Avoiding ransomware is not rocket science.
Ransomware attacks are loud and noisy - imagine the amount of stealthy attacks we don't hear about.
Which puts this further on the attacker. The attacker can't claim that I should have nicer things and he couldn't help himself. There's way too much victim blaming in information security.
In your example let's replace the TV with a weapon and I bet you will be still found liable for not taking appropriate precautions to secure your weapon like keeping it in a locked safe.
Similarly, most online crime uses lots of compromised machines as its infrastructure. Making their owners/operators liable would actually add an incentive to not buy/operate insecure devices which in turn would put pressure on manufacturers to make secure products, otherwise customers will be afraid to buy them if it can get them in legal trouble.
So what happens if I drop that TV on top of someone else's head?
The point is that a basic breach like this should be treated as negligence.
Fun fact: this isn’t true in the US. For example: you can leave your car unlocked and with keys in it, and if it’s stolen you’ll still be covered by insurance.
Security incidents, viewed generally, are the conjunction of two factors: threats and vulnerabilities. It is a massive over-generalization to view all cyber attacks through a lens that focuses only on one factor.
Sure, there might have been vulnerabilities in the software or processes of Funke group. But it's a dishonest analysis that ignore the threat actor (a criminal in this case - let's not mince words) who exploits the vulnerability.
If I leave my ground floor window open with cash sitting just inside and someone reaches in and steals it, that's my fault. It's dishonest to suggest that dishonest actors don't exist or are anything other than a fact of life/force of human nature.
As such they don't bear much discussion - I left the window open. That's on me.
Claiming the contrary is exactly victim blaming.
But in a world that contains muggers, and that you know contains muggers, walking around the bad part of town with cash visibly hanging out of your pocket is not very wise. It's not a moral failure, but it is a failure of common sense and reasonable prudence.
In the case of murder, sure. But I'm with you. But bad actors (in the form of petty theft, exploitation, confidence tricks, etc) are a fact of life. Failing to account for them, just as failing to account for hurricanes if you live in hurricane alley, is completely on you. You can reduce that down to a blanket "but you're just victim shaming!" if you'd like, but it doesn't make it any less true.
I can get in your house even if you close the window. It's a window and can be opened. Are you still to blame? I can look for money even if you hide them, I'll search around. Are you still to blame? You could have taken the precaution of not having money in the house or at least not living on the ground floor if you do.
Many attacks are 0day, many others are supply chain attacks, many exploit the weakest of links, the human. There's a limit to how much you can protect yourself from one attack in an instant before you cause yourself harm slowly but continuously. No matter how many locks you put you're not guaranteeing anything. It's a calculated risk and sometimes the calculation doesn't pay off.
I don't think hacking/cracking should be illegal. If I send you a series of electrical pulses and that causes your systems to do something stupid, that's your problem. You are not a "victim".
Laws against physical violence and against stealing physical objects have good reasons to exist, because otherwise there would be no point in having any moral conception at all, because everyone would solve their problems through violence.
On the other hand, sending messages through a wire doesn't have good reasons to be outlawed. We could live peacefully sending each other all sorts of bytes, and each entity would make an effort for their own systems to behave correctly.
Most people disagree with me, but their abstraction is leaking, because even they agree with me on a fundamental level, they just don't know it. The moral discussion is so disconnected from concrete actions and formal definitions that it devolves into dumb analogies like "but if you left your door open blah blah".
Having a "right not to be hacked" is of the same nature as having a "right not to be offended".
In my opinion there are good reasons for physical property to exist (individual freedom), but avoiding violence is not the best theoretical argument for it.
Is physical property against freedom or in favor of freedom? I think both, depending how you look at it. I've though about this a lot, and tend to fall on the side of proprietarianism, because I think property is absolutely necessary for the fulfillment of human needs and desires.
That depends on your intent. If you purposefully send the pulses in order to cause damage, that would generally be considered a crime.
> Are Hackers criminals? Yes, because the law says they are.
You seem to be implying that "hackers are bad because the law says they are".
No, crackers, specifically, are bad because they act in bad faith and they can cause serious problems for people and organizations. We, as a society, codified that into law. If there were no laws, they would still be "bad".
> Does that matter? Not much outside the realm of law.
Yes, it does matter. The law was made for a reason. If it didn't matter, we wouldn't have the law in the first place. You might disagree with the reason the law was made, but even if you do, it mattered for the majority of people, so you're in the minority (not in an "underdog" kind of way, but in the "the earth is flat" kind of way of being a minority).
> If I send you a series of electrical pulses and that causes your systems to do something stupid, that's your problem.
Yes, but that's not where the story ends. It's also my family's problem. It may be my friends' problem as well. It might become a problem for all my contacts. It might even be a problem for my company. It might be a problem for the suppliers of my company. It might be a problem for their clients too. It may even become YOUR problem.
That's just thinking of 1 person. What if, by some miracle, the US Treasury gets hacked? Or the DHS? 328 million people have a new problem now
So we collectively got together we said that my problem could really quickly become everyone's problem and we said we'll start addressing it by making laws that say "hacking other people is bad".
Then you come around and you're like "boo hoo I don't think causing problems for other people is a big deal. They should just deal with it". Well, you're wrong, sir, and I hope you see why you also come across as a bit of an asshole.
> You are not a "victim"
Yes, you are. By definition of the word "victim".
> Most people disagree with me
Well there's your first clue, Sherlock.
> Most people disagree with me, but their abstraction is leaking, because even they agree with me on a fundamental level, they just don't know it
What does a leaky abstraction have to do with people disagreeing with you, but then somehow unknowingly agreeing with you on some fundamental level?
The legal system does not work very well for international crime.
I think these reductionistic arguments are naive. It is the information and intent that matters. Many times racist and sexist harassment only consists of “making pressure changes in the air with vocal cords.” However, those pressure waves have meaning(words) and there is intent behind them, so we condemn that behavior.
It's like saying no, I didn't shoot that person, I just gave momentum to a bullet that caused their body to do something stupid and they died.
'I don't think assault should be illegal. If I send a series of simple kinetic impacts to someone's unprotected body that causes their organs to do something stupid, that's their problem. They are not a "victim."'
Do you see how absurd this idea sounds?
The parent poster is saying Funke and/or their software vendors are guilty of negligence. You, too, even go on to admit there might have been vulnerabilities in the software or processes of Funke group.
The parent poster is not the one being dishonest...
I mean there is a whole range of possibilities here, at what point do you stop blaming the victim?
1- The front door was left wide open 2- The front door was closed, but left unlocked. 3- The back door was left unlocked. 4- All doors were locked, but with an easily picked lock. 5- All doors were locked and with a legit key, but a window was left closed, but not locked. 6- All windows and doors were locked, but the windows were easily broken. 7- The windows were reinforced, but a door was broken down or someone drilled the locks, or just forced the window until the lock failed. 8- The doors and window locks were reinforced, but they pried up the garage door and broke through the flimsy door between the house and garage. 9- The exterior entryways were all truly secured, but they found a way in through a chimney, a sewer pipe, or just sawz-alled through the exterior siding...
At what point do you stop calling the resident an idiot and start blaming the perpetrator? Personally I would say around #4 in the meatspace the world, but 2/3 I would say they are still being victimized depending on where they lived and whether they routinely left the door unlocked or not.
And then in the digital world, there are things like not setting a password or leaving a default one up, but what about patching known vulnerabilities? How long is too long once a patch is made available? What about zero days, and vectors of attack no one thought of... and maybe line employees who just don't know better?
Just in general, people are very quick to blame the victims in situations like this- I just had an argument about this with someone the other day when I heard the news that a neighbor's bike was stolen- from outside their door on the third floor. It was an exterior door/stairway, but not visible from the street, and the bike was locked but with a cheap one. They brought bolt cutters and took the bike. People were like "this is on you for using that cheap lock..." but I think he took reasonable precautions, but many had no sympathy for the guy. Personally I can't wrap my head around that mindset.
In the case of the SolarWinds attack, their management seemed to be quite technical and the attacker was just too strong/sophisticated, so SolarWinds is considered a victim.
But in the case of the Equifax, they're considered at fault because their head of security seemed unqualified for the job and the victims were actually the millions of users whose private data was put at risk of abuse.
The probability in this case is very high that the upper management at Funke was quite incompetent at how they've digitized their operations.
So you're describing just the first link in a long attack chain. Eliminating that weak link doesn't mean the attackers can't gain access to the network, it just means they have to find another entrypoint, and in a real-world network where people need to regularly click on links and open untrusted documents it's notoriously difficult to plug all holes.
Even the largest DAX corporations in Germany regularly become victims of cyber attacks, and trust me they spend a ton of money on cyber security and have thousands of people working on it.
Which orgs are immune to ransomware?
Of course the criminal should ultimately be held accountable, but to be honest when when these kind of hacks occur I tend to direct more rage toward the corporation. The analogy I picture is more like an overloaded train crossing the same creaky and neglected bridge every day.
They do, quite often. Same is true for rape victims. It may even be that weak-seeming people are more likely to be blamed as victims, because they serve as an uncomfortable reminder of danger and have already shown that they can be defeated. Think of negative feedback loops where people start to avoid someone they perceive as being unlucky, thus leading to poorer outcomes in future.
It is a criminal activity that should be investigated and prosecuted. Period
Don't blame the victim