20 ms·
After Boeing declines to pay up, ransomware group leaks 45 GB of data
- monkeydust 3y agoLLM training fodder?
- m3kw9 3y agolol no sht man, pay up and they’d still sell it behind their backs. Someone always have a copy
- strangattractor 3y agoDidn't a ransomware gang just renege on a deal and release the data anyway. Seems like they are killing their own business model. If company X cannot depend on the gang delivering why pay in the first place. Boeing will have to pay for any fallout form the data breach - why have the added expense of paying the criminals for the privilege?
- barryrandall 3y agoThey do that all the time. The first ransom is to get the decryption keys to the target's data, the second ransom is to prevent them from publishing the decrypted data.
- CivBase 3y agoIf they're going to publish the data publicly, what do you need decryption keys for? Seems like it's basically an all-or-nothing deal to me.
- contravariant 3y agoI think that's why you ransom the decryption key first. If I understood correctly.
- deleted 3y ago[deleted]
- bretpiatt 3y agoPerspective as CEO of a backup and disaster recovery company... A lot of folks now have ransomware protected backups for critical data so they aren't paying for decryption keys. This has escalated to hack and release, the attackers are now exfiltrating data and threatening to make it public in addition to encrypting it on the host system.
- sandworm101 3y ago>> If they're going to publish the data publivally, what do you need decryption keys for? Because they will publish the bad stuff, the stuff you really don't want public, but likely withhold the boring stuff, the stuff the business really needs to function. And whatever they release might not be in the format that it was taken.
- barryrandall 3y agoThey only tell you about the second extortion attempt after the success of the first. As I understand it, each gang operates differently, but most are consistent in their approach (e.g. x will always double ransom, but y will never).
- asdfman123 3y agoTragedy of the commons. We need to establish a centralized judicial system to identify and shut down bad ransomware actors.
- op00to 3y agolet's hold off on advocating for a New World Order just yet.
- asdfman123 3y agoNo, this would be a shadow government by ransomware companies to govern other ransomware companies. We can all get along!
- xeckr 3y agoThis opens up an interesting (albeit highly unethical and illegal) strategy to combat ransomware, which could be implemented by state actors: 1. hack targets and hold their data for ransom 2. get the ransom and release the data anyway This would largely discredit the actual ransomware gangs. A way to make this more ethical would be to have the data be insignificant or encrypted. The media will still have their story, and public perception will be changed. An even better way would be to secretly coordinate with the "targets" of the hacks, turning the whole thing into a harmless spectacle that nevertheless decreases the incentive to hold data for ransom.
- ceejayoz 3y agoI wonder if this counts as an ITAR violation on Boeing's part.
- da_chicken 3y agoHow do you figure that?
- ceejayoz 3y agoThere's almost certainly ITAR-subject data in a Boeing data dump of this size; I'm curious as to whether not paying a ransom counts as releasing it.
- lesuorac 3y agoI'm more curious why failing to secure it doesn't count as a ITAR violation.
- kenjackson 3y agoI think you need to do reasonable effort. Perfect security doesn’t exist.
- hiharryhere 3y agoI doubt it. Here in Australia at least companies with large gov contracts are prevented by gov policy from paying ransoms.
- 2OEH8eoCRo0 3y agoBeing a Russian-linked cyber gang, anything sensitive in there should be treated as public information now anyway. Why bother paying then?
- kh49 3y agoThe never ending cost of low quality outsourced digital transformation. Pathetic how many large corps have been hit. And tax payer has to foot the ever growing bill to investigate and defend these useless orgs.
- hnthrowaway0315 3y agoBasically every large, traditional business is relying on some offshore gig for certain key technical responsibilities. They probably don't consider it the real key as they are cost centers, but hey ransomewares are reminding them. It's not even just offshore. Some onshore consultancies are really of agasp quality.
- pid-1 3y agoIs there any case of a company suffering significant financial backlash due ransomware attacks? My current impression is: consumers don't care, regulators don't care... so why should CEOs care?
- hnthrowaway0315 3y agoYeah you have a good point.
- rileyphone 3y agoCustomers care if your business is in security, especially b2b. Though the biggest downstream effects are probably from security tightening making it more difficult to get anything done. Source: my company was hit a couple months ago
- dimitrios1 3y agoI don't think in the case of airlines we have the option to care. We are just kind of stuck with whatever the government-backed airline oligarchy chooses to do. The airlines would be the ones to have to care for it to matter. When the 737-MAX crashes occurred many frequent travelers, including myself, flat out refused to fly 737-MAX even after we were given assurances by the regulatory bodies. But after a while it just didn't matter. Life goes on, your company will book you on the plane that's the cheapest or part of their plan or whatnot, and you just get stuck being a cog in the wheel again.
- legitster 3y agoI struggle to see how this business model would work in the first place. They pay you and you pinky swear not to release it? All you are doing by negotiating is to buy the victim time to harden their systems. This sounds liked a failed ransomware attack. They encrypted the systems - Boeing says "no thank you, we have backups". There were no valuable zero-days to sell to GRU, so give a last ditch offer to try to salvage something.
- hnthrowaway0315 3y agoI wouldn't be surprised if some ransomeware gangs are frontends of national (in)security agencies. They don't care about profits. Sure it's good to have some.
- kramerger 3y agoWell, every time Boeing tried to bribe a country, someone leaked emails and audio recordings from their secret meetings. Usually we blame the Chinese, but in this case I think its a toss between CIA and NSA. (I think I'm on some kind of list now) Edit: I am an idiot. I was thinking of Airbus, see @perihelions comment below
- perihelions 3y agoWhich incident are you referring to? The NSA took credit for hacking Airbus, but that's Boeing's foreign competitor—not Boeing. https://www.economist.com/special-report/2003/06/12/airbuss-secret-past https://www.economist.com/special-report/2003/06/12/airbuss-... - "According to a European Parliament report, published in 2001, America's National Security Agency (NSA) intercepted faxes and phone calls between Airbus, Saudi Arabian Airlines and the Saudi government in early 1994. The NSA found that Airbus agents were offering bribes to a Saudi official to secure a lion's share for Airbus in modernising Saudi Arabian Airlines' fleet. The planes were in a $6 billion deal that Edouard Balladur, France's then prime minister, had hoped to clinch on a visit to see King Fahd in January 1994. He went home empty-handed." - "James Woolsey, then director of the Central Intelligence Agency, recounted in a newspaper article in 2000 how the American government typically reacted to intelligence of this sort. “When we have caught you [Europeans]...we go to the government you're bribing and tell its officials that we don't take kindly to such corruption,” he wrote. Apparently this (and a direct sales pitch from Bill Clinton to King Fahd) swung the aircraft part of the deal Boeing's and McDonnell Douglas's way."
- ars 3y agoThe US should make it illegal to pay ransom, with a penalty of prison for anyone paying a ransom or authorizing payment. The purpose of the law is that now ransomware gangs will be less likely to target US companies because companies are unlikely to risk paying them.
- ironmagma 3y agoIt's maybe already illegal[1][2]. That doesn't stop companies from paying for it. If you're a hospital, you're weighing breaking the letter of the law with killing a bunch of people. [1] https://www.gma-cpa.com/technology-blog/paying-ransom-on-a-ransomware-attack-is-illegal https://www.gma-cpa.com/technology-blog/paying-ransom-on-a-r... [2] https://cbs12.com/news/cbs12-news-i-team/hospital-ransomware-attack-to-pay-or-not-to-pay-data-patient-lawsuit-florida-hca-healthcare-tenet-st-marys-good-samaritan-florida-7-20-2023 https://cbs12.com/news/cbs12-news-i-team/hospital-ransomware...
- gregwebs 3y agoPaying ransomware is not in any way illegal in the United States. Making payments to sanctioned entities (ransomware or otherwise) is. If companies go to their insurer, etc, they will probably get help to do the compliance to check to see if the payment requested would go to an OFAC sanctioned entity or not.
- bee_rider 3y agoIs the duty to make sure you know you aren’t paying to a sanctioned entity, or is it to not know whether or not you are? Given the sources of many of these attacks, one should reasonably assume they are likely to be doing business with a sanctioned entity, right?
- gregwebs 3y agoThere isn't necessarily a way to know who you are actually dealing with. Maybe in some cases there might be some information to figure this out to some degree. But normally the only information that is certain is where the payment is going. Which is just a bitcoin wallet address.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- carabiner 3y agoWhen Boeing can't match the salaries of Seattle tech companies, this is what happens.
- klyrs 3y agoSpeaking as a native Seattleite with multiple friends and family at the company, Boeing stopped being a Seattle company in 1997.
- Cacti 3y agoMan, that was 25 years ago. Time to move on.
- jmbwell 3y agoTIL: Although Boeing still has manufacturing facilities in the Seattle area, they moved their HQ from Seattle to Chicago in 1997.
- klyrs 3y agoTo rephrase: As McDonnell Douglas was crumpling under the ineptitude of its management, Boeing merged with McDonnell Douglas, keeping Boeing's name and McDonnell Douglas's management.
- massysett 3y agoThe classic joke here is that McDonnell Douglas bought Boeing with Boeing's money.
- voxadam 3y agoWelcome to McBoeing, would you like fries with that? I really wish I could find the McBoeing stickers I was given when I worked as an outside contractor during the time of the merger. The stickers weren't standard issue swag but rather made by a frustrated employee, that said they were a common sight on toolboxes at various plants. I worked installing, qualifying, training on the use, and maintaining CNC machine tools in many shops spread across multiple plants. The folks in the shops where I worked were seriously displeased about the merger. Many of the people I had the pleasure working with had decades of service under their belts and were worried what would come of the combined company. It turns out their fears were entirely valid, though, I suppose most of them retired years ago and are enjoying their pensions.
- kramerger 3y agoIs there anything "useful" in this dump? The article mentions citrix and emails, but that could be anything
- dmix 3y agoUseful to whom? Email dumps and other data could be useful for further breaches and attacks against personnel. I'm sure their infosec will be going through everything but they could miss stuff and personal information is exploitable for fraud even with awareness. Govs like China and aircraft/defense competitors to Boeing probably got a goldmine if they didn't already have their own access. Boeing does plenty of NATSEC and space stuff.
- steponlego 3y agoNow that it's out there somebody will doubtless download it and check it out eventually. Stuff that goes onto the Internet rarely goes away.
- jacquesm 3y agoExcept when you want to preserve it.
- Gigablah 3y agoThere should be a law for this. (Law as in Murphy’s law)
- ttrrooppeerr 3y agoJacques's Law
- whatever1 3y agoLike how can one download so many files from a company network and no alarm is set off ? What do the useless IT departments set up? Just employee spyware ?
- GartzenDeHaes 3y agoLet's say you have 6TB a day going through your perimeter firewall. It's kind of hard to pick out a 40GB stream(s) on HTTPS going to some US cloud provider.
- JoblessWonder 3y agoI mean, depending on the data type... 45GB isn't really all that much. They probably have 45GB individual CAD files... Now, if it is 2,000,000 text files totaling 25gb, then that is harder to explain away. (I just read the article and saw that it deals with a vendor we use daily... so... great news.)
- bunabhucan 3y agoI remember an engineer telling me the physical drawings for the 747 weighed ten times as much as the plane itself.
- Invictus0 3y ago1000 sheets of paper weighs 10 lbs, the 747 weighs 910,000 lbs, so there were 91 million sheets of paper describing the 747? Does not seem accurate
- avar 3y agoThe 747 has around 6 million individual parts, 15 sheets of paper per part doesn't seem unreasonable. Just detailed schematics of a given plastic knob in the cockpit should take at least a few pages, nevermind something more complex or critical like turbine blades.
- 3y ago
- ThinkBeat 3y agoMy memory is not the greatest and simple Google searches are not helping right now. Have there ever been massive problems from one of these leaks for the targeted company? I seem to remember quite a lof of similar leaks over the past two years where the market and public shrug it off. Clearly 45gig is a lot. I would think if there was a major horrible thing to find that Boeing would have paid the ransom (and told no one). Will it have any real negative consequences for Boeing? It is a black mark against them that they were vulnerable. I guess it is favorable point for many that they didn't pay.
- anitil 3y agoI think it would be a problem if people started digging, but I suspect most people just don't have the time, inclination, or willingness to take the legal risk.
- jacekm 3y agoCompetition will love to have a look at this data but obviously they won't announce it to the whole world that they are digging through the files. One day Airbus will build a new plane before Boeing or just win a lucrative contract and we will never know whether this happened naturally or because of the knowledge they got from this data.
- Denvercoder9 3y agoAirbus won't touch this data with a 90ft pole. Their lawyers will make sure of that, as even just downloading it opens them up to tons of lawsuits. The ones looking at this will be China, Russia and their associates that don't care about (Western) law.
- omnimus 3y agoAirbus is not a person but a company. Of course some of the employees will look at this data. They will all pretend that they dont but companies pay for industry secrets why would they stay away from free ones.
- 1-6 3y agoThe moment a company pays good money, that legitimizes the hacking group and emboldens them to keep going. You can’t trust that they’ll not leak even after they get paid.
- freedude 3y ago45GB of data could be like a dozen employees' or less Outlook PST files. For this to be astounding we would need to know the quality of the data. Otherwise it is a bunch of hype and hoopla.
- campbel 3y agoYou better pay up or we'll delete all of Marge and Victors email backups!
- anitil 3y agoI'm not sure about the legality and ethics of training models on stolen data, but for reference, but so far as I can tell the Enron email data set is about 1.5GB (much lower than I expected to be honest!). And I believe some of the more interesting things found in that data set (outside of the fraud) were people cheating on their partners. https://www.kaggle.com/datasets/wcukierski/enron-email-dataset/data https://www.kaggle.com/datasets/wcukierski/enron-email-datas...
- justsocrateasin 3y agoI do believe that 1.5GB is tarred and gzipped though, so it is a fair bit bigger. That's also supposedly half a million emails, so 45gb is quite a bit.
- primax 3y agoSure, but that was leaked in 2004. A very different time for email, and where attachments were generally smaller.
- jmalicki 3y agoThe Enron dataset was not leaked - it was made public by the US government as evidence from an investigation by the Federal Energy Regulatory Commission. https://www.ferc.gov/electric/industry-activities/addressing-2000-2001-western-energy-crisis/information-released-enron-investigation https://www.ferc.gov/electric/industry-activities/addressing...
- augustulus 3y agowe should be careful making the assumption that this is all the data they exfiltrated. this could easily just be the first tranche to prove that they’re serious
- SahAssar 3y agoCan we stop using disk size as a measure of leaked data? There are bluray movies larger than this leak and there are files smaller than 10kb a lot more critical in most businesses. It'd be nice if there was some sort of scale for data leaks like (just spitballing here): 1. Leak destroys all core company functions (crypto-exchange leaks all wallet keys, CA leaks all root keys and becomes banned from all trust stores, etc.) 2. Leak causes regulatory issues criminal enough to shut down company 3. Leak severely hinders core company functions (deploy keys for a cloud computing SaaS are deleted which stops all new deployments until all infra is reconfigured) 4. Leak severely looses company competitive advantages (new products leak that are replicable by competitors) 5. Leak causes severe PR disaster 6. Leak shows embarrassing internal company communication without any of the above
- tyingq 3y agoWould be nice, but there would quite a lot of analysis needed to be able to determine any of that. Which you can't start until the file is public.
- SahAssar 3y agoSure, but instead of saying "Boeing leaked 45GB" it would say "Boeing leaked files of undetermined severity". The disk size does not matter, and when the severity was actually determined it would show up in the headlines as "Boeing leak determined to be a level 3 leak" instead of just being "That boeing leak 5 months ago was kinda bad". Either way, listing the size says very little.
- incahoots 3y agoI'm at an en-passe here, on the one hand I think Boeing sucks as it's primary business is now hyper focused for defense purposes. On the other, ransomware generally hurts companies and municipalities that generally don't deserve it. Boeing, Lockheed Martin, Facebook, etc...deserve it
- verandaguy 3y agoNit: it’s an impasse, not an en-passe.
- incahoots 3y agoI'm just another victim of autocorrect
- justrealist 3y ago> Boeing sucks as it's primary business is now hyper focused for defense purposes This is a childish 2000s take. The world is rougher, Pax Americana is over, we need effective defense contractors because the world is full of assholes. Grow up.
- mach5 3y agoits rougher because of america, not in spite of it. its a self-reinforcing feedback loop. implying you are the grown up in the room because you are 'realist' about this or whatever is a classic dimwit take.
- justrealist 3y agoLet me guess, Russia invaded Ukraine to eradicate the US biolabs breeding nazi GMO mosquitos.
- mach5 3y agono and also i just noticed you have “realist” in your username, i didn’t even do that on purpose, lmao bozo
- gist 3y agoA writer contacted me about my thoughts (unrelated and separate from this event) about how the disclosure of vulnerabilities and methods of hacking (of all types and in almost all situations) aids bad actors vs. helps companies protect their systems (by knowing vulnerabilities that are often so obscure they would reasonably never be exploited). Point is what is the upside of disclosure (I think) vs. the downside. Nobody is suggesting no disclosure but the writer seemed to think that the security industrial complex has lawmakers believing that everything should be open and there should be constant white hat hacking which seems to feed and benefit the security industry. I am curious if anyone has a thought on this topic.
- npalli 3y agoFor an external party, having access to the 45 GB is the easy part. Now, you will need to create a company and supplier base the size of Boeing to make any use of this :-)
- hrdwdmrbl 3y agoChina
- bozhark 3y agoAlready had it
- npalli 3y ago1. They probably already have it :-) 2. Imagine the sheer pain of duplicating every single process and spec to the minutest detail, nobody is flying an airplane that only 'works' 99.99% of the time. Probably easier to start from scratch and learn it. BTW, this was tried by Russia in the all through the '80s, they tried to steal all advanced tech. but by the time they duplicated the stolen technology, the next generation appeared. A losing battle.
- reactordev 3y agoSounds a lot like software forks… cough Not the ones that were forked due to abandonment, but the forks due to “irreconcilable differences”.
- denimnerd42 3y agoor hadoop
- ethbr1 3y ago> nobody is flying an airplane that only 'works' 99.99% of the time Might I introduce you to the Tupolev Tu-134? https://en.m.wikipedia.org/wiki/List_of_accidents_and_incidents_involving_the_Tupolev_Tu-134 https://en.m.wikipedia.org/wiki/List_of_accidents_and_incide...
- Spk-17kek 3y agoWhat if it is false information to harm opportunists?
- pcurve 3y agoThe market seems to think this is inconsequential.
- newuser94303 3y agoThe bigger problem for Boeing will be that they probably have fraud evidence in the 45G.
- worthless-trash 3y agoI have grown respect for boeing after not paying this.
- extheat 3y agoThe best way to mitigate attacks like this is simple: don't hold the data in the first place. Beyond that, encrypting and limiting who has access to what, and logging who opens what when makes it much harder for attacks like these to go under the radar. Obviously, not every company is Google and having super sophisticated security practices is both hard to do from an engineering standpoint (requires lots of infra) _and_ requires staff to have a security focused mindset. This is not something a lot of places have, not even tech companies by trade. The cost benefit analysis isn't high, so you end up with orgs that do things akin to dumping all corporate code into one Github account and then wonder how things went wrong when something bad happens. Boeing Co, as a government contractor being hacked is obviously more concerning than a breach at $x company. It's a shame. I'd say this is a learning opportunity, but it likely won't be. Onto the next round of "cybersecurity" speak...
- deleted 3y ago[deleted]
- cosmojg 3y agoAs someone who works in the defense industry, I can assure you that 45 GB of unencrypted emails is next to worthless from a commercial standpoint and a total non-event from a national security standpoint. This is probably more of a threat to individual employees than it is to anybody else. To put it another way, if this data had value, the ransomware group wouldn't be leaking it for free.
- visarga 3y agoMaybe we can get another email corpus like Enron for NLP from all of this.
- fakedang 3y agoStill useful to find weak links as a foreign adversary.
- IndySun 3y ago>As someone who works in the defense industry, I can assure you... Defence industry is broad, though, perhaps you needed to be for security reasons. However, stating your job then saying individual people don't matter but commercial entities do may make you unfit for certain defence careers.
- haliskerbas 3y agoThe people who think individual human lives have value usually opt out of working in “defense”.
- solardev 3y agoWell, they could be in the "all are equal, some are more equal" camp. Lives have value, but some have more value... especially "ours". Realistically, most people aren't going to spare more than an internet comment or a weekend protest for some atrocity going on across the world, anyway. The world teaches us to compartmentalize evil in order to go on living...
- gehwartzen 3y agoOut of curiosity how do you guys mentally interpret the data size when reading about a hack/leak story? 45GB? Do you think 10s of millions of text files? A few DVD rips? a server backup? It seems so useless but is always portrayed as the "wow look at that number!" part of any leak/hack story
- hadlock 3y agoAt one Very Corporate job I had, there was a file share that somehow had never been culled, had a bunch of coworkers (current and previous) vacation photos, even a couple episodes of seinfield and I think the movie Die Hard. This was pre-snowden and the ripped videos were very pre-snowden. This share was like 8 or 9gb. Two or three .ISOs from a POC (proof of concept) with a vendor could easily push it over 16gb. If they compromised the share the marketing department kept their 2006 era .wma files of the company team building activity from That One Time it might result in not a lot of actual text files. I've had my gmail account for almost as long as you've been able to have one (almost 19 years?) and I've only managed to accrue 17GB in that time.
- offices 3y agoComparing my personal email account with my work email account, the latter has a lot more 'waste'. An email for every meeting, daily office grumblings, JIRA spam, CI spam, etc. And most of these also apply to aerospace engineers. 45 GB is nothing.
- riffraff 3y ago"three times my Gmail inbox accumulated in about 20 years"
- vidarh 3y ago4x my current inbox, accumulated over 2 years since I moved providers. 45GB and a a lot of it's just text. If it includes documents, it could be next to nothing.
- workfromspace 3y agohttps://archive.is/LUqeb https://archive.is/LUqeb
- runeks 3y agoNew security-through-obscurity tactic: make sure to automatically send lots of fake emails between employees, containing importantly-sounding words such as "classified", "secret" and "important" — with some identifying characteristic that makes the employees' email clients ignore them. Then an email dump of 45 GB of useful information could instead be 4.5 TB (with 1% useful information), and wading through all the non-information to find something useful will not be worth the time of the adversary. The more important information you have in emails the more you need to increase the misinformation-to-information ratio.
- chakintosh 3y agoI wonder if anything here is related to the MCAS disasters
- Xcelerate 3y agoThe government should just make it illegal for companies to pay ransomware groups. There, now the ransomware business model evaporates and companies have to actually focus on security rather than hoping they can pay their way out of a potential problem. It’s short-term pain for society in exchange for a better long-term solution.
- PhilipRoman 3y agoI believe circumvention of such measures is already common, companies hire expensive "experts" and "consultants" who just quietly pay the ransomware group.
- Billamnathan 3y ago[dead]