U.S. to give ransomware hacks similar priority as terrorism, official says • Hacker News Board

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#541

Post by chitowneats » Fri, Jun 04, 2021, 7:22 PM UTC

jessaustin wrote: post #538

chitowneats wrote: post #493

Earlier quoted context omitted.

If you honestly believe shutting down the likes of Coinbase and Kraken requires "outlawing math", you're gonna be real disappointed.

Thanks for finally admitting your intentions. I don't see a similar suggestion anywhere ITT or TFA, but it all did seem a bit too coy. Physically, it would be possible to shut down e.g. Coinbase. Legally, that seems a stretch. Politically, with the particular investors they now have, you're trying to shut the barn door after the horse has joined the circus. Shutting down Coinbase, however, will have no effect on bitc…

> Shutting down Coinbase, however, will have no effect on bitcoin or the people who use it.

You all are more than free to continue to associate with each other. As long as you're not breaking any preexisting federal laws (let's be honest: most of you are). It's the normie and Wall Street market we are targeting. Good luck maintaining the bull run, sweetheart.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#542

Post by ryanlol » Fri, Jun 04, 2021, 7:43 PM UTC

virtue3 wrote: post #539

ryanlol wrote: post #411

Earlier quoted context omitted.

Not if the hackers use monero.

at some point they have to turn monero into currency.

So what?

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#543

Post by ixacto » Fri, Jun 04, 2021, 7:50 PM UTC

im3w1l wrote: post #529

tempestn wrote: post #397

Earlier quoted context omitted.

Those bets could be easier to trace than the ransom payment though. Is there a way to make market bets completely untraceably?

Let's not do the criminals' jobs for them.

It is just pointing out the obvious that there exist ways to transfer money obtained via criminal actions that may not be in compliance with various nations tax laws. Talking about activities that are illegal in one's own jurisdiction without intent to break the law is not illegal...

Would posting a paper by the german federal police on a practical home heroin manufacture be doing the criminals job? https://www.unodc.org/pdf/research/Bulletin07/bulletin_on_na...

Irregardless the groups that pulled this off already know this and have machinery like that which was revealed in the panama papers and crypto mixers ready to launder the money.

What is now needed is to give real consequences to US-based companies and institutions that pay any sort of ransom to the state/non-state actors that are perpetrating these hacking events. This will remove the profit motive, and I don't care if it's Colonial Pipeline or UCSF, this behavior needs to stop and the criminals behind it need to know that there is not any money to be made.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#544

Post by mywittyname » Fri, Jun 04, 2021, 7:52 PM UTC

grayfaced wrote: post #274

rodneyg_ wrote: post #255

Earlier quoted context omitted.

If it was illegal to pay the hackers back, and the Colonial Pipeline ransomware attack still happened, what would the options be? We'd have to turn the systems back on some way right?

They'd restore from backups, which is already what they did even after paying the ransom. More importantly, would the hack have happened in first place if they knew there was no chance of being paid? Every ransom paid just funds and encourages the next hack. The social damage is deserving of a large fine (i.e. 10x the ransom).

If they restored from backup, how do they know the attack wouldn't hit again immediately? The ransom wasn't just to decrypt the data, but to halt the attack.

> More importantly, would the hack have happened in first place if they knew there was no chance of being paid?

Why wouldn't it? They could easily been paid by another group to perform the hack, used the hack to manipulate stock prices, sold the stolen financial data, or, most likely, the ransom would have been paid indirectly though some other means, like hiring a "cyber security consultant."

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#545

Post by mcguire » Fri, Jun 04, 2021, 8:07 PM UTC

tracerbulletx wrote: post #199

blast wrote: post #188

I'm surprised at how dismissive the comments are. We need many angles of defense against these criminals. Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise. That's silly. We need preventative care and treatment. I'm not surprised by this announcement because the way that the pipeline-company ransomware hackers beat a hasty retreat was notice…

Agreed. I'm a bit tired of the victim blaming with security. It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Crime is a social problem, we can't rely on a dream world of mathematically perfect zero trust security.

On the other hand, we have known since the 1970s roughly how to make computer systems significantly more secure and resilient. However, we, as a society, have decided that it's costly and difficult and that we would prefer not to do anything about it. It's "move fast and break things" at the social level.

I really, really hate reasoning by metaphor, but you do lock your doors, right?

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#546

Post by mcguire » Fri, Jun 04, 2021, 8:10 PM UTC

WalterBright wrote: post #446

passwordqwe wrote: post #426

Earlier quoted context omitted.

But there is a big difference between airline safety and software safety. An airliner survives against the environment, it's PvE, a software system has to survive against hackers, it's PvP. If you shoot a rocket at an airliner, the airliner will fail, in that case we blame the person who shot the rocket.

> But there is a big difference between airline safety and software safety I've worked professionally in both industries; they are not fundamentally different. Software practices can learn a lot from aviation practice, but they seem determined to spend decades rediscovering the methods the bitter, expensive way. For example, software is still stuck in the dark ages where the idea is better training / better programme…

That would seem to require the software industry to take responsibility.

The software industry is to responsibility roughly as surgeons are to checklists.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#547

Post by restalis » Fri, Jun 04, 2021, 8:23 PM UTC

throwaway210222 wrote: post #464

WalterBright wrote: post #444

Earlier quoted context omitted.

> Yes, building a safe airplane is doable. It didn't start out that way. It took a long time to figure out how. > But this is not a good comparison. I can't agree with that. I don't see any rationale for either airplanes or software systems being special. > Security in a company is not a single system, An airplane isn't, either. For example, part of airplane safety is the air traffic control system. Part is the weath…

> Yes, building a safe airplane is doable. It didn't start out that way. And now only FAA/EASA etc. certified companies and individuals can build a commercial aircraft. And they can only build the aircraft they are certified to, using the same certified components, and the same certified tools. They cannot change any aspect of the construction without another round with the authorities. Let me know when the CIOs of l…

"And they can only build the aircraft they are certified to, using the same certified components, and the same certified tools."

And that level of rigor is appropriate for the stakes that selling mass produced commercial aircraft implies. The discussion context was critical systems. But then you threw "word processors" in there. Why?

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#548

Post by mcguire » Fri, Jun 04, 2021, 8:42 PM UTC

krisoft wrote: post #452

WalterBright wrote: post #446

Earlier quoted context omitted.

> But there is a big difference between airline safety and software safety I've worked professionally in both industries; they are not fundamentally different. Software practices can learn a lot from aviation practice, but they seem determined to spend decades rediscovering the methods the bitter, expensive way. For example, software is still stuck in the dark ages where the idea is better training / better programme…

> For example, software is still stuck in the dark ages where the idea is better training / better programmers / more punishment will prevent these sorts of failures. What is your source on this? This goes against what anyone at any company where I have worked at ever believed. No-fault root cause analysis, process improvements, inherently safer practices, languages, libraries is what every place aimed for. I don’t e…

In about 2008 I started working for SAIC, on a contract to NASA's "Enterprise Applications Competency Center". While I was waiting for my computer and all the accounts and permissions to get set up, I was sent to do a code review for a minor application written in Flash/Flex/ActionScript + Java as was popular at the time, written by one guy. Everything looked pretty decent to me, except that he'd done all of the authentication/authorization in the Flash frontend. I pointed out that anyone who could connect to the app and fake the protocol could do anything the app could do, at a minimum. He said yeah, he'd have to do something about that. It went into production the next week. He's now part of the architecture/"engineering" group.

All of the things you mention are great, but they don't really address the problem. You need developers who know what the issues are and are willing to do the work to fix them even though they don't add anything to the feature list. In my experience, I don't have much reason to believe that today's developers are any better about that than yesterday's. There is a lot of security cargo-culting going on, which probably does improve the situation, but there's also a lot of "bootcamp" developers without the background to know that there are issues.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#549

Post by restalis » Fri, Jun 04, 2021, 8:49 PM UTC

hospadar wrote: post #513

throwaway210222 wrote: post #464

Earlier quoted context omitted.

> Yes, building a safe airplane is doable. It didn't start out that way. And now only FAA/EASA etc. certified companies and individuals can build a commercial aircraft. And they can only build the aircraft they are certified to, using the same certified components, and the same certified tools. They cannot change any aspect of the construction without another round with the authorities. Let me know when the CIOs of l…

> Let me know when the CIOs of listed companies are up for that kind of lifestyle for their email and word processors. I think you're absolutely right that this kind of rigidity is not part of our tech culture, but maybe it should be if that tech is running power grids, [oil] pipelines, and other critical infrastructure. In summary - maybe we should spend more money so that we get systems which are reliable and resis…

"this kind of rigidity is not part of our tech culture"

Yes and no. "No" because there are best practices and bits of midleware that although may still get improvement over time, receive nevertheless fewer and fewer changes (and have logarithmic looking dynamic of development). They mature. Advising strongly things that passed the test of time and broad use scrutiny just makes sense, regardless if that may look "rigid". (Not that many implement their own double linked lists nowadays.) Then "yes" because the our "tech culture" pool is big enough to also accommodate fashion, hype, and a whole lot of other psychosocial can of worms...

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#550

Post by mcguire » Fri, Jun 04, 2021, 8:49 PM UTC

restalis wrote: post #547

throwaway210222 wrote: post #464

Earlier quoted context omitted.

> Yes, building a safe airplane is doable. It didn't start out that way. And now only FAA/EASA etc. certified companies and individuals can build a commercial aircraft. And they can only build the aircraft they are certified to, using the same certified components, and the same certified tools. They cannot change any aspect of the construction without another round with the authorities. Let me know when the CIOs of l…

"And they can only build the aircraft they are certified to, using the same certified components, and the same certified tools." And that level of rigor is appropriate for the stakes that selling mass produced commercial aircraft implies. The discussion context was critical systems . But then you threw "word processors" in there. Why?

Because word processor documents have often been the vectors for attacks. And once an attack is inside your systems, there is nothing preventing the attack attached to a document from infecting and encrypting your machine or infecting your PLC and destroying your industrial equipment.