Yeah sure, just like sanctions and tariffs are a economic way of doing war. But how do you response with counter cyber attacks or sanctions and tariffs.
Merck’s NotPetya attack: Was it an act of war?
31–40 of 115 posts
Re: Merck’s NotPetya attack: Was it an act of war?
#32> One researcher told a colleague she’d lost 15 years of work. You're telling me that you had never backed up anything in the span of 15 years?
This happens far more often than it should. Non-experts simply don't realise the importance of backups.
Re: Merck’s NotPetya attack: Was it an act of war?
#33Earlier quoted context omitted.
The claim in the article is that the target was Ukraine, the attacker Russia, and Merck a collateral casualty at an attempt to disguise a state-sponsored cyber-attack as a criminal extortion attempt. One would need to dig deeper to get a really informed opinion. I do believe Russia to be able and willing to do that, I do believe the so-called "Western intelligence agencies" to blame any malware on Russia or China on…
If you analyze the NotPetya attack, it differs from other ransomware attempts in two respects. First, it was specifically targetting Ukraine. Second, the attackers didn't actually take any money but rendered all systems defunct. If you are a criminal, you aim to make money, right? Why give up on that possibility? It makes no sense. So, even if in the infosec world you can never say never, but just as Stuxnet is gener…
>If you are a criminal, you aim to make money, right? //
I don't think that is right. You don't decide to be a criminal, you decide to perform an action, you get labelled then by others.
Some people want to destroy big businesses, they can possibly make as much money as they need already.
Of course you can make money through a side-channel that's less traceable too.
Re: Merck’s NotPetya attack: Was it an act of war?
#34Act of war against .... Merck, a company? I've heard of some circuitous logic to deny insurance claims, but this was not an act of war against Merck, which BTW isn't a country, so by definition, one can't go to war with it? Well, maybe hyperbolically a competitor might, but unlike real war, they're bound by the rules and laws of civil society This is the very definition of an accident, if the article is to be believe…
>> This is the very definition of an accident How is something deliberately planned and executed, by a military intelligence agency, for weeks or months, an accident? And how are you so sure Merck's IT team didn't fail to have backups, redundancy, security patches, etc. to prevent an attack of any sort from being such a big deal?
Did that military agency plan for it to damage Merck? Or was that an accident?
Re: Merck’s NotPetya attack: Was it an act of war?
#35Something like a missile attack on a Samsung factory is so easy to investigate and get conclusive evidence about what happened. Within hours or days we would know with almost certainty if it was an act of war or something else (accidental firing by the South Korea military or something...).
Consider something like Stuxnet, it took years before it was truly discovered and attribution could be made, at least in way which would hold up in a lawsuit about insurance claims.
Re: Merck’s NotPetya attack: Was it an act of war?
#36It's really an act of not being prepared. $1.7B? They should be able to destroy and rebuild their entire infrastructure in less than a day. Have tested backup and restore processes. Ideally have all users in VMs. I don't see how this isn't entirely Merck's fault.
Our entire software and hardware ecosystem is extremely vulnerable and any single layer or part you can name has been proven insecure. Processors, programming languages, frameworks and packages, undersea cables, routers...it's swiss cheese all the way down.
All of us who are working in software and hardware are in a way to blame for this disaster and until everything is rebuilt from the ground up computing will depend on the worldwide cooperation of benevolent actors.
Re: Merck’s NotPetya attack: Was it an act of war?
#37Earlier quoted context omitted.
>> This is the very definition of an accident How is something deliberately planned and executed, by a military intelligence agency, for weeks or months, an accident? And how are you so sure Merck's IT team didn't fail to have backups, redundancy, security patches, etc. to prevent an attack of any sort from being such a big deal?
Did that military agency plan for it to damage Merck? Or was that an accident?
Are you serious? They planned to launch the equivalent of a digital bomb, knowing full well there would be plenty of collateral damage. Hell no it isn't an "accident"
I will put it another way. I feel quite confident the 9/11 bombers did not know, or specifically target, my friends and acquaintances who died in those towers. Therefore, are you going to claim 9-11 was an accident?
If I intend to rob a convenience store, and in the process of doing so, my gun goes off and the clerk is shot and killed, was it just an accident?
Re: Merck’s NotPetya attack: Was it an act of war?
#38Act of war against .... Merck, a company? I've heard of some circuitous logic to deny insurance claims, but this was not an act of war against Merck, which BTW isn't a country, so by definition, one can't go to war with it? Well, maybe hyperbolically a competitor might, but unlike real war, they're bound by the rules and laws of civil society This is the very definition of an accident, if the article is to be believe…
>> This is the very definition of an accident How is something deliberately planned and executed, by a military intelligence agency, for weeks or months, an accident? And how are you so sure Merck's IT team didn't fail to have backups, redundancy, security patches, etc. to prevent an attack of any sort from being such a big deal?
>"And how are you so sure Merck's IT team didn't fail to have backups, redundancy, security patches, etc. to prevent an attack of any sort from being such a big deal?"
If the insurance claim is ~$1.3bn, we can safely say that the NotPetya cleanup isn't a trivial thing for them.
How many companies have we heard about who were totally screwed after a ransomware outbreak, because their only backups were online - network connected? Does anybody have offline backups anymore?
Is corporate IT negligent where it appears to have no disaster recovery plan?
Re: Merck’s NotPetya attack: Was it an act of war?
#39Earlier quoted context omitted.
Did that military agency plan for it to damage Merck? Or was that an accident?
Are you serious? They planned to launch the equivalent of a digital bomb, knowing full well there would be plenty of collateral damage. Hell no it isn't an "accident" I will put it another way. I feel quite confident the 9/11 bombers did not know, or specifically target, my friends and acquaintances who died in those towers. Therefore, are you going to claim 9-11 was an accident? If I intend to rob a convenience stor…
Yes I am serious. Are you? How about we keep this respectful and do away with the condescending tone, which is not really welcome here on Hacker News?
9/11 was presumably intended to damage as much property and kill as many people as possible. So no, the people who died as a result of that terrorist attack against the US were not killed by accident.
Yes, if your gun accidentally goes off during a robbery, that is by definition an accident. An accident that could have been avoided if different choices had been made, but still an accident.
If the intended target in this case was the Ukraine, and companies in the USA suffered immense damages it's reasonable to ask if those unintended consequences were accidental. Similar to how a bomb dropped on an Italian border in WWII might accidentally kill ally French citizens on the other side of the border. With cyber warfare it becomes much more interesting, because those accidents don't respect physical distance.
Re: Merck’s NotPetya attack: Was it an act of war?
#40Act of war against .... Merck, a company? I've heard of some circuitous logic to deny insurance claims, but this was not an act of war against Merck, which BTW isn't a country, so by definition, one can't go to war with it? Well, maybe hyperbolically a competitor might, but unlike real war, they're bound by the rules and laws of civil society This is the very definition of an accident, if the article is to be believe…
Act of war against Ukraine, per the article.
Not really per the article. The article says there are claims that it was an act of war against Ukraine. It does not provide proof that it was in fact an act of war.