Are not the organizations that signed this report the ones who should be doing something about ransomware?
The ransomware surge
51–60 of 216 posts
Re: The ransomware surge
#52Earlier quoted context omitted.
Is it true that hack any random staff / computer of the company can lead to the ransomware attack of the machine holding the crucial data of the company?
It is probably more true in "Corporate America" where MS Windows Active Directory is in use and all the computers are domain joined and have read/write access to file servers.
It sounds like a problem the IT department should solve. No?
Re: The ransomware surge
#53Earlier quoted context omitted.
It is probably more true in "Corporate America" where MS Windows Active Directory is in use and all the computers are domain joined and have read/write access to file servers.
It sounds like a problem the IT department should solve. No?
It is, but solving that problem would entail re-training staff, reduce "productivity", and moreover, cost money... Many companies have cut their IT provision below what is needed to simply stand still.
IT is a cost to their business, not a revenue source. They don't consider the counter-factual of "well, what if we didn't use IT and computers and the internet" when valuing what IT is bringing to their business. If they did, they'd perhaps be willing to spend more.
MBAs don't like spending money on something that doesn't yield them more sales though...
Re: The ransomware surge
#54Earlier quoted context omitted.
Implicit in this comment is the assumption that current technology is pretty much the best we can do? > IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? Modern security…
> Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? because software is tremendously complex with a large surface area to attack. And many OS features were designed when wide-scale hacking was not a problem.
Then that means the software is hopelessly inadequate for the current environment where wide-scale hacking is a constant problem. To echo what they said, why do we accept and deploy systems that catastrophically fail in circumstances that we know are going to occur? Why is it acceptable to take systems that were not previously connected and actively make a decision to connect them to internet if they are completely unfit for that environment? And not just that, they are so unfit that they not only fail in the new environment, but they enable total organizational collapse in a way reminiscent of the exhaust port on the Death Star.
Re: The ransomware surge
#55Earlier quoted context omitted.
Yeah but software engineers know that hostile actors come with the territory any time they expose a networked device or service. It's no different than corrosion or any number of other inevitabilities that engineers have to deal with. When's the last time a civil engineer designed a bridge without accounting for corrosion or the fact that people will be driving over it?
How is wear and tear equivalent to hostile humans purposefully trying to fuck it up? Even military installations needs armed guards to stop people from just cutting through the fence. Wear and tear is more equivalent to keeping your site from going down to high traffic. Show me a road that's still safe when three guys with guns are standing in the middle of it shooting at passing drivers.
How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them? Engineers design stuff to withstand adversaries all the time, when it's required. Designing with adversaries in mind is always required for connected systems in our field.
The computer equivalent to "three guys with guns are standing in the middle of [a road] shooting at passing drivers" would be three gunmen gaining physical access to a datacenter - game over. We don't try to protect against that attack vector any more than civil engineers protect against terrorists when designing some intersection, except maybe we encrypt some data at rest and they put up some bollards and CCTV.
You're getting hung up on the agency aspect when the most important thing is the attack by attrition. It doesn't matter whether it is a force of nature like corrosion or all the bad actors in human civilization, the point is that it is a known quantity that will eventually degrade and break every nontrivial system.
We don't know which future zero day exploit will break our systems any more than civil engineers know which wave or car will cause the ultimate collapse, but we know that it is inevitable. That's why we have defense in depth. It is the nature of the beast.
Re: The ransomware surge
#56Earlier quoted context omitted.
Kidnappers can also demand dollars for ransom. Are governments going to regulate dollars out of existence? Or are you saying they'll just use it as an excuse to harass bitcoin?
Dollars are a little different in that transferring large amounts anonymously is hard. Collecting the ransom is probably the point of highest vulnerability and that is something law enforcement agencies like the FBI have used to catch kidnappers. However, with cryptocurrency, that vulnerability is mitigated a lot, and that completely changes the dynamics. There is a reason, the ransomware attackers aren't demanding s…
Good thing, then, that Bitcoin is anything but anonymous.
Re: The ransomware surge
#57Exchanges are good at blacklisting BTC ,so this means it will be hard for hackers to cash out. Just converting BTC into XMR is not a trivial process, as it needs to go through an exchange. Trustless cross chain transactions are still in infancy .
> Trustless cross chain transactions are still in infancy . They can technically exist?
> They can technically exist?
Do you mean in the specific case of ring signatures? Or at all?
There are already threshold-signature-based schemes for doing this with ECDSA (though they're very gas heavy at the moment). But none has emerged for ring signatures yet beyond the paper stage.
Re: The ransomware surge
#58The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetra…
Absolutely this - most ransomware attacks are pretty unsophisticated. You don't need privilege escalation, or an exploit. You can carry out the attack using just basic user permissions. You are exploiting a basic "problem" of most modern OSs (that apps run "as" the user executing them) - the user/group permission model ceases to work in 2021 with non-expert users. Portal-based access to individual files via secure OS…
I would like to see rate-limiting built into OS's.
Eg. an application is only allowed to touch 100 files per second or 1000 files per hour.
When it reaches those limits, it gets paused and a popup asks the user if this application really should be doing X.
Then at least ransomware can't run through stuff too quickly.
Re: The ransomware surge
#59Exchanges are good at blacklisting BTC ,so this means it will be hard for hackers to cash out. Just converting BTC into XMR is not a trivial process, as it needs to go through an exchange. Trustless cross chain transactions are still in infancy .
Is this really true? All it takes is for someone to set up a new exchange without a blacklist, and in the first few days all those blacklisted coins will be converted into other currencies and the blacklisted coins will end up in the wallets of other innocent users.
Re: The ransomware surge
#60The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetra…
Implicit in this comment is the assumption that current technology is pretty much the best we can do? > IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? Modern security…
>Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group?
Because there's not enough money in making things bug-free from the start. It is possible (see seL4 and They Write the Right Stuff), but the incentives aren't there.
Some kind of liability or minimum standard (similar to building code) would help, but I'm not sure just how it would be best implemented.