News for hackers. Stuff that matters.

A comment on Merck’s NotPetya attack: Was it an act of war?. Parent comment

Re:Merck’s NotPetya attack: Was it an act of war? by dvfjsdhgfv on Wednesday December 04, 2019 @03:10AM (#21700449)
If you analyze the NotPetya attack, it differs from other ransomware attempts in two respects. First, it was specifically targetting Ukraine. Second, the attackers didn't actually take any money but rendered all systems defunct. If you are a criminal, you aim to make money, right? Why give up on that possibility? It makes no sense.

So, even if in the infosec world you can never say never, but just as Stuxnet is generally attributed to Israel/USA, in the same way NotPetya is attributed to Russia, even though none of these countries will ever admit they actually did it.

[ Parent | on HN ]
Re:Merck’s NotPetya attack: Was it an act of war? by pbhjpbhj on Wednesday December 04, 2019 @05:27AM (#21701062)
>If you are a criminal, you aim to make money, right? //

I don't think that is right. You don't decide to be a criminal, you decide to perform an action, you get labelled then by others.

Some people want to destroy big businesses, they can possibly make as much money as they need already.

Of course you can make money through a side-channel that's less traceable too.

[ Parent | on HN ]
Re:Merck’s NotPetya attack: Was it an act of war? by Iv on Thursday December 05, 2019 @12:23AM (#21710185)
Oh I did not know that. The attack was behaving differently on Ukrainian targets? That's a pretty damning thing indeed and makes the question of the act of war very relevant.

Note that it could make sense to a pro-Russia Ukranian group to extort money abroad and to hurt economically on the target. That seems to be the Russian MO to not be directly implicated in the Ukrainian operations: help with tools, weapons and money the groups that are already in place.

They give up direct control over the actions in exchange of deniability.

[ Parent | on HN ]
Re:Merck’s NotPetya attack: Was it an act of war? by MattPalmer1086 on Friday December 06, 2019 @07:17AM (#21721124)
As far as I know, it didn't behave differently on Ukraine targets. The attack was on Ukrainian tax software M.E.Doc that businesses in the Ukraine are legally mandated to use.

So it was targeted at the Ukraine, but plenty of multinational companies also operate there, so they were collateral damage

[ Parent | on HN ]