Hacker News Reader

Comment by nneonneo | Hacker News Reader

Ugh. This ransomware crap doesn't stop until the money stops. At this point, ransomware operators are bribing insiders to install their custom, AV-evading ransomware directly on company servers (e.g. https://www.secureworldexpo.com/industry-news/fbi-sting-the-...). No need to trick someone into running a malicious Word attachment when you can just wire someone $1M to do it deliberately! And, best of all, you can set this up in a totally plausibly deniable way - the employee just "accidentally" opens that attachment and off you go.

A lot of ransomware operators are on sanctions lists. Paying them is already illegal. The US DoJ might want to check if Colonial has violated any laws in making these payments - and if they have, punishing them to serve as an example could well discourage future ransomware payers. As long as ransomware operators know they can get paid for their work, they're going to keep doing it.

View on HN

Absolutely this. Paying a ransom should be illegal and company officers should face personal criminal liability for allowing it. If the CEO of Colonial was facing jail time, there is no way the payment would have happened.

I would sooner have security negligence be criminalized as there are a number of products that are critical to the economy and peoples health. Having a companies systems get wiped out can have a monumental amount of collateral damage.

Paying Ransoms should be criminalized as there is far more damage from allowing this to continue then having a few systems wiped and restored from backups.

Not taking steps to have cybersecurity in companies should be criminalized as well... I am a CEO and thinks CEO's should be held directly criminally responsible for this.

Finally, any nation that allows hackers to operate from within their borders should be subject to 100x over damages caused sanctions. Countries without strong governments to enforce this should have direct airstrikes conducted against the individual hackers.

If you think the 100X damages is overkill please reconsider within this framework:

Any nation that harbors international terrorists by not at least attempting to hold them accountable is implicitly operating an outsourced covert activities team. The actions of any such team should be considered representative of that country and thus this would be an act of guerilla warfare.

Nukem from orbit, it's the only way to be sure.

I’ll go to prison for some time for being their new CFO. If some cash goes to myself or a close family member after I pay the ransomware as CCO.

Obviously this would be too transparent if done in the span of a week.

I think ransomware is the best thing that happened in computer security in a long time.

All these companies keeping lots of people data or even being relevant to national security having completely no incentive to stay secure. Now There is incentive to test their security.

A single person being able to compromise your company when paid a lot is a security issue that needs to be addressed.

This sounds like the kind of argument a ransomware developer would use to delude themselves... or quite a lot like the "Bitcoin is actually good for the environment!" people.

Maybe let's try more substantive arguments than a genetic fallacy.

Wasn't that what Jesus said about Judas Iskariot? To paraphrase: there must necessarily be evil in the world, but woe to the one who makes himself its conduit.

They could have started incentivizing after the Equifax hack. Personal data of hundreds of millions of people spilled over the web, everyone plus their dog gets to monitor their credit report or swap credit cards, yet Equifax still exists, and no meaningful consequences for anyone, including the CEO who sold his shares before the intrusion become public. Why is that even permitted?

I was going to say fine these companies a fair amount if there's a data breach;

But they would just turn around and add their costs on to the consumer.

I'll get hammered for this, but there's a part of me that would like to just outlaw all bitcoins worldwide, and even that might not work unless every country banned them?

To add, I'm pretty sure ransomware groups provide tips on how to beef up security and how they got hacked in the first place.

Like dentistry, you can pay a little upfront for a better toothbrush or you can pay the dentist way more to repair your teeth later on.

I know what you're getting at... but as far as I see it, all it means is that every company i've contracted to lately installs horrifically limiting corporate safety-dreck that ruins your battery and performance, it's really becoming a lot less fun working with computers nowadays. Everything is so slow and limited.

The proper Milton Friedman / Reagan capitalism solution is to let the hacked oil company to bankrupt, wipe out the cap table and then competent new owners can take over for cheap

Realistically, ransomware will just never stop until IT systems are sufficiently hardened.

Or sufficiently backed up, right? If you’ve got a backup and quick recovery process ransomware is impotent.

This is by far the cheapest solution.

unless your data is legally required to stay confidential under HIPPA or similar law. Then a backup just keeps you operating but not immune to the threat of data publication.

While the threat of publication is a risk, the data has already been breached and you are no longer compliant with the law.

I wonder if companies still get fined if the data is just encrypted without any exfil

What data needs to be confidential in the case of the Colonial Pipeline?

I'm sure that there's proprietary data. Maybe knowing how much oil / gasoline is flowing might allow some traders to make unfairly informed trades (or maybe not: only inside trading is illegal. If someone figures out the information some other way, its not illegal IIRC).

And maybe employee data should be kept private, but there's no HIPPA requirement on that. Its not like there's payment processors on this thing either, so no PCI compliance here.

So I'm not exactly seeing why backing up data would be an issue in this case.

Not quite. The attacker still got access to the system in some way. They may have a permanent backdoor now and opportunity for messing with your backup operation.

Nowadays the attackers will threaten to disclose the sensitive data publicly, as they did in this case. So ensuring your own access to your data, i.e. backups, is not the only concern. It's still important, of course.

If hackers take the slow route, all backups may be encrypted too. Or at least, compromised.

Also, backups are often taken but rarely is their actual recoverability tested.

And if the penalty for hacking systems for malicious purpose goes up.

Hopefully every member of DarkSide ends up in court if they're US or friendly nation citizens or in Gitmo otherwise

Nah. It will never stop.

The problem is information density.

So long as billions of records that are needed for the business exist in a device the size of a shoebox, we’re fucked. An insider can always take the shoebox, lock the shoebox, etc.

Three stories of paper files in file cabinets can’t be ransomed short of a physical bomb threat.

Don’t know what the solution is. But I do know the problem. Exfiltrarion is similar: the odd quirk of technology that has enabled these massive thefts is the ability to load millions of pages in a few seconds into a thumb drive. Odd pickle we’ve got ourselves into.

Your metaphor works both ways: the ability to fit billions of records in a shoebox means that it’s perfectly manageable to keep another shoebox as a backup, under independent control.

So now there are two shoeboxes. Hasn’t solved exfiltration. In fact, you’ve just doubled the risk.

There may not be a solution if the problem is untrustworthy people.

The custodians of your ‘independent control’ will eventually get ransomwared themselves.

Then what?

It’s like cash... If you are a sophisticated criminal, do you waste time burglarizing individuals? Or, do you rob the bank where the individuals keep their money for ‘safekeeping’?

How many people at Amazon have access to the database other companies use to store info?

2? 20? 200?

I don’t know, but I bet it’s a lot. And I doubt they get paid enough to make them immune to a generous offer (or a scary threat) from a bad guy.

Seriously, how many individuals at Amazon have the ability — if they wanted - to irreparable corrupt, encrypt, or destroy data?

I thought we were talking about denying access to important files. Data exfiltration is a different threat model than what I was addressing.

There is a part of me that would like to go back to the way we dud business before the internet, and computers.

I think three daily encrypted backups mandated by law would be enough to stop the multi-million dollar ransoms.

We will still see companies paying ransom for a business days loss, but not complete shutouts? And infrastructure specific operations, like this pipe line, should be air gapped.

It’s good practice for a cash business to make daily runs to deposit daily at the bank. Stupid to leave cash laying in the till overnight.

Which is why thieves rob banks.

But, money is fungible... if it’s stolen, it can be replaced. If the bank can’t replace it without going broke, the FDIC steps in and, essentially, prints more money to make you whole (up to a point.)

But, data is unique and irreplaceable.

If everyone is backing up to a smaller and smaller number of ‘cloud’ companies, it’s just centralizing the problem... putting everyone’s eggs in one basket.

Some ransomware is time-delayed because of this, so it isn't clear which backup is still untainted.

I wonder how long you’d sit it out losing money before you paid. I think it’s very easy to talk a big game until you’ve lost many multiples of the ransom with no end in sight. It’s literally just a waiting game for the hackers, they have nothing to lose and everything to gain. So what if you don’t pay, you can just leave them screwed and move on to the next one.

Or if you're running a service which can't wait. Like a medical clinic with no access to patient records.

Or you know people's power, heating, electricity, ability to drive, ability for services to run generally. etc. etc.

>ransomware

I prefer to think of them as bug bounties. Too often, bugs are reported now to bug bounty programs and are either grossly underpaid for the bug's actual value, or deflected as not a real issue at all. Ransomware is ultimately the result. "Fuck you, pay me."

https://www.youtube.com/watch?v=3XGAmPRxV48

Reply on news.ycombinator.com