Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

nbcboston.com

Post reply on HN
Print view View original

241–250 of 267 posts

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#241

Post by biztos »

creato wrote: post #237
jacquesm wrote: post #233

Interesting how everybody focuses on the things that they know about: technical solutions, legal solutions aiming at the victims, payment options and so on. When the real failure is somewhere else: bringing these perps to justice. The fact that they can get away with this over and over again hiding behind anonymity is what enables these crimes.

I think a big factor here is IT people jumping at the chance to say "I told you so! Triple my budget!" I agree the problem is that these criminals are sheltered from prosecution.

Shouldn't it at least be possible to identify them, by following the crypto addresses until someone cashes out?

I get that you might not be able to do anything about it if they are sheltered from prosecution where they cash out.

But I don't get why we can't at least, to some reasonable degree of accuracy, say Address A took the ransom and eventually it ended up with Address Z cashing out through Exchange B. Then if either Exchange B or Address Z has anything at all to do with the US-dominated international financial system, you've got serious leverage.

If I'm Coinbase, am I not worried about unwittingly laundering money for terrorists? Don't I have a staff trying to prevent that?

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#242

Post by user-the-name »

creato wrote: post #181
Workaccount2 wrote: post #113

Earlier quoted context omitted.

That's not a function of banning cash however, its on account of the rise of credit cards. No one sacrificed or was inconvenienced to get here, it was just natural progression with good side effects.

Of course, but it doesn't invalidate the point, banning cash would have similarly reduced muggings. Just like banning bitcoin will reduce ransomware activity.

Cash is useful and widely used, unlike bitcoin. There's very little secondary harm in banning bitcoin. Instead, there are several other benefits to doing it, such as reducing environmental harm and stopping several other kinds of fraud.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#243

Post by svenfaw »

rdtsc wrote: post #221
viraptor wrote: post #122

Earlier quoted context omitted.

The Risky Business podcast #624 talks about pretty much all your questions if your want to listen to it. But here's some relevant info: Hardening can help, but we'll always have new exploits and some of the time the intrusion comes from standard fishing rather than automation, so tech can't solve it. Crypto coins enable payment at scale, but Russia enables the operation to not worry about consequences (a lot of ranso…

> but Russia enables the operation to not worry about consequences (a lot of ransomware will disable itself on Russian computers to avoid local prosecution). I remember reading how supposedly adding a Russian or a few other keyboard layouts might fool some of the malware to ignore the machine [1]. I guess one idea for the Western intel agencies could be to play off of that, and somehow disable that check (infect thei…

If they could do that they might just as well disable the file-encrypting part.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#244

Post by greyface- »

dodobirdlord wrote: post #238
sanderjd wrote: post #227

Earlier quoted context omitted.

Ban them how? Ban the on-ramps in the US so that companies can't legally purchase cryptocurrency with which to pay the ransom? Is that fundamentally different than making it illegal to pay the ransom in any currency? It seems that in either case, what you've done is push a company into breaking the law if they want to pay the ransom, which would probably deter most of them from doing it. Or do you mean banning both t…

Laws can be made very broad and can generally lay out a ban and leave it up to those impacted to figure out how to comply with the law. A hypothetical law could criminalize possession of all cryptocurrency wallet keys for all US citizens and all corporations that operate in the United States, with a regulatory agency tasked with adding to the list of “cryptocurrencies” each time someone launches a new one. There’s no…

What constitutes "possession" of a key? How do we treat multi-signature arrangements?

What differentiates a cryptocurrency key from a non-cryptocurrency key? Would this criminalize the holding of any private key at all, even if intended for non-cryptocurrency applications?

What happens if I generate a key for non-cryptocurrency use and then someone later sends cryptocurrency to it? Am I going to jail? Do I need to rekey immediately? Is it my duty to monitor for this situation? If I'm evil, can I cause trouble by "spoiling" an enemy's known public keys in this way?

Here's an exhaustive list of all bitcoin keys; you're now in possession of all bitcoin in circulation: https://lbc.cryptoguru.org/dio/

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#245

Post by adrian_b »

dredmorbius wrote: post #201
sdenton4 wrote: post #186

Earlier quoted context omitted.

/The likelihood that attackers have some database of victims + passwords seems low./ My impression is that most of these start with phishing, and probably even tailored phishing for larger organizations. A particular phishing campaign then just needs to include an encryption key, while the decryption key is kept elsewhere; this process is still quite easy to automate. Hell, you could even just let loose lots of malwa…

At some point there's a functional mapping from key to indicia. Releasing "lots of malware" either means a finite keyset, or a key-generation mechanism. At least as I see it. (I'd really like to find a detailed analysis of the malware software. There was an earlier version of the Darkside attack which used a weak mechansim for key generation.)

They would normally use a key-generation mechanism, but knowing that is not helpful at all.

A typical key-generation mechanism would be for each malware copy to have a serial number and the keys to be generated by encrypting the serial number, e.g. with AES, using another secret key.

Even if you know precisely the serial number of a copy and how the per-copy keys are generated by the attacker, you do not know the attacker's secret key used for key generation, so this is a dead end.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#246

Post by thih9 »

mrweasel wrote: post #30

I continue to wonder why more companies aren't utilizing application whitelisting. Most, if not all, of the attacked companies run Windows, and Windows have been able to restrict system to only running whitelisted application for ages. Sure, whitelisting is annoying to say the least, but these are critical systems, you don't need to install new software daily or even monthly.

> these are critical systems

I’d guess that recognizing that a given computer is now critical infrastructure is also part of the problem.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#247

Post by WalterBright »

mjevans wrote: post #234
WalterBright wrote: post #187

Earlier quoted context omitted.

The odds of hitting the secondary are zero if you've got a hardware write enable switch! One thing you could do is get one of those mechanical lamp timer clocks from the hardware store, and have it turn the power on/off the network card on schedule.

I am now seeing a grandma style light timer device used to turn off and on a cheep switch.

Oh you could find an expensive way to do it, but the idea is the same.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#248

Post by dodobirdlord »

greyface- wrote: post #244
dodobirdlord wrote: post #238

Earlier quoted context omitted.

Laws can be made very broad and can generally lay out a ban and leave it up to those impacted to figure out how to comply with the law. A hypothetical law could criminalize possession of all cryptocurrency wallet keys for all US citizens and all corporations that operate in the United States, with a regulatory agency tasked with adding to the list of “cryptocurrencies” each time someone launches a new one. There’s no…

What constitutes "possession" of a key? How do we treat multi-signature arrangements? What differentiates a cryptocurrency key from a non-cryptocurrency key? Would this criminalize the holding of any private key at all, even if intended for non-cryptocurrency applications? What happens if I generate a key for non-cryptocurrency use and then someone later sends cryptocurrency to it? Am I going to jail? Do I need to re…

> What constitutes "possession" of a key? How do we treat multi-signature arrangements?

These are solved legal problems. Cryptographic possession is a well understood legal concept that comes up all the time in contexts like custody of financial instruments or digital evidence.

> What differentiates a cryptocurrency key from a non-cryptocurrency key? Would this criminalize the holding of any private key at all, even if intended for non-cryptocurrency applications?

Intent, primarily, so no. The applicability of intent to the criminality of an action is also a well understood legal principle.

> What happens if I generate a key for non-cryptocurrency use and then someone later sends cryptocurrency to it? Am I going to jail? Do I need to rekey immediately? Is it my duty to monitor for this situation? If I'm evil, can I cause trouble by "spoiling" an enemy's known public keys in this way?

In this thought experiment with this hypothetical ban, this feels analogous to mailing cocaine to someone's house. Again, well-understood legal principles around intent cover this without issue. Based on relevant precedent for physical contraband, you'd presumably have no obligation to monitor for it, but you would have an obligation to report it if you discovered it and turn it over to authorities.

Blockchain ledger technology makes relinquishing contraband very straightforward. Once you discover that you are in possession of cryptocurrency, you can simply send it directly to a government-controlled blackhole address, and investigators will be able to trivially verify that this transaction is the only one you initiated while in possession of the cryptocurrency.

> Here's an exhaustive list of all bitcoin keys; you're now in possession of all bitcoin in circulation: https://lbc.cryptoguru.org/dio/

The legal system has been around the block on this one. The concept of criminalization of the possession of certain bit sequences when they correspond to some meaningful embedding is well understood. Child pornography is the classic example. Any arbitrary sequence of bits could in principle be child porn expressed in some highly unusual binary format, and yet somehow the legal system has successfully avoided criminalizing the possession of arbitrary random numbers. But if you happen to have a decoder for said highly unusual binary format, then you are going to jail.

Likewise if you happen to know that your "random numbers" are in fact cryptocurrency-controlling key pairs and you harbor an intent to traffic in cryptocurrencies, lo and behold, those "random numbers" suddenly transmute into a cognizable thing that can be criminalized.

Intent matters in law.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#249

Post by dredmorbius »

tibbydudeza wrote: post #170
dredmorbius wrote: post #135

Earlier quoted context omitted.

At some point they're affected. Staff, service workers, guests, neighbours.

Yes who is going to serve the champagne and canapes ???.

I understand the sentiment. But the logistical and support tail is large, and too large to chopper over.

The point remains that a ferry service cut will be felt. Snark-infested waters or not.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#250

Post by kwhitefoot »

rsj_hn wrote: post #179
MattGaiser wrote: post #119

Earlier quoted context omitted.

As I said, we can dislike it, but as a society we have basically decided that anything short of reasonably straightforward violent crime/extreme violent crime and high value property crime and easy to prosecute drug crime is not worth the effort. I don't disagree, but I hear very little discussion about low solve rates for smaller crimes.

> As I said, we can dislike it, but as a society we have basically decided that anything short of reasonably straightforward violent crime/extreme violent crime and high value property crime and easy to prosecute drug crime is not worth the effort. No, I would say that a few counties have decided this, but the majority of counties have not. In most places, you do get arrested for property crimes, you still serve pris…

counties -> countries ?
Post reply on HN