5 ms·

Could someone please help me understand how can changing a headline on some websites cause five-figures damages? Honest question, really. Every time I see arti

by klez 13y ago

Could someone please help me understand how can changing a headline on some websites cause five-figures damages? Honest question, really. Every time I see articles about computer vandalism or hacking I see these big numbers and don't understand how they are calculated.

tptacek 13y ago
Straightforward. * Employees of the company spend X number of days responding to the incident, and you take their fully loaded cost and divide it out by the number of days they spent having to deal with the incident, and that's a big number. Plus: * If the site is disabled or degraded, you can often easily calculate outage costs based on the average volume of revenue the site generates during the outage period. Plus: * In a high-profile incident, outside professionals will often need to come in, first because insurance and contracts require a full investigation, and second because once a site is compromised you have to assume there are backdoors that will restore access for the attackers in the future. The cost of an external forensics investigation can hit mid-5-figures by itself very easily. Plus: * A high-profile incident is inevitably going to involve legal fees for the victim. That's before you get into things like reputation damage, loss of clients/customers/advertisers, &c. Like I said upthread, $10k-$20k damages for the defacement of one of the largest newspaper websites in the world sounds like a very low figure to me. I don't mean that in a normative sense. I mean, in the positive, descriptive sense, that sounds like less than what these incidents usually actually cost to their victims.
- _delirium 13y ago
  That makes some sense, but is a little out of keeping with what people expect in part because losses in many "physical" kinds of crimes aren't usually reported in an all-inclusive manner, but just report the direct damage. For example, if someone vandalizes (or steals) $20k of goods in a Wal-Mart warehouse, both Wal-Mart and the media will typically report that as $20k damage (or theft), rather than adding to the $20k the cost of the security response, lost business or increased overtime caused by supply-chain disruption, etc. Theft statutes that include thresholds for different classes of theft also usually refer only to the value of the stolen goods, not other losses caused by their theft (such as loss of business, cost of security response, or supply-chain disruption). You could justify including them, but it doesn't seem to be that common.
  - tptacek 13y ago
    We might be talking about two different issues. If you steal $20k worth of PS4s from Best Buy and totally fuck up their January promo event, the $20k theft amount might be all that factors into your criminal sentence, but Best Buy can probably come after you civilly for the rest of it.
- Zigurd 13y ago
  > "Employees of the company spend X number of days responding to the incident, and you take their fully loaded cost and divide it out by the number of days they spent having to deal with the incident, and that's a big number." That should be discounted by the amount of time they spent getting their site up to basic good practices, if any. Otherwise it makes hacking the incompetent a greater crime than cracking in to a high-value hard target.
  - danielweber 13y ago
    Damages are damages. If I throw a bowling ball into your garage late at night, is it "fair" that I have to pay more because you own a new Ferrari while the damages would be much less if you owned a 15 year old Honda? Once you commit a tort, it's generally all on you.
pbhjpbhj 13y ago
I don't know but I suspect it's probably in the clean up. For example I've cleaned up websites with malware infections that ultimately failed to operate (they had errors in their implementation). The infections thus caused zero direct damage. There was nothing on the front end that changed and no hidden phishing pages were operated, etc.. However the infections nonetheless had to be cleaned up, the source of the infections found, modifications to the sites made (where possible) including increased protections and reporting mechanisms. It's like losing your keys - locks might need changing, those locks might have multiple keys, etc., the locks might be secure facilities than need to be checked for incursions (eg inventories made) and such ...
elemeno 13y ago
Because fixing the problem isn't just a matter of changing the headline back to what it was supposed to read. Someone entering your system, which is supposed to be secure, and changing the headline on your front page mean that you'll (if you're sensible) then go and contract an external firm to perform a security audit and find out how the intruders got into your system, what needs to be done to fix it, and why your system had that particular vulnerability to begin with. All of which costs money. Alternatively, you'll use your own staff to do the same - which isn't free either, since they're now not doing their normal jobs for the duration. If I'm paying you $120,000 to be my sysadmin and then need to pull you off your normal duties to investigate someone entering my systems for a month then that investigation has cost me $10,000. That I was going to be paying you that money anyway isn't really relevant - that was the cost of your time that was used on that investigation.
- tptacek 13y ago
  You probably can't simply use your own staff to do it; your contractual and insurance obligations will probably mandate that a reputable third party conduct the audit. That's not always the case, but in big cases it usually is.
  - elemeno 13y ago
    Oh, absolutely. In my arena, finance, there's no way you'd use your own staff - it would go straight to external auditors who'd conduct the investigation or contract specialist firms to investigate. Of course, not always going to be the case for smaller companies and more minimal impact cases.
fleitz 13y ago
I can't comment for the specific headline case but quite frequently these are just made up numbers. Prosecutors make up whatever they can get away with... Public companies are required to report damages over X but when you find their quarterlies after a hacking incident it lists damages < X. See Sun & Kevin Mitnick. Either these companies are lying to the court, or they are lying to the SEC.
thesimpsons1022 13y ago
If you read underground by Julian assange and Dreyfus you'll see a lot of these numbers are just pulled out of their asses. I remember once case went from 6 digit damages to 4digit when the defendant stoop up against it.

by klez 13y ago

tptacek 13y ago

Straightforward. * Employees of the company spend X number of days responding to the incident, and you take their fully loaded cost and divide it out by the number of days they spent having to deal with the incident, and that's a big number. Plus: * If the site is disabled or degraded, you can often easily calculate outage costs based on the average volume of revenue the site generates during the outage period. Plus: * In a high-profile incident, outside professionals will often need to come in, first because insurance and contracts require a full investigation, and second because once a site is compromised you have to assume there are backdoors that will restore access for the attackers in the future. The cost of an external forensics investigation can hit mid-5-figures by itself very easily. Plus: * A high-profile incident is inevitably going to involve legal fees for the victim. That's before you get into things like reputation damage, loss of clients/customers/advertisers, &c. Like I said upthread, $10k-$20k damages for the defacement of one of the largest newspaper websites in the world sounds like a very low figure to me. I don't mean that in a normative sense. I mean, in the positive, descriptive sense, that sounds like less than what these incidents usually actually cost to their victims.

_delirium 13y ago
That makes some sense, but is a little out of keeping with what people expect in part because losses in many "physical" kinds of crimes aren't usually reported in an all-inclusive manner, but just report the direct damage. For example, if someone vandalizes (or steals) $20k of goods in a Wal-Mart warehouse, both Wal-Mart and the media will typically report that as $20k damage (or theft), rather than adding to the $20k the cost of the security response, lost business or increased overtime caused by supply-chain disruption, etc. Theft statutes that include thresholds for different classes of theft also usually refer only to the value of the stolen goods, not other losses caused by their theft (such as loss of business, cost of security response, or supply-chain disruption). You could justify including them, but it doesn't seem to be that common.
- tptacek 13y ago
  We might be talking about two different issues. If you steal $20k worth of PS4s from Best Buy and totally fuck up their January promo event, the $20k theft amount might be all that factors into your criminal sentence, but Best Buy can probably come after you civilly for the rest of it.
Zigurd 13y ago
> "Employees of the company spend X number of days responding to the incident, and you take their fully loaded cost and divide it out by the number of days they spent having to deal with the incident, and that's a big number." That should be discounted by the amount of time they spent getting their site up to basic good practices, if any. Otherwise it makes hacking the incompetent a greater crime than cracking in to a high-value hard target.
- danielweber 13y ago
  Damages are damages. If I throw a bowling ball into your garage late at night, is it "fair" that I have to pay more because you own a new Ferrari while the damages would be much less if you owned a 15 year old Honda? Once you commit a tort, it's generally all on you.

pbhjpbhj 13y ago

I don't know but I suspect it's probably in the clean up. For example I've cleaned up websites with malware infections that ultimately failed to operate (they had errors in their implementation). The infections thus caused zero direct damage. There was nothing on the front end that changed and no hidden phishing pages were operated, etc.. However the infections nonetheless had to be cleaned up, the source of the infections found, modifications to the sites made (where possible) including increased protections and reporting mechanisms. It's like losing your keys - locks might need changing, those locks might have multiple keys, etc., the locks might be secure facilities than need to be checked for incursions (eg inventories made) and such ...

elemeno 13y ago

Because fixing the problem isn't just a matter of changing the headline back to what it was supposed to read. Someone entering your system, which is supposed to be secure, and changing the headline on your front page mean that you'll (if you're sensible) then go and contract an external firm to perform a security audit and find out how the intruders got into your system, what needs to be done to fix it, and why your system had that particular vulnerability to begin with. All of which costs money. Alternatively, you'll use your own staff to do the same - which isn't free either, since they're now not doing their normal jobs for the duration. If I'm paying you $120,000 to be my sysadmin and then need to pull you off your normal duties to investigate someone entering my systems for a month then that investigation has cost me $10,000. That I was going to be paying you that money anyway isn't really relevant - that was the cost of your time that was used on that investigation.

tptacek 13y ago
You probably can't simply use your own staff to do it; your contractual and insurance obligations will probably mandate that a reputable third party conduct the audit. That's not always the case, but in big cases it usually is.
- elemeno 13y ago
  Oh, absolutely. In my arena, finance, there's no way you'd use your own staff - it would go straight to external auditors who'd conduct the investigation or contract specialist firms to investigate. Of course, not always going to be the case for smaller companies and more minimal impact cases.

fleitz 13y ago

I can't comment for the specific headline case but quite frequently these are just made up numbers. Prosecutors make up whatever they can get away with... Public companies are required to report damages over X but when you find their quarterlies after a hacking incident it lists damages < X. See Sun & Kevin Mitnick. Either these companies are lying to the court, or they are lying to the SEC.

thesimpsons1022 13y ago

If you read underground by Julian assange and Dreyfus you'll see a lot of these numbers are just pulled out of their asses. I remember once case went from 6 digit damages to 4digit when the defendant stoop up against it.