Hacker News Reader

Comment by SahAssar | Hacker News Reader

Can we stop using disk size as a measure of leaked data?

There are bluray movies larger than this leak and there are files smaller than 10kb a lot more critical in most businesses.

It'd be nice if there was some sort of scale for data leaks like (just spitballing here):

1. Leak destroys all core company functions (crypto-exchange leaks all wallet keys, CA leaks all root keys and becomes banned from all trust stores, etc.)

2. Leak causes regulatory issues criminal enough to shut down company

3. Leak severely hinders core company functions (deploy keys for a cloud computing SaaS are deleted which stops all new deployments until all infra is reconfigured)

4. Leak severely looses company competitive advantages (new products leak that are replicable by competitors)

5. Leak causes severe PR disaster

6. Leak shows embarrassing internal company communication without any of the above

View on HN

Or at least say what the 45GB (for this example) of data compromises. As you say, if it were video files, that would add up pretty quick, but if it were 45GB of emails, then that's a hellalotuvdata. That would be the equivalent of a hostile law firm dumping a truck load of banker boxes on a smaller law firm to bury the lede.

Kind of like saying I have 10. 10 what? As my math/science teachers always said, don't forget to include your units.

This sounds like how we use a CVSS score to gauge the severity of software vulnerabilities.

Maybe the world needs a standardized place to catalog and rank all the data breaches that have been disclosed.

Would be nice, but there would quite a lot of analysis needed to be able to determine any of that. Which you can't start until the file is public.

Sure, but instead of saying "Boeing leaked 45GB" it would say "Boeing leaked files of undetermined severity".

The disk size does not matter, and when the severity was actually determined it would show up in the headlines as "Boeing leak determined to be a level 3 leak" instead of just being "That boeing leak 5 months ago was kinda bad".

Either way, listing the size says very little.

These are journalists publishing breaking news. They are not autistic IT professionals.

Relevant quote from the article: "I haven’t gone over the whole data set but Boeing emails and a few others stand out as useful for those with malicious intent"

Journalists are almost never deep experts of the fields they report on (although I hope well versed), but given the tools to report the news in a way that is more understandable to the public I think they will use them.

Both journalists and the public need a better way to understand how different breaches affect them.

As someone wrote earlier, they won't know the severity until it is analyzed. That could take a long time. Days or weeks. This is just the breaking news. Also what incentive does anyone have to waste their free time analyzing the data and issuing a report to you after this headline that the general public will not give a shit about a few days later?

I'm not saying to delay the report. I'm saying to not headline the size of the leak unless it has some sort of significance. If the severity is later known report that as news.

If anything this would create two stories where there now is one, so journalists would not have less or later to report.

> They are not autistic IT professionals.

What does autism have to do with having the professional integrity to understand what it is you're writing about before publishing sensational claims?

Well, first, I'd expect Boeing already had some idea of the scope of what was compromised simply by investigating their own systems. After all, they knew enough to declare there was no impact on flight safety.

And second, even if a company has no idea of the scope, the hackers would somehow want to prove at least privately what the scope was, else their threat is not as manipulative as it could be. On the other hand, the hackers can't credibly bluff and inflate the scope too far beyond reality because the company can just say "prove it or I don't believe you and I won't pay." And the hackers want to get paid.

It's a business deal after all. A really crappy one involving criminals. But at the end of the day, the company must have already assessed the value of the leak in order to reach a decision.

>I'd expect Boeing already had some idea of the scope of what was compromised

I've seen companies say this sort of thing with high confidence. But that seems hard to me, assuming some level of administrative access was breached.

I believe that Boeing already did than analysis and determined it’s #6.

At this point, I think there's quite a lot of "breach fatigue" now where the general public doesn't care about these stories. It's just "oh, I guess I get another year of free identity theft services".

Because half the time companies can’t be trusted to even admit there’s a leak, let alone the severity of it.

Groups that leak are likely to want to inflate the severity of the leak to ensure they get paid.

The larger a leak, the higher the probability there’s sensitive information in there, and the better opportunities/more time attackers had to exfiltrate it.

Agreed, but journalists need a better way to communicate. Saying 45GB sounds like a lot of emails to a technical person and nothing to someone who bought a bargain-bin 64GB USB memory stick the other day and filled it with a single HD movie.

The info says nothing, it conveys nothing. Even skipping the size and saying it leaked "emails" says more in the headline than the size.

A single video recording of an all-hands meeting could fill that size but it could also be emails containing the keys for accessing a large part of DOD.

I was working (very recently, during the 5000+ companies that were hacked via some what I presume were zero day hacks) for an MSP. 600 GB of data were exfiltrated from a law firm with several terabytes of storage of customer data kept due to data retention laws.

They asked for almost a million USD. FBI got involved, everything was restored from backups (thankfully, a month loss of digitalized work, and absolutely nothing was given to the ransomware group.

To your point, there are severe regulatory issues that have to be addressed due to the exfiltration. I no longer work for them, so I don't know the extent of their cost in 1. notifying affected clients and 2. providing credit protection coverage due to leaking of personal data.

You’re describing a risk matrix. What level of risk does this data hold for the company.

I think that is a good way of measuring it.

"After Boeing declines to pay up, ransomware group releases DEFCON 3 leak"

Could be the alternative headline.

They leak this stuff on their Tor leak site. Downloading 45GB from LockBit's site takes something like a week. Then you have to review the contents to determine its value.

No news org is going to go through that effort.

For me the disk size is interesting because it tells me how long I'd have to wait if I wanted to download the leak myself, which I do from time to time. (not downloading this one though)

This happened now, you can't assess right now any of these statements.

Nice, it sounds to me similar to the earthquake Richter scale.

Reply on news.ycombinator.com