Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

nationalcrimeagency.gov.uk

Post reply on HN
Print view View original

31–40 of 67 posts

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#31

Post by scott_w »

martinald wrote: post #25
scott_w wrote: post #16

Earlier quoted context omitted.

This simply isn’t true. Yes, teenagers are morons by the standard of a well adjusted 30 year old, but they’re more than capable of understanding consequences for their actions. I hate to sound like my parents/grandparents but I absolutely knew that causing millions of pounds of damage and attempting to blackmail a major corporation could have huge negative consequences for people and myself at 17.

But it is very well understood and accepted that teenage - especially male prefrontal cortexes don't fully develop until mid 20s. I'm sure they knew it could have major consequences, but when your risk taking pedal (limbic system) pedal is pushed to the floor all the time and your risk avoidance brakes (prefrontal cortex) is not fully developed that all goes out of the window, not unlike being intoxicated. For exampl…

> Young people have little fear of repercussion as they cant really fathom the consequences.

> But it is very well understood and accepted that teenage - especially male prefrontal cortexes don't fully develop until mid 20s.

Your statement here does not mean that the statement I quoted above is true. Just because biology predisposes one to doing stupid shit does not mean young people are incapable of understanding consequences and repercussions. The fact that most of us here never went out to cause millions of pounds of damage is testament to that.

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#32

Post by scott_w »

immibis wrote: post #19
scott_w wrote: post #16

Earlier quoted context omitted.

This simply isn’t true. Yes, teenagers are morons by the standard of a well adjusted 30 year old, but they’re more than capable of understanding consequences for their actions. I hate to sound like my parents/grandparents but I absolutely knew that causing millions of pounds of damage and attempting to blackmail a major corporation could have huge negative consequences for people and myself at 17.

The probability they'll try to teach you to obey the law instead of locking you in a cell for life is significantly higher when you're 17 than when you're 35. Even better if you're 13, though.

I’m a bit torn on that, honestly. Were this an embarrassing hack like the ones I read about as a teenager, I’d agree. However, they caused millions of pounds of damage to multiple companies (and their customers) and attempted to blackmail the CEO for profit.

I’d be amazed, and I think the public would be outraged, if they got a slap on the wrist for this.

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#33

Post by skippyboxedhero »

miohtama wrote: post #26
golan wrote: post #14

Related Reddit thread : https://www.reddit.com/r/cybersecurity/s/LXb88TKC4M

In a proper capitalistic system, those who build low quality e-commerce services, including hackable ones, should go out of business and replace more competent companies. This includes buying services from bad suppliers. This Reddit post hints that many shortcuts were taken, security not taken seriously when they should have, and now they reap what they sow.

There has been no reaping. MKS shares were largely unimpacted (despite this costing at least £300m). Management have tried to deflect, said this was a highly sophisticated attack, said that other firms had been hacked but just didn't report it, endless amounts of lying.

The reality is that decreasing costs is a far easier lever to pull than increasing revenue so managers will be heavily incentivised to do this if you give them profit-based incentives. This happens every few years with listed companies in the UK now, no-one ever changes their behaviour (retail, in particular, is ground zero for bluffers in the UK, managers are exceptionally bad, and even worse are comp committees that set targets that cannot be achieved without damaging long-term value).

There is no efficient market here. It is as simple as managers understanding the world we now live in, and that is unlikely because all these companies view IT as a cost and their managers are people who rotate through executive roles and politics despite leaving a flaming wreck in their wake. Things will stay the same.

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#34

Post by toomuchtodo »

bargainbin wrote: post #20
golan wrote: post #14

Related Reddit thread : https://www.reddit.com/r/cybersecurity/s/LXb88TKC4M

This doesn’t surprise me. I work for a company that hires a substantial headcount from TCS, probably one of their biggest clients, and the quality of the work is astonishingly bad. I’d recommend avoiding at all costs but we all know these companies are brought in by non-technical people.

+1 from first hand experience with TCS

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#35

Post by immibis »

miohtama wrote: post #26
golan wrote: post #14

Related Reddit thread : https://www.reddit.com/r/cybersecurity/s/LXb88TKC4M

In a proper capitalistic system, those who build low quality e-commerce services, including hackable ones, should go out of business and replace more competent companies. This includes buying services from bad suppliers. This Reddit post hints that many shortcuts were taken, security not taken seriously when they should have, and now they reap what they sow.

In capitalism-as-explained-by-capitalists, that would happen. In actual capitalism, it would not.

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#36

Post by BoorishBears »

scott_w wrote: post #31
martinald wrote: post #25

Earlier quoted context omitted.

But it is very well understood and accepted that teenage - especially male prefrontal cortexes don't fully develop until mid 20s. I'm sure they knew it could have major consequences, but when your risk taking pedal (limbic system) pedal is pushed to the floor all the time and your risk avoidance brakes (prefrontal cortex) is not fully developed that all goes out of the window, not unlike being intoxicated. For exampl…

> Young people have little fear of repercussion as they cant really fathom the consequences. > But it is very well understood and accepted that teenage - especially male prefrontal cortexes don't fully develop until mid 20s. Your statement here does not mean that the statement I quoted above is true. Just because biology predisposes one to doing stupid shit does not mean young people are incapable of understanding co…

I don't understand why clarifying young folks are capable of understanding consequences and repercussions, but will underperform at doing so for a myriad of reasons, including real physical differences in brain structure, should be this contentious.

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#37

Post by immibis »

golan wrote: post #15
beepboopboop wrote: post #7

Earlier quoted context omitted.

Why is that surprising?

I guess I’d expect them to be in a country where it’d be difficult to be apprehended and extradited. Being in the UK seems like a stupid move to me, but what do I know!

Was it a professional operation? Says they were 17. Some people playing around with their Commodore 64 except it's connected to the internet and a pretty big company.

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#38

Post by lyu07282 »

miohtama wrote: post #26
golan wrote: post #14

Related Reddit thread : https://www.reddit.com/r/cybersecurity/s/LXb88TKC4M

In a proper capitalistic system, those who build low quality e-commerce services, including hackable ones, should go out of business and replace more competent companies. This includes buying services from bad suppliers. This Reddit post hints that many shortcuts were taken, security not taken seriously when they should have, and now they reap what they sow.

That's a very naive view of capitalism, there is nothing inherently preventing companies from being negligent in infosec no matter how "proper" that system is. Also wouldn't defunding the ICO make it more proper?

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#39

Post by lyu07282 »

aaronrobinson wrote: post #5

This stinks of foreign sponsorship. I can see how they could pull off the social engineering but being able to work their way around a foreign system like they did - no way.

Active directory has become an invaluable tool for ransome gangs, it not only gives them effortless root access on every system, but also documents the company structure so you can focus your resources. This isn't sophisticated at all.

Re: Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

#40

Post by scott_w »

BoorishBears wrote: post #36
scott_w wrote: post #31

Earlier quoted context omitted.

> Young people have little fear of repercussion as they cant really fathom the consequences. > But it is very well understood and accepted that teenage - especially male prefrontal cortexes don't fully develop until mid 20s. Your statement here does not mean that the statement I quoted above is true. Just because biology predisposes one to doing stupid shit does not mean young people are incapable of understanding co…

I don't understand why clarifying young folks are capable of understanding consequences and repercussions, but will underperform at doing so for a myriad of reasons, including real physical differences in brain structure, should be this contentious.

Because we’re talking in the context of young people who executed a multi-stage criminal enterprise causing millions of pounds of damage, harming multiple companies and their customers, AND TRIED TO EXTORT THE CEO FOR PROFIT.

This is not “behavioural immaturity” associated with an underdeveloped prefrontal cortex!

Post reply on HN