Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US travel firm $4.5M ransom negotiation open chat

twitter.com

Post reply on HN
Print view View original

421–430 of 480 posts

Re: US travel firm $4.5M ransom negotiation open chat

#421

Post by buran77 »

tiew9Vii wrote: post #386
koonsolo wrote: post #367

Earlier quoted context omitted.

> It’s sad that it’s come to this point but the end result may be better for everyone. Meanwhile in the real world, a company I develop for implemented the most draconian security measures to "prevent ransomware". Development environment is a virtual machine at the other end of the world, with disabled copy-pasting from and to the local system. A complete separation between safe internal network and unsafe developmen…

Had one of these. All development through Citrix. The security policy was draconian to the extent I’m sure it was well intentioned but led you to do things in the least secure way possible as it was the only way to complete a contract. I.e the servers on the other end running Windows 7 (in late 2019) where so old they didn’t have the required cpu instruction set to run some required software. Likewise input lag was e…

> The security policy was draconian

The setup you describe sounds less like draconian security and more like a half baked solution that confused usability hurdles for security. Just because security usually brings lower usability, it was probably (wrongly!) assumed that lowering usability will bring security.

Re: US travel firm $4.5M ransom negotiation open chat

#422

Post by coryfklein »

wendyshu wrote: post #408
benlumen wrote: post #393

Earlier quoted context omitted.

My thoughts, also. It's obvious why they don't, but ideally, every business would take a "we don't negotiate with terrorists" stance on this. Could governments outlaw these ransom payments?

Seems like there's a great case to make it illegal, I wonder why it's not.

You would need a way to legislate this globally. Outlawing it here in the US only intensifies the prisoner dilemma aspect of this - the criminal enterprises keep winning the remaining 85% of world GDP, while all US companies suffer the most from the ransomware.

You'd likely still see US companies pay the ransom anyway, but just try to keep it secret. Probably less risky than losing their crucial data and systems.

Re: US travel firm $4.5M ransom negotiation open chat

#423

Post by foobiekr »

hellotomyrars wrote: post #263
foobiekr wrote: post #118

Earlier quoted context omitted.

The people releasing terrible software (that has a default-open admin port with no login credentials and no filtering, as just one of many examples) are not usually the ones who end up paying the ransoms.

I'd argue on the scale of a company like in this example and other high-profile example that if you're integrating software with such glaring holes in your network then you're the one who is culpable. Obviously if there are unknown vulnerabilities that is one thing, but there is a level of due diligence you should practice as the operator.

I agree that they are culpable, but that doesn’t close the loop.

Re: US travel firm $4.5M ransom negotiation open chat

#424

Post by staticassertion »

jjoonathan wrote: post #420
staticassertion wrote: post #409

Earlier quoted context omitted.

App whitelisting is rarely rolled out, but it's just such a definitive win these days. a) You just kill ~85% of malware (rough estimate, probably technically higher, but I'm basing that on stats around interpreter-based/LOLBAS malware). Anything that isn't targeted is probably dead in the water. b) You know exactly what's running on everyone's computers, more or less, so you have a way easier time baselining and buil…

It's easy-mode for security because it offloads the cost of security to employees. Done right, many hands make light work. Done wrong, it's the very picture of "if nobody can use it, hackers can't either." I'm interested in learning how to do this right, because I've only ever seen it done wrong. How do you streamline the process for getting programs approved? How do you accommodate developers who need to generate an…

> It's easy-mode for security because it offloads the cost of security to employees.

Yeah, absolutely. But I consider this to be, when done right, a good thing. A single security team is going to drown trying to scale your company's security asymmetrically with your company's growth. For every 1000 developers you might have 5-50 security engineers depending on how serious the company is about it. Spreading out security work across the company scales extremely well.

Of course, you want to minimize burden too.

There are a number of ways you can go. Personally, at my company, we're so small that it's trivial. We rarely onboard new employees and pretty much all approvals are handled within a few minutes of the employee getting their laptop.

As you scale it may make more sense to crowdsource this. 'Upvote' is one such tool. https://github.com/google/upvote

Upvote-like systems basically give you reputation based approvals. If you can convince a number of your coworkers that the app is worth installing, you can install it. I've seen a number of systems built this way that combine crowdsourced approvals with other forms of reputation.

At my company we use Chromebooks. Apps/Extensions are only allowed once approved. The Linux environment is where development happens.

This is nice because there's a strong separation between environments. That said, we don't do any sort of application whitelisting in the Linux environment today, due to a lack of tooling support.

If we did, what I'd like to do is just have simple rules like "If the binary was created by gcc etc allow it to execute". Santa allows for process-tree based rules like this.

Another option is developer VMs like in EC2. These can be nice for devs because they're often much more powerful than a laptop anyways. It requires a bit of tooling to work smoothly though with local IDEs and whatnot.

Re: US travel firm $4.5M ransom negotiation open chat

#425

Post by tenuousemphasis »

noodlesUK wrote: post #11

Whilst paying the ransom is often advisable in specific cases like these, it’s absolutely a bad thing for society as a whole. Seeing successes like this will encourage organised crime to keep doing this, as they know there’s gonna be a big reward. It’s like the prisoners dilemma. If people didn’t pay the ransom, there wouldn’t be ransomware. But people don’t take precautions, so they have to pay the ransom, leading t…

On the other hand, due to the same dilemma, every ransomware attacker has a strong incentive to actually deliver the keys upon payment of the ransom.

Perhaps the key to ending ransomware is some high profile attacks (real or fictional) where the victim pays but does not get their data back.

Re: US travel firm $4.5M ransom negotiation open chat

#426

Post by pc86 »

Cederfjard wrote: post #396
Animats wrote: post #333

Earlier quoted context omitted.

While these stories are becoming all too common I’d like to think that while we’re in a golden age of being a ransomware payouts, it will lead to actually caring about security by many of the high-profile affected companies. It may also lead to companies paying for a more aggressive response. Uber has been known to deal with fraud by eventually finding the fraudster, even in Nigeria, and having them "visited".[1] [1]…

Would you mind elaborating a little bit? To me what you're saying implies extralegal activities, just want to make sure I'm not misunderstanding.

http://digamoo.free.fr/isaac2019.pdf page 177 has a (very) brief summary of what happened.

And just to clarify for others, "extralegal" isn't necessarily bad, and does not mean illegal. It simply means not regulated by the law one way or the other. Calling a Nigerian lawyer and having them talk to someone is definitely not illegal.

Re: US travel firm $4.5M ransom negotiation open chat

#427

Post by tenuousemphasis »

jasonhansel wrote: post #395
noodlesUK wrote: post #11

Whilst paying the ransom is often advisable in specific cases like these, it’s absolutely a bad thing for society as a whole. Seeing successes like this will encourage organised crime to keep doing this, as they know there’s gonna be a big reward. It’s like the prisoners dilemma. If people didn’t pay the ransom, there wouldn’t be ransomware. But people don’t take precautions, so they have to pay the ransom, leading t…

Not to mention the fact that the money could be going to terrorists or rogue states. This is clearly unethical, and IMHO should absolutely be against the law.

The U.S. government funded terrorism throughout the world. Thus paying taxes to the U.S. should be made illegal.

Re: US travel firm $4.5M ransom negotiation open chat

#428

Post by ptero »

hellotomyrars wrote: post #40

While these stories are becoming all too common I’d like to think that while we’re in a golden age of being a ransomware payouts, it will lead to actually caring about security by many of the high-profile affected companies. While the overall cost may be low for them, if they don’t make meaningful changes to prevent these issues in the future, it’s not hard to imagine it might add up quickly. I don’t support these at…

> It’s sad that it’s come to this point but the end result may be better for everyone.

You make a lot of good points, but I am afraid that when such organizations start caring the cure will be worse than the disease. Some of this already leads to either draconian security policies (that make development hard but do not improve ransomware security by much) or passing the risk on someone else, for example by buying a security policy (which increases costs, but seldom improves security). Similar to most restrictions introduced "because pornography" or "because terrorism" those are likely to be mostly a drag on society.

We might eventually get to better security practices: general policies that are easy to implement and not onerous to comply with and flexible exceptions, where the damage is small and relaxing a policy leads to other improvements, but this state seems very far away. My 2c.

Re: US travel firm $4.5M ransom negotiation open chat

#429

Post by CWuestefeld »

staticassertion wrote: post #424
jjoonathan wrote: post #420

Earlier quoted context omitted.

It's easy-mode for security because it offloads the cost of security to employees. Done right, many hands make light work. Done wrong, it's the very picture of "if nobody can use it, hackers can't either." I'm interested in learning how to do this right, because I've only ever seen it done wrong. How do you streamline the process for getting programs approved? How do you accommodate developers who need to generate an…

> It's easy-mode for security because it offloads the cost of security to employees. Yeah, absolutely. But I consider this to be, when done right, a good thing. A single security team is going to drown trying to scale your company's security asymmetrically with your company's growth. For every 1000 developers you might have 5-50 security engineers depending on how serious the company is about it. Spreading out securi…

We're trying to do much of what you mention here. It ain't easy. Here's some of my thoughts, as one of the people in Development trying to achieve it.

The app whitelist impairs my efficiency, and honestly takes a fair amount of fun out of work. I can no longer use many of the tools that help me, and instead am confined into the corporate-approved structure. This is both a productivity issue and a job satisfaction issue.

Trying to separate our development workstations, and dev environment overall, from the rest of the sordid mess, is extraordinarily difficult. We're trying to do similar what you recommend, with developer VMs running in our internal ESX cluster. However, that technology conflicts with Microsoft's Hyper-V (we're a MS shop). We're trying to get to Docker/k8s, but we can't run Docker inside a VM that runs in ESX. So we're trying to offload the actual execution of the system, even for local testing, into DevSpaces. But there's a lot to figure out, and DevSpaces is a young product. Further, private AKS environments are a new thing in Azure, and we've a couple of times now run into roadblocks with MS's own growing pains.

Your "upvote" system seems to have merit, but with, I dunno, 50 or 60 devs, spread across several teams focused on different tech, it doesn't seem like it would scale well. Coming up with the right mix of apps, and convincing our Risk team, is very difficult. Especially when so much of their pushback seems confusing (like, DBeaver was denied as a FOSS product, but approved when we paid for the Enterprise version).

Re: US travel firm $4.5M ransom negotiation open chat

#430

Post by pc86 »

AnIdiotOnTheNet wrote: post #416
greesil wrote: post #98

Earlier quoted context omitted.

Think of it as a very expensive bug bounty.

Yeah, let's just equate criminal behavior with doing people a service, that's going to reflect well on people in IT.

No worse than us being unable to take an extremely obvious joke as a joke, and feeling the need to respond to it as if it wasn't meant completely in jest.
Post reply on HN