Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Merck’s NotPetya attack: Was it an act of war?

inquirer.com

Post reply on HN
Print view View original

91–100 of 115 posts

Re: Merck’s NotPetya attack: Was it an act of war?

#91

Post by MrMorden »

t0ddbonzalez wrote: post #38
listenallyall wrote: post #30

Earlier quoted context omitted.

>> This is the very definition of an accident How is something deliberately planned and executed, by a military intelligence agency, for weeks or months, an accident? And how are you so sure Merck's IT team didn't fail to have backups, redundancy, security patches, etc. to prevent an attack of any sort from being such a big deal?

>"And how are you so sure Merck's IT team didn't fail to have backups, redundancy, security patches, etc. to prevent an attack of any sort from being such a big deal?" If the insurance claim is ~$1.3bn, we can safely say that the NotPetya cleanup isn't a trivial thing for them. How many companies have we heard about who were totally screwed after a ransomware outbreak, because their only backups were online - network…

Any large organization that doesn't, at a bare minimum, implement NSA's Top Ten Cybersecurity Mitigation Strategies[1], ASD's Essential Eight[2], etc. is grossly negligent; and an insurance carrier willing to write a policy not conditional on implementing those strategies is equally negligent. The insurance carriers in this case could very well be attempting to deny payment under the acts-of-war exclusion because they're too incompetent or greedy to correctly write a cybersecurity policy.

[1] https://www.nsa.gov/Portals/70/documents/what-we-do/cybersec...

[2] https://www.cyber.gov.au/publications/essential-eight-explai...

Re: Merck’s NotPetya attack: Was it an act of war?

#92

Post by dmix »

Considering it hit the company by accident via a server in Ukraine the whole act of war thing is really questionable.

It’s completely reckless use of malware and there should be consequences for Russia not taking care of their offensive weapons and causing serious damage.

But phrases like “act of war” shouldn’t be thrown around like that. I highly doubt that was Russia’s intention, which I think should matter, even if we still find them at fault.

Re: Merck’s NotPetya attack: Was it an act of war?

#93

Post by tqi »

dmix wrote: post #92

Considering it hit the company by accident via a server in Ukraine the whole act of war thing is really questionable. It’s completely reckless use of malware and there should be consequences for Russia not taking care of their offensive weapons and causing serious damage. But phrases like “act of war” shouldn’t be thrown around like that. I highly doubt that was Russia’s intention, which I think should matter, even i…

I don't think the accidental nature is the crux here. As I understand it, if a Russian bomb had inadvertently damaged / destroyed a physical office in Ukraine, the insurance would not have covered that either. The question is whether or not this virus was an act of war (against Ukraine) or if this was an act of vandalism/crime by an individual actor.

Re: Merck’s NotPetya attack: Was it an act of war?

#94

Post by listenallyall »

tchaffee wrote: post #39
listenallyall wrote: post #37

Earlier quoted context omitted.

Are you serious? They planned to launch the equivalent of a digital bomb, knowing full well there would be plenty of collateral damage. Hell no it isn't an "accident" I will put it another way. I feel quite confident the 9/11 bombers did not know, or specifically target, my friends and acquaintances who died in those towers. Therefore, are you going to claim 9-11 was an accident? If I intend to rob a convenience stor…

Yes I am serious. Are you? How about we keep this respectful and do away with the condescending tone, which is not really welcome here on Hacker News? 9/11 was presumably intended to damage as much property and kill as many people as possible. So no, the people who died as a result of that terrorist attack against the US were not killed by accident. Yes, if your gun accidentally goes off during a robbery, that is by…

I never said the gun went off "accidentally", you added that word to support your otherwise baseless argument. Guns go off during robberies because the robber got nervous or impatient, because there was a melee, because a third party got involved. By deliberately bringing the gun into the situation, the subsequent claim of an "accidental" firing is nullified.

A guy drinks two quarts of whisky at his favorite bar then drives home. On the way in his drunken state he runs a red light, smashes into a school bus and kills a 9 year old he never met named Mikey. Whoops, sorry Mikey's mom and dad, it was just an accident! Because Tchaffee says so.

Re: Merck’s NotPetya attack: Was it an act of war?

#95

Post by robocat »

marvin wrote: post #70
gchamonlive wrote: post #43

Earlier quoted context omitted.

Dropping a bomb is not an act of war because of the target itself. It is because to do it you have to violate the country's whole security system and cause damage to the country's real state, which is an act of war, whereas to invade a company's cluster of computers you don't have to compromise the country's whole cybernetwork. It is interesting though to think about aftermath. If it is not an act of war, one can com…

Deliberate attacks against a country’s economy would probably be handled on a case by case basis through diplomatic channels. E.g. I’d argue that if China announced it would not repay its massive Treasury debts to the US, that would basically be an act of war even if no aggression was used, just due to the extreme destructive effects. And the reaction would be similarly upsetting, although not quite on the level of a…

> E.g. I’d argue that if China announced it would not repay its massive Treasury debts to the US

Other way round: US has “borrowed” money from China

Re: Merck’s NotPetya attack: Was it an act of war?

#96

Post by randcraw »

marvin wrote: post #14
throwGuardian wrote: post #12

Act of war against .... Merck, a company? I've heard of some circuitous logic to deny insurance claims, but this was not an act of war against Merck, which BTW isn't a country, so by definition, one can't go to war with it? Well, maybe hyperbolically a competitor might, but unlike real war, they're bound by the rules and laws of civil society This is the very definition of an accident, if the article is to be believe…

While I’m opposed to using legal terms to weasel out of an insurance claim, it’s an interesting question. If Russia deliberately dropped a bomb on Merck’s factory, it would unquestionably be an act of war. Likewise if they dropped a bomb on a neighboring plant and also accidentally destroyed Merck’s plant. But dropping a bomb on a facility in Ukraine, with equally destructive shrapnel destroying facilities all over t…

Yeah, this act was wildly indiscriminate. Russia could easily have limited the propagation of NotPetya to Ukraine only, but chose not to. That makes the act irresponsible and comparable to distributing an infectious biological agent via randomly addressed mail bombs that were posted in Kiev.

An appropriate response needs to arise from a cooperative authority like the UN or Interpol, and needs a policy suited to address future events before they arise.

Re: Merck’s NotPetya attack: Was it an act of war?

#97

Post by corodra »

tchaffee wrote: post #81
corodra wrote: post #66

Earlier quoted context omitted.

You still get punished for it... That's the whole argument. Even it's an accident, it's not the same kind of accident as turning a corner and spilling coffee on them.

The thread is not about whether or not whoever did it gets punished. The question is whether or not it was accidental or if damaging Merck was an intentional act. Based on the evidence so far, it sure seems like damaging Merck was a result of negligence and not intentional.

Releasing a computer virus intended to replicate and spread on any machine it can... like... wtf are you arguing for? The whole point to the thing was to cause massive damage to whoever the intended target was, with little care for collateral damage. It was meant to spread hard and fast and cause damage. If you infected a Merck employee with weaponized ebola and that employee traveled to the USA while the strain was still in incubation, then got USA citizens sick with ebola, "Oh, it's okay, it was just an accident. No worries! You didn't mean to hurt the USA. Want to have some cheesecake with us?" Replace the USA with Germany, Japan, Chile, Mexico, South Sudan, I don't care. I'd feel just as strongly about this. It's not a Russia-USA issue. It's a "Russia literally gives zero fucks what happens to the world." I don't see bags of rice given out to poor countries with the Russian flag on it.

It was intentional even if Merck wasn't targeted. Negligence and accident aren't magic words to hide behind if your initial goal is to cause harm in the first place. Stuxnet at least had a bunch of parameters and was highly specialized so it only deploy on its intended target with little to no chance of opening up its payload on an unintended target. I'm not going to argue whether or not Stuxnet was morally in the right. But, it sure as shit proves there is a format of trying to make sure unintended targets don't get harmed in the process of widespread release of cyber warfare.

Re: Merck’s NotPetya attack: Was it an act of war?

#98

Post by marvin »

robocat wrote: post #95
marvin wrote: post #70

Earlier quoted context omitted.

Deliberate attacks against a country’s economy would probably be handled on a case by case basis through diplomatic channels. E.g. I’d argue that if China announced it would not repay its massive Treasury debts to the US, that would basically be an act of war even if no aggression was used, just due to the extreme destructive effects. And the reaction would be similarly upsetting, although not quite on the level of a…

> E.g. I’d argue that if China announced it would not repay its massive Treasury debts to the US Other way round: US has “borrowed” money from China

Ah, I had a suspicion I had my signs mixed up. Thanks for pointing that out. Point stands though :)

Re: Merck’s NotPetya attack: Was it an act of war?

#99

Post by listenallyall »

tchaffee wrote: post #39
listenallyall wrote: post #37

Earlier quoted context omitted.

Are you serious? They planned to launch the equivalent of a digital bomb, knowing full well there would be plenty of collateral damage. Hell no it isn't an "accident" I will put it another way. I feel quite confident the 9/11 bombers did not know, or specifically target, my friends and acquaintances who died in those towers. Therefore, are you going to claim 9-11 was an accident? If I intend to rob a convenience stor…

Yes I am serious. Are you? How about we keep this respectful and do away with the condescending tone, which is not really welcome here on Hacker News? 9/11 was presumably intended to damage as much property and kill as many people as possible. So no, the people who died as a result of that terrorist attack against the US were not killed by accident. Yes, if your gun accidentally goes off during a robbery, that is by…

Wait, didn't even reach the absurd final paragraph. If I have a bomb with a blast radius of say, 200 meters, which I drop 50 meters inside an Italian border, knowing full well the blast radius extends into France, you are still claiming deaths in France from my bomb are just an accident?

Re: Merck’s NotPetya attack: Was it an act of war?

#100

Post by tchaffee »

listenallyall wrote: post #99
tchaffee wrote: post #39

Earlier quoted context omitted.

Yes I am serious. Are you? How about we keep this respectful and do away with the condescending tone, which is not really welcome here on Hacker News? 9/11 was presumably intended to damage as much property and kill as many people as possible. So no, the people who died as a result of that terrorist attack against the US were not killed by accident. Yes, if your gun accidentally goes off during a robbery, that is by…

Wait, didn't even reach the absurd final paragraph. If I have a bomb with a blast radius of say, 200 meters, which I drop 50 meters inside an Italian border, knowing full well the blast radius extends into France, you are still claiming deaths in France from my bomb are just an accident?

Please point out where I said you know the blast radius and which direction it heads. Not to mention it's an analogy and I'm not a bombing expert. You can probably figure out my point.
Post reply on HN