4 ms·

50GB of data from a big company seems like a big nothing burger unless it's like 50GB of specifically executive email or similar. If it's actual product info, 5

by bragr 3y ago

50GB of data from a big company seems like a big nothing burger unless it's like 50GB of specifically executive email or similar. If it's actual product info, 50GB of CAD files is nothing for a big industrial project.

ASalazarMX 3y ago
That's probably why Boeing didn't pay, mustn't be very valuable hostages there. OTOH, this isn't plain ransomware, it's exfiltration+ransomware. More and more bad actors ransom, and after being paid, sell anyway. Why pay if they're going to slap your other cheek regardless?
sschueller 3y ago
It could contain just a few kbit of documents that would get Boeing into even bigger legal troubles for example regarding the MCAS and the 737 Max.
- rl3 3y ago
  Wonder if there's ever been hearings on evidence admission in product liability cases where the data source is a ransomware group. As aside, it's hard to believe this incident in particular didn't get full NSA attention. https://news.ycombinator.com/item?id=24670701 https://news.ycombinator.com/item?id=24670701
  - lazide 3y ago
    Shouldn’t be an issue. Plenty of court precedent that evidence gathered through crimes is admissible as long as it wasn’t the cops/gov’t committing the crimes.
    - jstarfish 3y ago
      Fruit of the poisoned tree normally applies. When does it not? (The only exception I know of is allowing illegally-obtained evidence in defense against defamation claims...IANAL.)
      - neodymiumphish 3y ago
        FOTPT only applies in instances where the cops obtained the content illegally. If some vigilante or bad actor obtains evidence of a crime without coordination or involvement from the government, then the government obtains this illegally-obtained information through legal means, it's still fair game for prosecution. For example, if I break into your home and steal your safe, which contains evidence of fraud you're committing, then the cops catch me and seize the evidence of my crime, thus observing evidence of your crimes, the evidence they took from my case can be used against you. In fact, if I'm talking to my cop friend and he tells me about the case against you and that they think there's evidence of your criminal activity in your safe, but they haven't obtained probable cause, I could break in, take the safe, and provide it to my friend and it still be admissible in court. Your defense would have to make a convincing argument that my cop friend asked or coordinated with me to commit the crime of breaking into your house/safe.
        lazide 3y ago
        Yup, though if the cop had any sense he’d slap that friend silly before he bought himself all the legal bills from that stunt.
        userinanother 3y ago
        Can’t sue someone with no money just saying
        lazide 3y ago
        They can end up in jail for burglary if they can’t afford decent lawyers though.
deleted 3y ago
[deleted]
jstarfish 3y ago
Exfiltration isn't always about copying the tech. 50GB may not be enough to reproduce the object, but it's enough to sniff out a vulnerability. Boeing happens to be a defense contractor... > files said to be related to [...] supplier details. Supply chain attacks are the social equivalent of malware persistence. Now you know what parts they need, what vendors they source from, and maybe even for what products, so you've found a number of ways to get back in later.

by bragr 3y ago

ASalazarMX 3y ago

That's probably why Boeing didn't pay, mustn't be very valuable hostages there. OTOH, this isn't plain ransomware, it's exfiltration+ransomware. More and more bad actors ransom, and after being paid, sell anyway. Why pay if they're going to slap your other cheek regardless?

sschueller 3y ago

It could contain just a few kbit of documents that would get Boeing into even bigger legal troubles for example regarding the MCAS and the 737 Max.

rl3 3y ago
Wonder if there's ever been hearings on evidence admission in product liability cases where the data source is a ransomware group. As aside, it's hard to believe this incident in particular didn't get full NSA attention. https://news.ycombinator.com/item?id=24670701 https://news.ycombinator.com/item?id=24670701
- lazide 3y ago
  Shouldn’t be an issue. Plenty of court precedent that evidence gathered through crimes is admissible as long as it wasn’t the cops/gov’t committing the crimes.
  - jstarfish 3y ago
    Fruit of the poisoned tree normally applies. When does it not? (The only exception I know of is allowing illegally-obtained evidence in defense against defamation claims...IANAL.)
    - neodymiumphish 3y ago
      FOTPT only applies in instances where the cops obtained the content illegally. If some vigilante or bad actor obtains evidence of a crime without coordination or involvement from the government, then the government obtains this illegally-obtained information through legal means, it's still fair game for prosecution. For example, if I break into your home and steal your safe, which contains evidence of fraud you're committing, then the cops catch me and seize the evidence of my crime, thus observing evidence of your crimes, the evidence they took from my case can be used against you. In fact, if I'm talking to my cop friend and he tells me about the case against you and that they think there's evidence of your criminal activity in your safe, but they haven't obtained probable cause, I could break in, take the safe, and provide it to my friend and it still be admissible in court. Your defense would have to make a convincing argument that my cop friend asked or coordinated with me to commit the crime of breaking into your house/safe.
      - lazide 3y ago
        Yup, though if the cop had any sense he’d slap that friend silly before he bought himself all the legal bills from that stunt.
        userinanother 3y ago
        Can’t sue someone with no money just saying
        lazide 3y ago
        They can end up in jail for burglary if they can’t afford decent lawyers though.

deleted 3y ago

[deleted]

jstarfish 3y ago

Exfiltration isn't always about copying the tech. 50GB may not be enough to reproduce the object, but it's enough to sniff out a vulnerability. Boeing happens to be a defense contractor... > files said to be related to [...] supplier details. Supply chain attacks are the social equivalent of malware persistence. Now you know what parts they need, what vendors they source from, and maybe even for what products, so you've found a number of ways to get back in later.