Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

nationalcrimeagency.gov.uk

Post reply on HN
Print view View original

41–50 of 67 posts

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#41

Post by socalgal2 »

miohtama wrote: post #27
gluten_guardian wrote: post #3

Crazy how young all these cyber criminals are. When I was their age, the peak of my criminal career was scoring booze by lying about my age. I wish they shared a little bit on what cyberattacks they were conducting.

How bad your system be if it can be hacked by a kid?

A kid can break all the windows in your house, smash in your door, set your house, car, bike, clothing on fire. I guess all those things are bad

I'm not saying the system wasn't poorly implemented but, society doesn't work when people abuse everything either. Maybe that just means we're doomed but most of society works because people don't go around smashing and/or taking everything they possibly can.

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#42

Post by chrisweekly »

miohtama wrote: post #26
golan wrote: post #14

Related Reddit thread : https://www.reddit.com/r/cybersecurity/s/LXb88TKC4M

In a proper capitalistic system, those who build low quality e-commerce services, including hackable ones, should go out of business and replace more competent companies. This includes buying services from bad suppliers. This Reddit post hints that many shortcuts were taken, security not taken seriously when they should have, and now they reap what they sow.

"go out of business and replace more competent companies"

... be replaced by more competent companies

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#43

Post by helloooooooo »

miohtama wrote: post #26
golan wrote: post #14

Related Reddit thread : https://www.reddit.com/r/cybersecurity/s/LXb88TKC4M

In a proper capitalistic system, those who build low quality e-commerce services, including hackable ones, should go out of business and replace more competent companies. This includes buying services from bad suppliers. This Reddit post hints that many shortcuts were taken, security not taken seriously when they should have, and now they reap what they sow.

They do. Security is about risk management. It’s all very actuarial. If the damages from an attack are severe enough (ie. a company makes it go bankrupt), that’s capitalism working.

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#44

Post by SheinhardtWigCo »

golan wrote: post #14

Related Reddit thread : https://www.reddit.com/r/cybersecurity/s/LXb88TKC4M

> In 3 of 4 calls, the service desk reset passwords and re-enrolled MFA with zero resistance. The caller simply gave a name – no validation, no callback, no check. On the 4th call, the attacker requested access to a privileged group. The TCS agent asked for an employee ID. The ID given didn’t even match our company’s format; and yet, the access was granted anyway.

Yikes

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#45

Post by dylan604 »

immibis wrote: post #37
golan wrote: post #15

Earlier quoted context omitted.

I guess I’d expect them to be in a country where it’d be difficult to be apprehended and extradited. Being in the UK seems like a stupid move to me, but what do I know!

Was it a professional operation? Says they were 17. Some people playing around with their Commodore 64 except it's connected to the internet and a pretty big company.

Let's not pretend these kids were trying to hack the Gibson just for the lulz. Calling into help desk, requesting password resets with social engineering, getting into network, installing ransomware is all well beyond playing around. I know there are smart teens, but I would not be surprised to find out there is someone more experienced in the background that got the kids going if not even on behalf of.

There are plenty of teens selling dope, stealing cars, breaking into homes, yet nobody thinks they're just knuckleheads playing around. Why do we think because "but on a computer" makes it different?

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#46

Post by mtkd »

djaychela wrote: post #18

A friend of mine is senior management at one of these companies. His life has been a real nightmare trying to get things back on track - there are so many interconnected systems that they needed to get back up 'clean' and running just to get their normal business running, let alone the online side. And he's not even directly responsible for any of this, but it's all so embedded in a modern retail business that if som…

>it's your problem to deal with to a degree

How is it not the responsibility of senior management at a major retailer to ensure an exploit at a vendor can't take the whole house of cards down?

Many other major enterprise clients out there are all over vendor security/compliance ... auditing and reauditing vendors to minimise chance of this happening or worst-case, if does happen, containing it and recoverying quickly

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#47

Post by Aurornis »

miohtama wrote: post #26
golan wrote: post #14

Related Reddit thread : https://www.reddit.com/r/cybersecurity/s/LXb88TKC4M

In a proper capitalistic system, those who build low quality e-commerce services, including hackable ones, should go out of business and replace more competent companies. This includes buying services from bad suppliers. This Reddit post hints that many shortcuts were taken, security not taken seriously when they should have, and now they reap what they sow.

> In a proper capitalistic system, those who build low quality e-commerce services, including hackable ones, should go out of business

If the impact is large enough, they do.

This not a case where binary thinking works for most situations, though. The costs associated with the attack will hurt them by damaging their balance sheets a little bit, taking capital away from more productive opportunities, and distracting their employees from more fruitful tasks.

There’s always a public thirst for immediate blood in these situations, but the damage is more subtle and manifests more as opportunity cost than a sudden collapse of the company. The demand for sudden stock market collapse of companies is ironic, given all of the criticisms thrown at companies for putting too much emphasis on short term stock results.

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#48

Post by Aurornis »

miohtama wrote: post #27
gluten_guardian wrote: post #3

Crazy how young all these cyber criminals are. When I was their age, the peak of my criminal career was scoring booze by lying about my age. I wish they shared a little bit on what cyberattacks they were conducting.

How bad your system be if it can be hacked by a kid?

3/4 of them were over 18. The other was 17.

It’s also unclear if this was everyone, or just who they caught. It’s not unknown for hacking groups to position the youngest (least experienced, most desperate for recognition) people in the most vulnerable positions.

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#49

Post by michaelt »

BoorishBears wrote: post #36
scott_w wrote: post #31

Earlier quoted context omitted.

> Young people have little fear of repercussion as they cant really fathom the consequences. > But it is very well understood and accepted that teenage - especially male prefrontal cortexes don't fully develop until mid 20s. Your statement here does not mean that the statement I quoted above is true. Just because biology predisposes one to doing stupid shit does not mean young people are incapable of understanding co…

I don't understand why clarifying young folks are capable of understanding consequences and repercussions, but will underperform at doing so for a myriad of reasons, including real physical differences in brain structure, should be this contentious.

There are some statements that, though reasonable in isolation, are almost always heard from people teeing up a really bad opinion.

For example, if someone says "I'm not racist, but" I'm already rolling my eyes before they've even said what they're about to say.

Similarly, when some people hear "prefrontal cortexes don't fully develop until" they start rolling their eyes pre-emptively at the infantilising, anti-personal-responsibility take that usually follows. Even if it didn't, in your case.

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#50

Post by pinoy420 »

miohtama wrote: post #27
gluten_guardian wrote: post #3

Crazy how young all these cyber criminals are. When I was their age, the peak of my criminal career was scoring booze by lying about my age. I wish they shared a little bit on what cyberattacks they were conducting.

How bad your system be if it can be hacked by a kid?

[dead]
Post reply on HN