Massachusetts Steamship Authority hit by ransomware attack; ferries delayed • Hacker News Board

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#221

Post by rdtsc » Thu, Jun 03, 2021, 3:37 AM UTC

viraptor wrote: post #122

uses wrote: post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

The Risky Business podcast #624 talks about pretty much all your questions if your want to listen to it. But here's some relevant info: Hardening can help, but we'll always have new exploits and some of the time the intrusion comes from standard fishing rather than automation, so tech can't solve it. Crypto coins enable payment at scale, but Russia enables the operation to not worry about consequences (a lot of ranso…

> but Russia enables the operation to not worry about consequences (a lot of ransomware will disable itself on Russian computers to avoid local prosecution).

I remember reading how supposedly adding a Russian or a few other keyboard layouts might fool some of the malware to ignore the machine [1].

I guess one idea for the Western intel agencies could be to play off of that, and somehow disable that check (infect their malware) such that it can and does attack the Russian infrastructure.

[1] https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#222

Post by an_opabinia » Thu, Jun 03, 2021, 3:43 AM UTC

uses wrote: post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

Banning crypto currencies would have no negative impact on the real economy and end ransom payments overnight.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#223

Post by viraptor » Thu, Jun 03, 2021, 4:05 AM UTC

dopidopHN wrote: post #216

viraptor wrote: post #206

Earlier quoted context omitted.

Sure, there are ways that would pretty much nuke most of the ransomware business. For example application whitelisting. I wish it was more popular.

But then who whitelist the whitelister? Solarwind was fun for that. They provide safe update of signed binaries . But their build system is corrupt, builds tampered stuffs and sign them. I’m a just a user of those things: it seams that cryptography is not what is breaking the chain of trust. It’s the usage? But go fix phishing. Maybe gov agencies should opt in for some tightly manage environments?

Windows application whitelisting in this context means your own list based on either paths or hashes of executables. https://www.bleepingcomputer.com/tutorials/create-an-applica...

But you're right that it wouldn't help with the solarwind situation. Once installed and given privileges, a trusted app can do whatever it wants.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#224

Post by redisman » Thu, Jun 03, 2021, 4:11 AM UTC

echelon wrote: post #71

helen___keller wrote: post #42

Earlier quoted context omitted.

> This is meant sincerely, not glibly: How? How can cryptocurrencies be banned in any meaningful sense? The main avenue would be by getting rid of the sanctioned on/off ramps for crypto (that is, crypto exchanges), leaving only the illegal on/off ramps which I'm sure exist. This obviously wouldn't stop everybody, but it would certainly be a deterrent for all but the most motivated and well-connected of buyers. At tha…

Drugs are illegal for Americans to buy, sell, and produce. Laws are how you prevent this. Can you imagine the Massachusetts Steamship Authority paying in cocaine ? Why would paying in Bitcoin be any different? Bitcoin is parroted largely by a bunch of libertarian speculative grifters that think they're above the authority of our government to manage the monetary supply. They want to soak up all the advantages of buil…

> Drugs are illegal for Americans to buy, sell, and produce.

Are you seriously using the war on drugs as an example of a successful policy? Drugs are easier to get and more numerous than ever, even though we have these magical laws in place for decades.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#225

Post by [deleted] » Thu, Jun 03, 2021, 4:26 AM UTC

uses wrote: post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

[deleted]

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#226

Post by [deleted] » Thu, Jun 03, 2021, 4:42 AM UTC

rdtsc wrote: post #221

viraptor wrote: post #122

Earlier quoted context omitted.

The Risky Business podcast #624 talks about pretty much all your questions if your want to listen to it. But here's some relevant info: Hardening can help, but we'll always have new exploits and some of the time the intrusion comes from standard fishing rather than automation, so tech can't solve it. Crypto coins enable payment at scale, but Russia enables the operation to not worry about consequences (a lot of ranso…

> but Russia enables the operation to not worry about consequences (a lot of ransomware will disable itself on Russian computers to avoid local prosecution). I remember reading how supposedly adding a Russian or a few other keyboard layouts might fool some of the malware to ignore the machine [1]. I guess one idea for the Western intel agencies could be to play off of that, and somehow disable that check (infect thei…

[deleted]

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#227

Post by sanderjd » Thu, Jun 03, 2021, 5:08 AM UTC

an_opabinia wrote: post #222

uses wrote: post #91

I'd really like to see/hear/read a breakdown of some of related issues from some experts. Even on HN it's the same knee-jerk reactions every time one of these stories hit. This is one of the most pressing technology issues of this moment and the discourse just sucks. * Does banning ransom payments do anything? Good idea/bad idea? Historical analogues? * Do we need to pay rewards to cyber privateers to take down cyber…

Banning crypto currencies would have no negative impact on the real economy and end ransom payments overnight.

Ban them how? Ban the on-ramps in the US so that companies can't legally purchase cryptocurrency with which to pay the ransom? Is that fundamentally different than making it illegal to pay the ransom in any currency? It seems that in either case, what you've done is push a company into breaking the law if they want to pay the ransom, which would probably deter most of them from doing it.

Or do you mean banning both the US on-ramps and the foreign off-ramps? Are you optimistic that the US could get, for instance Russia, to enforce such a ban?

I'm not necessarily opposed to this "just ban cryptocurrency" talking point, but I'm never sure I understand what people mean by it in practice.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#228

Post by runeks » Thu, Jun 03, 2021, 5:58 AM UTC

JumpCrisscross wrote: post #6

A federal ban on paying ransomeware would reduce the incentive to commit these attacks.

Why ban paying ransomware specifically? Why not ban paying ransom in general?

The argument for banning payment of ransom for a ransomware attack applies just as much to any other situation where a ransom is demanded.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#229

Post by Godel_unicode » Thu, Jun 03, 2021, 6:04 AM UTC

WalterBright wrote: post #202

DangitBobby wrote: post #199

Earlier quoted context omitted.

How does a physical switch prevent you from writing backups of infested machines? Most organizations don't realize they are infected until they can't open any of their files.

Presumably one has rolling backups. Something line N backup drives, and every day you back up to the next one in line. Then there are rolling monthly backups, etc. The idea is hopefully you notice the problem before all are corrupted. With the way I understand ransomware works, merely connecting a backup to the system will corrupt it. This is where a write-enable switch really comes into play, it cannot corrupt the b…

First, adding manual steps to backups is a terrible idea. People already don't do them (which, since you missed it, you should know is actually the problem), and you're suggesting making them error-prone and manual.

Second, where is this idea coming from that corrupted backups are the issue? You're solving a problem that doesn't exist and creating a real one.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#230

Post by Godel_unicode » Thu, Jun 03, 2021, 6:15 AM UTC

mrweasel wrote: post #30

I continue to wonder why more companies aren't utilizing application whitelisting. Most, if not all, of the attacked companies run Windows, and Windows have been able to restrict system to only running whitelisted application for ages. Sure, whitelisting is annoying to say the least, but these are critical systems, you don't need to install new software daily or even monthly.

How are you proposing to stop fileless malware with application whitelisting? How about popping shells on firewalls with memory corruption, then using the creds to pivot live-off-the-land style? Solarigate style supply chain attacks?

Whitelisting is the cool buzzword again, but it doesn't do much against human operated ransomware. It's a huge effort to implement (I know you want to say it isn't; try it and learn) and it's not very useful.

That's why most shops skip it.