Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

nbcboston.com

Post reply on HN
Print view View original

101–110 of 267 posts

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#101

Post by nneonneo »

loveistheanswer wrote: post #76
helen___keller wrote: post #42

Earlier quoted context omitted.

> This is meant sincerely, not glibly: How? How can cryptocurrencies be banned in any meaningful sense? The main avenue would be by getting rid of the sanctioned on/off ramps for crypto (that is, crypto exchanges), leaving only the illegal on/off ramps which I'm sure exist. This obviously wouldn't stop everybody, but it would certainly be a deterrent for all but the most motivated and well-connected of buyers. At tha…

>The main avenue would be by getting rid of the sanctioned on/off ramps for crypto (that is, crypto exchanges), leaving only the illegal on/off ramps which I'm sure exist. From what I've read it seems its only the stupidest of criminals who are using exchanges like Coinbase to cash out, because that's the easiest way to get caught.

What you want to attack is the on-ramps, not the off-ramps. Make it really hard to legally acquire cryptocurrency, to the point where a company would probably have to break a law or two just to get their payment together. That, plus criminalizing ransom payments, would go a very long way to stemming this tide.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#102

Post by samstave »

OminousWeapons wrote: post #92
JumpCrisscross wrote: post #29

Earlier quoted context omitted.

> the reality is going to be that paying is necessary to continue to exist. What happens when that option, as crappy as it is, is off the table? Insurance. Back-ups. Bail outs. Go out of business. That ransom paid has negative externalities that manifest nationally.

You won't even be able to get private insurance if the industry has to insure against complete destruction of a given business. Are you expecting the US gov to backstop every business regardless of size against ransomware? Who is going to pay for that? Additionally, how do you protect against the obvious opportunities for fraud and abuse (business deliberately attacks itself to collect the insurance payout, business…

>"insure against complete destruction of a given business."

Isnt that what fire/flood insurance is for?

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#103

Post by xkyf »

alksjdalkj wrote: post #100
uses wrote: post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

Another issue I don't see discussed much is how cryptocurrencies basically enable the business of ransomware. It's not like we're less secure than we were 20 years ago, the difference is now hackers can actually get paid.

That gets discussed every time, hackers were using prepaid cash services. Ransomware predates cryptocurrencies by decades.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#104

Post by Ekaros »

walrus01 wrote: post #98
1970-01-01 wrote: post #85

This isn't news anymore, its weather. If your company does not have a full time cybersecurity team, they soon will, even if they say they don't need it.

and as a parallel to modern industry standard infosec best practices, a good offsite/off-line backup system, disaster recovery program, tested backups/recovery methodology. A lot of the companies I've seen badly affected by a cryptolocker malware would have been equally in a dire situation if their head office/datacenter had burned down.

Defined process to run things without systems, if at all possible. That would sound obvious to me. May take lot of effort but with critical sectors such plans should be mandatory.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#105

Post by Workaccount2 »

OminousWeapons wrote: post #92
JumpCrisscross wrote: post #29

Earlier quoted context omitted.

> the reality is going to be that paying is necessary to continue to exist. What happens when that option, as crappy as it is, is off the table? Insurance. Back-ups. Bail outs. Go out of business. That ransom paid has negative externalities that manifest nationally.

You won't even be able to get private insurance if the industry has to insure against complete destruction of a given business. Are you expecting the US gov to backstop every business regardless of size against ransomware? Who is going to pay for that? Additionally, how do you protect against the obvious opportunities for fraud and abuse (business deliberately attacks itself to collect the insurance payout, business…

You would be able to get affordable private insurance if you had a cyber security team.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#107

Post by meowface »

mnd999 wrote: post #8
user-the-name wrote: post #2

Time to ban bitcoin. https://newrepublic.com/article/162589/ban-bitcoin-cryptocur...

Nope, no point banning the thing the criminals use, because they don’t follow the law anyway. Ban paying ransoms, the corporations are much more likely to follow the law.

Of the three most common ransomware-combating suggestions I've been observing over the past few months, I'm strongly opposed to the first two (banning cryptocurrencies or banning ransom payments) and would instead strongly advocate for the third: reinstitute letters of marque for privateers.

Enable activity instead of futilely trying to ban activity. Instead of focusing on punishing the victims and unrelated third parties, focus on punishing and disrupting the perpetrators.

Or if not letters of marque, they could at least just issue a notice that certain activity will have a blind eye turned towards it, to mirror the policy of some of the governments that bear most of the responsibility for ransomware activity.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#108

Post by MattGaiser »

uses wrote: post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

As an alternative question, how much is this worth stopping?

As how much is being spent on these payments overall each year? How would that compare to the massive IT fortification project people are demanding?

We don't meaningfully fight bike theft for this reason. The cost of doing so relative to the benefits is just too high. We can debate whether that is reasonable, but that is essentially what has been decided as a society. Most low level crime is not meaningfully investigated.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#109

Post by zaphar »

lumost wrote: post #64
JumpCrisscross wrote: post #35

Earlier quoted context omitted.

> regulation requiring decent cybersecurity measures would be better For those of us who make money when cybersecurity dollars are spent, yes. Practically, you’d get a federal agency writing checklists.

Good security practices are mainly checklists. Do you use https? Do you store password hashes instead of passwords? Is the DB storing passwords in a firewalled network? Is access to the DB restricted to only "need to know individuals"? Does the DB send password hashes to other services? Have you had a penetration test of your authentication system? Do you sanitize the SQL you send to your DB? etc. Unfortunately the m…

Those are best practices in hardening a system but those are just table stakes. Good security requires having observability of your systems and following up and/or checking on any anomalous activity you detect.

For the most part determined actors (many of them state sponsored) are going to be hard to prevent if they target you. Your best defense is early detection and reaction to the initial breaches. If you only do the hardening part and leave out the monitoring/observation part you are going to get owned.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#110

Post by lumost »

artful-hacker wrote: post #77
lumost wrote: post #64

Earlier quoted context omitted.

Good security practices are mainly checklists. Do you use https? Do you store password hashes instead of passwords? Is the DB storing passwords in a firewalled network? Is access to the DB restricted to only "need to know individuals"? Does the DB send password hashes to other services? Have you had a penetration test of your authentication system? Do you sanitize the SQL you send to your DB? etc. Unfortunately the m…

I feel like a checklist is just part of it. The truth is that a secure software development lifecycle needs to be taken seriously at every stage, and this costs a lot of money. During prototyping and requirements gathering you need to be setting security requirements, vetting planned dependencies, and prototyping things like authentication and authorization. Each design should include threat modeling and threat mitig…

> people that have the skills to execute on them are rare

This is the limiting factor in secure coding. We need more efficient ways of scaling out the few teams doing top tier work, as it only takes a single bad code review to open a security hole.

Teams should not need to implement their own authentication mechanism. Most companies should not need to implement their own mechanism. Authentication providers should explicitly and automatically verify that their clients have implemented auth correctly.

Post reply on HN