Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

nbcboston.com

Post reply on HN
Print view View original

151–160 of 267 posts

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#151

Post by user-the-name »

mandelbrotwurst wrote: post #124
alksjdalkj wrote: post #100

Earlier quoted context omitted.

Another issue I don't see discussed much is how cryptocurrencies basically enable the business of ransomware. It's not like we're less secure than we were 20 years ago, the difference is now hackers can actually get paid.

How do you know that we’re not less secure? It wouldn’t surprise me at all if our systems are on average far less secure simply because so much more is online now, to speak nothing of increases in the complexity of and opportunities for errors and misconfigurations in today’s systems.

Because twenty years ago computer security was an absolute and utter shambles. Exploiting a vulnerability today is orders of magnitude harder than it was twenty years ago. Massive strides have been made.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#152

Post by PeterisP »

mrweasel wrote: post #30

I continue to wonder why more companies aren't utilizing application whitelisting. Most, if not all, of the attacked companies run Windows, and Windows have been able to restrict system to only running whitelisted application for ages. Sure, whitelisting is annoying to say the least, but these are critical systems, you don't need to install new software daily or even monthly.

The initial foothold exploits - where application whitelisting would help the most - generally are not "critical systems", they are the daily workstations of random employees. By the time the attackers reach your critical systems, they most likely can attack them with stolen credentials without running any exploits that whitelisting would prevent.

To protect your company, application whitelisting needs enough usability to be easily supportable for the workstations of your accountant, office receptionist, and the VP of Marketing (those three are all good examples of valuable entry points for targeted attacks), which all may get management approval to throw out application whitelisting if it inconveniences them enough - there's no reasonable tradeoff between security and usability, you must get both as usability is mandatory and usability deficiencies will result in security features getting removed in all but the most critical circumstances.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#154

Post by vecter »

owlbynight wrote: post #95

The US is going to end up tracking and assassinating these people, if we're not already. Messing with the old money usually doesn't turn out well for whoever's doing it.

Are there actual examples of the US "assassinating" bad actors in this way? That seems farfetched, as opposed to just going after them in the judicial system.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#155

Post by tobesure »

bluGill wrote: post #130
owlbynight wrote: post #95

The US is going to end up tracking and assassinating these people, if we're not already. Messing with the old money usually doesn't turn out well for whoever's doing it.

Not just the US. A lot of countries care. Western Europe (not sure about the east) does as well and will do something even if they aren't as violent as the US. (In fact they are probably going to claim the moral high ground of not assassinating people only because they give evidence to the US and look the other way). South America, South Asia, and Africa will all have at least some helping out, though it isn't clear…

Why not China? I always have problems with these attributions - they inevitably depend on "signatures" like timestamps and language encodings that would be trivial to deliberately fake by a competent team - and some of these hacks indicate competence.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#156

Post by mannerheim »

user-the-name wrote: post #151
mandelbrotwurst wrote: post #124

Earlier quoted context omitted.

How do you know that we’re not less secure? It wouldn’t surprise me at all if our systems are on average far less secure simply because so much more is online now, to speak nothing of increases in the complexity of and opportunities for errors and misconfigurations in today’s systems.

Because twenty years ago computer security was an absolute and utter shambles. Exploiting a vulnerability today is orders of magnitude harder than it was twenty years ago. Massive strides have been made.

Just a couple years ago, the largest botnet in history infected IOT devices using default passwords in order to DDOS Minecraft servers, so perhaps these strides haven't been so massive.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#157

Post by lnwlebjel »

vecter wrote: post #154
owlbynight wrote: post #95

The US is going to end up tracking and assassinating these people, if we're not already. Messing with the old money usually doesn't turn out well for whoever's doing it.

Are there actual examples of the US "assassinating" bad actors in this way? That seems farfetched, as opposed to just going after them in the judicial system.

This would suggests that there are not actual examples: https://en.wikipedia.org/wiki/Targeted_killing#Use_by_United...

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#158

Post by WalterBright »

uses wrote: post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

An easy way to blunt such attacks is to have physical write-enable switches on drives used for backups. Then, when restoring from backup, it cannot get corrupted.

Of course, even better would be a physical switch for incremental backups, so a disk drive works like tape - it can physically only be appended to if that switch is "off".

Come on, security professionals. None of this has any technical or cost barriers. Demand it from drive vendors. My older drives have such a switch.

Post reply on HN