Hacker News Reader

Comment by frays | Hacker News Reader

Is it just me, or does it seem crazy that we all just accept that private businesses are obligated to protect themselves from state-sponsored hacking? Imagine if Wal-Mart had to fund a private air force and patrol over their stores in order to combat foreign bombers coming in and everyone was like, "Yeah, that's just how it goes."

Isn't a primary responsibility of government to protect its citizens and businesses from other states' militaries?

View on HN

In principle, that's what the NSA would be doing. When DES was developed and standardized in 1976, the NSA had input in selecting some of the constants that were chosen for it [0]. It wasn't until the late 80s when independent development of differential cryptanalysis [1] came out, and people realized that the DES constants were deliberately chosen to be resistant to this attack.

The NSA has since turned away from this responsibility, and has done the exact opposite. When Dual_EC_DRBG was developed [2], there was a similar choice of constants, with the final values having been chosen by the NSA. In this case, rather than protecting against a attack method known only by the NSA, the constants were chosen to allow an attack method known only by the NSA.

[0] https://en.wikipedia.org/wiki/Data_Encryption_Standard

[1] https://en.wikipedia.org/wiki/Differential_cryptanalysis

[2] https://en.wikipedia.org/wiki/Dual_EC_DRBG

Or maybe the choice of Dual EC DRBG constants are intended to protect against a new cryptanalysis technique known only to the NSA

internal documents leaked by Snowden and reported by the NYT confirmed the intent of the program

https://en.m.wikipedia.org/wiki/Bullrun_(decryption_program)

stop simping for the nsa

I highly doubt it. Dual EC DRBG basically works by encrypting your seed value with a NSA provided public key. It’s kinda amazing how blatant the back door is.

Sorry but Walmart has cameras, guards, and most importantly locked windows and doors.

Just because nobody has figured out (or bothered to invest into) building the equivalent of basic security doesn't mean it's the state's responsibility.

It is the government's responsibility to make sure companies take their responsibilities of protecting their customers' data, and the internet more broadly from the impact of the company's decisions.

I think the question is about foreign government operations. If North Korean agents threw up some graffiti on a Wal-Mart and stole some soda, the private security would not be expected to handle the situation on their own. Even if the stakes seem low, that's an international incident.

That's... a very weird, reaching argument to make. And also not an international incident, since it's just some graffiti, not espionage or assassination or whatever. I'm not sure what point you're trying to make here.

The original argument is that it's weird private businesses have to protect themselves against state actors such as foreign governments. The equivalent would be if Walmart was expected to protect itself while a foreign governments special forces raided their stores.

Of course I'm not sure that's how it's playing out anyway, as I'm certain that the relevant three letter agencies are interested in foreign state actors digital incursions, it's just a very delicate situation and not as simple or clear cut as the Walmart example.

It doesn't seem that far reaching. There's a difference between "foreign citizen action" and "foreign government action". If another government comes to your territory, to break your laws and deprive one of your businesses of their property or rights, that's a big deal. But because it happens online, it's given a pass and pushed on to private individuals to deal with.

I am pretty sure that it does not matter who stole the soda - North Koreans or locals. Either way it is up to store security to catch them and hand over to police. Police may then hand NKs over to someone else, but this doesn't change what store security must do.

> this doesn't change what store security must do.

There is no _must_ here. The police _must_ deter and punish crime. A private entity _may_ hire security if they find the police to be ineffective at stopping certain crimes. If walmart was robed while the security guard was off duty, it is still the police's job to investigate and arrest the criminal.

I think a somewhat comparable scenario could be: it's reasonable to expect that Walmart should defend against most counterfeit currency on their own. But should they be expected to defend against counterfeit currency made with state-level resources, such as supernotes with the same paper, ink, printing process and security features, where there's no guarantee that any reasonable detection method will work? This is, interestingly, something that has been linked to North Korea as well (https://en.wikipedia.org/wiki/Superdollar).

Honestly, ignoring the state actor part of this, even if a bunch of local kids run up and graffiti the outside of a Walmart, I don't think we tend to regard it as a fundamental failure of Walmart's duty to secure their business, or a failure of their architects and security staff to do basic diligence or follow best practices to allow it to happen.

It's just a criminal act, of which Walmart are the victim, and it's the state's job to find and prosecute and deter that kind of thing from happening again.

How can Walmart defend itself from foreign government's attack, with cameras, guards, and most importantly locked windows and doors?

Defending internet infrastructure from foreign government's attack is not "basic security".

You're missing one thing though: North Korea doesn't rob Walmarts. Expecting private entities to be able to stand up to the kind of attack a hostile nation state can muster is unrealistic, and, quite frankly, probably a drag on the economy.

Besides, what ever happened to "provid[ing] for the common defense?"

The correct equivalency would be the roads leading to the Walmart. If a Walmart were blocked by people pointlessly driving on the road to make the Walmart effectively unreachable, police would intervene and clear the road of the noise.

There is no such thing as a "correct equivalency".

The US government does do quite a bit to protect their citizens from electronic attacks. There are organizations like CISA and NIST that do a lot of work to help prevent attacks, and the FBI and DOJ do a lot of investigate and enforcement work after the fact.

For example:

https://www.fbi.gov/investigate/cyber/partnerships

https://www.cisa.gov/stopransomware/ransomware-guide

Well stated.

We also have a tendency to conflate the requirements on software systems with respect to security threats as being somewhat similar to the requirements on other kinds of engineering with respect to safety and environmental threats, and I think that does a disservice to the vastly different scope of responsibility involved.

When I see people arguing that software engineers need to treat security as seriously as, say civil engineers treat structural stability when designing a bridge, or mechanical engineers treat vehicle crash safety, I agree to an extent, but I also think it’s worth considering:

Most bridges are not designed to actually survive being deliberately attacked with the kinds of weapons nation states can bring to bear on them. When militaries get involved, bridges tend to fail.

Likewise, civilian car safety testing does not make cars that are able to survive attacks that nation state actors can carry out with things like tanks, mines, or drones.

We need to be realistic in our expectations for what level of military threat civilian systems can reasonably be expected to deal with unaided.

While your logic is solid and I do think this would be ideal I struggle to see how this would work.

Dropping bombs on a walmart store is clearly unwelcome, sending traffic to walmart's website? Much less clear. You can guess based on the traffic pattern but the only way to really know is to ask walmart if this is welcome traffic (not just a burst because some new product came out). Especially since many cases are DoS with encrypted TLS traffic that looks much like any other traffic to an outside observer.

However much of the protection is threat of retaliation ("if you drop bombs on us we will flatten your country"). So maybe that is the solution here, the government should treat these attacks as real threats and punish those responsible.

Well, a government could start by mandating that internet peers authenticate their packages, and cutting the access of bad actors.

People can't do that, and it's a very basic defense.

"Mandate private companies protect their customers" sounds very different than "the government should protect everyone" even if the result is similar.

Start by mandating BCP38 (RFC2827).

What stops that? (Both its widespread implementation and making it mandatory)

You mean what that protects against?

It provides the first part of my post, authenticating the packages.

The second part is cutting out misbehaving connections. On this case on the article, it would be trivial, and governments should be on the ISP shoulders making them make call everywhere and cutting some of their clients. But there are many attacks where the ISPs don't have enough information to act if they implement something like BCP38.

What I find much more crazy is how this is made out as "state-sponsored hacking", even tho the article doesn't mention with a single sentence who or what the attackers are.

In that context instantly jumping to "state-sponsored!" strikes me not only as a needless, but particularly dangerous escalation.

It's like people forget that "cyber" is most of all asymmetrical and attribution is usually more of a guessing game than an exact science.

Yet nearly every larger hack is very quickly labeled as some kind of "state sponsored offense!" to serve foreign policy narratives, and most of all; Excuse the incompetence that often enabled such attacks in the very first place.

It is just you. In the physical world a military can observe an attack, can announce that it is not cool, and can drive a tank through most intruders.

Now ask yourself this question, would you like to give your military the full access to your infrastructure together with command and control capabilities to do with your devices and the software on them as it pleases according to the situation? If you actually think that in fact you are not okay with 24/7 monitoring and management from a centralized government institution, you should own up to your desires and get your defense together.

Of course, this is a simplistic and extreme scenario. Much of the missed part is about availability and basic institutional capability for military cyber operations, but the fundamental question is: when one demands something from the government, what exactly they wish to give up as a consequence of the proposed solution.

Yes, it's walmart responsibility to protect their customers. It's their responsibility that their supply chain is not hacked to say distribute poison, it's their responsibility that the cameras they use in store are theirs and only they have access, it's their responsibility that the card I use in their terminal is safe. The example you gave won't be hurting the people, otherwise yes if they want to gain trust in dangerous land they have to ensure safety of people.

I feel like it more broadly boils down to, if you put it on the internet you are responsible for securing it.

If you can't or don't want to secure it, don't put it online.

23 people were killed and 23 more injured in a Walmart in El Paso in 2019 in a mass shooting. Is it your position that Walmart has sole responsibility for failing to prevent those deaths?

Many private businesses already are expected to protect themselves from state (and similar capability) physical interference and attacks, especially if they are in the supply chain of critical infrastructure. It's one of the things you have to do effectively to earn profits in that sector.

We rolled over to state-sponsored election meddling. There’s no way we’re going to care about this.

Indeed. We definitely need laws to hold companies accountable for their IT-related activity.

For one, we need to hold commercial vendors accountable - that means especially to refuse to provide security updates for the reasonably expected life time of a piece of software or hardware.

But especially, we need the companies using IT systems to be held accountable. The magic word is "defense in depth" - the scenario of the post we're talking about is a piece of equipment that was not supposed to be reachable from the Internet and despite that knowledge it was made accessible to the Internet. Seriously, anyone caught exposing dangerous stuff to Shodan should be fined to hell and back. Or to continue using your military comparison: most governments have laws that call for harsh punishment for "aid to the enemy" or similar. Time to update the law to the new digital world.

A failure to defend yourself is not aiding the enemy. That is insane.

The government provides for the common security. That's one of it's most fundamental jobs.

Imagine if your house was destroyed by a Russian drone and you were thrown in jail for not having enough "defense in depth" against drone strikes.

> A failure to defend yourself is not aiding the enemy. That is insane.

Let's say you are the leader of a border post, and you leave your post unmanned allowing the enemy in - of course you will be held accountable.

Exposing stuff to the Internet despite the manufacturer warning against it is at least grossly negligent and should be punished.

We are at war with Russia and China on a nation-state level and on top of that we also have cybercrime gangs.

> Let's say you are the leader of a border post

Let's not say that. Suggesting that civilians have defence duties on par with members of the military is ridiculous.

> Let's say you are the leader of a border post, and you leave your post unmanned allowing the enemy in - of course you will be held accountable.

Yes! Because if you are a member of the state operated defense force, then defense is your responsibility. The state is responsible for defense.

If on the other hand, you are a civilian who just happens to own property near a border, you have absolutely zero obligation to defend the border yourself. The same is true for businesses near a border.

> We are at war with Russia and China on a nation-state level and on top of that we also have cybercrime gangs.

Man, if only society had a way to form some sort of governance body which could provide defense against other nations and provide some sort of justice system to protect against and punish crimes. Oh well, I guess its every man for themselves ¯\_(ツ)_/¯

Likewise, if I sell... garden fencing, and the military decides to buy it as just another customer, how liable should I be if it's easily bypassed?

"We are at war with Russia and China on a nation-state level"

Not aware of any country in the world that is currently in a declared state of war with Russia and China.

The insistence of people on a formal declaration of war is one of the reasons why the situation has escalated so far.

Just how much evidence do you need to realize that the actions of both Russia and China have been - for years now - to undermine Western societies and the global set of rules?

Depends. Do you want the government to control the internet?

I guess it depends on the analogy, and whether physical location means anything for the internet. Piracy of commercial ships, for example.

That is also very much a problem where states are expected to intervene.

It seems similar to me. They sometimes intervene, but often don't.

maybe one day when the people in charge are at least somewhat technically litterate

so, china's internet? because that's what you're actually asking when you ask a policed internet.

It very much is the responsibility of the NSA, but they mostly fail at their primary job, and conduct illegal activities such as mass surveillance instead.

Another example of a government agency that fails at their job: the FDA. The FDA is supposed to protect consumers from harmful foods and medications, but the fact that you can walk into any store and grab a can of food or bottle of vitamins/supplements contaminated with heavy metals is a huge red flag [0][1][2][3][4][5]. The FDA does 0 product screening whatsoever. If the FDA actually did their job, healthcare revenues would be at an all time low in America. It pays off big time to have a diseased population.

[0] https://www.consumerlab.com/answers/supplements-and-foods-th...

[1] https://www.consumerlab.com/answers/do-zinc-supplements-cont...

[2] https://www.consumerlab.com/news/metals-in-seaweed-snacks/12...

[3] https://www.consumerlab.com/recalls/11882/herbal-supplements...

[4] https://www.consumerlab.com/news/contamination-in-greens-who...

[5] https://www.consumerlab.com/news/caution-with-spirulina-supp...

Reply on news.ycombinator.com