U.S. to give ransomware hacks similar priority as terrorism, official says • Hacker News Board

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#441

Post by hulitu » Fri, Jun 04, 2021, 7:05 AM UTC

blast wrote: post #188

I'm surprised at how dismissive the comments are. We need many angles of defense against these criminals. Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise. That's silly. We need preventative care and treatment. I'm not surprised by this announcement because the way that the pipeline-company ransomware hackers beat a hasty retreat was notice…

> I'm surprised at how dismissive the comments are. We need many angles of defense against these criminals. Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise.

No it is like increasing price of cigarettes and giving those money to the health system.

>That's silly. We need preventative care and treatment and everything in between.

No, we need secure by default. These things are already criminalised, this does not seem to stop anybody.

Why is a child on a default Windows 10 account able to install a program by clicking a link ? Why is this program able to install itself as a service ? This is not security.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#442

Post by [deleted] » Fri, Jun 04, 2021, 7:06 AM UTC

ixacto wrote: post #244

“Colonial Pipeline decided to pay the hackers who invaded their systems nearly $5 million to regain access, the company said.” That is the problem right there. Someone just made 5MM tax free. Time to make paying ransomware illegal and that will stop the potential criminal market for ransomware attacks apart from political motivations.

[deleted]

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#443

Post by KirillPanov » Fri, Jun 04, 2021, 7:09 AM UTC

paxys wrote: post #93

stonepresto wrote: post #47

Earlier quoted context omitted.

The downward trend in bug bounty payouts and frustration from researchers might also sweeten that deal for more experienced persons.

Companies which fall victim to such attacks aren't normally the kind which have bug bounties or engage with security researchers.

They're running software sold by companies that do.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#444

Post by WalterBright » Fri, Jun 04, 2021, 7:11 AM UTC

BrandoElFollito wrote: post #434

WalterBright wrote: post #418

Earlier quoted context omitted.

It's impossible to build a safe airliner, but we can get pretty damn close. Airline engineers know one cannot create a component or system that cannot fail. So the question then becomes, assume a system fails. Now how does the airplane survive? With software systems, instead of demanding a perfect defense against the root password being compromised, think "if the root password is compromised, how do we prevent that f…

Yes, building a safe airplane is doable. But this is not a good comparison. Securing a company is like saying that you have to chnage all of the wiring in a country without impacting power supply. ALL of them - the house wirings, the cables transporting power, everyting. At once. Security in a company is not a single system, it is a messy interaction of unknown dependencies nobody understands. And this mess runs a bu…

> Yes, building a safe airplane is doable.

It didn't start out that way. It took a long time to figure out how.

> But this is not a good comparison.

I can't agree with that. I don't see any rationale for either airplanes or software systems being special.

> Security in a company is not a single system,

An airplane isn't, either. For example, part of airplane safety is the air traffic control system. Part is the weather forecasting system. And on and on.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#445

Post by KirillPanov » Fri, Jun 04, 2021, 7:12 AM UTC

kiadimoondi wrote: post #316

Would a nationalized bug bounty program help here? Along with some compliance enforcement that the bounty is actually addressed, fulfilled, and payed by the vulnerable entity or the government (funded through some form of corporate tax). I haven't really thought out the details, but likely some kind of practical and effective threshold exists where a business entity in the US enters into mandatory participation. Genu…

> Would a nationalized bug bounty program help here?

A nationalized ransomware team would.

I'm serious. Just like how NSA said "we can't beat em so we'll join em" and started buying zero-days with both fists. If, back in the 1990s, you tried telling people this would happen you would get shouted down by everyone in the room. But it did happen.

If you get owned by Team Fed you get a phone number. You call the phone number, get informed that you got hacked, and get the decryption key immediately. The ransom is added to your company's next annual tax filing. Ransom levels are slowly jacked up until morale^H^H^H security improves.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#446

Post by WalterBright » Fri, Jun 04, 2021, 7:13 AM UTC

passwordqwe wrote: post #426

WalterBright wrote: post #418

Earlier quoted context omitted.

It's impossible to build a safe airliner, but we can get pretty damn close. Airline engineers know one cannot create a component or system that cannot fail. So the question then becomes, assume a system fails. Now how does the airplane survive? With software systems, instead of demanding a perfect defense against the root password being compromised, think "if the root password is compromised, how do we prevent that f…

But there is a big difference between airline safety and software safety. An airliner survives against the environment, it's PvE, a software system has to survive against hackers, it's PvP. If you shoot a rocket at an airliner, the airliner will fail, in that case we blame the person who shot the rocket.

> But there is a big difference between airline safety and software safety

I've worked professionally in both industries; they are not fundamentally different. Software practices can learn a lot from aviation practice, but they seem determined to spend decades rediscovering the methods the bitter, expensive way.

For example, software is still stuck in the dark ages where the idea is better training / better programmers / more punishment will prevent these sorts of failures.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#447

Post by spuz » Fri, Jun 04, 2021, 7:17 AM UTC

Igelau wrote: post #313

> a cyber criminal group... penetrated a pipeline operator on the U.S. East Coast, locking its systems and demanding a ransom. The hack caused a shutdown lasting several days... I expect more precise language than this from Reuters. This makes it sound like the ransomware was responsible for shutting down the pipeline. The billing system was compromised. Colonial shut the pipeline down themselves so they wouldn't hav…

They shut down the pipeline so that the malware wouldn't affect more critical systems. It's a myth that they did it to prevent billing inaccuracies.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#448

Post by andrewnicolalde » Fri, Jun 04, 2021, 7:24 AM UTC

demadog wrote: post #303

blast wrote: post #188

I'm surprised at how dismissive the comments are. We need many angles of defense against these criminals. Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise. That's silly. We need preventative care and treatment. I'm not surprised by this announcement because the way that the pipeline-company ransomware hackers beat a hasty retreat was notice…

Imagine if all companies had to individually fight pirates in the heyday of pirate hood!

If I’m not mistaken, some like the British East India Company actually did!

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#449

Post by indigochill » Fri, Jun 04, 2021, 7:31 AM UTC

hunter2_ wrote: post #334

tracerbulletx wrote: post #199

Earlier quoted context omitted.

Agreed. I'm a bit tired of the victim blaming with security. It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Crime is a social problem, we can't rely on a dream world of mathematically perfect zero trust security.

Oddly enough though, the analogy tends to diverge when scaled: the more material you put into your house, the less vulnerable it is; the more lines of code you put into your software, the more vulnerable it is. Taken to an extreme, anyone can take down a house made of straw with their fist, but nobody can exploit hello world. I despise seeing simple apps with ridiculous dependency trees (package.json with line counts…

> but nobody can exploit hello world

If I may quibble over a technicality, hello world is just one layer of an already complex technology stack. Suppose someone was able to slip code somewhere deeper in the stack such as your printf implementation (which generally a programmer will, and should, trust just works like it's supposed to) that opened a C2 channel. Then when you run your innocent hello world program, you're pwned through no fault of the program at the top of the stack.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#450

Post by BrandoElFollito » Fri, Jun 04, 2021, 7:38 AM UTC

WalterBright wrote: post #444

BrandoElFollito wrote: post #434

Earlier quoted context omitted.

Yes, building a safe airplane is doable. But this is not a good comparison. Securing a company is like saying that you have to chnage all of the wiring in a country without impacting power supply. ALL of them - the house wirings, the cables transporting power, everyting. At once. Security in a company is not a single system, it is a messy interaction of unknown dependencies nobody understands. And this mess runs a bu…

> Yes, building a safe airplane is doable. It didn't start out that way. It took a long time to figure out how. > But this is not a good comparison. I can't agree with that. I don't see any rationale for either airplanes or software systems being special. > Security in a company is not a single system, An airplane isn't, either. For example, part of airplane safety is the air traffic control system. Part is the weath…

Imagine you had airplanes be built the way they wanted, crashing from time to time, not starting and having people work on the wings to fix things in flight.

If this was something done for fun and without impact on people then nobody would care.

Suddenly, a Monday morning, someone says "woah, this cannot be - you have to fix this". But this is not fixable, you have to build a new plane from scratch, or completely review the existing ones. Planes would be grounded.

Now a software company: typically your old plane flying by more or less miracle (when it flies). You cannot fix it, you have to rebuild it. Either you ground the company and force them to build something new, or you will always have legacy.

The legacy is not fixable - it simply is not. You need money to redo everything and if you do not have the proper pressure then it will not happen.

Then, building a new company/software can be done the right way. This is not even difficult, I would even say that having these constraints will help in the overall quality. But this is a new software, not a "fix" of the old one.