Or they just sold it / gave it to NSA and needed a cover story…
AT&T says criminals stole phone records of 'nearly all' customers in data breach
521–530 of 874 posts
Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach
#522Earlier quoted context omitted.
Anything you receive via post office. Sender/Receiver address is scanned. Post office uses OCR's for sortation and that information is captured.
Ah. The metadata. Inconsequential, then, to a degree.
"We Kill People Based on Metadata", ex-NSA chief General Michael Hayden:
https://abcnews.go.com/blogs/headlines/2014/05/ex-nsa-chief-...>
As Bruce Schneier has noted, metadata equals surveillance, as it's actually far more amenable to analysis and inference than whole-text or audio capture. Though that latter may have shifted significantly with the rise of LLM AI techniques.
https://www.schneier.com/blog/archives/2014/03/metadata_surv...>
Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach
#523AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the c…
> Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the corporate veil and criminally prosecute those whose negligence made this possible. Maybe have fines that are so massive that company leadership and stockholders face real consequences. I really dislike this att…
No, the root-cause is not AT&T were "attacked, by criminals"; there's a much wider issue involving Snowflake and multiple customers. The full facts are not in yet.
AT&T's data was compromised as one of Snowflake's many customer breaches (Ticketmaster/LiveNation, LendingTree, Advance Auto Parts, Santander Bank, AT&T, probably others [0][1]), which occurred and were notified in 4/2024 (EDIT: some reports says as far back as 10/2023). Supposedly these happened because Snowflake made it impossible to mandate MFA; some customers had credentials stolen by info-stealing malware or obtained from previous data breaches. Snowflake called it a “targeted campaign directed at users with single-factor authentication”. The Mandiant report tried to blame unnamed Snowflake employee (solutions engineer) for exposing their credentials.
How much responsibility Snowflake had, vs its clients, is not clear (for example, seems they only notified all other customers May 23, not immediately when they suspected the first compromise). Reducing the analysis to pure "victims" and "criminals" is not accurate. When you say "criminally prosecute those whose negligence made this possible", it wouldn't make sense to prosecute all of Snowflake's clients but not Snowflake too. Or only the cybercriminals but not Snowflake or its clients.
[0]: The Ticketmaster Data Breach May Be Just the Beginning (wired.com) https://news.ycombinator.com/item?id=40553163
[1]: 6/24 Snowflake breach snowballs as more victims, perps, come forward (theregister.com) https://news.ycombinator.com/item?id=40780064
Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach
#524Earlier quoted context omitted.
> paying fines rarely, if ever, causes these too-big-to-fail corporations to materially impact them. That means the fines aren’t big enough. They should probably be scaled according to the business’ revenue.
From a justice perspective, it should be scaled according to the number of customers impacted (and how bad the impact was). Which is likely to be about the same as scaling with revenue.
Justice isn't served if the impact of the penalty doesn't force change. If a company can harm millions of people but the financial damages we can assign to that are lower than the cost savings of the decisions that caused the problem at the scale of a large business, the business only has the logic of finance to care about, and that logic almost always says "wellp that was still the right call"
If our only tool is fines, we must scale those fines not by some monetary definition of the harm, but by what will make the necessary impact on the decisionmakers involved.
I think we should use tools other than fines, like criminal conspiracy liability for controlling shareholders and executives, and the threat of dissolution of businesses to pay out to the victims, but if it's fines or bust, the marginal value of dollars is just on a different scale for these businesses and we should grow the fines accordingly
Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach
#525AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the c…
Hurting the shareholder is the only option to actually fix anything. Until the C-suite and board are forced to face the music caused by rich people being parted from their money, they'll just continue patting themselves on the back and giving themselves bonuses.
Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach
#526Earlier quoted context omitted.
The NSA buys all of the data available from data brokers. 4A? What 4A? With telcos they have the extra advantage of ordering them around with an NSL.
For those not deeply versed in US federal regulations: Part 4a of Title 15 of the Code of Federal Regulations (CFR), which covers the "Classification, Declassification, and Public Availability of National Security Information" for the National Security Agency (NSA). https://www.ecfr.gov/current/title-15/subtitle-A/part-4a?toc... >
Not entirely sure, but I thought they were talking about the 4th amendment, which also is relevant. It prevents the government from spying on Americans without a warrant. The NSA works around it so openly by buying the spy data from third parties, and saying the 4th Amendment doesn’t apply since they didn’t collect the data themselves, so it’s fine. It’s a giant middle finger to the Constitution of the US.
https://en.m.wikipedia.org/wiki/Fourth_Amendment_to_the_Unit...
Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach
#527Earlier quoted context omitted.
yep was trying to avoid word which carry varying connotations, e.g. vpn or zero trust. zero implicit trust is likely the best term? you have to trust something, but enforce (and therefore trust) strong (not network based) identity, authN and authZ. this can be done anywhere via a software-only overlay. a litmus test is server iptables (to use an example) looks like: iptables -P INPUT DROP iptables -P FORWARD DROP and…
For highly secured services, I completely see the rationale for a private overlayed network. Tailscale, et al are great for this, where you're only exposing services to members of the private network. The problems start when people make the assumption that the private network is a secured network. I don't think any of this would have mattered to ATT, as the breach was from a third party that wouldn't have been on a p…
Companies worked that way for decades. Everything was on the corporate network which was only accessible in an office or via VPN.
Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach
#528Earlier quoted context omitted.
The correct way is to follow what all other engineering and trade (medicine/law) already follow. Some software engineers are licensed. A company must hire these software engineers, and any changes to what data is saved or how is saved must be signed by these engineers. If a breach occurs, an investigation occurs and if these licensed software engineers are found to be negligent, they lose their license. If they are f…
If AT&T had spent more on security, this would not have happened. I absolutely do not believe individual engineers should be held liable.
The way this works in civil engineering is that the engineer refuses to sign off on an unsafe design. If costs have to increase to address the issue, then they do. If management doesn't budge, then they bleed money while twiddling their thumbs staring at an unapproved design.
Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach
#529Earlier quoted context omitted.
> Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the corporate veil and criminally prosecute those whose negligence made this possible. Maybe have fines that are so massive that company leadership and stockholders face real consequences. I really dislike this att…
I think the implicit assumption is that the vast majority of these breaches are obviously preventable (basic incompetence like leaving a non-password-protected database connected to the public internet is common). A better analogy is not a bank defending against an army, but a bank forgetting to install doors, locks, cameras, or guards. _Yes_, the criminals are the root cause, but human nature being what it is it's n…
To run with the analogy some more:
The bank is expected to have people trying to break into it. Sure would be nice if they didn’t, but that’s not the reality. As such, failing to provide adequate defences is absolutely a failing on the banks behalf.
If they were keeping even more data than necessary, that’s just extra failure on their behalf.
Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach
#530AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the c…
> Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the corporate veil and criminally prosecute those whose negligence made this possible. Maybe have fines that are so massive that company leadership and stockholders face real consequences. I really dislike this att…
No way. If I were running a small MSP, I was breached, and my customers were infected I'd be sued out of business immediately. The fact that they are a titan means they should be that much more vigilant.