Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Merck’s NotPetya attack: Was it an act of war?

inquirer.com

Post reply on HN
Print view View original

61–70 of 115 posts

Re: Merck’s NotPetya attack: Was it an act of war?

#61

Post by mc32 »

flarg wrote: post #59
mc32 wrote: post #42

Earlier quoted context omitted.

I'm not familiar with their environment but depending on the software and vendors who support aspects of software, those patches may be held at their request. That is people like Rockwell, Emmerson, whatever, may not “release” a patch because it can have implications for GxP environments. So not saying this is the case, but there are times when that is the case and companies have to sit on fixes. However in these sit…

In many cases unpatched systems automatically fail GxP by not being patched but pharmaceutical organisations still run operations like it's the 90s and they just don't acknowledge the problems. Have worked in pharma IT for 10 years.

I think the problem is that their vendors’ applications run like it's the ‘90s. Often the orgs will be waiting on a vendor’s patch to be released which has been qualified for the sec patch. This requirement is kind of dubious but if you patch before they release their patch you’re on your own.

Re: Merck’s NotPetya attack: Was it an act of war?

#62

Post by corodra »

tchaffee wrote: post #39
listenallyall wrote: post #37

Earlier quoted context omitted.

Are you serious? They planned to launch the equivalent of a digital bomb, knowing full well there would be plenty of collateral damage. Hell no it isn't an "accident" I will put it another way. I feel quite confident the 9/11 bombers did not know, or specifically target, my friends and acquaintances who died in those towers. Therefore, are you going to claim 9-11 was an accident? If I intend to rob a convenience stor…

Yes I am serious. Are you? How about we keep this respectful and do away with the condescending tone, which is not really welcome here on Hacker News? 9/11 was presumably intended to damage as much property and kill as many people as possible. So no, the people who died as a result of that terrorist attack against the US were not killed by accident. Yes, if your gun accidentally goes off during a robbery, that is by…

That's called manslaughter... You don't get to walk when you rob a place and "accidentally" shoot someone. A sassy judge should ask "Did you accidentally rob the place too?"

Re: Merck’s NotPetya attack: Was it an act of war?

#63

Post by occamrazor »

boomboomsubban wrote: post #52
marvin wrote: post #14

Earlier quoted context omitted.

While I’m opposed to using legal terms to weasel out of an insurance claim, it’s an interesting question. If Russia deliberately dropped a bomb on Merck’s factory, it would unquestionably be an act of war. Likewise if they dropped a bomb on a neighboring plant and also accidentally destroyed Merck’s plant. But dropping a bomb on a facility in Ukraine, with equally destructive shrapnel destroying facilities all over t…

>If Russia deliberately dropped a bomb on Merck’s factory, it would unquestionably be an act of war. The US does this all the time and it is not labeled an act of war. The most famous incident is the Al-Shifa medical facility, but this is common practice in the "war on terror."

In insurance context any bombing by military airplanes falls under war exclusion clauses.

Re: Merck’s NotPetya attack: Was it an act of war?

#64

Post by throwaway_tech »

throwGuardian wrote: post #12

Act of war against .... Merck, a company? I've heard of some circuitous logic to deny insurance claims, but this was not an act of war against Merck, which BTW isn't a country, so by definition, one can't go to war with it? Well, maybe hyperbolically a competitor might, but unlike real war, they're bound by the rules and laws of civil society This is the very definition of an accident, if the article is to be believe…

>but this was not an act of war against Merck, which BTW isn't a country,

Its an insurance policy...an act of war is a limitation on coverage.

No one is saying an act of war was specifically committed against Merck. Merck was damaged, filed a claim with its insurance and the insurer denied coverage because the damage was the result of an act of war (that has nothing to do with Merck being a county or the attack being directed at Merck).

Re: Merck’s NotPetya attack: Was it an act of war?

#65

Post by tchaffee »

corodra wrote: post #62
tchaffee wrote: post #39

Earlier quoted context omitted.

Yes I am serious. Are you? How about we keep this respectful and do away with the condescending tone, which is not really welcome here on Hacker News? 9/11 was presumably intended to damage as much property and kill as many people as possible. So no, the people who died as a result of that terrorist attack against the US were not killed by accident. Yes, if your gun accidentally goes off during a robbery, that is by…

That's called manslaughter... You don't get to walk when you rob a place and "accidentally" shoot someone. A sassy judge should ask "Did you accidentally rob the place too?"

To be more specific, involuntary manslaughter. Which is broadly speaking an accident that occurred while committing a crime. Or due to some other negligence. We are still firmly in the territory of accident, regardless of the legal consequences.

Re: Merck’s NotPetya attack: Was it an act of war?

#66

Post by corodra »

tchaffee wrote: post #65
corodra wrote: post #62

Earlier quoted context omitted.

That's called manslaughter... You don't get to walk when you rob a place and "accidentally" shoot someone. A sassy judge should ask "Did you accidentally rob the place too?"

To be more specific, involuntary manslaughter. Which is broadly speaking an accident that occurred while committing a crime. Or due to some other negligence. We are still firmly in the territory of accident, regardless of the legal consequences.

You still get punished for it... That's the whole argument. Even it's an accident, it's not the same kind of accident as turning a corner and spilling coffee on them.

Re: Merck’s NotPetya attack: Was it an act of war?

#67

Post by brutt »

mlb_hn wrote: post #55
brutt wrote: post #50

Earlier quoted context omitted.

Laws of war require to wear uniform, even for cyber soldiers. If they are not wearing uniform when doing their informational attacks, masquerading as civilians, then it's just act of war crime. There is no need to update the law.

Espionage/sabotage is not a war crime https://ihl-databases.icrc.org/customary-ihl/eng/docs/v2_rul...

Informational war is not a espionage, nor sabotage. It similar to sabotage, but, unlike sabotage, it's done from withing territory of attacker. If someone will destroy a factory behind enemy line, then it's sabotage. If someone will launch a rocket from their country to factory in another country, then it's not.

If it done by state military agency, then it's act of war.

If it done by civilians without support of and not directed by state, then it's terrorism.

If it done by civilians, with support of or directed by state, then it's state sponsored terrorism, a war crime.

There is no excuse for not wearing of uniform for warriors at their own country.

Re: Merck’s NotPetya attack: Was it an act of war?

#68

Post by Iv »

Buge wrote: post #19
Iv wrote: post #10

Earlier quoted context omitted.

The claim in the article is that the target was Ukraine, the attacker Russia, and Merck a collateral casualty at an attempt to disguise a state-sponsored cyber-attack as a criminal extortion attempt. One would need to dig deeper to get a really informed opinion. I do believe Russia to be able and willing to do that, I do believe the so-called "Western intelligence agencies" to blame any malware on Russia or China on…

> One would need to dig deeper to get a really informed opinion. There are a ton of security experts who have indeed dug deeper, and came to the conclusion that it was Russia.

There just need to be one, with a good write up of the evidence and the evidence be better than "they used the same tools" or "their IP is in Russia". The linked article does not detail them.

I have seen US TLAs blame China on really laughable evidences (and fail to do it properly on the one undeniable attack they did on GitHub)

Re: Merck’s NotPetya attack: Was it an act of war?

#69

Post by blaser-waffle »

t0ddbonzalez wrote: post #38
listenallyall wrote: post #30

Earlier quoted context omitted.

>> This is the very definition of an accident How is something deliberately planned and executed, by a military intelligence agency, for weeks or months, an accident? And how are you so sure Merck's IT team didn't fail to have backups, redundancy, security patches, etc. to prevent an attack of any sort from being such a big deal?

>"And how are you so sure Merck's IT team didn't fail to have backups, redundancy, security patches, etc. to prevent an attack of any sort from being such a big deal?" If the insurance claim is ~$1.3bn, we can safely say that the NotPetya cleanup isn't a trivial thing for them. How many companies have we heard about who were totally screwed after a ransomware outbreak, because their only backups were online - network…

> Is corporate IT negligent where it appears to have no disaster recovery plan?

Arguably, yes. Merck isn't a small time start-up. They've been on the Fortune 500 list for 60+ years. They can afford whatever layers of backup and redundancy they need.

> Does anybody have offline backups anymore?

Previous gigs, for large ISPs and related orgs, did. This was on a team-by-team basis, though.

Re: Merck’s NotPetya attack: Was it an act of war?

#70

Post by marvin »

gchamonlive wrote: post #43
marvin wrote: post #14

Earlier quoted context omitted.

While I’m opposed to using legal terms to weasel out of an insurance claim, it’s an interesting question. If Russia deliberately dropped a bomb on Merck’s factory, it would unquestionably be an act of war. Likewise if they dropped a bomb on a neighboring plant and also accidentally destroyed Merck’s plant. But dropping a bomb on a facility in Ukraine, with equally destructive shrapnel destroying facilities all over t…

Dropping a bomb is not an act of war because of the target itself. It is because to do it you have to violate the country's whole security system and cause damage to the country's real state, which is an act of war, whereas to invade a company's cluster of computers you don't have to compromise the country's whole cybernetwork. It is interesting though to think about aftermath. If it is not an act of war, one can com…

Deliberate attacks against a country’s economy would probably be handled on a case by case basis through diplomatic channels.

E.g. I’d argue that if China announced it would not repay its massive Treasury debts to the US, that would basically be an act of war even if no aggression was used, just due to the extreme destructive effects. And the reaction would be similarly upsetting, although not quite on the level of an unprovoked, large-scale military action.

But it quickly becomes a discussion of semantics at that point ;)

Post reply on HN