Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Merck’s NotPetya attack: Was it an act of war?

inquirer.com

Post reply on HN
Print view View original

11–20 of 115 posts

Re: Merck’s NotPetya attack: Was it an act of war?

#11

Post by dvfjsdhgfv »

EddieCPU wrote: post #7

I don't believe it, NotPetya was generic ransomware that spread to a lot of organizations including the NHS in England. This fiction, yet another example of the neocons attempting to demonize the Russian Federation, no doubt to distract from problems at home.

You must be kidding, right? NotPetya was designed for Ukrainian targets and brought the country to their knees (again) - what some Western companies like Merck or Maersk experienced was just a tiny fraction of what the institutions in Kiev went through.

Whether insurers like AIG can run away from their contractual obligations playing the "cyber war" card is a different issue. Technically, it was a cyberattack similar to many others, no matter if the authors were Kremlin-employed or not.

Re: Merck’s NotPetya attack: Was it an act of war?

#12

Post by throwGuardian »

Act of war against .... Merck, a company? I've heard of some circuitous logic to deny insurance claims, but this was not an act of war against Merck, which BTW isn't a country, so by definition, one can't go to war with it? Well, maybe hyperbolically a competitor might, but unlike real war, they're bound by the rules and laws of civil society

This is the very definition of an accident, if the article is to be believed, with Merck not even being the target. Pay up insurers, this is why you exist.

Further, what is the point of insurance, especially for sensitive IP laden companies like pharma research, if there's no protection against nationa-state attacks, which isn't outside the realm of possibility for such companies.

Re: Merck’s NotPetya attack: Was it an act of war?

#13

Post by dvfjsdhgfv »

Iv wrote: post #10
hdhgzwhegh wrote: post #2

If the attacker doesn't declare war and the defender doesn't respond by going to war then the blunt answer seems like it'd have to be a no.

The claim in the article is that the target was Ukraine, the attacker Russia, and Merck a collateral casualty at an attempt to disguise a state-sponsored cyber-attack as a criminal extortion attempt. One would need to dig deeper to get a really informed opinion. I do believe Russia to be able and willing to do that, I do believe the so-called "Western intelligence agencies" to blame any malware on Russia or China on…

If you analyze the NotPetya attack, it differs from other ransomware attempts in two respects. First, it was specifically targetting Ukraine. Second, the attackers didn't actually take any money but rendered all systems defunct. If you are a criminal, you aim to make money, right? Why give up on that possibility? It makes no sense.

So, even if in the infosec world you can never say never, but just as Stuxnet is generally attributed to Israel/USA, in the same way NotPetya is attributed to Russia, even though none of these countries will ever admit they actually did it.

Re: Merck’s NotPetya attack: Was it an act of war?

#14

Post by marvin »

throwGuardian wrote: post #12

Act of war against .... Merck, a company? I've heard of some circuitous logic to deny insurance claims, but this was not an act of war against Merck, which BTW isn't a country, so by definition, one can't go to war with it? Well, maybe hyperbolically a competitor might, but unlike real war, they're bound by the rules and laws of civil society This is the very definition of an accident, if the article is to be believe…

While I’m opposed to using legal terms to weasel out of an insurance claim, it’s an interesting question. If Russia deliberately dropped a bomb on Merck’s factory, it would unquestionably be an act of war. Likewise if they dropped a bomb on a neighboring plant and also accidentally destroyed Merck’s plant.

But dropping a bomb on a facility in Ukraine, with equally destructive shrapnel destroying facilities all over the world? Knowing that using this weapon can easily cause such collateral damage?

We barely have the terminology for discussing this type of warfare. The initial attack was an act of war, certainly. Beyond that, we have to come up with definitions and reactions. At the very least, it’s a subject for diplomatic channels, maybe even sanctions.

Re: Merck’s NotPetya attack: Was it an act of war?

#15

Post by diffeomorphism »

throwGuardian wrote: post #12

Act of war against .... Merck, a company? I've heard of some circuitous logic to deny insurance claims, but this was not an act of war against Merck, which BTW isn't a country, so by definition, one can't go to war with it? Well, maybe hyperbolically a competitor might, but unlike real war, they're bound by the rules and laws of civil society This is the very definition of an accident, if the article is to be believe…

> which BTW isn't a country, so by definition, one can't go to war with it?

Suppose North Korea shoots artillery on Samsung factories. Is that not an act of war because they were targeting a company's buildings?

The US has some mixed messaging on cracking. On the one hand they reserve the right to consider attacks on them as acts of war (and to respond with bombs) on the other hand they have no reservations about cracking others (e.g. Iran).

Re: Merck’s NotPetya attack: Was it an act of war?

#16

Post by arminiusreturns »

The main problem with allowing cyberattacks into the "declaration of war" category against all known diplomatic norms, is that attribution is extremely questionable. History is full of false flags done in the physical realm. Cyberattacks will be no different, other than easier to perform.

Re: Merck’s NotPetya attack: Was it an act of war?

#17

Post by qaq »

Iv wrote: post #10
hdhgzwhegh wrote: post #2

If the attacker doesn't declare war and the defender doesn't respond by going to war then the blunt answer seems like it'd have to be a no.

The claim in the article is that the target was Ukraine, the attacker Russia, and Merck a collateral casualty at an attempt to disguise a state-sponsored cyber-attack as a criminal extortion attempt. One would need to dig deeper to get a really informed opinion. I do believe Russia to be able and willing to do that, I do believe the so-called "Western intelligence agencies" to blame any malware on Russia or China on…

This is a bit simplistic my educated guess is in Russia, Ukraine and prob some other countries given pay structure in 3 letter agencies they simply can not afford hiring proper skills for the cyber sec especially for the offensive side. So they have a hybrid private/gov system where certain groups get some level of immunity for their "commercial" activities in exchange for deploying their skills for 3 letter agency use when needed. Alternatively people who are caught for some criminal activity get their sentence suspended in exchange for services.

Re: Merck’s NotPetya attack: Was it an act of war?

#19

Post by Buge »

Iv wrote: post #10
hdhgzwhegh wrote: post #2

If the attacker doesn't declare war and the defender doesn't respond by going to war then the blunt answer seems like it'd have to be a no.

The claim in the article is that the target was Ukraine, the attacker Russia, and Merck a collateral casualty at an attempt to disguise a state-sponsored cyber-attack as a criminal extortion attempt. One would need to dig deeper to get a really informed opinion. I do believe Russia to be able and willing to do that, I do believe the so-called "Western intelligence agencies" to blame any malware on Russia or China on…

> One would need to dig deeper to get a really informed opinion.

There are a ton of security experts who have indeed dug deeper, and came to the conclusion that it was Russia.

Re: Merck’s NotPetya attack: Was it an act of war?

#20

Post by lexs »

diffeomorphism wrote: post #15
throwGuardian wrote: post #12

Act of war against .... Merck, a company? I've heard of some circuitous logic to deny insurance claims, but this was not an act of war against Merck, which BTW isn't a country, so by definition, one can't go to war with it? Well, maybe hyperbolically a competitor might, but unlike real war, they're bound by the rules and laws of civil society This is the very definition of an accident, if the article is to be believe…

> which BTW isn't a country, so by definition, one can't go to war with it? Suppose North Korea shoots artillery on Samsung factories. Is that not an act of war because they were targeting a company's buildings? The US has some mixed messaging on cracking. On the one hand they reserve the right to consider attacks on them as acts of war (and to respond with bombs) on the other hand they have no reservations about cra…

I would say that it's not an act of war against Samsung but South Korea which should be a difference.
Post reply on HN