Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

nbcboston.com

Post reply on HN
Print view View original

251–260 of 267 posts

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#251

Post by kwhitefoot »

strogonoff wrote: post #197
throwawaygh wrote: post #79

Earlier quoted context omitted.

Writing a law that prevents this sort of pass-through is trivial. Hold all parties responsible. Don't even require first-hand knowledge that a ransom was paid. Writing a law with proper disincentives is also trivial -- forget about fines. Proper jail time for senior execs and board members. Execs and boards will be damn sure not to pay ransoms, and additionally damn sure that any company they hire to help knows in no…

Laws that disincentive paying ransoms don’t seem to necessarily be that simple to implement and uphold, at least as long as cryptocurrencies are in the equation. Someone may have paid into that wallet, but who? Was it the attackers themselves, to make it seem to observers as if they succeeded? Did some consultant happen to keep a stash of crypto? Maybe the boss of the hacked organization wisely maintained a wallet fo…

Presumably someone had to buy the cryptocurrency in the first place so that should be traceable.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#252

Post by kwhitefoot »

MattGaiser wrote: post #52
api wrote: post #39

Earlier quoted context omitted.

A few businesses die. The rest get the message that security matters. The ransomware industry is deprived of revenue.

This is a government agency. https://en.wikipedia.org/wiki/Steamship_Authority

In which case there are no investors so just wipe all the computers and start again.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#253

Post by kwhitefoot »

JumpCrisscross wrote: post #35
xwdv wrote: post #32

Earlier quoted context omitted.

A federal regulation requiring decent cybersecurity measures would be better.

> regulation requiring decent cybersecurity measures would be better For those of us who make money when cybersecurity dollars are spent, yes. Practically, you’d get a federal agency writing checklists.

Checklists make aviation and surgery safer.

No one expects the check lists to result in a perfect outcome but not having them quite likely results in a worse outcome.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#254

Post by franksredhot »

kwhitefoot wrote: post #250
rsj_hn wrote: post #179

Earlier quoted context omitted.

> As I said, we can dislike it, but as a society we have basically decided that anything short of reasonably straightforward violent crime/extreme violent crime and high value property crime and easy to prosecute drug crime is not worth the effort. No, I would say that a few counties have decided this, but the majority of counties have not. In most places, you do get arrested for property crimes, you still serve pris…

counties -> countries ?

I assume the parents comment was a reference to some of the counties in Washington state and a few other states where the district attorney’s office has opted to not persecute non-violent offenses or otherwise limit what charges they are willing to pursue.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#255

Post by benhurmarcel »

bagacrap wrote: post #200
PeterisP wrote: post #152

Earlier quoted context omitted.

The initial foothold exploits - where application whitelisting would help the most - generally are not "critical systems", they are the daily workstations of random employees. By the time the attackers reach your critical systems, they most likely can attack them with stolen credentials without running any exploits that whitelisting would prevent. To protect your company, application whitelisting needs enough usabili…

What makes app whitelisting hard to use on an employee's corporate issue laptop? They shouldn't install anything that doesn't have a business purpose, and these days there are hardly any native apps people want to install anyway.

In practice it's quite common to run (and sometimes install) software that isn't whitelisted officially, even if it's outside strict IT rules.

Otherwise have fun editing scripts with Notepad++ because IT never cared to allow VSCode, unzipping using Windows Explorer's feature because your request for 7zip was denied since the feature exists on paper, navigating the web without content blocker, being restricted to Python 3.1 because the responsible doesn't care about updates, not being able to run your own compiled scripts, being unable to run your keyboard macros, having to manage your passwords in a txt file, having only Excel to analyze data…

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#256

Post by [deleted] »

PopePompus wrote: post #203
dharmab wrote: post #129

Earlier quoted context omitted.

I think a lot of the HN crowd think of laws like computer code- that it needs to be very exact. Most laws are fairly generalized with broad coverage, and the cases where they're not tend to be the exception, not the rule.

The law is like 100,000 lines of pseudo-code written by a humanities major who never took a CS class.

[deleted]

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#257

Post by throwawaygh »

strogonoff wrote: post #197
throwawaygh wrote: post #79

Earlier quoted context omitted.

Writing a law that prevents this sort of pass-through is trivial. Hold all parties responsible. Don't even require first-hand knowledge that a ransom was paid. Writing a law with proper disincentives is also trivial -- forget about fines. Proper jail time for senior execs and board members. Execs and boards will be damn sure not to pay ransoms, and additionally damn sure that any company they hire to help knows in no…

Laws that disincentive paying ransoms don’t seem to necessarily be that simple to implement and uphold, at least as long as cryptocurrencies are in the equation. Someone may have paid into that wallet, but who? Was it the attackers themselves, to make it seem to observers as if they succeeded? Did some consultant happen to keep a stash of crypto? Maybe the boss of the hacked organization wisely maintained a wallet fo…

This is a great example of technologists underestimating the law. Juries, judges, and legislators are not complete dumbasses.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#258

Post by strogonoff »

kwhitefoot wrote: post #251
strogonoff wrote: post #197

Earlier quoted context omitted.

Laws that disincentive paying ransoms don’t seem to necessarily be that simple to implement and uphold, at least as long as cryptocurrencies are in the equation. Someone may have paid into that wallet, but who? Was it the attackers themselves, to make it seem to observers as if they succeeded? Did some consultant happen to keep a stash of crypto? Maybe the boss of the hacked organization wisely maintained a wallet fo…

Presumably someone had to buy the cryptocurrency in the first place so that should be traceable.

One might not need to buy cryptocurrency all at once after the hack nor do it with visible corporate money, CEO can own a crypto wallet not connected to them in any way, there are mixers/anonymizers, etc. The range of possibilities is much broader in that land.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#259

Post by rsj_hn »

kwhitefoot wrote: post #250
rsj_hn wrote: post #179

Earlier quoted context omitted.

> As I said, we can dislike it, but as a society we have basically decided that anything short of reasonably straightforward violent crime/extreme violent crime and high value property crime and easy to prosecute drug crime is not worth the effort. No, I would say that a few counties have decided this, but the majority of counties have not. In most places, you do get arrested for property crimes, you still serve pris…

counties -> countries ?

I am talking about counties in the U.S. There are a handful of extremist district attorneys that follow the view that non-violent crime should not result in prosecution or prison. To my knowledege, there are no countries anywhere that have adopted this view, and only a few local district attorneys are advocating for it. There are differences in the severity of non-violent crime needed to get prison sentences, but that was always the case.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#260

Post by dredmorbius »

adrian_b wrote: post #245
dredmorbius wrote: post #201

Earlier quoted context omitted.

At some point there's a functional mapping from key to indicia. Releasing "lots of malware" either means a finite keyset, or a key-generation mechanism. At least as I see it. (I'd really like to find a detailed analysis of the malware software. There was an earlier version of the Darkside attack which used a weak mechansim for key generation.)

They would normally use a key-generation mechanism, but knowing that is not helpful at all. A typical key-generation mechanism would be for each malware copy to have a serial number and the keys to be generated by encrypting the serial number, e.g. with AES, using another secret key. Even if you know precisely the serial number of a copy and how the per-copy keys are generated by the attacker, you do not know the att…

How would the malware itself generate, or verify, the decryption key without the secret key?

This is the distributed-secret-key problem.

Post reply on HN