U.S. to give ransomware hacks similar priority as terrorism, official says • Hacker News Board

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#571

Post by salawat » Sat, Jun 05, 2021, 3:07 AM UTC

mcguire wrote: post #548

krisoft wrote: post #452

Earlier quoted context omitted.

> For example, software is still stuck in the dark ages where the idea is better training / better programmers / more punishment will prevent these sorts of failures. What is your source on this? This goes against what anyone at any company where I have worked at ever believed. No-fault root cause analysis, process improvements, inherently safer practices, languages, libraries is what every place aimed for. I don’t e…

In about 2008 I started working for SAIC, on a contract to NASA's "Enterprise Applications Competency Center". While I was waiting for my computer and all the accounts and permissions to get set up, I was sent to do a code review for a minor application written in Flash/Flex/ActionScript + Java as was popular at the time, written by one guy. Everything looked pretty decent to me, except that he'd done all of the auth…

First thing I have a group of developers do in a new context is learn the existing business process without automating or writing a line of code. They can dissect, name, and research any code they want generated by who they are to build for, but no writing until they get the business context.

You'll never build a better tool than the one that eases your own pain. Make the user's pain your own, and beautiful things happen.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#572

Post by salawat » Sat, Jun 05, 2021, 3:27 AM UTC

MR4D wrote: post #519

WalterBright wrote: post #418

Earlier quoted context omitted.

It's impossible to build a safe airliner, but we can get pretty damn close. Airline engineers know one cannot create a component or system that cannot fail. So the question then becomes, assume a system fails. Now how does the airplane survive? With software systems, instead of demanding a perfect defense against the root password being compromised, think "if the root password is compromised, how do we prevent that f…

> And the largest piece of hubris and madness in critical systems is allowing over-the-internet updates. What would you suggest in its place? You'd need to replace the internet with something - postal mail, Fedex, courier deliveries, etc, or just have things that never get upgraded. Every one of those options has significant limitations, and in many countries, I'd trust SSL over postal mail every single day. I think…

Note, the American postal service got it's reputation for reliability among the citizenry (which has been soiled by hostile management and politics in recent years) in part because the U.S. government was willing to back it with men with guns. The Marines were tasked seeing that mail was delivered, or dying in the process. This was incredibly effective at the time to the point that even today, no one even considers attacking the post a realistic option despite the withdrawal of armed forces from active involvement.

The Internet has a two-fold issue.

A) It's fundamental ideation was an interconnected network of trusted nodes, with a self-healing capability to facilitate C&C continuity in case of nuclear attack. All protocols have underneath them that starting assumption.

There is an entirely unexplored depth of "authorization/security first" computer networking practice out there waiting to be enumerated, instead of trying to bolt-on security mechanisms to what is already built without an ideation of distrust built in from the get-go.

It's just so wildly impractical to implement, and undesirable to at least the Western philosophical foundation to free by default expression that it's not a natural thing to wrap one's head around.

B ) What are you gonna do to me? I'm behind 7000 proxies in different jurisdictions that work fundamentally different from yours and are unlikely to cooperate with your projection of power!

In short, it's a people problem, not a technical one. To the degree it is a technical one, the middle-boxes hold everything back .

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#573

Post by patrick451 » Sat, Jun 05, 2021, 5:02 AM UTC

This headline absolutely terrifies me.

The federal government has been pushing to ban different encryption standards for years, or at least require a governmental backdoor. If we get a 9/11 size cyber attack, they will ruthlessly weaponize it, and whatever semblance of internet privacy we had will be gone.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#574

Post by salawat » Sat, Jun 05, 2021, 6:07 AM UTC

mcguire wrote: post #567

restalis wrote: post #552

Earlier quoted context omitted.

I'd say that the surface of attack here is the industrial equipment's link to general computing equipment (which it's expected to be less secure). The solution just can't be to secure the whole world of software that may somehow end up on general use computers. The point is, my remark is still valid, as a discussion on critical systems got mixed with clearly non-critical ones.

Ok, so I shouldn't have confused the issue by mentioning Stuxnet. The point is, failing to secure those general use computers has bad consequences.

I don't think you confused the issue there at all, but forced a clarification of boundaries. The safety critical PLC industrial controller network should be isolated from the Net, however, even with the pipeline hack, the shutdown of the PLC network was due to compromise of billing systems, which are non-safety critical to the immediate user population (administration) but mission critical to the architecture of the western, market-mediated economic activity. You can't secure those systems perfectly, though we can definitely do better. The correct response, however, in this case is effective deterrence of those looking to engage in cyber offensives. Like it or not, when you can sit back outside the reach of effective enforcement measures, and cause mayhem and havoc, and make a buck doing it financial incentivization mechanisms pretty much ensure it will happen.

I just hope we don't take it too far. Many young and talented people in the CS and IT space cut their teeth testing the limits of legitimate access without pushing into the full on destructive regime these attackers have.

I'd hate to see things cracked down on so hard we lose a good signal for talent because we decide that the integrity of cyber systems must be defended at all costs. However, there needs to be a much more pronounced reaction to the types ofor blatantly malicious activity that has been escalating for the past decade or so.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#575

Post by salawat » Sat, Jun 05, 2021, 6:19 AM UTC

panny wrote: post #259

mlac wrote: post #236

Earlier quoted context omitted.

The market doesn’t incentivize security until it is too late. A pipeline operator that passes security costs onto consumers will lose to one with lower security and lower costs. Serious, significant attacks might occur at year 5, when the company becomes a big enough target to make it worthwhile to attack. By this time, the company who did not invest as heavily in security has captured the market while the one that i…

>The market doesn’t incentivize security until it is too late. That's why you have government and law to require it. The free market solving everything is a myth, and the USA is lucky that all the pipeline hackers wanted was money. Imagine if that was a nation state trying to immobilize the military in preparation for an invasion. No ransoms, instead bombs start falling while you are paralyzed.

I'd actually be less worried about that to be honest. That type of mobilization puts out signals we're already well equipped to catch.

The entire reason the pipeline hack is such a noteworthy event is that (and I truly believe this), someone was dumb enough to take a job bigger than their head. I don't think a nation state would have burned that opportunity by signaling their technical capability that way.

Funnily enough, the pipeline hack and ransom wouldn't even be feasible without the advent of cryptocurrencies making the AML bypass feasible. As much as I despise those regulations in particular, I cannot argue with their efficacy.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#576

Post by salawat » Sat, Jun 05, 2021, 6:33 AM UTC

542354234235 wrote: post #492

jliptzin wrote: post #235

Earlier quoted context omitted.

I don’t think that’s a fair comparison. I think a fair comparison would be 80,000 companies buy the same vault door from supplier X. But suddenly one criminal group has found a universal key to the vault that no one else knows about, and can now access all 80,000 vaults nearly simultaneously and clandestinely even though they still look closed and secure from outside observers.

80,000 planes use the same bolts to secure the engine pylons to the wing. It is found that the bolt can sheer in cold weather due to a casting defect. This does not cause a catastrophic failure because the aircraft are designed in such a way that an individual compromise will not bring down the entire system. Bank vault doors don’t open to the street for a reason. If your entire system is relying on the security of t…

Even plaintext can be secure with the right other measures. Air gapped in a physically secured, access controlled location, with all egress/exit points covered by sufficiently rigorous security measures? You're fine.

Encryption introduces it's own SPOF's. If you'very never had a power failure in the middle of a key rotation, you've never been bitten back by your attempt at securing everything with cryptography. Or worse, corrupted by sketchy hardware.

Defense in depth, and proper threat modeling is key. There is also the very real question of "Do you really need that Internet connected anyway?"

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#577

Post by effnorwood » Sat, Jun 05, 2021, 7:30 AM UTC

ZFS. This is not hard.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#578

Post by Woodi » Sat, Jun 05, 2021, 9:59 AM UTC

They already failed - let's make taskforce for central monitoring of revents...

Do they hear about evaluation of the problem ? a) un-Internet that damn infra; b) replace M$ system with Linux or other for of nix excluding Apple products (too user brain replacing and limiting for building on them).

Now you say nixes have bugs too and hackers already have malware versions running on them ? But there is at least one difference: admins have control of that systems parts and can do what they please - including components upgrades. Not so much with 40's years M$ big-ball-of-mud.

And why I'm so so anti M$ ? Remember Ukraine electric-factory problems ? M$. Hydro-dam in US ? M$. Lastly something in Brasil ? Guess what.

Do the evaluation of base problem.

And build more fibers for infrastructure handling !

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#579

Post by Siira » Sat, Jun 05, 2021, 3:37 PM UTC

meetups323 wrote: post #77

axlee wrote: post #45

Earlier quoted context omitted.

I'd rather not see taxpayers have to foot the bill for the profit of megacorps neglecting proper cybersecurity while sitting on mountains of tax-evaded offshore cash, thank you. The industry should be magnitudes larger than it is currently, and we shouldn't encourage corporate recklessness by socializing the costs.

If other States sent proper Armies over to attack critical infrastructure the US government would surely foot the bill to aid in security. Why should cyberarmies be treated more leaniently?

Physical security is a public good, while computer security is a private good. (Websearch the definitions if you don’t know them already.) The economics just don’t match up.

Re: U.S. to give ransomware hacks similar priority as terrorism, official says

#580

Post by Siira » Sat, Jun 05, 2021, 3:39 PM UTC

koheripbal wrote: post #482

Animats wrote: post #315

This is just DOJ, so far. If ransomware gets defined as terrorism for the US anti-terrorism community, it could become very dangerous to be in the ransomware business. The US has a huge anti-terrorism operation in being, and it's not that busy. Islamic terrorism against the US has been confined to minor local nuts since the US wiped out Bin Laden. And, before that, being "#2 in Al Queda" meant having a rather short l…

I don't really see how this designation helps stop hackers based in Russia, China, Iran, North Korea, etc...

The same way it did with Afghanistan, presumably?