3 ms·

"The hackers stated that they attempted to contact Red Hat with an extortion demand but received no response other than a templated reply instructing them to su

"The hackers stated that they attempted to contact Red Hat with an extortion demand but received no response other than a templated reply instructing them to submit a vulnerability report to their security team." Just hilarious

1970-01-01 1y ago
You didn't give the kicker: "According to them, the created ticket was repeatedly assigned to additional people, including Red Hat's legal and security staff members." Summarized: Given enough eyeballs, all extortion demands are fallow.
- nomilk 1y ago
  fallow == marked by inactivity Thanks, hadn't encountered this word before.
  - bombcar 1y ago
    Normally used with farming; you run the land two years, and then leave it fallow for a year to recover.
  - poppafuze 1y ago
    Linus' Law used a different word.
- elicash 1y ago
  And then there's more, via 404: “Since RedHat doesn't want to answer to us,” the hackers wrote in a channel on Telegram viewed by 404 Media, suggesting they have attempted to contact Red Hat. [...] “We have given them too much time already to answer lol instead of just starting a discussion they kept ignoring the emails,” the message added. In another message, the group said it had “gained access to some of their clients' infrastructure as well, already warned them but yeah they preferred ignoring us.” https://www.404media.co/red-hat-investigating-breach-impacting-as-many-as-28-000-customers-including-the-navy-and-congress/ https://www.404media.co/red-hat-investigating-breach-impacti...
  - parliament32 1y ago
    https://archive.ph/l9Hxh https://archive.ph/l9Hxh
  - nailer 1y ago
    "Since RedHat doesn't want to answer to us" First rule of having someone reply: spell their name correctly.
- andmarios 1y ago
  To be fair, once your data has been stolen, it doesn't make sense to engage with the hackers. There is no way to guarantee that the stolen data won't be used. What you must do immediately is notify the affected customers, bring down or lock the affected services, and contact the authorities.
  - poemxo 1y ago
    I'm a customer and the first I'm hearing about this is from HN.
  - themafia 1y ago
    There's no way to guarantee that I won't get in a car accident. So I pay for insurance. I may never need it, it may never come in handy, but it still makes sense to carry the policy.
  - jasonjayr 1y ago
    There is an interesting dynamic/risk in play: If an attacker make an extortion threat, but then still follows through on the release/damage after being paid, then people are not incentivized to engage with you, and will go into attack mode right away, making it riskier for you. HOWEVER, if the attacker make the extortion threat, takes payment, and then honors the agreement, and ends the transaction, then parties are more inclined to just pay to make the problem go away. They know that the upfront price is the full cost of the problem. I've seen that there are 'ethical attackers' out there that move on after an attack, but you never know what kind you're dealing with :-/ "Never negotiate...."
    - Loudergood 1y ago
      Then the hacker org spins up a new name(like a shitty construction llc) and robs the next guy. Reputation isn't all that useful for extortion. Running all your crimes as the "Wet Bandits" makes it much easier for law enforcement if they do catch up with you.
  - eviks 1y ago
    There is no guarantee anywhere (strictly speaking, including in the legal market), but that doesn't mean the paying has no effect of the probability of data being dumped. Notification is an independent requirement.
- jayd16 1y ago
  Corpo cyberpunk
behnamoh 1y ago
Can't be extorted if you can't be reached. such a two-brain move!
lanfeust6 1y ago
made my day
devonkim 1y ago
This whole process happening is exactly what happens in a quest in Cyberpunk 2077. There’s an e-mail chain where a gang tried to extort a corporation and gave up after being unable to reach a person. I sincerely hope that the game doesn’t become prophetic in the manner Idiocracy has.

1970-01-01 1y ago

You didn't give the kicker: "According to them, the created ticket was repeatedly assigned to additional people, including Red Hat's legal and security staff members." Summarized: Given enough eyeballs, all extortion demands are fallow.

nomilk 1y ago
fallow == marked by inactivity Thanks, hadn't encountered this word before.
- bombcar 1y ago
  Normally used with farming; you run the land two years, and then leave it fallow for a year to recover.
- poppafuze 1y ago
  Linus' Law used a different word.
elicash 1y ago
And then there's more, via 404: “Since RedHat doesn't want to answer to us,” the hackers wrote in a channel on Telegram viewed by 404 Media, suggesting they have attempted to contact Red Hat. [...] “We have given them too much time already to answer lol instead of just starting a discussion they kept ignoring the emails,” the message added. In another message, the group said it had “gained access to some of their clients' infrastructure as well, already warned them but yeah they preferred ignoring us.” https://www.404media.co/red-hat-investigating-breach-impacting-as-many-as-28-000-customers-including-the-navy-and-congress/ https://www.404media.co/red-hat-investigating-breach-impacti...
- parliament32 1y ago
  https://archive.ph/l9Hxh https://archive.ph/l9Hxh
- nailer 1y ago
  "Since RedHat doesn't want to answer to us" First rule of having someone reply: spell their name correctly.
andmarios 1y ago
To be fair, once your data has been stolen, it doesn't make sense to engage with the hackers. There is no way to guarantee that the stolen data won't be used. What you must do immediately is notify the affected customers, bring down or lock the affected services, and contact the authorities.
- poemxo 1y ago
  I'm a customer and the first I'm hearing about this is from HN.
- themafia 1y ago
  There's no way to guarantee that I won't get in a car accident. So I pay for insurance. I may never need it, it may never come in handy, but it still makes sense to carry the policy.
- jasonjayr 1y ago
  There is an interesting dynamic/risk in play: If an attacker make an extortion threat, but then still follows through on the release/damage after being paid, then people are not incentivized to engage with you, and will go into attack mode right away, making it riskier for you. HOWEVER, if the attacker make the extortion threat, takes payment, and then honors the agreement, and ends the transaction, then parties are more inclined to just pay to make the problem go away. They know that the upfront price is the full cost of the problem. I've seen that there are 'ethical attackers' out there that move on after an attack, but you never know what kind you're dealing with :-/ "Never negotiate...."
  - Loudergood 1y ago
    Then the hacker org spins up a new name(like a shitty construction llc) and robs the next guy. Reputation isn't all that useful for extortion. Running all your crimes as the "Wet Bandits" makes it much easier for law enforcement if they do catch up with you.
- eviks 1y ago
  There is no guarantee anywhere (strictly speaking, including in the legal market), but that doesn't mean the paying has no effect of the probability of data being dumped. Notification is an independent requirement.
jayd16 1y ago
Corpo cyberpunk

behnamoh 1y ago

Can't be extorted if you can't be reached. such a two-brain move!

lanfeust6 1y ago

made my day

devonkim 1y ago

This whole process happening is exactly what happens in a quest in Cyberpunk 2077. There’s an e-mail chain where a gang tried to extort a corporation and gave up after being unable to reach a person. I sincerely hope that the game doesn’t become prophetic in the manner Idiocracy has.