Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported

nytimes.com

Post reply on HN
Print view View original

31–40 of 51 posts

Re: An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported

#31

Post by hinkley »

vkou wrote: post #19
mindslight wrote: post #16

Earlier quoted context omitted.

Actually, the situation is complete opposite. Code is formal, deterministically executable rules. That's a boon for the rule of law, as the vast majority of "crimes" can be prevented a priori , rather than chased down post facto. Even C++ is miles ahead of the "legalese" that forms traditional laws. Being executable by the common person, it avoids one glaring violation of equal protection that modern legalese limps a…

> The real problem driving this article is the legacy ambient authorities wanting to expand their role, insisting that the informal intentions behind the design of (and decision to run) the code should carry more weight than the code itself! Just because I accidentally left my door unlocked today doesn't mean that entering my house, and taking all my stuff isn't burglary. You don't have to be a telepath to know that…

    just because you could do something, you can do something.
There is no more perfect state of Anarchy in the world than code.

What we are missing is good forensics. A number of people in this thread have hinted at this.

Re: An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported

#32

Post by hinkley »

arca_vorago wrote: post #20
rb808 wrote: post #12

Earlier quoted context omitted.

Would be nice if cloud providers automatically had a fence around your subnet with an ssh proxy that did this stuff already. Seems crazy that typically you open up ssh directly to everyone.

I haven't done that for years, prefering instead to change ports to an uncommon one and even then that port is only opened upon port knocking. My logs are so much easier to parse. (These days in nftables instead of iptables.) There actually is some security through obscurity, despite everyone loving to bandwagon otherwise.

You put a wall around your property. It kept the dilettantes out, which means you have free time for something else.

If there’s a buffer overflow attack against SSH then you have security through obscurity. In the meantime you have security and obscurity. Assuming you’re using known rsa keys to login remotely...

Re: An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported

#33

Post by gowld »

mindslight wrote: post #16
tessierashpool wrote: post #15

tech crimes are so much easier to commit than to solve, prevent, or punish that they represent a huge threat to the rule of law. in the West, crime hasn't had this kind of advantage over law enforcement since the Middle Ages. in particular, C and C++ could literally become the downfall of Western civilization.

Actually, the situation is complete opposite. Code is formal, deterministically executable rules. That's a boon for the rule of law, as the vast majority of "crimes" can be prevented a priori , rather than chased down post facto. Even C++ is miles ahead of the "legalese" that forms traditional laws. Being executable by the common person, it avoids one glaring violation of equal protection that modern legalese limps a…

https://meltdownattack.com/ spectactulary refutes this thesis.

Also: https://en.wikipedia.org/wiki/Zero-day_(computing)

Re: An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported

#34

Post by devit »

tessierashpool wrote: post #15

tech crimes are so much easier to commit than to solve, prevent, or punish that they represent a huge threat to the rule of law. in the West, crime hasn't had this kind of advantage over law enforcement since the Middle Ages. in particular, C and C++ could literally become the downfall of Western civilization.

> C and C++ could literally become the downfall of Western civilization.

Rust coming to the rescue!

Seriously, I think peak insecure C/C++ has already passed, so if civilization hasn't fallen yet, it's not likely to fall for this reason.

Re: An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported

#35

Post by logfromblammo »

IntronExon wrote: post #2

Many, if not most, crimes go unreported offline. Is it really a shock that the same might be true online? It’s not as though police are likely to find and return your stolen property from a mugging or burglary. Above all, policing needs “better systems for gathering data,” the report said. Oooooh. Well that was predictable. Stingrays and lobbying for cryptographic backdoors not enough to do the job hm?

The only reason I'd report property crime to the cops is because my insurance company makes me do it as part of the claims process.

The cops don't work for us; they work for the Them with a capital 'T'. The only thing that reliably works is best-effort individual defense plus insurance for when that fails. Keep your doors locked and your backups offsite, because chances are good that if anyone breaks in, police investigators won't produce any useful results, ever.

The Warren vs. D.C. decision just confirmed what was already fact.

If you live in the U.S., it is likely that you have lived your entire life such that the number of police encounters you might rate as positive are vastly outweighed by those you saw as negative. That is certainly true for me. At least my encounters have ranged from "unhelpful" to "annoying", rather than from "useless" to "deadly".

What they need is better systems to ensure that they are actually acting in the public interest, instead of like a hostile occupying army.

Re: An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported

#36

Post by djsumdog »

chatmasta wrote: post #30
UseStrict wrote: post #18

For entire classes of online crime, from a purely data perspective I wonder if providing a way to anonymously report a crime would help? Things like extortion, cheating spouses, lewd photos, revenge porn tend to be quite embarrassing, and perhaps pursuing justice isn't worth getting exposed. But knowing names, emails, patterns, and other details might help at least paint a better picture of the true nature of online…

An informal and anonymous process to allow the public to arbitrarily submit people’s names to a criminal watchlist? What could go wrong?

Makes me think of the Swatting incident.

Re: An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported

#37

Post by djsumdog »

MichaelGG wrote: post #13
IntronExon wrote: post #2

Many, if not most, crimes go unreported offline. Is it really a shock that the same might be true online? It’s not as though police are likely to find and return your stolen property from a mugging or burglary. Above all, policing needs “better systems for gathering data,” the report said. Oooooh. Well that was predictable. Stingrays and lobbying for cryptographic backdoors not enough to do the job hm?

What's the point of reporting? We had an issue with a sysadmin. Ended up firing him but didn't revoke all his credentials in time. He logged in and deleted all our Azure servers and rm -rf'd our GCP boxes. MS wouldn't help us at all, but Google's console log showed the login from the guy's town. What're we supposed to do? He was in England and we the US. Had a similar issue with a hacker that found a way around our b…

The US has police relations with both the UK and Canada. When happened when your company tried to contact authorities in those States? It seems like prosecution should be possible, or at least civil liability.

Re: An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported

#38

Post by djsumdog »

rb808 wrote: post #12
protomyth wrote: post #5

Looking at one of my servers that services an external address, I see about 100 IPs listed in the authlog file that are trying various passwords and such to break in. Its not even a main server (www, mail, dns, etc.). Of course, I use keys only for login, but it is a bit annoying. I guess I am getting quite a block list built. So, does the author expect me to report all these IPs? Who would I send them to? Is there a…

Would be nice if cloud providers automatically had a fence around your subnet with an ssh proxy that did this stuff already. Seems crazy that typically you open up ssh directly to everyone.

In my most recent setup I created two VMs, one with just 80/443 -> HAProxy open and a second with only openvpn open. It should be more common practice, and offered by default from more providers, but unfortunately for now, you still have to set it all up yourself:

http://penguindreams.org/blog/bee2-creating-a-small-infrastr...

Re: An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported

#39

Post by vkou »

mindslight wrote: post #21
vkou wrote: post #19

Earlier quoted context omitted.

> The real problem driving this article is the legacy ambient authorities wanting to expand their role, insisting that the informal intentions behind the design of (and decision to run) the code should carry more weight than the code itself! Just because I accidentally left my door unlocked today doesn't mean that entering my house, and taking all my stuff isn't burglary. You don't have to be a telepath to know that…

> Society only functions because we respect the informal intentions of other people. I agree wholeheartedly, in the local scale person-to-person sense. But your argument is knocking down a straw man, by coming at it from the other direction. I'm not advocating for being an asshole via finding loopholes, but against the ridiculousness of creating a second set of half-formal rules to repair deficiencies in the fully fo…

> If an action is "wrong" but not illegal you can't actually be sanctioned for it. See: pretty much any large company in the news over some kind of outrage that will ultimately go unpunished.

Law is subject to human interpretation, evaluation of intent, and error correction. Every case has a number of unknowns that judges and juries are supposed to clarify. This is a feature, not a bug.

Code does not. The source for any non-trivial program encodes an uncountable number of unknowns that frequently lead us to absurd conclusions, with no ability to sanity check or correct them.

Re: An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported

#40

Post by leggomylibro »

TeMPOraL wrote: post #4

Skimming the article, it seems to me that what they need most right now is not systems for gathering more data, but systems for analyzing data they already have . Like, the iPhone thing - they didn't notice because they classified each event as one-off, so nobody looked for possible connection. I assume police stations don't exchange data with each other as much as they should either. As for the crimes going unreport…

What you're saying was more or less the argument in favor of the Patriot Act's expanding of domestic intelligence gathering, fwiw.

And how'd it work out? Apparently not too well, if we're still seeing the same comments a decade later.

Post reply on HN