Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

nbcboston.com

Post reply on HN
Print view View original

71–80 of 267 posts

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#71

Post by echelon »

helen___keller wrote: post #42
Jtsummers wrote: post #20

Earlier quoted context omitted.

> Ban cryptocurrencies. This is meant sincerely, not glibly: How? How can cryptocurrencies be banned in any meaningful sense? We can "ban" them in a legal sense ("Use of cryptocurrencies are illegal after 1 Jan 2022"), great. But how can they be practically banned so long as computers themselves are not invaded by governments to observe every detail of their operation and private overlay networks are still technicall…

> This is meant sincerely, not glibly: How? How can cryptocurrencies be banned in any meaningful sense? The main avenue would be by getting rid of the sanctioned on/off ramps for crypto (that is, crypto exchanges), leaving only the illegal on/off ramps which I'm sure exist. This obviously wouldn't stop everybody, but it would certainly be a deterrent for all but the most motivated and well-connected of buyers. At tha…

Drugs are illegal for Americans to buy, sell, and produce.

Laws are how you prevent this.

Can you imagine the Massachusetts Steamship Authority paying in cocaine?

Why would paying in Bitcoin be any different?

Bitcoin is parroted largely by a bunch of libertarian speculative grifters that think they're above the authority of our government to manage the monetary supply. They want to soak up all the advantages of building and controlling an economy.

If you look through the covers, it's all speculation and hype. There's noting "decentralized" or "democratic" about it. Bitcoiners are fine with letting social services and the underserved slip through the cracks as long as they get their reward that they feel they earned.

The US is a democracy, and theoretically it helps people of all backgrounds and socioeconomic statuses. It might not be evenly distributed, but at least we can toss out the bad players. Bitcoin is not a democracy. It rewards the Ponzi schemers at the top and leaves everyone else out to dry.

And now look at what it's gotten us -- unprecedented crime from across international boarders that we can't stop. All brought to you by the remarkable "governmentless decentralization".

Just wait until the kidnappings start. Or the murders for hire.

Fucking good for nothing bitcoin. The world was better before it existed.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#72

Post by swiley »

walrus01 wrote: post #59
Decabytes wrote: post #57

I wonder if this will mean an increase in cyber security related postings in industries that have otherwise not had to worry about cyber security before (I.E the Steamship Authority, Meat industry etc)

I saw a badly written headline yesterday that combined the meat industry hack with something about colonial pipeline, and it briefly brought to mind a mental image of a liquefied meat slurry/pink goo pipeline.

https://xkcd.com/1649/

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#73

Post by akiselev »

cma wrote: post #27
JumpCrisscross wrote: post #6

A federal ban on paying ransomeware would reduce the incentive to commit these attacks.

You can imagine it just being easier to code indiscriminate attacks where they only review the results to pick who it is worth collecting the ransom from. Unencrypting for vicitims in the US that couldn't pay would just add more exposure risk to them of getting caught, so they would have no incentive to actually do it. It would take a large bit of money out of the system, but it seems like you need all countries to c…

> How many of these attacks are fully automated in the initial attack/encrypt phase vs. human operators explicitly working to more fully infiltrate a target?

Given the effectiveness of social engineering in hacking's history, that's a very good question. I wouldn't be surprised if randomized attacks are used to create a "sales funnel" of high value targets with poor IT ops/outdated equipment/etc that can be exploited for big payouts. All it takes is a few hundred or thousand dollars to bribe a low level employee so the vast majority of the cost is likely in finding targets. Once they've identified a target, the exploitation process is probably mechanical.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#74

Post by causality0 »

Decabytes wrote: post #57

I wonder if this will mean an increase in cyber security related postings in industries that have otherwise not had to worry about cyber security before (I.E the Steamship Authority, Meat industry etc)

Cybersecurity is not a technology problem. It's a policy and enforcement problem. Ground and mid-level operating convenience will always destroy any attempt to create security unless strong standards of behavior are created and ruthlessly enforced. I've never seen it happen successfully outside of technology corporations staffed by nerds who actually care or the military. All it takes is one guy who knows a guy and then the admin password is on a notepad on the desk. All it takes is one guy who doesn't get a 4G signal in one room so he brings a router from home and plugs it into the network.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#75

Post by OminousWeapons »

mnd999 wrote: post #8
user-the-name wrote: post #2

Time to ban bitcoin. https://newrepublic.com/article/162589/ban-bitcoin-cryptocur...

Nope, no point banning the thing the criminals use, because they don’t follow the law anyway. Ban paying ransoms, the corporations are much more likely to follow the law.

I don't think this is going to work. Time is on the side of the attackers. All the attackers have to do is wait and repeatedly restate that they will fully restore operations if the victim pays a small fee and when losses grow large enough investors / shareholders will apply enough pressure to management to make it happen, whether it is legal or not. No one is going to eat massive losses for the greater good. There are plenty of policies against negotiating with kidnappers and terrorists, and yet people still do it for this exact reason.

Banning crypto exchanges is actually a much more effective solution to the problem because it at least forces someone to show up in person to collect the money.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#76

Post by loveistheanswer »

helen___keller wrote: post #42
Jtsummers wrote: post #20

Earlier quoted context omitted.

> Ban cryptocurrencies. This is meant sincerely, not glibly: How? How can cryptocurrencies be banned in any meaningful sense? We can "ban" them in a legal sense ("Use of cryptocurrencies are illegal after 1 Jan 2022"), great. But how can they be practically banned so long as computers themselves are not invaded by governments to observe every detail of their operation and private overlay networks are still technicall…

> This is meant sincerely, not glibly: How? How can cryptocurrencies be banned in any meaningful sense? The main avenue would be by getting rid of the sanctioned on/off ramps for crypto (that is, crypto exchanges), leaving only the illegal on/off ramps which I'm sure exist. This obviously wouldn't stop everybody, but it would certainly be a deterrent for all but the most motivated and well-connected of buyers. At tha…

>The main avenue would be by getting rid of the sanctioned on/off ramps for crypto (that is, crypto exchanges), leaving only the illegal on/off ramps which I'm sure exist.

From what I've read it seems its only the stupidest of criminals who are using exchanges like Coinbase to cash out, because that's the easiest way to get caught.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#77

Post by artful-hacker »

lumost wrote: post #64
JumpCrisscross wrote: post #35

Earlier quoted context omitted.

> regulation requiring decent cybersecurity measures would be better For those of us who make money when cybersecurity dollars are spent, yes. Practically, you’d get a federal agency writing checklists.

Good security practices are mainly checklists. Do you use https? Do you store password hashes instead of passwords? Is the DB storing passwords in a firewalled network? Is access to the DB restricted to only "need to know individuals"? Does the DB send password hashes to other services? Have you had a penetration test of your authentication system? Do you sanitize the SQL you send to your DB? etc. Unfortunately the m…

I feel like a checklist is just part of it. The truth is that a secure software development lifecycle needs to be taken seriously at every stage, and this costs a lot of money. During prototyping and requirements gathering you need to be setting security requirements, vetting planned dependencies, and prototyping things like authentication and authorization. Each design should include threat modeling and threat mitigations. Implementation time should include mandatory code review, static analysis and secure code checklists. Testing needs to include manual penetration testing and dynamic scanning. Finally, maintenance is another area where things fall apart. Who is going to handle patching? Who will be accountable in 4 years when that version of Tomcat is EOL? None of these things are trivial, and people that have the skills to execute on them are rare. Getting a company fully willing to spend the money and time on them is even rarer. I had an old boss who aptly said once "Security is a black hole where money goes to die".

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#78

Post by willcipriano »

MattGaiser wrote: post #41
JumpCrisscross wrote: post #6

A federal ban on paying ransomeware would reduce the incentive to commit these attacks.

Would this result in not paying or them hiring consultants who pay on their behalf and just invoice them for "resolution services"?

It's illegal to fund terrorism, I don't think paying someone to fund terrorism is a defence in a court of law.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#79

Post by throwawaygh »

MattGaiser wrote: post #41
JumpCrisscross wrote: post #6

A federal ban on paying ransomeware would reduce the incentive to commit these attacks.

Would this result in not paying or them hiring consultants who pay on their behalf and just invoice them for "resolution services"?

Writing a law that prevents this sort of pass-through is trivial. Hold all parties responsible. Don't even require first-hand knowledge that a ransom was paid.

Writing a law with proper disincentives is also trivial -- forget about fines. Proper jail time for senior execs and board members.

Execs and boards will be damn sure not to pay ransoms, and additionally damn sure that any company they hire to help knows in no uncertain terms that they are also not to pay any ransoms.

It really isn't that hard to write laws that disincentivize paying ransoms and aren't possible to route around with wink-and-nod bullshit.

Re: Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

#80

Post by [deleted] »

echelon wrote: post #71
helen___keller wrote: post #42

Earlier quoted context omitted.

> This is meant sincerely, not glibly: How? How can cryptocurrencies be banned in any meaningful sense? The main avenue would be by getting rid of the sanctioned on/off ramps for crypto (that is, crypto exchanges), leaving only the illegal on/off ramps which I'm sure exist. This obviously wouldn't stop everybody, but it would certainly be a deterrent for all but the most motivated and well-connected of buyers. At tha…

Drugs are illegal for Americans to buy, sell, and produce. Laws are how you prevent this. Can you imagine the Massachusetts Steamship Authority paying in cocaine ? Why would paying in Bitcoin be any different? Bitcoin is parroted largely by a bunch of libertarian speculative grifters that think they're above the authority of our government to manage the monetary supply. They want to soak up all the advantages of buil…

[deleted]
Post reply on HN