Hacker News Reader

Comment by kjrose | Hacker News Reader

The fact this was paid off, and paid off so rapidly means that targeting major infrastructure for massive payoffs is going to become more and more prominent. The next time though, it'll be $50M. I work with people in the oil fields and I know the numbers they are playing with and the fact that a single well being down can easily be $100,000 lost per hour. So obviously they want these systems back up fast.

$5M for shutting down that major of a pipeline seems like too little, unless, of course, they weren't expecting the company to even pay. Now that these actors know that the oil (and quite likely other utilities) are more than willing to pay big bucks to get back online, they will be targeted far more.

There are so many reasons this is very very bad.

View on HN

I think these ransoms are net good. I'd rather greedy hackers shake them down for money then having the country get crippled by political terrorists or enemy nation states that can't be negotiated or reasoned with.

There are lots of infrastructure management teams taking security more seriously than they were a month ago. That alone is worth more than $5M

I think you're kidding yourself if you think a company that gets "hacked" by off the shelf cryptoware is going to step up their game enough to have any chance of stopping a targeted state actor.

The fact they caved so quickly tells me they are years away from a reasonable security posture.

It gives other companies with more responsible practices an opportunity to get a competitive advantage from their failure.

Without widespread ransomware scammers, the risk of getting compromised is just theoretical, not tangible. Companies can get away with ignoring security concerns for a long time and might never be impacted by it.

Thus, companies which are paying a premium for better security might never be able to benefit from the mitigations they are implementing, and could be outcompeted by the companies which simply got lucky enough to avoid being attacked.

Eventually we end up with major too-big-to-fail megacorps like Equifax getting hacked by trivial exploits because nobody took advantage of them when they didn't have such a strong market position.

> I think you're kidding yourself if you think a company that gets "hacked" by off the shelf cryptoware is going to step up their game enough

Still, this might lead to their first solid security hire that can bring about change in the form of zero-trust principles, security in depth, etc.

> to have any chance of stopping a targeted state actor.

Given unlimited resources, interest and budget, no participant in the modern digital landscape has a significant chance of stopping motivated threat actors.

> The fact they caved so quickly tells me they are years away from a reasonable security posture.

Yes, obviously, but driving change is about incrementally tending to a desired state. Your fatalism is, quite frankly, unnecessary, not that you're not entitled to your opinion, just that disagreeing with GP or stating they are naive because this won't bring about perfect, all-encompassing change is not useful.

No single participant has a significant chance, but if each target becomes more expensive on average, then state actors can only afford less targets, which makes the society as a whole more resilient.

And if one target is so critical that it could take out a society, perhaps it would be better to either 1. Make it so minimalistic that it can be fully audited and secured or 2. Broken into smaller pieces and decentralised so they can either qualify for #1 or increase the total cost and complexity of compromise.

Also, making society and individuals more prepared and ready to deal with no-more-oil for a while, situations.

E.g. warm blankets at home, and food that doesn't need to be boiled, if cannot heat the house because the oil and electricity system is broken for a while?

Yea, I think I tend to agree with you. It may cause a lot of pain in the short term, but being forced to pay penetration testers seems like it could be a net good in the long term for security in general. I don't think nation state attackers would be so kind as to un-fuck your system after they cripple it, even for a massive fee.

I don’t know. Did any of it matter? It was bad when people started hoarding gas. Just a few unfathomably stupid people - as always in this country. If idiots didn’t hoard gas, nothing would really have gone wrong.

The preppers are the other side of the same coin. The only thing they seem to never run out of is toilet paper. Who the fuck cares? Pentesters have the same energy. They tell you about what software not to use (anything in their automated suite), followed by a bunch of meaningless bullshit. It is a form of anti preparation, it would not have helped Colonial at all.

You talk about crippling, and in the biggest audition for crippling society in the world, time after time it’s the Everyman being an idiot - or a Prepper being too smart for their own good - that is responsible for all the bad.

You know what's way more effective at stopping gas hoarding so it's available for someone who really wants/needs it? Doubling the price per gallon. Anti-price gouging laws caused the shortage, just like with toilet paper and PPE last year.

A price increase that effectively stops people from hoarding gas would be equally as effective at stopping people who need gas from affording it.

Addressing legitimate problems of hardship can be dealt with from the other end, by channeling resources to those people. In the mean time, higher prices mean that supply isn't interrupted, and for the vast majority of people that means that you don't fill up your car and your wife's car and your lawnmower and a 55gal drum, because it's not worth it. You just skip a few trips and let your gas tank get below half a tank. And if you were wrong about thinking you could hold out, you can still buy gas because it's not sitting in your neighbor's new gas cans in his garage.

We shouldn't have widespread shortages for the sake of theoretical people whose existences are structured around 5 gallon commutes and razor thin margins tied with no lines of credit to float a week of double gas expenses.

By “theoretical people” I think you’re referring to a very sizable portion of the population.

The people who would be hurt by such an increase, absent already-in-place assistance, constitute the vast majority of people. And, unfortunately, nobody is helped by "can be dealt with" -- the policies to prevent their pain, and to prevent disadvantaged folks from being disproportionately impacted by such an increase, need to be in place before the increase.

The reason, which is likely apparent to both of us and everyone reading this, is that such assistance would likely never be put in place, and the only help ordinary folks will have in the event of such an increase is wishful thinking.

> The people who would be hurt by such an increase, absent already-in-place assistance, constitute the vast majority of people.

and so you suggest hurting the vast majority of people even more?

That's right, your suggested approach of keeping artificially-low-prices-that-allow-hoarding leads to zero gas at the pumps, and zero gas at the pumps hurts the vast majority of people very directly and very effectively.

Allowing prices to float higher in a shortage solves the allocation problem for scarce resources by ensuring that people think twice about how they use it, while keeping it available. Ignoring that the resource is scarce not only doesn't solve anything, it makes the problem worse.

>and so you suggest hurting the vast majority of people even more?

1. More people are hurt by price gouging of products with inelastic demand than hurt by limiting the price increase.

2. A completely floating gas price disproportionately affects disadvantaged folks who have no alternative, even when there are no outages.

I mean, I totally agree with OP, there's a straightforward solution: set up a government program that insulates people from the effects of a floating price proportionately to how disadvantaged they are, and then, after that, let the gas price float. That way we get your idea without hurting anyone! Win-win.

What crazypants world do you live in where the vast majority of people have all that excess, but the poor are in the minority?

> A price increase that effectively stops people from hoarding gas would be equally as effective at stopping people who need gas from affording it.

no, your statement is false.

Hoarding cheap gas results in zero gas at the pump, and that is MORE effective at stopping people who need it than high prices do.

That's right, market pricing solves allocation problems that your misguided approach creates.

You can't buy gas that isn't there. Anti-gouging laws simply result in no gas available.

And rationing can address that problem. These complex issues are never so simple.

Rationing makes simple things complex. For example, rationing assumes that everyone has exactly the same need. Trying to fix that is hopelessly complicated.

I don't see how that's an argument against anti-price gouging laws though. It's not like price gouging solves that problem. Fundamentally a shortage is just never going to give perfect results.

Even simplistic rationing is at least relatively fair and can ensure at least a base level of availability. For the major necessities this can be pretty reasonably accounted for to ensure nobody suffers from some extreme deprivation.

It also lets you at least put some somewhat predictable cap on how fast resources are going out. Allowing price gouging doesn't let you predict much of anything, and I'm not sure it even slows the outflow given the uncertainty of these situations.

How high prices work is:

1. only those who really need it buy it

2. others are encouraged to increase supply

For example, before anti-gouging laws, when a hurricane interrupted the gas supply, people from a state over would immediately fill jerry cans with gas and drive into the disaster zone, selling gas out of the back of their pickups.

Anti-gouging laws put a stop to that. Now nobody gets gas until FEMA gets around to it.

I've talked to people who lived through WW2 gas rationing. It was a mess of mis-allocation. People who didn't need their ration turned into criminals selling it on the black market. People who needed it turned into criminals buying it on the black market. It was pure political theater.

This is not the whole story, by any means.

Those who buy it are those who can afford it. They also (think) they need it, for some reason. That can include the intention to legally resell it. Buying suddenly comes with even more time pressure. Buying now becomes both a hedge and speculation, with zero legal risks.

Sure, people bringing in supplies on their own sounds good. It can even be good. But how much does it actually bring in? Does it come with other problems, like additional stress on infrastructure? If this really is such a great thing, I don't see how it should be wholly incompatible with anti-price gouging laws. If you want to specifically incentivize private transport of goods from out of the area, you don't have to allow them to be sold for any price, nor do you have to allow it for goods already in the area.

As for the black market, I'm not sure that's a bug. It makes it harder, and adds some risk, to acquiring more. If you actually need it enough, you'll do it. There some be some correlation between actual need and willingness to participate in the black market. With proper use of the discretion available to law enforcement, maybe this even enhances how well the goods end up distributed. That's a big "with" but still.

> As for the black market, I'm not sure that's a bug.

Rationing implies a black market must be illegal. Besides, it enriches random people who don't need gas, at the expense of the people who went to the effort to supply it.

If that isn't a topsy-turvy unjust, inefficient and inequitable way to run an economy, I don't know what is.

Rationing suffers from the delusion that bureaucratic rules can distinguish who needs something and who doesn't, and denial of the existence of normal human motivations.

Then you get a black market... it's almost a cobra effect.

Sure. I'd guess it still adds enough friction to help result in a better distribution of goods in the end. The time, effort, and (legal) risk you are willing to take to acquire something should correlate decently with how much you really need those goods.

What price do you suppose is high enough to effectively stop hoarding?

Keep raising the price until the traffic to your gas station is at sustainable levels.

Price of gold and silver is at its peak and people are buying it more than ever convinced it will somehow become extinct. The people who have money to hoard gas are also the people who have the money to hoard gas at double the price. These are not individuals with any knowledge of economics - theyre not doing it for trade, they're doing it out of belief.

> The people who have money to hoard gas are also the people who have the money to hoard gas at double the price.

But then the outcome would not have changed, the people who hoard will be worse off, the people who produce a valuable commodity will be better off and there is incentive for people to contingency plan and have gas reserves for when things get tight.

That is a strict improvement. Plus, you're probably being overly pessimistic - people will stop hoarding once the price gets high enough. The shelves would not be bare.

> These are not individuals with any knowledge of economics - theyre not doing it for trade, they're doing it out of belief.

The people with knowledge of economics don't have much of an advantage though, do they? When has an official body ever been banging the drum before a major crisis issuing panicked warnings? Every crisis it turns out all the people held up as experts had grossly misread the situation.

People with knowledge of economics often get bowled under by people with a knowledge of politics or of statistics when it comes to trading.

"The people who have money to hoard gas", in the current environment, is as worthwhile a qualifier as "the people who have shoes to hoard gas". They're both necessary for going out to get gas, but neither is limiting in any important way. The people hoarding gas had a particular combination of gas containers, lawnmowers, and free time. I want the gas stations hoarding the gas and then trying to figure out what price will make them the most money by pricing high enough to just barely sell out by the end of a shortage.

Last year when all the grocery stores were running out of staples, I was unluckily traveling for work where there are no grocery stores. Upon returning, I conveniently found that my neighborhood co-op still had eggs because, while almost all eggs had been sold out, no one wanted to hoard $7.50/dz eggs, meaning I had the opportunity to get eggs if I really wanted them. I was able to buy eggs and did so, adjusting my habits accordingly to operate on fewer (but not zero) eggs. Everyone else who had visited that store had the same opportunity, and they also had the chance to compare their own desire for eggs against others' desires to recognize that they could do with fewer, as could I. At the end of the day, having reduced amounts of something I want is way less impactful than having none.

The only problem here is if gas stations talk to each other to set a price, but that is collusion, and is illegal independent of gouging laws.

We have to wait and see if future results justify current actions, when the action is preparation for some future event. It is only in hindsight that we can truly point out if someone's risk/reward calculation for the future was flawed.

I'm not buying gold, but the odd thing is that Russian and Chinese central banks are. I would assume those people know a thing or two about economics. I'm curious to see what the future holds.

Why would Russia and China central banks buy gold?

They’re already the #3 and #1 producing countries world-wide.

Because their central banks are concerned about stability of international currencies [1]. A central bank is in a good position to use gold, whereas most individuals aren't.

[1] https://www.marketwatch.com/story/why-russian-and-chinese-ce...

> Price of gold and silver is at its peak and people are buying it more than ever

no, you've got it exactly backward. People buying it more than ever is driving the price up, and the feedback of higher prices is actually slowing down their purchasing not only by changing their minds, but also because their purchasing budget is spread more thinly.

I disagree that a higher price will dissuade hoarders from hoarding; you've just validated their notion that gas is getting more valuable and more scarce. See: deflation.

I doubt companies care about anything besides profit and that they could care less about gas hoarders. Also, this was just a little taste of havoc that could be done to the economy and society. I'm hoping they lost enough money to knock some sense into them to practice better security and hopefully it makes others think twice about practicing sloppy security. I'm also guessing in the wake of this that ransom attacks will increase in frequency, ransom demands will increase in value, and insurance premiums will increase as well and insurance providers may be forced to do better due diligence about policies that they sell to large corporations to ensure that they don't practice sloppy security. I'm hoping there is some tipping point where it makes financial sense for these large corporations to practice better security. Right now, they gamble that they won't be attacked and so don't invest in security and for the most part they have been rewarded.

>If idiots didn’t hoard gas, nothing would really have gone wrong.

Maybe. But, I tend to lay the blame with the foreign criminals/adversaries who attacked us rather than a panicky handful of my fellow country people.

Not sure why some here are blaming the victims while giving the criminals a pass, and even thanking them as if unsolicited, live pentesting on critical infrastructure with a side order of extortion is a good thing.

>I don’t know. Did any of it matter

I bet a lot of companies, including Colonial, are investing more in security, including hiring more people for security.

Company: Well this is a painful lesson

Me: Only if you learn it.

Penetration testing is part of a security program. If you don't have a security program, penetration "testing" isn't useful whether it's painful or not.

Haves the careers or investments of anyone significant who brought things to this point been screwed? If not, nothing will change.

I think ransomware gangs will be emboldened and more will go after bigger targets. I also think ransom demands will grow and insurance premiums will continue to grow as well. I'm hoping there is some attainable point where it makes financial sense to practice good security.

>> Me: Only if you learn it.

As someone with a lot of friends and co-workers who are on the info-sec side, the stories I repeatedly hear of how many times they visit the same company year/year and little if anything is done to harden their networks, and impose stricter security on their users is way more common than it should be.

Most, if not all of these networks should be taken offline and siloed, but you know that won't happen now, the genie is out of the bottle. If they did, it would create a much smaller attack surface for critical infrastructure. As it sits now? Doubtful we would go back to that world.

1. Any system can be hacked. We don't know enough to judge Colonial's infosec posture.

2. Agree that paying leads to bad outcomes. But I also suspect the feds put some pressure on Colonial. Voters remember gas lines and the pump prices.

>> But I also suspect the feds put some pressure on Colonial

This was my thought was as well. I thought they were in on this before it hit the public media. For me, it was like in the movies when the feds are trying to tap the line and the person is trying to keep the bad guy on the line as long as possible so they can trace the call?

My theory is the feds encouraged Colonial to string it out in order for them to get as much information on the hacking team as possible. From what we're seeing now (bitcoin seized, servers seized) it sounds like the Feds have them nailed pretty good and their gamble paid off.

Maybe the NSA should hack these companies for free. That would be helpful.

I might agree if I had any faith that the people who paid this ransom would do any more than the bare minimum to close this one specific vulnerability and nothing else.

So they'll be out of business sooner or later then and a company that follows security best practices will take over ideally.

Yes, "ideally" that's what would happen. Do you really expect that to happen in practice?

Well, fines are a fixed cost, the risk can be calculated and offset against a bonus. A ransom has an unknown downside. I'd imagine most ransoms would be priced to likely get paid, but ransomers don't really know the biz inside and out, so they might guess a painful or fatal price. but that's a one time cost. the lost revenue is the killer.

I'd expect there will be some serious talks about how much to pay to prevent things like this. 5 million, once? Meh, why bother taking security seriously? I suspect the lost revenue is tougher to swallow.

I dunno. you gotta pay every month forever, for protection against maybe something bad happening someday? It's an insurance premium, but you don't get made whole.

I guess, I'd expect companies to start paying a little for infrastructure so they can buy good insurance policies. backups would get you a lot.

It'll be interesting.

Yea, it seems like a pretty novel situation where I'm almost happy that these gangs are walking through these companies' unlocked front doors and causing enough havoc to be noticed but not enough to hurt them beyond repair. If it becomes enough of an infectious cesspool with diseases that can't be slept off to the point that these sloppy companies are forced to wear hazmat suits to exist in the environment, maybe that isn't such a bad thing in the long run. Before that tipping point, hopefully we don't just breed a large quantity of super bug diseases/ransomware gangs that laugh at decent security.

> being forced to pay penetration testers

Hardware write-enable switches on the drives are 2 or 3 cents.

I remember wiring up firmware lock switches on paytv receivers. That brings me back.

We have been in a less than ideal evolutionary equilibrium with respect to security: in the short term, companies that don't fund security can outcompete the prices of companies that do fund security, but they leave themselves vulnerable long-term to attackers.

This is analogous to overspecialization in an ecological niche where there was no predation.

As ransomware becomes more widespread, it becomes more and more detrimental to companies to pursue short-term security savings. That's good for everyone.

I think that would only be true if you thought it possible to obtain perfect security, but we’ve seen that even air-gapped systems are vulnerable to nation states motivated enough, and exploits are always laying in wait. This gets some bugs patched - but it also illustrates US infrastructure weaknesses to others.

Of course political terrorists can be negotiated with, they have an agenda and stated goals. You might not like it but they're not actually mad they just use means you are not comfortable being brought to bear so close to home.

I'd agree. But I would be surprised to see that level of action. At least for the next while. Considering the payment time on an invoice is averaging 270 days now. I would be surprised if they moved on this.

I’m on the fence. I definitely see your point, it’s solid. But I also think this (even only 5 million) incentivizes more of the same. It’s no stretch to see we’re in for an increasing amount of this.

This is not like paying bug bounties to white hats who isolate and report exploits before they are utilized in the wild.

In 20 years Edward Snowden Jr will reveal to us that it was the Department Of Energy the whole time...

Or a dev testing the chaos monkey...

> I'd rather greedy hackers shake them down for money then having the country get crippled by political terrorists or enemy nation states

These may be the same thing however.

If the terrorists and nation states are content with going after random single targets, causing low disruption, and leaving with some money, then good! That's not the scary scenario.

While I'm not directly trying to claim that this hack was the result of a nation-state actor, there's also no reason to assume such an entity wouldn't test the waters with small scale, targeted interference either.

Okay, but in a way that doesn't really affect whether the attack has positive/negative effects.

The situation of not being able to tell is pretty good.

These ransoms are funding the work of enemy nation states trying to cripple western nation states...

$5M is less than coffee money for a nation state

It adds up quickly. For North Korea the revenue from "criminal enterprises", including hacking and ransomware, are a valuable source of foreign currency.

At the very least, $5M seems a good start to fund an ongoing effort at developing cyber attack capabilities.

Someone mentioned that these could be terrorists posing as hackers. So, why not both?

I’m wondering if in the grand scheme of things this could be one more reason to speed up development of solar/wind + distributed energy production.

why would solar or wind have any better security, if the incentives for better security isn't really there in the first place?

I’d rather we pay the $5M in ransom, and then $5T to track the hackers down and eliminate them. Certainly someone died due to the pipeline shutdown. Eliminating the hackers would be fully justified.

Is this intentionally absurd? $5 trillion to kill some hackers?

>These ransoms are net good...There are a lot of infrastructure teams taking security more seriously.

Nonsense. This is not an academic exercise. Our country is being attacked by "nation states" (do more research) and we need to respond accordingly, treating it as the national security threat it is and making the perpetrators pay a heavy price. If they'd bombed our critical infrastructure, no one would be sitting around saying, "oh this is good for improving our defense. Thank you for dropping bombs on us."

The idea that they are doing us some kind of service and we should just play a game of defensive cat and mouse, hoping for 100% effectiveness (which we know is impossible) is absurd.

Wake up. We're at war.

> Wake up. We're at war.

With whom? And given that nation states have engaged in this sort of thing for years, and that the US/5-eyes/etc also engage in these activities, do you really want to turn a cyber/cold-war into a hot one?

The solution is defense-in-depth, with liability on the providers of software, which will require them to insure, which will raise prices, which will force them to address security as COGS which will force them to reduce their attack surfaces to reduce their insurance premiums.

Russia. That's not exactly a secret.

I didn't say we needed to turn it hot. Where did you read that? But, I do believe this idea that we "shouldn't escalate" emboldens the aggressors.

There is no defense-only solution. Your profile says you work in IT, so you know that.

Why are you against punishing/deterring the aggressors?

Can they unbomb it for $5 million? Cause that would be cool.

>Can they unbomb it for $5 million? Cause that would be cool

Yes, we could "unbomb" it for some amount of money. But, we generally use the term "repair".

But, that's a great point: as long as we can undo the damage for some amount of money (via repair or paying extortion), we should let foreign adversaries dictate the terms on which they'll allow us to operate our infrastructure.

Still, do let us know when you think we should be concerned. 2 more pipelines? 3 more hospitals? 4 more police stations?

$5 trillion ransoms? Maybe? No? Perhaps when infrastructure outages and other attacks cause deaths?

It's kinda the opposite scenario. The hackers knew they were willing to pay more but didn't actually want to cause this much attention and so lowballed so they'd quickly pay.

At least according to https://finance.yahoo.com/news/colonial-pipeline-paid-hacker...

    Krehel (chief executive officer and founder of digital forensics firm LIFARS and a former cyber expert at Loews Corp) said a $5 million ransom for a pipeline was “very low.” “Ransom is usually around $25 million to $35 million for such a company. I think the threat actor realized they stepped on the wrong company and triggered a massive government response,” he said.

Yup. They start doing this kind of damage, and they can start to expect the wrong kind of attention -- a kinetic response, as in cruise missile into the upper left window, circular error probable = 50cm., or similar.

Unless Vlad starts frowning on this behavior, which persists at his pleasure, it may take that (or a seriously escalatory cyber response) to lower the threat to acceptable levels.

The bigger the difference between the cost of the downtime and the ransom, the most likely it is to be paid.

Assuming you were in a TV show, and offered two options: Spin wheel 1 with a 95% chance of winning $5M, or spin wheel 2 with a 50% chance of winning $50M, which one are you going to spin? The EV is higher on the second one, sure, but taking the near-certain 5M may still be a better choice - a bird in the hand is worth two in the bush.

Additionally, this group is said to do its research and adjust ransoms accordingly, so it seems likely that the ransom amount was a carefully thought out choice.

Which option maximizes the long-term rate of growth of your wealth depends on how much money you already have. The Kelly Criterion takes this into account and handles a wide range of situations including this one.

Example: Say you have $10⁵, and you have the option to play game 1, which offers a 95% chance of a $5×10⁶ prize, or game 2, which offers a 50% chance of a $5×10⁷ prize. By the Kelly Criterion, the value of a scenario is the expected value of the logarithm of your wealth under that scenario:

• not playing at all = lg[10⁵] = 5

• game 1 = 95%×lg[10⁵ + 5×10⁶] + 5%×lg[10⁵ + 0] ≈ 6.6

• game 2 = 50%×lg[10⁵ + 5×10⁷] + 50%×lg[10⁵ + 0] ≈ 6.3

So game 1 is the best option if you have only $10⁵. On the other hand, if you have, say, $10⁶, then game 2 is the best option.

Great example. It is worth emphasising your model will capture the game from the ransom attackers perspective since for them it is repeated many times. It won't give the EV for the attacked as their number of ransom incidents will hopefully be very small rather than tend to infinity. Which likely means the EV will be based on their own personal utility function.

The Kelly Criterion can be used to analyze the options from the defender’s point of view, e.g.:

• pay for security that prevents attacks = lg[company value – cost of security]

• don’t pay for security = attack probability × lg[company value – cost of dealing with attack] + (1 – attack probability) × lg[company value]

Re. this group doing its research: one of my past employers got hit by a patent troll C&D demand, threatening to sue. It was clearly bogus but also clearly enough of a hassle that the company didn’t want to pick the fight if one could be avoided. Our clients were actually throwing their support behind us fighting it, offering their legal resources. But at the end of the day what the higher ups told us is that this patent troll was “very professional. They did their research on us and know exactly how much we can afford or pay them without going out of business.” So we ended up paying and I guess it all worked out ok from there.

When I was young my father had a new company in a industry that was known for lawsuits. The first came came in and I looked at it and said settle. He said no F’ing way. We won. Even with winning the legal fees, the cost in manhours was more then settling. Then the next one hit. Did not settle and won……and so on. After about 3 years no more lawsuits. His reputation was never settle and the trolls moved on.

Never negotiate with terrorist. As long as they feel there is a chance they will get paid it never stops. Burn it to the ground, but do not give in.

You're correct

This lesson should have been learned at school. If you give in to the bully you get exploited more.

Sure it's more work to fight. But it makes sure you're not abused so much.

Yeah, unfortunately the games that go into extortion mean that fighting back only makes sense (a) on such a long time scale that no one is considering it while being extorted, or (b) because it's the right thing to do.

The difference in actual value between the two for me at least is much smaller than the difference in numerical value.

Both amounts are enough for me to never work another day in my life, and instead focus on building what I want to build. Past that massive increase in quality of life extra money is relatively meaningless (to me) .

This is the same reason that people who decry spending money on lottery tickets as a stupid thing to do based on the EV alone are thinking far too simplistically.

> The difference in actual value between the two for me at least is much smaller than the difference in numerical value.

That was exactly one of the reasons why I showed that example.

While this may be different for a gang that has to split the money N ways, the "bird in the hand" might still be worth the two (or ten) in the bush, due to this or other factors.

Off topic, but I'm curious: What do you want to build and why can't you start building it now?

Mostly software - games and related tooling, learning more about type systems and applying it in a homebrew language.

I can start building it now. But after already spending 40 hours a week writing code at my day job and having those problems swimming around in my head all the time it's hard to find the motivation to do more, even when what I do for my day job isn't as creatively fulfilling.

In 2019, ProPublica wrote how paying ransoms benefit insurance companies.

They called this: "The extortion economy: How insurance companies are fueling a rise in ransomware attacks. Even when public agencies and companies hit by ransomware could recover their files on their own, insurers prefer to pay the ransom. Why? The attacks are good for business." [0]

[0]: https://www.propublica.org/article/the-extortion-economy-how...

Thank you for posting that link, it was really informative.

> ProPublica has found that they [insurers] often accommodate attackers’ demands, even when alternatives such as saved backup files may be available.

What a perverse set of incentives. Insurance companies are paid to manage risk. Risks go up the more they pay ransoms. As risks go up, the risks are more visible, more companies get policies, insurance gets more money. This is bordering or racketeering.

How many times do people on HN say “back up your files”. Certainly that’s the way to do it if you want less ransomware. It’s not sexy, it’s not “visible”, but it will reduce your risk. But apparently, the goal here is to encourage more ransomware.

For such a long article it's (IMHO) a fairly naive view. Sure insurance companies make some profit, specially in the beginning but, eventually, the price gets higher and higher and the cost to secure becomes less than the cost of insurance.

We had a similar issue with builder's insurance down here in Australia. It's was (and still is) cheaper to get insurance than build a quality building. Eventually that caught up with the builders (and they moved to using a seperate corporate entity for each building and closing it after the building is built, but that's another story of corruption).

> a seperate corporate entity for each building

Hmm, so if buying a house, it can be good to first find out if this house is the only one the construction company has built

> insurance companies make some profit, specially in the beginning

I've gotten the impression that CEOs often don't plan much longer than any bonus program periods?

And, later when getting too expensive, can't they just then start telling the companies to use their backups instead.

Security professionals need to start getting serious about demanding physical write-enable switches to all embedded systems, so malware won't survive a reboot.

Backup media must be append-only unless a physical write-enable switch is pressed.

Physical write-enable switches used to be standard.

I'm not buying the crazy argument that remote update is necessary to remove malware installed using remote update.

This was extremely poor (I'd say weak) leadership by Colonial Pipeline. While continuing to be down is painful, it puts a spotlight on the issue and forces hands of critical infrastructure to improve security and reach out to security companies for audits and consulting. Also, they could have gotten additional support from the US government and political support by continuing to stay down instead of the back alley payout.

Not to mention, rewarding people for bad behavior is never a good idea. I learned this as a child... "If you give a mouse a cookie, then he'll ask you for a glass of milk."

It appeared that they informed the government that they are paying the ransom, Government's view was that it was a private sector matter so it is prerogative of Colonial to act.

What I have heard regarding ransoms like these is that the perpetrators goal is to incentivize the transaction goes smoothly, or it won’t continue to work.

So they have to follow through with unlocking and they have to use an amount of money low enough to make the decision obvious.

Well from the article, the decryption tool was so slow they kept using backups along with it. Sounds like future hackers need to improve their decryption tools, or companies where speed matters (like utilities) won't bother paying.

This was the error yeah.

Given how encryption is generally symmetric in terms of operations and speed, I wonder how long the original encryption took as well? What warnings were overlooked leading up to the attack fully going into place?

I agree. I’d give 60% odds that there is at least one significant attack (ransomware plus shutdown) on US power grids in the next 18 months.

Basic game theory dictates that the cost of ransoms will continue to rise until it hits the price point at which the targeted company would have to replace its compromised systems from scratch.

5M, 50M, 500M, 5B, 50B?

I wonder how the government would react if a hacker group held gas/power/clean water/etc. hostage for millions of Americans for a ransom in the tens of billions

The government seems to have no problem with utilities doing this or worse to their own customers (PG&E, Texas power grid, Flint Michigan). But I guess if they could blame a foreign power that's an opportunity for a profitable war.

> The government seems to have no problem with utilities doing this or worse to their own customers (PG&E, Texas power grid, Flint Michigan).

The “utility" acting in Flint was state and state-imposed local government officials, 9 of whom have been criminally indicted for their role, so manifestly the government has something of a problem with it.

> I wonder how the government would react if a hacker group held gas/power/clean water/etc. hostage for millions of Americans for a ransom in the tens of billions

War.

Too grandiose a word for a targeted assassination of a handful of folks.

Not if the hacker group is a nation state. Sure, small time hacking is cute and all, but the US isn’t going to just roll over and be all like “oh no, you hit critical infrastructure that had a big impact on peoples life. Carry on”

Even this time too government was aware that Colonial paid the Ransom. The question was asked in the Whitehouse press breifing, it was told that this is essentially a private sector matter, Government will not advice Colonial in this regard. Also they said it was Colonial's prerogative to decide and act.

Transcript of Whitehouse Press Briefing: https://www.whitehouse.gov/briefing-room/press-briefings/202...

That's because nothing of consequence happened at this time. Had the actions resulted in deaths of a few hundred or a few thousand Americans the response would most likely be very different.

Wouldn't it cause more ransoms and more damage to millions of Americans?

continuing the unfortunate trend of the public spending to protect private profit.

Taking out a fuel pipeline in non-heating months seems a lot less likely to cause casualties than downing a power grid. Dead people get different responses than theft, even massive theft. Also, knowing how scary oil companies are, I wouldn't be surprised if some people turned up dead over the colonial hack. Even if they get the attribution wrong, a dead hacker group would have a chilling effect on such activities.

As per reports the ransomware had no effect in any of the physical pumping/operational systems required to pump/operate the pipeline, it only affected their billing system and they stopped pumping because later it would have difficult to reconcile the billing for it, not because the ransomware disabled the pumps.

Yeah, but now there is also a massive bounty out for these hackers. Money needs to get out at some point and that's when they'll get nailed.

Unfortunately these types of breaches don't net the culprits nearly as expeditiously as we'd all like. Given that they're likely based in a country that could care less or may be adversarial to the US this may even be lauded.

In the grand scheme of things it's very low likelihood we'll see any level of prosecution for this incident in the next year or two, if ever. And even then it will likely only result in attribution in a random report a year from now with no actual consequences for the attackers.

The final thing is the amount of money isn't extraordinary. As others have said it's mostly a rounding error in annual revenue that passes books of a company like this.

Check front page of HN :)

Sounds like a $50m incentive to hire a security team.

Or more likely insurance.

The insurance may demand better practices for lower premium in turn

There were some news reports yesterday about insurance companies dropping cyber-ransom insurance from their offerings (AXA, I think). Very likely more insurance companies will do the same soon, or at least, refuse to insure the company unless they comply with some cybersecurity standards.

Pretty much. Insurance industry can be helpful here. They can develop audits and make requirements same as they do for worker safety procedures.

From my experience. They will hire you but they won't pay your invoice until net-270

You're the second person who mentioned net-270 in this thread. What's the context?

It means you invoice and they pay after 270 days of receiving the invoice.

Basically the large oil firms know they hold all the cards so they regularly delay payment as long as possible.

My friend who works in cyber security share this framework to deal with ransomware with me: https://securityandtechnology.org/ransomwaretaskforce/report...

This problem needs to be solved in collective level.

I think you're entirely wrong. I doubt the hackers realized quite what they had hacked, and by the time they did realize, they were probably shaking in their boots.

My guess is they lowballed - $5m is considerably less than other payments I have seen them take before for a much bigger catch.

They could always just keep the "X" unplugged, it is doubtful hackers from Russia go onsite and sabotage things. Maybe this will make companies realize if they can't secure it at least just disconnect it. Everything doesn't have to be online.

The “X” may be unplugged but your day-labor contract industrial cleanup techs are hired through an Uber-for-Cleaners Hygiene-as-a-service Heroku app that’s had every backup silently deleted for a month and has just been replaced with a funny cat photo by someone claiming their name is spelled with a zero in it.

You can’t hire cleaners. Site cleanup is suspended. Your insurance is invalid if workers are onsite while hazmats are left uncleaned. You shut down on the day you were about to ship a full warehouse of product. Manufacturing grinds to a halt because the outbound warehouse is full. You have to cease goods incoming because they were misusing the day-labor app for handling delivery grunt work.

Ph0bos Security Services also hacked your email so now everyone has to use personal phones and WhatsApp but upper management won’t share their numbers with anyone except the foreman so he is now the bottleneck for everyone who needs approval to make out of budget purchases to handle the capacity overload that’s happening everywhere except for hazmat cleaning.

But the pumps were airgapped so at least they didn’t get hacked.

It certainly will fund them to go stronger in the future. (And now invents bad behavior even more) The challenge is this isn’t this Colonial’s problem. It’s the next one.

At some point it will wake up the authorities to go after them more seriously too.

Hardly, they regularly take much more than this. This is an organized criminal enterprise, I just read through a chatlog where they got $12 million and this is just one of many.

$5m was 100% a lowball because of the geopolitical implications of this attack.

Interesting. I hadn’t realized that the quiet payoffs were so high.

It is a scientific fact that there will be more of it. It's called operant conditioning. If you reward behavior, you get more of it.

If you think it's about the ransom though, think bigger. Can you even imagine how many billions of dollars silicon valley is going to make off it? They just paid Microsoft dozens of billions for some AR glasses.

How much for some software to prevent cyber terrorism? How much did TSA get to secure planes? $8 Billion/yr.

$18 Billion for border protection.

How much for cyber border protection? $100 Billion? Where will it go? Google? Microsoft? Palantir? Facebook? Twitter? Amazon?

Trillions.

They haven't even gotten started. $5 Million is pennies. Rounding error.

Moneystuff had a good post that touched on this today.

Even if they don’t pay, the scammers buy puts on the public stock for the companies they’re ransoming so they profit off of blowing them up too.

I’d imagine that’s easier to track and stop, but it’s interesting.

It is much better to pay a 50M bug bounty than to have a system downtime cause billions in damage.

Reply on news.ycombinator.com