6 ms·
Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods
- clort 1y agoLittle information there about them, but I find it kind of surprising that the suspects are even UK based..
- beepboopboop 1y agoWhy is that surprising?
- golan 1y agoI guess I’d expect them to be in a country where it’d be difficult to be apprehended and extradited. Being in the UK seems like a stupid move to me, but what do I know!
- deleted 1y ago[deleted]
- immibis 1y agoWas it a professional operation? Says they were 17. Some people playing around with their Commodore 64 except it's connected to the internet and a pretty big company.
- dylan604 1y agoLet's not pretend these kids were trying to hack the Gibson just for the lulz. Calling into help desk, requesting password resets with social engineering, getting into network, installing ransomware is all well beyond playing around. I know there are smart teens, but I would not be surprised to find out there is someone more experienced in the background that got the kids going if not even on behalf of. There are plenty of teens selling dope, stealing cars, breaking into homes, yet nobody thinks they're just knuckleheads playing around. Why do we think because "but on a computer" makes it different?
- RainyDayTmrw 1y agoCybercrime is usually international, cross-border, because (1) it's all online anyways, and so it's approximately equally difficult from any country, and (2) to disincentivize your own local law enforcement from getting involved.
- dboreham 1y agoYou have to buy underwear or prawn sandwiches in the UK to know M&S exists?
- gluten_guardian 1y agoCrazy how young all these cyber criminals are. When I was their age, the peak of my criminal career was scoring booze by lying about my age. I wish they shared a little bit on what cyberattacks they were conducting.
- pekim 1y agoI suspect that it is related to the M&S and Co-op attacks. https://www.bbc.co.uk/news/articles/cwykgrv374eo https://www.bbc.co.uk/news/articles/cwykgrv374eo
- MisterTea 1y agoYoung people have little fear of repercussion as they cant really fathom the consequences. Either they learn from this misadventure or go on being a career criminal. All of this depends on their home lives.
- scott_w 1y agoThis simply isn’t true. Yes, teenagers are morons by the standard of a well adjusted 30 year old, but they’re more than capable of understanding consequences for their actions. I hate to sound like my parents/grandparents but I absolutely knew that causing millions of pounds of damage and attempting to blackmail a major corporation could have huge negative consequences for people and myself at 17.
- immibis 1y agoThe probability they'll try to teach you to obey the law instead of locking you in a cell for life is significantly higher when you're 17 than when you're 35. Even better if you're 13, though.
- scott_w 1y agoI’m a bit torn on that, honestly. Were this an embarrassing hack like the ones I read about as a teenager, I’d agree. However, they caused millions of pounds of damage to multiple companies (and their customers) and attempted to blackmail the CEO for profit. I’d be amazed, and I think the public would be outraged, if they got a slap on the wrist for this.
- lyu07282 1y agoApparently they pretended to be an employee and the help desk reset the password for them. Once in the door, active directory imploded as usual, with full access they encrypted everything and demanded ransome. Source: https://specopssoft.com/blog/marks-spencer-ransomware-active-directory/ https://specopssoft.com/blog/marks-spencer-ransomware-active...
- Hilift 1y agoReminds me of Maersk. They had poor endpoint hygiene and no EDR. In 2017 about 90% of their infrastructure was wiped in less than one minute. They had to reinstall a lot of things due to backups weren't up to par. Usually level 1 merchants (> 6 million transactions per year) are put on an audit and improvement plan if this occurs. In the UK, there could be an investigation and penalty from the ICO for the data breach.
- roywiggins 1y ago> They had to reinstall a lot of things due to backups weren't up to par. "After a frantic search that entailed calling hundreds of IT admins in data centers around the world, Maersk’s desperate administrators finally found one lone surviving domain controller in a remote office—in Ghana. At some point before NotPetya struck, a blackout had knocked the Ghanaian machine offline, and the computer remained disconnected from the network. It thus contained the singular known copy of the company’s domain controller data left untouched by the malware—all thanks to a power outage... So the Maidenhead operation arranged for a kind of relay race: One staffer from the Ghana office flew to Nigeria to meet another Maersk employee in the airport to hand off the very precious hard drive. That staffer then boarded the six-and-a-half-hour flight to Heathrow, carrying the keystone of Maersk’s entire recovery process." https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...
- Hilift 1y agoThey were lucky. Remote DC's were always entertaining for us. We had hundreds, and it was usually and reluctantly due to environmental conditions where they didn't want to deal with authentication issues if the network was down. The downside was the occasional DC that disappeared. Once in Egypt, a fire caused relocation of servers and what not, and we actually had a guy take a photo of our DC on a donkey cart in the process of moving down the street. I thought those were made up things, but donkey carts usually don't need a license or insurance.
- aaronrobinson 1y agoThis stinks of foreign sponsorship. I can see how they could pull off the social engineering but being able to work their way around a foreign system like they did - no way.
- lyu07282 1y agoActive directory has become an invaluable tool for ransome gangs, it not only gives them effortless root access on every system, but also documents the company structure so you can focus your resources. This isn't sophisticated at all.
- casenmgreen 1y agoEvil Tor used are blocked. Can't read site.
- jancsika 1y agoI only read sites that are written in Rust, and I can't load this one either. Can someone post a String Literal for us, please?
- testfrequency 1y ago[flagged]
- pinoy420 1y ago[dead]
- golan 1y agoRelated Reddit thread : https://www.reddit.com/r/cybersecurity/s/LXb88TKC4M https://www.reddit.com/r/cybersecurity/s/LXb88TKC4M
- bargainbin 1y agoThis doesn’t surprise me. I work for a company that hires a substantial headcount from TCS, probably one of their biggest clients, and the quality of the work is astonishingly bad. I’d recommend avoiding at all costs but we all know these companies are brought in by non-technical people.
- toomuchtodo 1y ago+1 from first hand experience with TCS
- miohtama 1y agoIn a proper capitalistic system, those who build low quality e-commerce services, including hackable ones, should go out of business and replace more competent companies. This includes buying services from bad suppliers. This Reddit post hints that many shortcuts were taken, security not taken seriously when they should have, and now they reap what they sow.
- skippyboxedhero 1y agoThere has been no reaping. MKS shares were largely unimpacted (despite this costing at least £300m). Management have tried to deflect, said this was a highly sophisticated attack, said that other firms had been hacked but just didn't report it, endless amounts of lying. The reality is that decreasing costs is a far easier lever to pull than increasing revenue so managers will be heavily incentivised to do this if you give them profit-based incentives. This happens every few years with listed companies in the UK now, no-one ever changes their behaviour (retail, in particular, is ground zero for bluffers in the UK, managers are exceptionally bad, and even worse are comp committees that set targets that cannot be achieved without damaging long-term value). There is no efficient market here. It is as simple as managers understanding the world we now live in, and that is unlikely because all these companies view IT as a cost and their managers are people who rotate through executive roles and politics despite leaving a flaming wreck in their wake. Things will stay the same.
- djaychela 1y agoA friend of mine is senior management at one of these companies. His life has been a real nightmare trying to get things back on track - there are so many interconnected systems that they needed to get back up 'clean' and running just to get their normal business running, let alone the online side. And he's not even directly responsible for any of this, but it's all so embedded in a modern retail business that if something like this happens it's your problem to deal with to a degree. The stress caused by this sort of thing is immense.
- mtkd 1y ago>it's your problem to deal with to a degree How is it not the responsibility of senior management at a major retailer to ensure an exploit at a vendor can't take the whole house of cards down? Many other major enterprise clients out there are all over vendor security/compliance ... auditing and reauditing vendors to minimise chance of this happening or worst-case, if does happen, containing it and recoverying quickly
- djaychela 1y ago>How is it not the responsibility of senior management at a major retailer to ensure an exploit at a vendor can't take the whole house of cards down? I think you may be misunderstanding their organisation layout - his job is entirely to do with the quality of the products that they offer (and he's very good at it). He's nothing to with sales or online or any of that, but part of the 'normal' retail chain that people would never think goes anywhere this stuff. But their systems were all taken out because of this.
- devwastaken 1y agoCyber crime does not exist. Only deficient systems intentionally designed to be exploited exist. if you want your “cyber infrastructure” to not be attacked, dont make it vulnerable. All tech is artificial, not of nature. Require software to be developed by licensed engineers. no more offshoring. no more importing of cheap labor. make tech corps pay instead of acruing mass wealth. Make the corps pay when the vulnerabilities they put in it are exploited.
- tsm 1y agoTheft does not exist. Only deficient windows intentionally designed to be breakable exist. if you want your "personal possessions" to not be taken, dont make them vulnerable. <etc> Yes, the companies involved should take some responsibility for terrible security practice (though I'm sure they wish this had never happened!) but victim-blaming doesn't justify crime.
- devwastaken 1y agoMore like if the store had the information of every customer sitting there for anyone to take. yes, theyre responsible for their negligence. When you know its going to happen, and then it happens because you did nothing - yeah, its your fault.
- cedws 1y agoThe focus will be on these teenagers but the real story is one of security negligence by these companies.