has been lost) ransomware is the term usually reserved for when the data was not leaked but the owner is unable to access it anymore(unless they pay the ransom). update: the link was changed to a much better article, so this question no longer makes sense. The data was stolen.

yieldcrv 3y ago
ransomware campaigns can be a distraction from a parallel exploit
alphager 3y ago
Ransomware groups have changed their approach and now routinely steal the data before encrypting it. They then offer two tiers of payment: pay X and they won't leak the data or opt for the premium plan and get the key to decrypt the data.

emptybits 3y ago

Just a Canadian here with a snarky idea... Start an activism movement to draw big ugly expensive attention to this whole Social Security Number misuse situation. My understanding is Americans can get new Social Security Numbers. There is a process for this, requiring at least evidence that their SSN is being used by someone.[1] So take a reasonable interpretation of "used by" ... leaked and/or stolen recently in Maine, now in nefarious hands. Sounds like they "know" a cybercriminal group has this data. Intent to use? Not a stretch, so run with it. Good enough for common sense and popular support. Yes, maybe this doesn't stand up to courts or IRS judgement but it's not an unreasonable request and an application from every taxpayer in Maine might stir up useful attention or change. i.e. question the half-baked status quo of "let's use SSNs for everyone's key in every database" The media might enjoy it and keep this issue alive a little longer before it's yet another massive event quickly forgotten. Or wishful thinking on my part. Sorry, Maine, this sucks. [1] https://www.ssa.gov/pubs/EN-05-10064.pdf https://www.ssa.gov/pubs/EN-05-10064.pdf

somat 3y ago
The worst part is the social security number is not supposed to be secret. Really it should be no more secret or effective than your name(which it represents). But some how it is treated as a password, a magical key that opens doors. Yeah, the situation sucks.
- Thorrez 3y ago
  Old social security cards said "carry this in your wallet". New social security cards say "don't carry this in your wallet". https://i.redd.it/p7o3pq6fuwa91.jpg https://i.redd.it/p7o3pq6fuwa91.jpg
  - mey 3y ago
    Yet they still don't want to laminate the damn thing
    - Obscurity4340 3y ago

yieldcrv 3y ago

web2isgoinggreat

cookiengineer 3y ago

Note that this vulnerability was disclosed in March this year. They had 7 months to fix this, if the cyber security providers and SOCs would do their job correctly. How can this happen if all of their EDR tech stack, firewall subscriptions and overpriced data enrichment pipelines are supposed to warn about this?

thedougd 3y ago
March? The MoveIT vulnerability was a zero day with a coordinated attack on Memorial Day weekend. "On May 31, 2023, the State of Maine became aware of a software vulnerability in MOVEit... The software vulnerability was exploited by a group of cybercriminals and allowed them to access and download files belonging to certain agencies in the State of Maine between May 28, 2023, and May 29, 2023." "Why Am I Hearing About This Now? The State of Maine carried out an extensive evaluation to identify the individuals whose information may have been impacted."
- cookiengineer 3y ago
  Come on, man. It's not like cl0p was quiet about this. Pretty much any hacking related channel was making fun of the RCE and bypass when "thenoc" was hacked, their and all their customers' (mostly lawyers) stuff was leaked, and cl0p devs bragged about it everywhere on Telegram. Maybe you should change your cyber intelligence provider if it's just as good as the NVD/NIST databases. Zero days like this can be easily caught if you have the right sources and don't rely solely on your splunk and fortinet tech stack, you know.
  - thedougd 3y ago
    Whose NOC was hacked? Or what does “thenoc” refer to? We’re talking about hundreds of organizations running MoveIt. Are they all culpable for not having threat intelligence better than disclosed vulnerabilities in COTS software? Or worse, in their vendors’ software? What should they subscribe to?
    - 3y ago

Animats 3y ago

So, the solution the State of Maine has chosen is to become a reseller of Pango/Identity Defense. People get the free trial with, probably, the paid auto-renew deal.

deleted 3y ago

[deleted]

egberts1 3y ago

First law that needs to pass is to prohibit transferring of SSN between any two parties.