Does that mean I'm going to have to take my shoes off to go into Bestbuy now?
U.S. to give ransomware hacks similar priority as terrorism, official says
381–390 of 591 posts
Re: U.S. to give ransomware hacks similar priority as terrorism, official says
#382Earlier quoted context omitted.
I'm a bit tired of the victim blaming with security. The victims of these breaches are the end users. Companies are the beneficiaries of not having to pay for and especially not having to inconvenience themselves with much more secure systems. That said, it's true you can't ask for 100% security. You can instead set standards. You can especially set standards of security for any enterprise that the public dependents…
There are many standards out there such as SOC-2. But that’s not particularly meaningful against dedicated professional hackers. It’s a totally asymmetric game.
It's in fact the inverse of: "The bad guys need to get lucky every time. The good guys just need to get lucky once."
Re: U.S. to give ransomware hacks similar priority as terrorism, official says
#383Earlier quoted context omitted.
IMO the first step to fixing is to add liability. If a breach happens through a piece of software, then the vendor is liable. Same way cars get recalls. (sometimes)
Liable in what way? Wouldn't that just kill OSS? Or do you not count programmers who upload swiss-cheese scripts to Github as vendors? What about Linux, openSSH, etc?
OSS licenses include a very broad waiver, after all it is a gift provided as-is.
Software that runs critical infrastructure (or could cause injury or death if it malfunctioned) should be required to use formal methods and that certainly would include everything to make it run also used such formal methods. (From the OS to shared libraries and even the compilers)
Re: U.S. to give ransomware hacks similar priority as terrorism, official says
#384I'm surprised at how dismissive the comments are. We need many angles of defense against these criminals. Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise. That's silly. We need preventative care and treatment. I'm not surprised by this announcement because the way that the pipeline-company ransomware hackers beat a hasty retreat was notice…
Agreed. I'm a bit tired of the victim blaming with security. It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Crime is a social problem, we can't rely on a dream world of mathematically perfect zero trust security.
I have seen personally, heard first hand accounts, and read many a post-mortem for situations where the primary blame really should be on the "victim". There's another word for this:
Negligence.
Of course there are always 0days. There are always sophisticated attacks. There is always human error.
Then there are people in leadership positions being given accurate information about basic security problems and possible outcomes over long periods of time flatly refusing to make security a priority or spend any time fixing dangerous situations.
Many of these ransom situations aren't the result of targeted attacks, but "hey we have this exploit and ransom kit, let's scan the entire Internet and see if we get anything".
Or the ever popular (ok maybe not so much any more) unsecured elasticsearch server on the public internet. I'm sorry but if you put your production data on a public IP on a standard port with zero security, it is positively your fault when your data gets stolen. (not much to do with ransom, but an example).
There is a difference between being the victim of a sophisticated attack and being the victim of your own negligence (and a lot of grey area in between).
Re: U.S. to give ransomware hacks similar priority as terrorism, official says
#385Earlier quoted context omitted.
Agreed. I'm a bit tired of the victim blaming with security. It's physically impossible to build a house that can't be broken in to, and even harder for computer systems. Crime is a social problem, we can't rely on a dream world of mathematically perfect zero trust security.
Oddly enough though, the analogy tends to diverge when scaled: the more material you put into your house, the less vulnerable it is; the more lines of code you put into your software, the more vulnerable it is. Taken to an extreme, anyone can take down a house made of straw with their fist, but nobody can exploit hello world. I despise seeing simple apps with ridiculous dependency trees (package.json with line counts…
If you do not audit and are not willing, in case of emergency, to take over support of your dependencies, you are creating a mine field. Most people do not understand what this even means though.
Solid libraries are boring and done: old, stable and active bug fix support. Not new features weekly.
Java or .net vs the js ecosystem. In our client contracts we have responsibility for our deliveries; in .net and Java we use well supported libs of over a decade old which we can support ourselves if the maintainers quit. With js this is an issue. Things are generally just not set up for decades of runtime and yet, there we are: we now have node js projects of almost 10 years old with many libs we have to audit and support ourselves and they are not very good quality. I think modern web is only just seeing the tip of the iceberg security wise. It will get much worse.
Re: U.S. to give ransomware hacks similar priority as terrorism, official says
#386Earlier quoted context omitted.
Monero is banned by nearly every US exchange, and hard to buy with USD as a US National. It still maintains value and has seen growth. While BTC may burst, it wouldn't go to $1/BTC. it would go to a small percentage of what it is now, but still retain some value.
How is it hard to buy with USD as a US national? I haven't bought any Monero, but I saw this website the other day: https://localmonero.co/ If that's legitimate, it seems pretty easy.
There's also blocktrades.us
I buy Monero by buying Litecoin at any exchange and then swap it for Monero using blocktrades.
Notably, Binance allows buying Monero directly.
Re: U.S. to give ransomware hacks similar priority as terrorism, official says
#387Earlier quoted context omitted.
The headline might be vague (though I'd personally love to see drone strikes on the scumbags that scam elderly people to of their meager savings) but the article itself talks in terms of priority and effort for investigations into malware attacks. E.g., they won't just shrug and do nothing because they care about other crimes more, like with my stolen GPS case.
I'm astonished you would support drone strikes on civilians. Scammers are working a bad job out of necessity. They are not villains who deserve to be extrajudicially murdered.
[deleted]
Re: U.S. to give ransomware hacks similar priority as terrorism, official says
#388Earlier quoted context omitted.
The headline might be vague (though I'd personally love to see drone strikes on the scumbags that scam elderly people to of their meager savings) but the article itself talks in terms of priority and effort for investigations into malware attacks. E.g., they won't just shrug and do nothing because they care about other crimes more, like with my stolen GPS case.
I'm astonished you would support drone strikes on civilians. Scammers are working a bad job out of necessity. They are not villains who deserve to be extrajudicially murdered.
The professional nature these scams are now (call from 'Microsoft', steal a little and then send properly dressed and documented people to the house to 'investigate the fraud' and steal more) is not desperate people scamming. Sure they do not have to be murdered, but removed from society is not a bad plan. These are pro organizations, not a handful of poor people anymore.
Re: U.S. to give ransomware hacks similar priority as terrorism, official says
#389I'm surprised at how dismissive the comments are. We need many angles of defense against these criminals. Dismissing this because companies should do better security is like dismissing doctors because people should get more exercise. That's silly. We need preventative care and treatment. I'm not surprised by this announcement because the way that the pipeline-company ransomware hackers beat a hasty retreat was notice…
> do better security is like dismissing doctors because people should get more exercise
Not dismissing doctors but making fat people (or drug users etc) pay more is not that silly and happens.
There need to be standards (ISO, PCI) for all companies. And if you get hacked, you get fined if you did not adhere to the standards.
And yes, go after the criminals as well, but bit to easy to just ignore ancient Windows installs and users with passwords 1234 who have admin access etc. All these issues are stated in both ISO and PCI compliance: we just need to have all companies comply, not just banks etc.
Re: U.S. to give ransomware hacks similar priority as terrorism, official says
#390uh... next time when the US targets Iran for example with stuxnet, will that mean they will call themselves terrorists now.... great. i didn't know that