Live data from Hacker News

Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

nbcboston.com

161–170 of 267 posts

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#161

This isn't news anymore, its weather. If your company does not have a full time cybersecurity team, they soon will, even if they say they don't need it.

In a lot of situations we've heard about, the cybersecurity team could consist of one person with a bullhorn walking around shouting "don't connect critical infrastructure to the Internet". Whether they'd listen to them still is another matter but that's the same with a regular cybersecurity team. And that is to say we have institutional standards where unsafe practices are considered OK and will be followed because…

I don't agree - that won't work as critical infrastructure can't be not connected to internet; perhaps we have a different understanding of what "critical infrastructure" means? You can have disconnected industrial networks, but the ransomware cases aren't really about those.

For example, let's look at the recent major Colonial Pipeline case. Their pipeline systems weren't connected to the Internet, and did not get compromised. What got compromised was their business billing and customer communications systems - and those do need to be connected to internet, that's their whole point, and they apparently were critical enough to make them shut down the (uncompromised) pipeline anyway.

It doesn't matter if your meat packing plant machinery SCADA systems are isolated, your inventory, logistics and sales systems are critical for your operations and need to be connected to the internet, so a ransomware attack will kill you even if your plant equipment works fine.

It doesn't matter if your chemical plant sensor network is isolated, your payroll and shift scheduling system is critical to your operations and needs to be connected to the internet.

Heck, for so many companies their email systems are critical to their operations (and leaking the contents would cause a massive liability) and those obviously need to be connected to the internet.

Not connecting is helpful in some cases, but it's nowhere close to a sufficient solution.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#162
post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

As an alternative question, how much is this worth stopping? As how much is being spent on these payments overall each year? How would that compare to the massive IT fortification project people are demanding? We don't meaningfully fight bike theft for this reason. The cost of doing so relative to the benefits is just too high. We can debate whether that is reasonable, but that is essentially what has been decided as…

> how much is this worth stopping?

Having a physical write-enable switch on the backup devices costs about three cents.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#163

The US is going to end up tracking and assassinating these people, if we're not already. Messing with the old money usually doesn't turn out well for whoever's doing it.

Unless there have been classified changes, EO 12333 bans such activity.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#164
post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

Another issue I don't see discussed much is how cryptocurrencies basically enable the business of ransomware. It's not like we're less secure than we were 20 years ago, the difference is now hackers can actually get paid.

But the genie is out of the bottle now. It's not going back in.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#165
post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

An easy way to blunt such attacks is to have physical write-enable switches on drives used for backups. Then, when restoring from backup, it cannot get corrupted. Of course, even better would be a physical switch for incremental backups, so a disk drive works like tape - it can physically only be appended to if that switch is "off". Come on, security professionals. None of this has any technical or cost barriers. Dem…

Anticipate a problem with your IT staff leaving the write-enable switch on? Have the drive maker add a (again, physical) clock circuit (could just be an RC delay) to turn it off again automatically.

(Even if you don't anticipate a problem with your IT staff, it's just good engineering to automatically turn off the write-enable. Nobody's perfect. I've gone to the airport without my passport once. It really sux when you do that.)

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#166

Earlier quoted context omitted.

Because twenty years ago computer security was an absolute and utter shambles. Exploiting a vulnerability today is orders of magnitude harder than it was twenty years ago. Massive strides have been made.

Just a couple years ago, the largest botnet in history infected IOT devices using default passwords in order to DDOS Minecraft servers, so perhaps these strides haven't been so massive.

IOT isn't datacenter server technology. IOT is basically in the state of software security from 20 years ago. Often running crappy proprietary stuff. Your average server running a recent Linux kernel is Fort Knox comparatively. There have been massive strides in many places in software security but IOT and embedded security in general is very lacking unless your talking things going into space or military.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#167
post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

[deleted]

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#168

Earlier quoted context omitted.

An easy way to blunt such attacks is to have physical write-enable switches on drives used for backups. Then, when restoring from backup, it cannot get corrupted. Of course, even better would be a physical switch for incremental backups, so a disk drive works like tape - it can physically only be appended to if that switch is "off". Come on, security professionals. None of this has any technical or cost barriers. Dem…

Anticipate a problem with your IT staff leaving the write-enable switch on? Have the drive maker add a (again, physical ) clock circuit (could just be an RC delay) to turn it off again automatically. (Even if you don't anticipate a problem with your IT staff, it's just good engineering to automatically turn off the write-enable. Nobody's perfect. I've gone to the airport without my passport once. It really sux when y…

This is a system I put together at my first IT job.

Backups get pushed from devices between 1AM and 3AM each day, so the primary backup server enables it's network card at 1 and disables it at 3.

Primary backup server also has a second network card, that in turn is attached to a small subnet containing it and the secondary backup server only. The secondary backup server pulls a copy from the primary on a weekly basis in a similar manner as the primary, disabling it's network card once it has finished.

Maybe they can hit the primary if the infection takes place overnight, but the odds of getting the secondary are pretty low.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#169
post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

Paying ransoms can be illegal if it is happening with a sanctioned entity.

We need to start holding companies criminally liable having security vulnerabilities that get breached. It is true that there will always be exploits but the issues are usually much more wildly irresponsible security practices and not “didn’t know about the latest 0day”

There needs to be a statutory liability to customers and required insurance. Let the insurance company figure out the regulations instead of bureaucrats and politicians, insurance company rules are optional and noncompliance is just more expensive.

It is an increasing trend but the current uptick in awareness is mostly media coverage. This stuff has been going on forever, a few particularly newsworthy things happened now everyone is going out of their way to report each new instance. Trends in reporting instead of trends in exploits (to a degree)

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#170

Earlier quoted context omitted.

The rich people on Martha's Vineyard don't use the ferries, they have their own yachts or helicopters to get there.

At some point they're affected. Staff, service workers, guests, neighbours.

Yes who is going to serve the champagne and canapes ???.
Post reply on HN