Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Another Ransomware Outbreak Is Going Global

forbes.com

Post reply on HN
Print view View original

341–350 of 435 posts

Re: Another Ransomware Outbreak Is Going Global

#341

Post by davidbanham »

hutzlibu wrote: post #325
sillysaurus3 wrote: post #242

Earlier quoted context omitted.

Only because most organizations don't know how to be effective at security. It's not hard. You don't actually have to change much. You just have to schedule regular pentests, ideally every couple weeks. Pentests protect everyone because it's our job to worry about all of the security flaws that you can't possibly be aware of in your normal day-to-day development cycle. There's just too much for any organization to kn…

"It's not hard." No, it is not, you just need skilled people working on it. Oh, those people want money for it ...

Exactly. It's not hard, it just costs some money.

It's exactly the same as physical security. You build fences and buy locks. You pay people to keep an eye on things. You take insurance to cover the rest of the risk.

Nothing hard, no new inventions required. It just takes some attention and cash. It's part of the cost of being in business.

Re: Another Ransomware Outbreak Is Going Global

#342

Post by dzhiurgis »

sillysaurus3 wrote: post #165
willstrafach wrote: post #131

FYI to Sysadmins: Paying the ransom at this point will be a waste of money, as the contact e-mail address has been blocked. https://posteo.de/blog/info-zur-ransomware-petrwrappetya-bet... (German) https://posteo.de/en/blog/info-on-the-petrwrappetya-ransomwa... (English)

It's always seemed like the best way to end ransomware is to launch hundreds of variants that demand money but don't actually decrypt anything. Unethical, to be sure, but eventually people would learn not to give them money. All the competent ransomware authors are probably quite unhappy whenever a defective ransomware strain pops up.

It's like saying best way to fight heroin addicts is to supply market with poisoned heroin. No heroin users - no problems!

Re: Another Ransomware Outbreak Is Going Global

#343

Post by yodon »

zanny wrote: post #326
yodon wrote: post #104

Earlier quoted context omitted.

You're not the only one who thinks the idea of wearing a tin foil hat when you use Windows because the NSA only knows how to attack Windows is demeaning to the intelligence of other tin foil hat wearers.

What should I trust more: A trade secret proprietary and obfuscated operating system from an organization known to collude with the government Or Code I have read in part, and know others read, and stand to believe that among all of us using those with the money or time would also audit Given, we are all on predominantly x86 computers with proprietary obfuscated control processors that can seize control of the system…

From the phrasing of your question, I suspect we disagree on the answer to your theoretically rhetorical question. I don't care what people could or would like to audit with their free time, I care what people do audit with their actual time, generally because they are paid or have a financial motive to do.

Windows is fuzzed, analyzed, traffic analyzed, attacked, and picked apart inside AND outside Microsoft with higher frequency and greater depth than Linux is, regardless of which happens to be open source and theoretically easier to examine. If Microsoft were to inject malicious stuff into Windows it would be found and reported and exploited. There is too much money, too much exploit opportunity, and too much security researcher brand cred available to anyone who discovers even a hint of malicious behavior on Microsoft's part for it to go unnoticed and unreported.

And again, the point of the comment wasn't "Windows is secure" as nothing in tech is secure. The point was that someone who advocates wearing tinfoil hats around Windows to protect against the NSA while thinking Linux somehow gets a pass from those same bogeymen is not making a rational case for how to behave or what to fear.

Re: Another Ransomware Outbreak Is Going Global

#344

Post by floatboth »

detaro wrote: post #284
floatboth wrote: post #283

Earlier quoted context omitted.

The name I suggested was a clear reference to them. But they provide storage "accessible with any SSH/SFTP tool", not a place to `zfs send` to.

http://www.rsync.net/products/zfsintro.html

Wow, nice! How did you find that page? http://www.rsync.net/products/platform.html doesn't link to it

Re: Another Ransomware Outbreak Is Going Global

#346

Post by kakarot »

biafra wrote: post #301
kakarot wrote: post #228

Earlier quoted context omitted.

Probably not viable right now because of the ridiculously high transaction fees.

Transaction fees only need to be high if you are in a hurry. If you can wait a week or two you can go with very small TX fees. As you can see in this graph even very low (5 to 10 Satoshi per byte) fee transaction are confirmed eventually. https://jochen-hoenicke.de/queue/#24h

Okay, then my theory is trash. They just weren't smart about it, then.

Re: Another Ransomware Outbreak Is Going Global

#347

Post by eternalban »

dwaltrip wrote: post #261
raw23 wrote: post #111

Earlier quoted context omitted.

Bitcoin is a neutral technology, think of it like cash. Buying illegal things is always done with cash but it doesn't mean we should get rid of cash altogether. Regardless even if we came to the collective decision that we wanted to get rid of bitcoin, its not feasible due to its decentralized nature.

I used to agree with the "neutral technology" line of reasoning, however I think my view has changed. Everything has an orientation to it, enabling or strengthening certain dynamics, but not others. These characteristics are not static, as they depend on the broader context, and can change rapidly and unpredictably sometimes -- yet they can be quite important and should be considered. I would argue the concept of "pe…

> Everything has an orientation to it

This seems true at face value. Consider the cutting edge technology aka as a knife, with an inherent bias for cutting things.

Dinner time. Killing time. ("Food is murder"?)

It is the context of utility of technology that is the determining factor. A technology, imo, can be deemed directly culpable of ill effects IFF it permits no other utility context other than that which results in morally or ethically unaceptable outcomes.

Ever nuclear weapons can be used for good, you know. (Extinguish fires, for example.)

Re: Another Ransomware Outbreak Is Going Global

#349

Post by edejong »

sillysaurus3 wrote: post #242
devcpp wrote: post #234

Earlier quoted context omitted.

Are you sure about that? You do know most organizations will implement that as a huge amount of bureaucracy for every commit, rather than proper man-hours of security-oriented development.

Only because most organizations don't know how to be effective at security. It's not hard. You don't actually have to change much. You just have to schedule regular pentests, ideally every couple weeks. Pentests protect everyone because it's our job to worry about all of the security flaws that you can't possibly be aware of in your normal day-to-day development cycle. There's just too much for any organization to kn…

Pen-tests show the presence if vulnerabilities, not their absence.

To make secure systems, we need to take the (very) difficult road of working our systems bottom up and proving the absence of vulnerabilities and defining the boundaries of safe operations.

Post reply on HN