Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker Publishes 2TB of Data from Cayman National Bank

twitter.com

Post reply on HN
Print view View original

81–90 of 491 posts

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#81

Post by CaymanCruiser »

magashna wrote: post #49
jdkee wrote: post #45

Earlier quoted context omitted.

"the company I founded and currently manage is offshored for tax and legal purposes" Simply curious, how do you feel about the ethics of this? Is it to reduce the tax burden in your company's home country?

> quite frankly draconian rules that usually places them on US/EU/OECD blacklists Assuming ethics is not a concern

I think the true moral crime here is preventing sovereign nations (using bullying tactics no less) who lack natural resources and other income-generating resources from offering convenient and flexible regulatory climates to business who need it. Singapore and Hong Kong were two countries that did this for decades and look where they are now - why shouldn't Vanuatu or Seychelles be offered the same opportunity?

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#82

Post by maximente »

zozbot234 wrote: post #43
tw04 wrote: post #38

Earlier quoted context omitted.

That's a pretty noble, if naive reason. "Rule of law" stops where economic interests begin and always has. Rule of law didn't stop the invasion of Iraq. Rule of law hasn't stopped the countless CIA backed coups in South America. Rule of law didn't stop funding/promoting the Arab spring. Larger countries constantly bully smaller ones and will continue to do so anytime it's economically convenient. The reason Grand Cay…

> Rule of law didn't stop the invasion of Iraq. Rule of law hasn't stopped the countless CIA backed coups in South America. Rule of law didn't stop funding/promoting the Arab spring. These places were all considered "rogue states" at some point, i.e. places that openly neglected the very same rule of law which protects others. Being a 'rogue' state may leave you open to being bullied, but that's hardly inconsistent w…

what criteria were/are used to make that consideration? because it sure as hell seems the US and Israel qualify, at least recently, for largely subjective definitions that i can come up with. alternatively if there are objective definitions, let's see them and decide for ourselves.

it seems, then, the only thing stopping these rogue states are powers or coalitions of powers with the potential to dominate them (or i guess survive) via conflict, either via subterfuge or military means, and the will to do so. put more simply, reigning in Iraq or Nicaragua is a hell of a lot easier than Israel. why is that, if not for power differentials?

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#83

Post by zionic »

glofish wrote: post #18
hurrdurr2 wrote: post #7

Earlier quoted context omitted.

Regrettably the media needs to publish what gets the most clicks; unfortunately what gets the most clicks these days is partisan stories that gets readers riled up. That Panama leak story was also quickly "forgotten" by the MSM.

Are you blaming the media for getting people what they want? As long as people demand the click-bait only the ones that provide such content will survive. Let's thank our luck that it is not Infowars style clickbait, so some resemblance of sanity still remains. FWIW the Panama papers have had a noticeable impact, especially where it matters most, clawing money back https://en.wikipedia.org/wiki/Panama_Papers

>Are you blaming the media for getting people what they want?

Media is not inherently profitable, it's a loss leader whose ultimate product is influence and the manufacture of consent.

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#84

Post by Avamander »

tetha wrote: post #79
goatsi wrote: post #69

Earlier quoted context omitted.

I thought it was pretty clear. They had already developed a Sonic Wall VPN exploit. They used zmap to scan for vulnerable devices then grepped the hostnames for "bank". When they exploited the VPN it gave them the whole network. >In this case, on the other hand, it was the same Windows domain passwords that were used to authenticate against the VPN, so I could get a good user password, including that of the domain ad…

To me, the scary part about this is: After Equifax, this is another big hack... and practically, it's one layer of defense and that's it. Shellshock, one password, everything's fucked. And yes, expletives are appropriate there. The rest is largely access maintenance, keyloggers and execution. That's scary. Maybe I'll need to badger my boss about a serious pentest of everything.

Pentesters don't drop 0-days though, but yes, it shouldn't be one layer of security to bypass.

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#85

Post by mcphage »

gxqoz wrote: post #50
jokoon wrote: post #21

After watching The laundromat, I think it's big news. Although I will always be curious why countries are letting those small, insignificant islands and countries manage all this wealth, and why they're trusted to do it. This can't be secure or safe. I'm curious about the diplomacy and the political implications of this. What if their office get robbed? What if the island gets attacked? What if one of those shady ban…

A recent piece in The Guardian argues that South Dakota and other US states are actually becoming the go-to place to store anonymously your illicit cash and make sure that your heirs can inherit it without taxes forever: https://www.theguardian.com/world/2019/nov/14/the-great-amer... Partly because the US has compelled other countries to provide more transparency without joining that transparency organization itself.…

> This loophole was unintentional

That seems a pretty hard pill to swallow.

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#86

Post by _8j50 »

tetha wrote: post #79
goatsi wrote: post #69

Earlier quoted context omitted.

I thought it was pretty clear. They had already developed a Sonic Wall VPN exploit. They used zmap to scan for vulnerable devices then grepped the hostnames for "bank". When they exploited the VPN it gave them the whole network. >In this case, on the other hand, it was the same Windows domain passwords that were used to authenticate against the VPN, so I could get a good user password, including that of the domain ad…

To me, the scary part about this is: After Equifax, this is another big hack... and practically, it's one layer of defense and that's it. Shellshock, one password, everything's fucked. And yes, expletives are appropriate there. The rest is largely access maintenance, keyloggers and execution. That's scary. Maybe I'll need to badger my boss about a serious pentest of everything.

Dude, forget a pentest, have a security architect look things over. Simple segmentation and endpoint firewall witha good edr might have stopped this. Everyone misses the basics, a lot of networks were pieced together 10+ years ago when people were not as security conscious as they are now.

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#87

Post by goatsi »

tetha wrote: post #79
goatsi wrote: post #69

Earlier quoted context omitted.

I thought it was pretty clear. They had already developed a Sonic Wall VPN exploit. They used zmap to scan for vulnerable devices then grepped the hostnames for "bank". When they exploited the VPN it gave them the whole network. >In this case, on the other hand, it was the same Windows domain passwords that were used to authenticate against the VPN, so I could get a good user password, including that of the domain ad…

To me, the scary part about this is: After Equifax, this is another big hack... and practically, it's one layer of defense and that's it. Shellshock, one password, everything's fucked. And yes, expletives are appropriate there. The rest is largely access maintenance, keyloggers and execution. That's scary. Maybe I'll need to badger my boss about a serious pentest of everything.

As I understand it this hack took place in 2016, they are just claiming it now. That's why they mention powershell being more useful.

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#88

Post by 52-6F-62 »

CaymanCruiser wrote: post #76
52-6F-62 wrote: post #48

Earlier quoted context omitted.

> tax and legal purposes This may be terribly naive, but doesn't that make the business de-facto illegal? What kind of legitimate business deserves to buck paying into the systems that support them? As a default I want to disagree, but I would like to know what business needs to operate outside of these constraints. Surely the businesses utilizing the favours of banks like Cayman are not being operated within tyranni…

>This may be terribly naive, but doesn't that make the business de-facto illegal? What kind of legitimate business deserves to buck paying into the systems that support them? As a default I want to disagree, but I would like to know what business needs to operate outside of these constraints. These constraints that you speak of are entirely arbitrary (geographical delineation) and were designed for a time before the…

I'm sorry but that just sounds absurdly reductive to me. It makes a gross assumption that people are incapable of keeping their government in check.

Perhaps, in spite of my own cynicism, I believe people are capable of deciding how they want their societies to run (also in spite of our hiccups here in the Western world).

So again: why do such businesses deserve to operate with such impunity? A natural function of business is risk. Subverting reasonable social good is an active harm that is reasonable given the circumstances (like an ambulance or fire truck asserting the right of way on a city street), but I fail to see why that should apply to any and all business.

I'll be happy to be convinced otherwise—but I doubt I will be.

I know you're speaking out under the condition of anonymity, so I won't ask which business you're operating or employed by but I am immensely curious about which industry you're representing. It would help much in understanding your perspective.

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#89

Post by jxramos »

seibelj wrote: post #58
52-6F-62 wrote: post #48

Earlier quoted context omitted.

> tax and legal purposes This may be terribly naive, but doesn't that make the business de-facto illegal? What kind of legitimate business deserves to buck paying into the systems that support them? As a default I want to disagree, but I would like to know what business needs to operate outside of these constraints. Surely the businesses utilizing the favours of banks like Cayman are not being operated within tyranni…

I still can’t believe it’s legal to move from SF to Texas if you were born and raised in SF. You owe the good people of San Francisco repayment for raising and nurturing you. Leaving after all that education and local services is a corrupt tax-dodge into a state without income tax.

https://en.m.wikipedia.org/wiki/Freedom_of_movement_under_Un...

Re: Hacker Publishes 2TB of Data from Cayman National Bank

#90

Post by georgeglue1 »

_8j50 wrote: post #70

From what I read the hack was not sophisticated at all. If they had decent endpoint protection this would not have happened. Maybe they disabled defender after the initial access and privesc because defender blocks Get-Keystrokes and other things in empire,even with significant modification. Anyway, I don't care about the hacktivism and propaganda (don't really get it -- tbh,rich people bad/corrupt?) But would very m…

>> (don't really get it -- tbh,rich people bad/corrupt?)

it's not so much that wealth is bad, but tax evasion and money laundering (from organized crime, corruption, etc.) is bad.

Post reply on HN