Hacker News Reader

Comment by alrs | Hacker News Reader

Ransomware is great.

1. Creates a huge financial incentive to try and break PGP encryption.

2. Pushes aside all of the lame corporate compliance "infosec" people whose job it is get lied to about PCI compliance and bitch about version numbers that they don't understand.

3. Proves useless all of the "ex-special-forces" "red team" "master safecracker" Defcon LARPers.

4. Gives the insurance companies enough room to attribute attacks to nation-state actors, making them "acts of war," and thus uninsurable. If companies can't half-ass this stuff and let their insurer clean up the mess, they're going to stop half-assing this stuff.

5. Put an end to the "I dunno, I pulled it off Dockerhub" madness.

View on HN

6. You used to need to wonder: Have I been hacked? How bad? Now you get an invoice day-of.

Yep, if the companies leak our sensitive data, they don't care, business as usual. Ransomware will force companies to finally take this seriously and I, for one, am thankful even if in the short term it's painful.

It's like "Little Bobby Tables" grew up, and is no longer content with just causing a little inconvenience.

Also the most likely tonic to platform churn, reinvented wheels, codebase growth. The culture will flip towards lambasting anything that hasn't been put through the wringer as "untrustworthy".

6. Put and end to our data hording. Turns out I don't need to keep all the data we have because it's now a liability.

I did some searching and didn't find anything about use of the OpenPGP standard in ransomware. It appears that ransomware creators don't care about interoperability, which makes sense for their biz.

A doubt that anyone has ever been motivated to try to break an encryption method just because it was used in some particular ransomware. The methods used are generally not breakable, the mistakes come from stuff like leaving keys laying around in memory or even on the disk.

I'm not sure how satirical the parent's comment was, but every single point is completely inaccurate, irrelevant, and/or nonsensical.

How so? Seems it's spot on. Since the birth of the internet companies haven't given a damn about leaks and there're no real consequences. Now they care because it hurts them instead of just us.

I work in infosec and agree with the point that a lot of companies are overly lax, ignorant, and negligent about security. But I could probably write like a 10 page essay disputing all of those points. For a summarized version, I wrote some semi-relevant comments about this in another ransomware thread from the other day, so this is a lazy answer but you could Ctrl+F my username in https://news.ycombinator.com/item?id=27096137

Basically, I agree in general that a large percentage of the industry is a massive joke, but at the same time, I think in many cases there's more victim-blaming than is warranted. Ransomware isn't what it used to be. Being hit or ruined by a ransomware attack doesn't necessarily imply negligence or lack of care (even if a high percentage of the victims probably are negligent simply due to the high base rate of such companies).

I see nothing there that invalidates any of those points. At best it weakens points 1, 4 and 5 on the basis that companies will get away with it by paying ransoms[0], and ransomers have a incentive to not be so extractive that they kill the hosts they're parasitising, but that's still a idiot tax for said companies.

0: rather than their previous strategy of ignoring the problem entirely because other poeple's privacy doesn't show up on their balance sheet

Indeed, I'd need to explicitly address each point to explain exactly why and how I disagree.

They're not exactly wrong in a general sense (which I know sounds a little contradictory given I said "every single point is completely inaccurate, irrelevant, and/or nonsensical"), but I think they're wrong in a fundamental way when talking about the ransomware problem. And point 1 is a total non-sequitur in at least three different ways.

It's a complex topic. Basically, I just think that even though a ton of cynicism (about this, about the infosec industry, about companies' approach to security) is absolutely and overwhelmingly warranted, they're being too cynical.

> they're being too cynical.

Huh? If anything, they're too optimistic; as you pointed out, it's likely many companies will continue to ignore this and either make backups without improving their security, pay ransoms after the fact or quietly implode when they can't.

I agree that 1 is a bit useless (although I took it to mean PGP-for-example, not PGP-specifically), but I didn't see anything particularly relevant to it, aside from what I mentioned above.

Items 2 and 3 will increase massively as people who don't know what they're doing attempt to cover their butts.

a steep climb in the short term that falls off a cliff in the not-so-short-term as those employers cease to exist.

That's not how the world works my friend.

so long as encryption-as-we-know-it holds-up, there's no rescue for orgs that repeatedly get hit and can't get their backup strategy together. Sure, you make a regulatory mis-step and you have friends in high places, they will look the other way. This indeed, is how the world works. If your entire infrastructure is encrypted into a solid block of nothingness it doesn't matter if your dad is a senator, you're done.

Name a single company that has died due to data breaches.

Meanwhile, I'll name a dozen that got breached/leaked data, and got away with it: Experian, Microsoft, Facebook, Google, Marriott, Yahoo, First American Financial Corporation, Deep Root Analytics, Court Ventures (a subsidiary of Experian), Capital One, Anthem.

Go on, search "list of largest data breaches" and then see how many of those companies are still in business.

It sure seems like large companies aren't suffering for their breaches.

"breached data" doesn't matter to companies, as we've seen. "gone data" is an existential threat.

why do we need an incentive to break PGP?

Let me explain, the basics:

Any system that has a case where key collisions can occur less than random is the only incentive you need...large use of bitcoin ensures that case all by itself with the rule that you use a new key for every transaction.

LEOs use this track down illicit money.

crypto in practical terms is not secure in that the key collision when it occurs and it will unmasks you not directly but indirectly and the cost to do the work of that lowers as it ages and does not go up computation wise.

It's somewhat perverse where when the world uses more bitcoin the more key collisions occur.

If you depend on PGP, knowing that there's an incentive to break it, and that people are actively trying to do so is good news. It's in your interest for it to be very well tested. "I can break PGP and spoof Debian packages" is an interesting conference talk. "I can break PGP and save your business $40m in ransomware costs and only charge you $10m" is a business.

I'm not sure what point 3 refers to?

#infosec "thought leaders" with a cool-sounding military history who purport to be able to do underwater lockpicking but can't put together a for loop. Their shtick exists to sell services to clients and to sell recent graduates on a Special Forces Awesome Security Career that in reality will be QA at best, corporate compliance at worst.

Reply on news.ycombinator.com