Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

nbcboston.com

Post reply on HN
Print view View original

31–40 of 267 posts

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#31

Post by AlexandrB »

Jtsummers wrote: post #20
user-the-name wrote: post #17

Earlier quoted context omitted.

It would cause companies to pay secretly and illegally instead, something which cryptocurrencies enable. Ban cryptocurrencies. They are the cause of the ransomware epidemic.

> Ban cryptocurrencies. This is meant sincerely, not glibly: How? How can cryptocurrencies be banned in any meaningful sense? We can "ban" them in a legal sense ("Use of cryptocurrencies are illegal after 1 Jan 2022"), great. But how can they be practically banned so long as computers themselves are not invaded by governments to observe every detail of their operation and private overlay networks are still technicall…

Cryptocurrencies are basically securities. If it's difficult or impossible to exchange fiat currency for cryptocurrency and vice-versa, the value of cryptocurrency drops to basically nothing. What's the point of owning a security you can't sell to pay your taxes/mortgage/electric bill?

Even if cryptocurrencyfiat transactions continue to be legal in other jurisdictions, making it illegal to trade USD for $crypto would make it very hard for a US company to pay cryptocurrency ransoms making such schemes much less lucrative.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#33

Post by JumpCrisscross »

Jtsummers wrote: post #20
user-the-name wrote: post #17

Earlier quoted context omitted.

It would cause companies to pay secretly and illegally instead, something which cryptocurrencies enable. Ban cryptocurrencies. They are the cause of the ransomware epidemic.

> Ban cryptocurrencies. This is meant sincerely, not glibly: How? How can cryptocurrencies be banned in any meaningful sense? We can "ban" them in a legal sense ("Use of cryptocurrencies are illegal after 1 Jan 2022"), great. But how can they be practically banned so long as computers themselves are not invaded by governments to observe every detail of their operation and private overlay networks are still technicall…

> How can cryptocurrencies be banned in any meaningful sense?

By banning them? In the law? Enforcement would probably pay for itself, plus some. Throw in a whistleblower bonus, like the SEC has, if you want it to run on autopilot.

More aggressive: level repeated 51% attacks. This is well within the budget of any of the G7.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#34

Post by tyingq »

COGlory wrote: post #24
x86_64Ubuntu wrote: post #14

Earlier quoted context omitted.

It's not the IT workers saying that their secure, it's us telling the business that we need X dollars to mitigate risk of Y. And then the accounting people are like "But it hasn't happened yet, why would we pay to prevent something that hasn't happened yet!???"

Can we go after these decision makers for negligence, then?

It feels like a chicken-egg problem. The actual consequences to the business aren't often serious, so it's difficult for them to get support to spend serious money on it.

Maybe mandatory high-cost, high-limit cyber insurance, with dramatically lower rates provided you can prove x/y/z, would make for an incentive?

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#35

Post by JumpCrisscross »

xwdv wrote: post #32
JumpCrisscross wrote: post #6

A federal ban on paying ransomeware would reduce the incentive to commit these attacks.

A federal regulation requiring decent cybersecurity measures would be better.

> regulation requiring decent cybersecurity measures would be better

For those of us who make money when cybersecurity dollars are spent, yes. Practically, you’d get a federal agency writing checklists.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#36

Post by paxys »

Jtsummers wrote: post #20
user-the-name wrote: post #17

Earlier quoted context omitted.

It would cause companies to pay secretly and illegally instead, something which cryptocurrencies enable. Ban cryptocurrencies. They are the cause of the ransomware epidemic.

> Ban cryptocurrencies. This is meant sincerely, not glibly: How? How can cryptocurrencies be banned in any meaningful sense? We can "ban" them in a legal sense ("Use of cryptocurrencies are illegal after 1 Jan 2022"), great. But how can they be practically banned so long as computers themselves are not invaded by governments to observe every detail of their operation and private overlay networks are still technicall…

They can easily ban all exchanges which convert USD BTC from operating within the US. If that is enforced, Bitcoin will effectively be dead in the country.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#37

Post by GauntletWizard »

Jtsummers wrote: post #20
user-the-name wrote: post #17

Earlier quoted context omitted.

It would cause companies to pay secretly and illegally instead, something which cryptocurrencies enable. Ban cryptocurrencies. They are the cause of the ransomware epidemic.

> Ban cryptocurrencies. This is meant sincerely, not glibly: How? How can cryptocurrencies be banned in any meaningful sense? We can "ban" them in a legal sense ("Use of cryptocurrencies are illegal after 1 Jan 2022"), great. But how can they be practically banned so long as computers themselves are not invaded by governments to observe every detail of their operation and private overlay networks are still technicall…

You don't need to. Absolutely, if you ban cryptocurrencies, only criminals will have cryptocurrencies. It will, however, add friction - and make it harder to acquire and launder the funds involved.

I think a complete ban on cryptocurrencies is unlikely to succeed, for much the same reasons that the US hasn't banned guns and that the war on drugs is such a shitshow. A punitative tax: 10% of every transaction, for example, would still make cryptocurrencies viable for some extreme schemes, but would make the practice much harder and help establish the "real identity" -> Bitcoin address audit trail. Al Capone was busted on tax evasion, after all.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#38

Post by ghaff »

COGlory wrote: post #19
user-the-name wrote: post #17

Earlier quoted context omitted.

It would cause companies to pay secretly and illegally instead, something which cryptocurrencies enable. Ban cryptocurrencies. They are the cause of the ransomware epidemic.

Unless they were globally banned, companies could secretly and illegally pay ransoms in them anyways.

They possibly could but a lot of executives would probably prefer that their soon to be ex-company took a hit than that they became personally liable for breaking a federal law.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#39

Post by api »

not_kurt_godel wrote: post #23
JumpCrisscross wrote: post #6

A federal ban on paying ransomeware would reduce the incentive to commit these attacks.

Would it? For some businesses, the reality is going to be that paying is necessary to continue to exist. What happens when that option, as crappy as it is, is off the table?

A few businesses die. The rest get the message that security matters. The ransomware industry is deprived of revenue.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#40

Post by OminousWeapons »

COGlory wrote: post #28
OminousWeapons wrote: post #25

Earlier quoted context omitted.

How are you going to sell customers tickets remotely without an internet presence? How are you going to field customer service complaints or general inquiries without email? How are your employees going to do work at multiple sites without VPNs? If you pitch "lets do everything by phone" you will be laughed out of the room. I agree that things should be kept off the internet unless they absolutely need to be there, b…

How are they going to sell tickets with their infrastructure offline to a ransomware attack? I'm not sure a perfect solution, but the standard of living was pretty good before the internet. Doing away with reliance on infrastructure for critical things like food processing, energy, and transit does not seem like a high price to pay to avoid a Thanksgiving turkey conundrum. All these services are going to go unhacked,…

> How are they going to sell tickets with their infrastructure offline to a ransomware attack?

They get by temporarily by doing things manually until they get their services back up, and they get compensated by insurance, but a few day partial loss of business pales in comparison to how much revenue they would lose by going offline. A vast swath of their current and potential users wouldn't even know they existed without them having an online presence. The only solution would be buying that knowledge from someone else such a travel agent. Even with that knowledge, it would be orders of magnitude more inconvenient to book and receive tickets, there would be a lot more fraud, and everything would move much more slowly.

> We get minor conveniences for having them online. We suffer massively when they go offline.

We get MASSIVE convenience by them being online and we suffer transient, relatively painless outages when they go offline. The most serious outage we suffered was that pipeline going down, and it was down for under a week.

Post reply on HN