Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

nbcboston.com

Post reply on HN
Print view View original

191–200 of 267 posts

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#191

Post by joe_the_user »

PeterisP wrote: post #161
joe_the_user wrote: post #143

Earlier quoted context omitted.

In a lot of situations we've heard about, the cybersecurity team could consist of one person with a bullhorn walking around shouting "don't connect critical infrastructure to the Internet". Whether they'd listen to them still is another matter but that's the same with a regular cybersecurity team. And that is to say we have institutional standards where unsafe practices are considered OK and will be followed because…

I don't agree - that won't work as critical infrastructure can't be not connected to internet; perhaps we have a different understanding of what "critical infrastructure" means? You can have disconnected industrial networks, but the ransomware cases aren't really about those. For example, let's look at the recent major Colonial Pipeline case. Their pipeline systems weren't connected to the Internet, and did not get c…

Their pipeline systems weren't connected to the Internet, and did not get compromised. What got compromised was their business billing and customer communications systems - and those do need to be connected to internet, that's their whole point, and they apparently were critical enough to make them shut down the (uncompromised) pipeline anyway.

When Colonial attack happened, there was a person posting who described Colonial's situation from the inside. Colonial shutdown because their system their billing was compromised and their pipleline could have been compromised.

The pipeline was connected two way in hardware but one-way in software. But software can be compromised. Why not one way in hardware? 'cause the company was. Once billing was compromised, they had to assume the pipeline was compromised.

I suggest you read:

https://news.ycombinator.com/item?id=27101756

Not connecting is helpful in some cases, but it's nowhere close to a sufficient solution.

Sure, my comment above involves some hyperbole. The main point is that companies allow a ragbag of profligate connections between various subsystems to be default OK because this saves them money now and costs other people money later. And then expect outsourced security to solve this.

I'm sure a lot of the companies hit by the solarwinds exploit had cybersecurity teams. It's just these teams can't say something like "don't allow some shitty third party to autoupdate their software into your system - if you view security as important, as maybe a government agency should."

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#192

Post by TheCoelacanth »

not_kurt_godel wrote: post #23
JumpCrisscross wrote: post #6

A federal ban on paying ransomeware would reduce the incentive to commit these attacks.

Would it? For some businesses, the reality is going to be that paying is necessary to continue to exist. What happens when that option, as crappy as it is, is off the table?

Then you go out of business. That's what is supposed to happen in capitalism when you run your business badly.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#193

Post by VectorLock »

WalterBright wrote: post #158
uses wrote: post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

An easy way to blunt such attacks is to have physical write-enable switches on drives used for backups. Then, when restoring from backup, it cannot get corrupted. Of course, even better would be a physical switch for incremental backups, so a disk drive works like tape - it can physically only be appended to if that switch is "off". Come on, security professionals. None of this has any technical or cost barriers. Dem…

This isn't "our backups need to be WORM."

This is "there are no backups."

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#194

Post by VectorLock »

Cyber privateers sounds like an interesting idea. Except instead of hunting criminals they hunt for victims. The government pays them bounties, then goes to the victims and says "We're fining you $X, and $Y per day until you fix this."

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#195

Post by joebergeron »

Interesting -- I was just in Woods Hole earlier today, and in fact saw this article pop up on Hacker News while walking by the Steamship Authority. Always strange to see your small slice of the world crop up in places like this. On that note, the Steamship Authority is such a fascinating choice of target for such an attack. Probably very low friction, as I can't imagine they have any sort of sophistication behind their technology stack.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#196

Post by rudedogg »

viraptor wrote: post #122
uses wrote: post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

The Risky Business podcast #624 talks about pretty much all your questions if your want to listen to it. But here's some relevant info: Hardening can help, but we'll always have new exploits and some of the time the intrusion comes from standard fishing rather than automation, so tech can't solve it. Crypto coins enable payment at scale, but Russia enables the operation to not worry about consequences (a lot of ranso…

This mentality of "there will always be new exploits" bothers me. Yes, there will always be exploits, but we can do a hell of a lot better at preventing them than we are. We know how to design systems that are really hard to get into – we just don't do that. Blaming a lack of IT funding is misguided in my opinion too.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#197

Post by strogonoff »

throwawaygh wrote: post #79
MattGaiser wrote: post #41

Earlier quoted context omitted.

Would this result in not paying or them hiring consultants who pay on their behalf and just invoice them for "resolution services"?

Writing a law that prevents this sort of pass-through is trivial. Hold all parties responsible. Don't even require first-hand knowledge that a ransom was paid. Writing a law with proper disincentives is also trivial -- forget about fines. Proper jail time for senior execs and board members. Execs and boards will be damn sure not to pay ransoms, and additionally damn sure that any company they hire to help knows in no…

Laws that disincentive paying ransoms don’t seem to necessarily be that simple to implement and uphold, at least as long as cryptocurrencies are in the equation.

Someone may have paid into that wallet, but who? Was it the attackers themselves, to make it seem to observers as if they succeeded? Did some consultant happen to keep a stash of crypto? Maybe the boss of the hacked organization wisely maintained a wallet for that purpose, funded by embezzling?

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#198

Post by samstave »

detaro wrote: post #120
samstave wrote: post #102

Earlier quoted context omitted.

>"insure against complete destruction of a given business." Isnt that what fire/flood insurance is for?

I wonder what the biggest company is that's totally dependent on a single location (or locations in the same flood zone) and at the same time is usefully insured against such destruction.

Ports?

Take out a port, and screw an entire region.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#199

Post by DangitBobby »

WalterBright wrote: post #162
MattGaiser wrote: post #108

Earlier quoted context omitted.

As an alternative question, how much is this worth stopping? As how much is being spent on these payments overall each year? How would that compare to the massive IT fortification project people are demanding? We don't meaningfully fight bike theft for this reason. The cost of doing so relative to the benefits is just too high. We can debate whether that is reasonable, but that is essentially what has been decided as…

> how much is this worth stopping? Having a physical write-enable switch on the backup devices costs about three cents.

How does a physical switch prevent you from writing backups of infested machines? Most organizations don't realize they are infected until they can't open any of their files.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#200

Post by bagacrap »

PeterisP wrote: post #152
mrweasel wrote: post #30

I continue to wonder why more companies aren't utilizing application whitelisting. Most, if not all, of the attacked companies run Windows, and Windows have been able to restrict system to only running whitelisted application for ages. Sure, whitelisting is annoying to say the least, but these are critical systems, you don't need to install new software daily or even monthly.

The initial foothold exploits - where application whitelisting would help the most - generally are not "critical systems", they are the daily workstations of random employees. By the time the attackers reach your critical systems, they most likely can attack them with stolen credentials without running any exploits that whitelisting would prevent. To protect your company, application whitelisting needs enough usabili…

What makes app whitelisting hard to use on an employee's corporate issue laptop? They shouldn't install anything that doesn't have a business purpose, and these days there are hardly any native apps people want to install anyway.
Post reply on HN