Norsk Hydro ASA Suffers Extensive Cyber Attack • Hacker News Board

Re: Norsk Hydro ASA Suffers Extensive Cyber Attack

#41

Post by michaelbuckbee » Wed, Mar 20, 2019, 12:43 AM UTC

lozaning wrote: post #15

chrischen wrote: post #3

They should make it illegal to pay ransoms.

Right now the FBI's advice for companies that get critical systems crypto locked is to just pay the ransom. https://securityledger.com/2015/10/fbis-advice-on-cryptolock...

That was in 2015, at the time ransomware was somewhat "behaved" and there weren't the many different variants that did things like just scrambling your files and throwing up a Bitcoin address to "decrypt" them.

I think things have shifted now to the where it's not something that's recommended.

Re: Norsk Hydro ASA Suffers Extensive Cyber Attack

#42

Post by ineedasername » Wed, Mar 20, 2019, 2:13 AM UTC

Stocks and commodities markets are moved by this, and someone in the know could plan and pounce on the situation. I wonder if that's the real motive, not the potential ransom sought.

Re: Norsk Hydro ASA Suffers Extensive Cyber Attack

#43

Post by achillean » Wed, Mar 20, 2019, 2:55 AM UTC

DoofusOfDeath wrote: post #36

Are there any companies in the business of hardening SCADA systems? I keep on hearing about the huge vulnerability they pose, which would make me expect a Y2K-level of focus by the industry.

Yes, it's been a longstanding issue and the ICS security space has been heating up the past few years as a result of the increasing awareness of the problem. There are quite a few companies trying to bring OT network security into the modern age but it's a slow moving field. We've been looking at the number of Internet-exposed industrial control systems and they've been increasing around 10% year over year despite all the news coverage/ attacks.

[1] https://icsmap.shodan.io

[2] https://ics-radar.shodan.io

[3] https://exposure.shodan.io/#/US

Re: Norsk Hydro ASA Suffers Extensive Cyber Attack

#44

Post by olavgg » Wed, Mar 20, 2019, 2:28 PM UTC

bdamm wrote: post #37

magduf wrote: post #30

Earlier quoted context omitted.

Then people shouldn't be too surprised when stuff like this happens, and they should just pay the ransom: it's what they accepted by using Windows. "That's the way it's always been" isn't a valid excuse for continuing to make something unsafe.

The advice is outdated because it is entirely possible for Windows machines to be secured well enough for this work. Windows security, like Linux security, is not a binary state with either a zero for no security or a one for security. They did not accept crippling ransomware by using Windows. Nobody does. This attitude is fatalistic and somewhat juvenile. They may have implicitly accepted crippling ransomware by not…

You are right, but still using an operating system with such large attack surface like Windows is a worldwide industry problem. No one is saying Linux is much better either, but there are other solutions like IncludeOS(http://www.includeos.org/technology.html#security) which has a very low attack surface, if not 100% impossible. I'm not saying IncludeOS would work in this case, but secure systems has come a loooong way the recent years.

Re: Norsk Hydro ASA Suffers Extensive Cyber Attack

#45

Post by lsllc » Wed, Mar 20, 2019, 8:24 PM UTC

lozaning wrote: post #15

chrischen wrote: post #3

They should make it illegal to pay ransoms.

Right now the FBI's advice for companies that get critical systems crypto locked is to just pay the ransom. https://securityledger.com/2015/10/fbis-advice-on-cryptolock...

My local Police Department got their dept. computers crypto locked via some ransomware or other, the FBI told them to pay the 1 bitcoin or whatever they were asking, which they did and got it unlocked!