Massachusetts Steamship Authority hit by ransomware attack; ferries delayed • Hacker News Board

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#261

Post by rdtsc » Thu, Jun 03, 2021, 5:38 PM UTC

svenfaw wrote: post #243

rdtsc wrote: post #221

Earlier quoted context omitted.

> but Russia enables the operation to not worry about consequences (a lot of ransomware will disable itself on Russian computers to avoid local prosecution). I remember reading how supposedly adding a Russian or a few other keyboard layouts might fool some of the malware to ignore the machine [1]. I guess one idea for the Western intel agencies could be to play off of that, and somehow disable that check (infect thei…

If they could do that they might just as well disable the file-encrypting part.

If the goal is to put them the crosshairs of their own government's law enforcement. However, that said, in those parts the line between law enforcement and criminal organization is pretty gray and fluid.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#262

Post by rurban » Thu, Jun 03, 2021, 8:19 PM UTC

dopidopHN wrote: post #217

Grimm1 wrote: post #166

Earlier quoted context omitted.

IOT isn't datacenter server technology. IOT is basically in the state of software security from 20 years ago. Often running crappy proprietary stuff. Your average server running a recent Linux kernel is Fort Knox comparatively. There have been massive strides in many places in software security but IOT and embedded security in general is very lacking unless your talking things going into space or military.

The S in IOT stands for security, after all.

The S in Linux ditto.

Linux has a far wider attack surface than my baremetal embedded firmware. Like 10^6 wider. There's a single mqtts service mostly, or just passive senders (sensors, controllers). Zero attack surface.

Linux is way too big, with thousands of drivers, services and patches.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#263

Post by rurban » Thu, Jun 03, 2021, 8:27 PM UTC

So why is HN steaming over this?

It's the classic antagonist to the Colonial pipeline hysteria, which stopped their pumps because they would not be able to account for the exact gallons delivered to which customer. So they rather stopped a critical infrastructure. Hilarious. Plus Windows.

Here again the Windows office PCs were affected, but the steamships themselves didn't care much. They kept going, you only had to pay for your ticket onboard, not online. Online reservations were not honored.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#264

Post by sanderjd » Thu, Jun 03, 2021, 9:04 PM UTC

dodobirdlord wrote: post #238

sanderjd wrote: post #227

Earlier quoted context omitted.

Ban them how? Ban the on-ramps in the US so that companies can't legally purchase cryptocurrency with which to pay the ransom? Is that fundamentally different than making it illegal to pay the ransom in any currency? It seems that in either case, what you've done is push a company into breaking the law if they want to pay the ransom, which would probably deter most of them from doing it. Or do you mean banning both t…

Laws can be made very broad and can generally lay out a ban and leave it up to those impacted to figure out how to comply with the law. A hypothetical law could criminalize possession of all cryptocurrency wallet keys for all US citizens and all corporations that operate in the United States, with a regulatory agency tasked with adding to the list of “cryptocurrencies” each time someone launches a new one. There’s no…

It is wise to consider enforceability when passing laws. The law you have proposed is not enforceable.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#265

Post by greyface- » Thu, Jun 03, 2021, 9:05 PM UTC

dodobirdlord wrote: post #248

greyface- wrote: post #244

Earlier quoted context omitted.

What constitutes "possession" of a key? How do we treat multi-signature arrangements? What differentiates a cryptocurrency key from a non-cryptocurrency key? Would this criminalize the holding of any private key at all, even if intended for non-cryptocurrency applications? What happens if I generate a key for non-cryptocurrency use and then someone later sends cryptocurrency to it? Am I going to jail? Do I need to re…

> What constitutes "possession" of a key? How do we treat multi-signature arrangements? These are solved legal problems. Cryptographic possession is a well understood legal concept that comes up all the time in contexts like custody of financial instruments or digital evidence. > What differentiates a cryptocurrency key from a non-cryptocurrency key? Would this criminalize the holding of any private key at all, even…

> Once you discover that you are in possession of cryptocurrency, you can simply send it directly to a government-controlled blackhole address

Previously you said I had to destroy the key. When is key destruction necessary and when is transfer to government necessary?

What if the transaction to my address is timelocked to 5 years in the future? Does that create any custody responsibilities on my end between now and 5 years from now when it becomes spendable and I can surrender it to the government?

What if I'm sent $50,000 worth of "dust" outputs that are only spendable by paying a $49,500 miner fee? Do I really need to pay miners to incur $49,500 worth of carbon emissions in order to cleanse my secp256k1 private key of $500 worth of bitcoin-ness so that I may continue using it in peace?

> Child pornography is the classic example. Any arbitrary sequence of bits could in principle be child porn expressed in some highly unusual binary format, and yet somehow the legal system has successfully avoided criminalizing the possession of arbitrary random numbers

This is true only because the "child pornography-ness" of the data is a property of the data itself, even if it's in an obscure format. Any arbitrary cryptographic key can be imbued with "cryptocurrency-ness" by anyone else, which means that revealing your non-cryptocurrency public keys now exposes you to risk, as long as some cryptocurrency out there uses the same type of public key.

If we're dead-set on banning it, why ban "possession" instead of use? If it's illegal to send cryptocurrency, but still legal to "possess" it, a lot of these problems go away. Making it illegal to sign a bitcoin transaction is a lot simpler than creating a new class of illegal number, and seems like it would be just as effective at ending the behavior it's trying to end. Maybe even better at it, since it would not incentivize additional "surrendering coins to government" transactions.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#266

Post by not_kurt_godel » Thu, Jun 03, 2021, 10:48 PM UTC

TheCoelacanth wrote: post #192

not_kurt_godel wrote: post #23

Earlier quoted context omitted.

Would it? For some businesses, the reality is going to be that paying is necessary to continue to exist. What happens when that option, as crappy as it is, is off the table?

Then you go out of business. That's what is supposed to happen in capitalism when you run your business badly.

Sounds like maybe not the best for people who work at the company and whose livelihoods depend on it (especially, of course, those whose purview has nothing to do with cybersecurity).

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#267

Post by Godel_unicode » Thu, Jun 03, 2021, 11:14 PM UTC

WalterBright wrote: post #232

Godel_unicode wrote: post #229

Earlier quoted context omitted.

First, adding manual steps to backups is a terrible idea. People already don't do them (which, since you missed it, you should know is actually the problem), and you're suggesting making them error-prone and manual. Second, where is this idea coming from that corrupted backups are the issue? You're solving a problem that doesn't exist and creating a real one.

> Second, where is this idea coming from that corrupted backups are the issue? When I read about how ransomware encrypted every drive attached to it, and encrypted the backup drives when they were attached. This was why the ransomware waited some length of time before shutting off access to the user - they wanted to get the backup drives encrypted, too. > You're solving a problem that doesn't exist Now you know!

Ah, you're talking about home user backups, then sure. I was confused because I thought we were talking about corporate backups and no corporation which does backups does them anything like how you're describing them.