A Modest Proposal About Ransomware

Some of this monoculture and attack surface is necessary (line-of-business software, standard productivity tooling, the OS itself...) for the company to function.

At least with remote management, you can respond at scale if one of those gets compromised.

Unfortunately companies cannot afford to build messy environments.

Fixing small issues, on-boarding new people, explaining existing setups to already employed, adding new servers. That is nontrivial amount of money burned there "day in and day out" when networks are monoculture with centralized access. Making it a little bit of this flavor a little bit of other, will make those costs grow 100x in no time. This way you have 100x operational costs to prevent something that may or may not happen.

Having messy environment also brings other risks like some operator might mess up easier because of being tired fighting that mess.

Non-computer-experts were sold computers and the internet as tools that would help them run their business.

I find it hard to blame them too much for unexpected unadvertised technical problems.

I propose something simpler: disconnect most computers from the internet, and don't put them places strangers can access them. Then build out the tools that work in that environment.

I don't actually think it would work in practice, though, because it's a race to the bottom. The company continuing to do all their shit over the public internet with commodity PCs is going to be doing things more quickly and more cheaply initially, and may thoroughly beat the competition before getting hit by an attack.

I believe the terminology for what you'd like to see is the zero-trust security model, and it is gaining acceptance as the new standard.

https://www.nist.gov/publications/zero-trust-architecture

The US wouldn't maintain their capabilities for long if they were burning all of their zero-days on defensive posturing.

This exists: https://en.wikipedia.org/wiki/Penetration_test

This solution has been proposed before in security circles. The reason I have heard that it is not done is that just the act of hacking into a system can destroy things that are important. With a pen tester the company can review their plan and make sure it won't affect critical systems. With the government randomly hacking systems they will eventually touch something they should not have. Encrypting all the systems for non-compliance is even worse, some systems will be effectively destroyed or require months to recover from just being off and unavailable. Some things can be recovered fairly easily (database rollbacks, replays) but often a lot of transaction history is lost when the systems go offline. We are not actually sure we could restart the USA power grid if the whole thing went down at the same time (never happened before). You do NOT want an uncontrolled shutdown of an oil refinery or chemical plant. There is a business cost too while the systems are down which might be viewed as a "fine", but that is a fine imposed with no legal recourse. A company could take the government to court, but they may never be able to recover from this "fine". The amount of the "fine" will vary per company also, some companies with the right recovery architecture could just consider it a cost of doing business and find it is cheaper than doing good security, others may be wiped out. There is no way to make the "fine" proportional to the crime.

None of this solves the problem of zero-days either. The only thing that I know of that sometimes could work against zero-days are intrusion detection/anomaly detection. They do not guarantee that you'll be able to stop the intrusion in time though, especially if the entire attack is automated or really sneaky, masquerading as normal users or third party vendors. An automated IDS that can halt an attack is a very risky thing; change your business practice one day and that could shut down your network meaning you just attacked yourself. It could be purposely triggered by an attacker also as a denial of service.

The only ransomware solution I can envision is gradual hardening, like in the old days of Sun workstations and how airplanes became so safe. Make only small incremental changes and respond to feedback so over time the system gets more and more secure, until everything is just secure by default except when rare new vulnerabilities are discovered (new zero days, but if the system doesn't change much they should get rarer and more difficult to discover with time discouraging people from trying to find new ones). This is expensive and takes time and kills innovation, but I don't think there is a quick fix. So reserve/require it for critical systems and let innovative systems be more subject to failure and attacks. The first step would be deciding what is critical (the power grid? facebook? your grocery store IT system?) and hence should be required to follow this practice. Eventually even the more innovative services will benefit from using some of the well hardened systems. Ransomware will run rampant meanwhile, diminishing with time. I view this as similar to global warming, there is not just one problem, there are thousands of problems in networks, computers, OS's, apps, services, and users, and it is not going to be fixed with a patch (especially when patches are also an attack channel). Big companies probably already do something like this (hence they continue to use Windows NT or DOS or invent their own flavor of Linux), but this is also something that should probably be a government requirement for the grid, chemical plants, ISP's and anything we can not risk having fail.

That may or may not help. If a company has a choice between going out of business or some probability of the CIO going to jail you know what they're going to choose.

This is by far the most effective solution to the problem. The foreign corrupt practices act [1] was highly effective at stopping US businesses from paying bribes in foreign countries, with many other developed nations following suit with similar laws. Such a law for ransomware would no doubt also be effective. Companies pay lawyers specifically to audit their processes around FCPA compliance because the penalties are so severe. No executive wants to go to prison because a salesperson hires some “consultant” in Thailand to win a deal…

[1] https://en.wikipedia.org/wiki/Foreign_Corrupt_Practices_Act

For one thing the bud has already bloomed into a vast field. For another, criminalizing the behaviour of the victims is rarely all that effective, especially when difficult to track and enforce.

There already are "security consultants" who will do the dirty work of paying the ransom and handing the victim the decryption key. Pretty hard to stop that sort of thing, no?

That will work fantastically well if the goal is to reduce the number of reported ransomware cases.

The main perverse incentive I see here is that it encourages companies to hide the fact that they've had a breach so they could pay the ransom w/o consequence.

I do think regulation making ransoms hard/impossible to collect is the way to stopping the immediate problems posed by ransomware.

More disturbingly, however, is that such hacks just underpin how vital infrastructure is exposed to nation states. When the motivation isn't collecting a ransom but rather to disable a country's vital infrastructure, such regulation would do little.

The theory behind banning ransom payments is an attacker won't go to the risk and expense of kidnapping someone if they know there's only a 1% chance they'll get paid.

But if the attack is an automated bulk exploitation of thousands of computers all around the world - why should an attacker stop targeting US computers just because US companies are banned from paying?

People pay the ransom because they need the data more than the money.

Bitcoin is quite traceable; but I take your point. To flesh out your position, are there any circumstances in which you believe two parties should be able to transact securely and privately?

That solves ransomware, which is bottom of the barrel in the hacker world. The reason talk about this is so much about _defense_ lately is because if people as untalented as ransomware operators can make it into US corporate and government infrastructure, imagine how deep in state-employed hackers must be. In the past decade US government infrastructure has been deeply penetrated multiple times, with catastrophic consequences.

https://en.wikipedia.org/wiki/Office_of_Personnel_Management...

https://www.wired.com/story/the-full-story-of-the-stunning-r...

https://en.wikipedia.org/wiki/2020_United_States_federal_gov...

Bitcoin seems highly resistant to centralized control; I suspect attempts to outlaw it would be easily thwarted.

Couldn't they still demand ransom in BTC? I assume if BTC is largely banned in the US, it will still exist. Exchanges will still exist (in some countries) and it'll still be traded.

Couldn't attackers still say, "Go get some BTC and deposit it. Where do you get some? Not our problem."

Maybe there's something I'm missing.

The article is attempting to follow in the satirical tradition of Jonathan Swift's "A Modest Proposal", which suggested feeding children to the poor in 18th century Ireland.

It isn't presumed, it's claimed by the U.S., and the presumption the author is making comes from granting that claim for the sake of his(facetious) argument.

Whether it's true or not doesn't matter. I don't think you'll find many countries making claims of weakness on defense-related topics. In the same way that no country would just announce that they have the 11th or 12th greatest military in the world, they'd never say they have the 2nd best cyber-warfare capability either.