US companies hit by 'colossal' cyber-attack • Hacker News Board

Re: US companies hit by 'colossal' cyber-attack

#11

Post by xwdv » Sat, Jul 03, 2021, 2:10 AM UTC

jiggawatts wrote: post #4

I never quite understood why these ransom-ware attackers restrict themselves to a small subset of the MSP's clients. E.g.: The SolarWinds attack affected only something like 1% of their customers, when it could easily have been 50% or more! If you're evil and out for money, wouldn't you want to cast the widest net possible? Similarly, by encrypting a huge number of corporations concurrently, you'd "exhaust" the abili…

Steady income is definitely the way to play. You don’t want to make a demand so large that there’s cheaper alternatives of dealing with you.

Also you want the company to stay in business so it can continue generating revenue to extract future ransoms, and not have it lose a bunch of its customers from your repeated attacks.

Re: US companies hit by 'colossal' cyber-attack

#12

Post by gonesilent » Sat, Jul 03, 2021, 2:11 AM UTC

jiggawatts wrote: post #4

I never quite understood why these ransom-ware attackers restrict themselves to a small subset of the MSP's clients. E.g.: The SolarWinds attack affected only something like 1% of their customers, when it could easily have been 50% or more! If you're evil and out for money, wouldn't you want to cast the widest net possible? Similarly, by encrypting a huge number of corporations concurrently, you'd "exhaust" the abili…

Didn't it only affect those who were unpatched hence the low percent? Current hack is 0-day.

Re: US companies hit by 'colossal' cyber-attack

#13

Post by vsareto » Sat, Jul 03, 2021, 2:14 AM UTC

jiggawatts wrote: post #4

I never quite understood why these ransom-ware attackers restrict themselves to a small subset of the MSP's clients. E.g.: The SolarWinds attack affected only something like 1% of their customers, when it could easily have been 50% or more! If you're evil and out for money, wouldn't you want to cast the widest net possible? Similarly, by encrypting a huge number of corporations concurrently, you'd "exhaust" the abili…

Tinfoil hat, but that Solarwinds access was way more valuable than a ransomware payoff. Made sense to keep quiet with it.

Re: US companies hit by 'colossal' cyber-attack

#14

Post by hn_throwaway_99 » Sat, Jul 03, 2021, 2:14 AM UTC

Honestly, I think this should be the death knell of these "remote monitoring and management" tools that have extreme low-level access to networks and systems, but just like the SolarWinds attack, it feels like these are run by companies with extremely poor security culture.

I mean, I'd be willing to trust security to Microsoft or Apple (I mean, at some level, you've got to trust the OS). But giving the keys to the castle to some mid-tier company is just a recipe for disaster, and the bad guys know how extremely lucrative these targets are.

Re: US companies hit by 'colossal' cyber-attack

#15

Post by hamandcheese » Sat, Jul 03, 2021, 2:18 AM UTC

I almost a fan of these attacks. At least someone is getting the bug bounty they deserve.

Re: US companies hit by 'colossal' cyber-attack

#16

Post by user3939382 » Sat, Jul 03, 2021, 2:19 AM UTC

These digital networks and devices have become so complex we can’t reason about them, or in any case can’t easily reason about them given the resources available to most of the organizations running them.

However, from what I’ve seen, most of these attacks are successful because these organizations are simply neglecting best practices (e.g. patch management, whitelisting, security awareness training).

Re: US companies hit by 'colossal' cyber-attack

#17

Post by yashap » Sat, Jul 03, 2021, 2:22 AM UTC

hn_throwaway_99 wrote: post #14

Honestly, I think this should be the death knell of these "remote monitoring and management" tools that have extreme low-level access to networks and systems, but just like the SolarWinds attack, it feels like these are run by companies with extremely poor security culture. I mean, I'd be willing to trust security to Microsoft or Apple (I mean, at some level, you've got to trust the OS). But giving the keys to the ca…

Agreed. Companies that are great at selling to governments and massive enterprises tend to be great at security theatre and security certifications, but that’s not the same as being great at security. Their tech tends to be bloated spaghetti full of tech debt, with a huge surface area for attacks, and systems like that are nearly impossible to secure in a truly robust way.

Embedding this kind of software deep in your internal networks/systems, with access to basically everything, is a recipe for disaster. I expect these sorts of supply chain attacks to get more and more common, they’re excellent back doors into basically every government agency and megacorp.

Re: US companies hit by 'colossal' cyber-attack

#18

Post by cyanydeez » Sat, Jul 03, 2021, 2:24 AM UTC

user3939382 wrote: post #16

These digital networks and devices have become so complex we can’t reason about them, or in any case can’t easily reason about them given the resources available to most of the organizations running them. However, from what I’ve seen, most of these attacks are successful because these organizations are simply neglecting best practices (e.g. patch management, whitelisting, security awareness training).

like everything else in america, #1 priority is fèeding ceo salary and shareholder value.

everything in corporate america is derived from the growing wealth inequality and these shake downs are precisely targetting the glut. soon enough, itll still be cheaper to have a bribe fund, just like tax evasion lawyers, lobbiests and the rest of the feeder classes than a holisitic defense.

Re: US companies hit by 'colossal' cyber-attack

#19

Post by colonelanguz » Sat, Jul 03, 2021, 2:30 AM UTC

yashap wrote: post #17

hn_throwaway_99 wrote: post #14

Honestly, I think this should be the death knell of these "remote monitoring and management" tools that have extreme low-level access to networks and systems, but just like the SolarWinds attack, it feels like these are run by companies with extremely poor security culture. I mean, I'd be willing to trust security to Microsoft or Apple (I mean, at some level, you've got to trust the OS). But giving the keys to the ca…

Agreed. Companies that are great at selling to governments and massive enterprises tend to be great at security theatre and security certifications, but that’s not the same as being great at security. Their tech tends to be bloated spaghetti full of tech debt, with a huge surface area for attacks, and systems like that are nearly impossible to secure in a truly robust way. Embedding this kind of software deep in your…

Would you mind briefly explaining the concept of "tech debt" to a layperson?

Re: US companies hit by 'colossal' cyber-attack

#20

Post by AnimalMuppet » Sat, Jul 03, 2021, 2:30 AM UTC

readams wrote: post #5

jiggawatts wrote: post #4

I never quite understood why these ransom-ware attackers restrict themselves to a small subset of the MSP's clients. E.g.: The SolarWinds attack affected only something like 1% of their customers, when it could easily have been 50% or more! If you're evil and out for money, wouldn't you want to cast the widest net possible? Similarly, by encrypting a huge number of corporations concurrently, you'd "exhaust" the abili…

You'd need to be able to process all the orders also. Every company needs support to pay the random and unlock. Also, at some point the military gets involved.

Yeah. If you take down 100 companies, it's crime. If you take down 100,000, it's an attack.