Massachusetts Steamship Authority hit by ransomware attack; ferries delayed • Hacker News Board

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#201

Post by dredmorbius » Thu, Jun 03, 2021, 1:25 AM UTC

sdenton4 wrote: post #186

dredmorbius wrote: post #144

There are threats which emerge when a viability threshold is crossed and realised. For cities, recurring plauges began occurring during Roman times and limited maximum city populations to about 1 million until the advent of modern sanitation, hygiene, public health, waste removal, and food quality. (Actual medical care and treatment had little to do with this, though vaccines and antibiotics helped.) Industrial pollu…

/The likelihood that attackers have some database of victims + passwords seems low./ My impression is that most of these start with phishing, and probably even tailored phishing for larger organizations. A particular phishing campaign then just needs to include an encryption key, while the decryption key is kept elsewhere; this process is still quite easy to automate. Hell, you could even just let loose lots of malwa…

At some point there's a functional mapping from key to indicia.

Releasing "lots of malware" either means a finite keyset, or a key-generation mechanism. At least as I see it.

(I'd really like to find a detailed analysis of the malware software. There was an earlier version of the Darkside attack which used a weak mechansim for key generation.)

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#202

Post by WalterBright » Thu, Jun 03, 2021, 1:31 AM UTC

DangitBobby wrote: post #199

WalterBright wrote: post #162

Earlier quoted context omitted.

> how much is this worth stopping? Having a physical write-enable switch on the backup devices costs about three cents.

How does a physical switch prevent you from writing backups of infested machines? Most organizations don't realize they are infected until they can't open any of their files.

Presumably one has rolling backups. Something line N backup drives, and every day you back up to the next one in line. Then there are rolling monthly backups, etc. The idea is hopefully you notice the problem before all are corrupted.

With the way I understand ransomware works, merely connecting a backup to the system will corrupt it. This is where a write-enable switch really comes into play, it cannot corrupt the backup when you're trying to restore from it. And if you have online archival databases, they can't be corrupted, either. After all, how much of your company data really needs to be writable? Certainly not last week's payroll records.

With append-only incremental backup systems, enforced by hardware, it'll take a lot longer to need to recycle the backups and risk them. Tape backup already does this inherently.

Another thing you can do with a backup drive, is attempt to read it from a clean system that has never been connected to the network. If you can read it, it isn't corrupted. Then, have a process where once a week see if the backup can be read. Then your worst case is a week lost.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#203

Post by PopePompus » Thu, Jun 03, 2021, 1:44 AM UTC

dharmab wrote: post #129

whimsicalism wrote: post #121

Earlier quoted context omitted.

I wonder where this pop-understanding of the law that seems prevalent on HN comes from. Loopholes exist, but in general the government is not terrible at figuring out basic schemes like this and adapt administration of the law.

I think a lot of the HN crowd think of laws like computer code- that it needs to be very exact. Most laws are fairly generalized with broad coverage, and the cases where they're not tend to be the exception, not the rule.

The law is like 100,000 lines of pseudo-code written by a humanities major who never took a CS class.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#204

Post by meowface » Thu, Jun 03, 2021, 1:51 AM UTC

echelon wrote: post #71

helen___keller wrote: post #42

Earlier quoted context omitted.

> This is meant sincerely, not glibly: How? How can cryptocurrencies be banned in any meaningful sense? The main avenue would be by getting rid of the sanctioned on/off ramps for crypto (that is, crypto exchanges), leaving only the illegal on/off ramps which I'm sure exist. This obviously wouldn't stop everybody, but it would certainly be a deterrent for all but the most motivated and well-connected of buyers. At tha…

Drugs are illegal for Americans to buy, sell, and produce. Laws are how you prevent this. Can you imagine the Massachusetts Steamship Authority paying in cocaine ? Why would paying in Bitcoin be any different? Bitcoin is parroted largely by a bunch of libertarian speculative grifters that think they're above the authority of our government to manage the monetary supply. They want to soak up all the advantages of buil…

>Bitcoiners are fine with letting social services and the underserved slip through the cracks as long as they get their reward that they feel they earned.

What are you basing this on?

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#205

Post by meowface » Thu, Jun 03, 2021, 1:53 AM UTC

boomboomsubban wrote: post #128

meowface wrote: post #107

Earlier quoted context omitted.

Of the three most common ransomware-combating suggestions I've been observing over the past few months, I'm strongly opposed to the first two (banning cryptocurrencies or banning ransom payments) and would instead strongly advocate for the third: reinstitute letters of marque for privateers. Enable activity instead of futilely trying to ban activity. Instead of focusing on punishing the victims and unrelated third pa…

So your answer to the problem is to encourage more ransomware attacks? You don't think ransomware itself is bad, you just take issue with the idea that you may be the victim? Training more people to use it's probably going to backfire on you then.

No, I'm definitely not suggesting deploying ransomware or legalizing deployment of ransomware. Apologies if I wasn't clear enough in my post.

By "enable activity" I just mean "instead of taking a general approach of trying to ban things to solve a problem, take a general approach of trying to enable certain other kinds of things to solve a problem". Not "enable ransomware activity".

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#206

Post by viraptor » Thu, Jun 03, 2021, 2:05 AM UTC

rudedogg wrote: post #196

viraptor wrote: post #122

Earlier quoted context omitted.

The Risky Business podcast #624 talks about pretty much all your questions if your want to listen to it. But here's some relevant info: Hardening can help, but we'll always have new exploits and some of the time the intrusion comes from standard fishing rather than automation, so tech can't solve it. Crypto coins enable payment at scale, but Russia enables the operation to not worry about consequences (a lot of ranso…

This mentality of "there will always be new exploits" bothers me. Yes, there will always be exploits, but we can do a hell of a lot better at preventing them than we are. We know how to design systems that are really hard to get into – we just don't do that. Blaming a lack of IT funding is misguided in my opinion too.

Sure, there are ways that would pretty much nuke most of the ransomware business. For example application whitelisting. I wish it was more popular.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#207

Post by marnett » Thu, Jun 03, 2021, 2:06 AM UTC

vecter wrote: post #154

owlbynight wrote: post #95

The US is going to end up tracking and assassinating these people, if we're not already. Messing with the old money usually doesn't turn out well for whoever's doing it.

Are there actual examples of the US "assassinating" bad actors in this way? That seems farfetched, as opposed to just going after them in the judicial system.

I don’t know exactly how public any instances would be, but presumably the large and well funded intelligence complex of the US would have the cyber forensic capabilities to potentially trace bad actors. Pairing this with the physical intelligence agencies, if the US truly wanted to find these individuals and take them out I’m sure they could. Recommended reading on the history of only one of these intelligence agencies (and the somewhat extrajudicial way in which they often operate) is Legacy of Ashes by Tim Weiner, which is a fantastic history of the CIA.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#208

Post by tgsovlerkhgsel » Thu, Jun 03, 2021, 2:10 AM UTC

wmf wrote: post #146

viraptor wrote: post #122

Earlier quoted context omitted.

The Risky Business podcast #624 talks about pretty much all your questions if your want to listen to it. But here's some relevant info: Hardening can help, but we'll always have new exploits and some of the time the intrusion comes from standard fishing rather than automation, so tech can't solve it. Crypto coins enable payment at scale, but Russia enables the operation to not worry about consequences (a lot of ranso…

Good 2FA (e.g. U2F) can solve most phishing. https://krebsonsecurity.com/2018/07/google-security-keys-neu...

In this context, "phishing" often means "random other forms of social engineering that people started calling phishing almost a decade ago".

The attackers no longer steal a password and log in with it, they kindly ask someone to please run their malware.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#209

Post by SyzygistSix » Thu, Jun 03, 2021, 2:19 AM UTC

FridayoLeary wrote: post #139

RobRivera wrote: post #53

this is getting a little out of hand

But entirely predictable. I might as well have bought shares in popcorn. It's almost a weekly occurrence now, and those are just the ones we hear about.

Wasn't it around 2010 when there were tons of cyber bank robberies and databases being held for ransom?

I don't think this is really anything new. Just different targets.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#210

Post by wrycoder » Thu, Jun 03, 2021, 2:24 AM UTC

owlbynight wrote: post #95

The US is going to end up tracking and assassinating these people, if we're not already. Messing with the old money usually doesn't turn out well for whoever's doing it.

Yeah, going after the ferry to Nantucket? That’s getting serious.

Unforced error.