Hackers infect ISPs with malware that steals customers' credentials | Hacker News Reader

Hackers infect ISPs with malware that steals customers' credentials

arstechnica.com

75 pointstrelane25 comments

Been feeling like it’s the beginning of the end for a while now… I have good security hygiene, but I am sure enough of my sensitive info has been leaked by various “trusted authorities” (I mean, fucking Equifax) that someone could ruin my life if they wanted to. You just stay vigilant and hope that doesn’t happen I guess.

Just a roll of the dice at this point. The USG has basically mandated that all of your most private identity information be turned over to global bad actors via their AML/KYC regime.

They're fine with that price.

North Koreans are currently funding their nuclear program by…. passing interviews at US tech companies and … actually doing the work

KYC is a joke when everybody’s ID can be used to make a valid account and receive payments

reminds me of this bank heist skit, where they just get employed at a bank for 30 years

https://youtu.be/jgYYOUC10aM?si=RqdLuyuNOn3bEhfF

I hear about lives being ruined or even just "identity theft" happening less often than it seemed to, but perhaps it's just my filtering is better. Still, given that to a first approximation the full details necessary for a fraudulent line of credit to be opened in the name of every US adult have been out there multiple times for years, and yet this hasn't happened to everyone, indicates something in the system works against it. Maybe something as simple as physical mail delivery/verification cuts down a lot of avenues of abuse for the average person.

My speculation on this is that China/Russia/whoever targets ISP's in order to identify people by IP that have come to their attention somehow. Your credentials aren't the only point of interest, your credentials gives up subscriber information name/email/address/etc. That's pretty valuable from an intelligence standpoint.

[dupe]

More discussion: https://news.ycombinator.com/item?id=41367964

Rising discord and worshipping money

When are we going to start taking this seriously?

Could you be more specific? What are you suggesting to do?

Hire more competent technical people and rely less on opaque "dashboard" management software for button-clickers.

I work in the security field and hiring competent technical people is harder than it sounds for businesses with small profit margins.

It's hard because your security department probably sucks. And so does your company culture. Do not take it personally, it's certainly why my employers can't find people fit for the space.

A large part of the problem is political cronyism and the incredibly tedious culture that develops when you get a lot of people with very few skills together to talk about something they know nothing about.

I'd legitimately take less money if I could somehow be convinced an employer isn't a piece of shit. If I'm going to work for an asshole, I will be well paid. I think this is a reasonable stance most people in the space take. That, or retiring and having a communal garden.

From the parent

> for businesses with small profit margins.

…

> It's hard because your security department

Dude, we barely have money for an engineering team, let alone enough people to call it a department.

The security department is me when I’m not being inundated with five other things, all at the same time.

It’s not like anyone else has a department either, there’s like, 12 people working here in total man.

^ parent, probably.

I know it was true for me in “cash strapped” environment

I don't know but I think current course is unsustainable.

Not until post-scarcity (if it's even achievable).

Until then, Gresham's Law is at work, and cheaper products and services that are of barely acceptable quality along their happy paths are going to dominate markets.

When they steal money from someone wealthy enough to have connections.

Is it even possible to steal truly massive sums of money?

The largest assets are not liquid, and laundering requires an even larger sum of loosely monitored funds to mix with.

It became even harder once Ethereum became non-fungible thanks to Tornado Cash and OFAC.

>Ethereum became non-fungible

What do you mean by this? I haven't been following this space for a long time and searching only brings up NFT stuff.

I don't understand how Tornado Cash (DPRK tool to evade sanctions) + Office of Foreign Assets control made Etherum non-fungible either, sounds like rambling to me

Ethereum (+tokens) that go through Tornado Cash are "tainted" and sometimes censored [1]. This means not all Ethereum are equal.

Btw, calling Tornado Cash a "DPRK tool" is disingenuous. It's a privacy tool.

[1]: https://www.mevwatch.info/

Fungibility means that one thing can be differentiated from another. In a basic sense, drops of water are fungible. Dollars are non-fungible, because 1 dollar is not equal to another cash dollar. That other cash dollar could be from a set of marked bills stolen during a drug buy, or it could be a rare serial number making it more valuable. It's a binary state of "is this thing completely indistinguishable from another of thing of its kind"

fwiw, the person you're responding to doesn't seem to be using the word in this manner.

I am using it in that manner. Ethereum OFAC compliance is enforced at the protocol level [1] so not all Ethereum are equal. Just like your "drug buy" example, some Ethereum are tainted. In fact, thanks to the public blockchain, I would argue crypto is far more "non-fungible" than marked cash.

[1]: https://www.mevwatch.info/

> I would argue crypto is far more "non-fungible" than marked cash.

There are no shades of fungibility, it's a binary state.

In general, cash is fungible. You gave an example of a "shade of fungibility" with marked cash used in crimes. Unfortunately, reality is not binary. Ethereum is fungible to the (increasingly small) non-OFAC compliant nodes, but non-fungible to the OFAC compliant nodes.

Reply on news.ycombinator.com