Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. to give ransomware hacks similar priority as terrorism, official says

reuters.com

Post reply on HN
Print view View original

421–430 of 591 posts

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#421

Post by throwaway3699 »

jeffbee wrote: post #186
spookthesunset wrote: post #141

Earlier quoted context omitted.

> These cyber attacks are all but literally one bored kid and a computer. Are you sure about that? A lot of this stuff is way more than just some bored kid. For the company I work for, there is almost certainly a group of well paid people who sit around every day trying to figure out new ways run scams using our site. When there is financial motivation, people go through great efforts to get that $$$. "Security" isn'…

Right, security is definitely not a box you can check but American business have decided that if they run Qualys to get that PCI-DSS everything is good. Nobody is out there seriously talking about the fact that the Linux kernel is written in fucking C. Well it's 2% faster than if we wrote it in an actual language with, I don't know, bounds checking , and we'd rather use the 2% for dividends, thanks very much. We need…

How many exploits are because of the Linux kernel, and not userspace software? No kernel will protect you running public ElasticSearch with "username" and "password01" as the credentials.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#422

Post by throwaway3699 »

ddingus wrote: post #210
papito wrote: post #71

Earlier quoted context omitted.

Sure, but they are up against state-sponsored, highly trained actors, and that's not a fair fight. This requires the resources of the US Government as their bodyguard.

Then it is also time to pay a lot more in taxes and keep less in the bank too Which is it?

Not really, the US military in particular has a lot of slack that could easily be funded into cyber stuff. I would bet there's plenty of (digital) offensive capability in the US so maybe it should be used?

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#423

Post by stdgy »

pdonis wrote: post #248
hindsightbias wrote: post #194

Earlier quoted context omitted.

What CEOs have ever been fired for security breaches? If the "free market" doesn't care, why would any "I told you so" from the gov't make any difference. He'll have already taken his golden parachute and some poor CSO will take the fall.

> What CEOs have ever been fired for security breaches? None. That's part of my point: the root problem is not actually security by itself, it's bad corporate governance. CEOs should be fired for such things, but they're not. > If the "free market" doesn't care Corporate governance is not a free market nowadays. It was more of one in the past (although an argument can be made that there were important non-free market…

To play devil's advocate, how much money did this breach actually cost the pipeline? A few million bucks?

That's probably a rounding error on their quarterly report. Heck, it might have cost them more money to hire more people to provide adequate security to prevent such attacks than to just suck it up and get attacked.

It may actually be economically favorable to stay insecure!

If that were the case, the market would actually encourage CEO's to spend less money on security, not more.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#424

Post by richardw »

panny wrote: post #259
mlac wrote: post #236

Earlier quoted context omitted.

The market doesn’t incentivize security until it is too late. A pipeline operator that passes security costs onto consumers will lose to one with lower security and lower costs. Serious, significant attacks might occur at year 5, when the company becomes a big enough target to make it worthwhile to attack. By this time, the company who did not invest as heavily in security has captured the market while the one that i…

>The market doesn’t incentivize security until it is too late. That's why you have government and law to require it. The free market solving everything is a myth, and the USA is lucky that all the pipeline hackers wanted was money. Imagine if that was a nation state trying to immobilize the military in preparation for an invasion. No ransoms, instead bombs start falling while you are paralyzed.

Or a foreign government paying more to not give back the data. Just for the economic impact. One that might be under sanctions from the target country, say.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#425

Post by beermonster »

SilverRed wrote: post #325
jtsiskin wrote: post #310

Earlier quoted context omitted.

Yes, but then you read things like https://googleprojectzero.blogspot.com/2021/01/introducing-i... , or look at the payments offered by https://zerodium.com/program.html… the days of clicking a link -> persistence payload with escalated privileges are still here

From what I see on that page. It costs $500,000 to exploit chrome and your attack only lasts for a few days and then google pushes out a fix to all chrome users. This is so much better than the IE era where a teenager with some free time and skill could make something up and there would still be exploitable machines years later for the same bug.

And yet have you seen how many zero day, patch now, actively explored in wild vulnerabilities there have been in Chrome just this year?

It doesn’t feel like even Google are winning

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#426

Post by passwordqwe »

WalterBright wrote: post #418
tracerbulletx wrote: post #199

Earlier quoted context omitted.

Agreed. I'm a bit tired of the victim blaming with security. It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Crime is a social problem, we can't rely on a dream world of mathematically perfect zero trust security.

It's impossible to build a safe airliner, but we can get pretty damn close. Airline engineers know one cannot create a component or system that cannot fail. So the question then becomes, assume a system fails. Now how does the airplane survive? With software systems, instead of demanding a perfect defense against the root password being compromised, think "if the root password is compromised, how do we prevent that f…

But there is a big difference between airline safety and software safety. An airliner survives against the environment, it's PvE, a software system has to survive against hackers, it's PvP. If you shoot a rocket at an airliner, the airliner will fail, in that case we blame the person who shot the rocket.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#427

Post by ddingus »

throwaway3699 wrote: post #422
ddingus wrote: post #210

Earlier quoted context omitted.

Then it is also time to pay a lot more in taxes and keep less in the bank too Which is it?

Not really, the US military in particular has a lot of slack that could easily be funded into cyber stuff. I would bet there's plenty of (digital) offensive capability in the US so maybe it should be used?

If it is about warfare, sure! Lots of money and resources are available.

This discussion is more policing, which is out of scope.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#428

Post by boc »

passwordqwe wrote: post #426
WalterBright wrote: post #418

Earlier quoted context omitted.

It's impossible to build a safe airliner, but we can get pretty damn close. Airline engineers know one cannot create a component or system that cannot fail. So the question then becomes, assume a system fails. Now how does the airplane survive? With software systems, instead of demanding a perfect defense against the root password being compromised, think "if the root password is compromised, how do we prevent that f…

But there is a big difference between airline safety and software safety. An airliner survives against the environment, it's PvE, a software system has to survive against hackers, it's PvP. If you shoot a rocket at an airliner, the airliner will fail, in that case we blame the person who shot the rocket.

This is a great way to frame the issue.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#429

Post by TwoBit »

ping_pong wrote: post #104

They fucked up by targeting infrastructure. If they stuck with small companies they could keep doing it till the cows came home. But now they have governments against them so now they will be hunted down.

And not by targeting hospitals?

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#430

Post by motoxpro »

mewpmewp2 wrote: post #374
hunter2_ wrote: post #334

Earlier quoted context omitted.

Oddly enough though, the analogy tends to diverge when scaled: the more material you put into your house, the less vulnerable it is; the more lines of code you put into your software, the more vulnerable it is. Taken to an extreme, anyone can take down a house made of straw with their fist, but nobody can exploit hello world. I despise seeing simple apps with ridiculous dependency trees (package.json with line counts…

Surely you mean lock files not package jsons?

Haha I would hope so. A 5-6 figure package.json would be insane!
Post reply on HN