News for hackers. Stuff that matters.
Re:US travel firm $4.5M ransom negotiation open chat by vmception on Sunday August 02, 2020 @11:43PM (#24034007)
Bug bounties rising to their actual market price is not a negative value for society.
Re:US travel firm $4.5M ransom negotiation open chat by istjohn on Sunday August 02, 2020 @11:55PM (#24034076)
By your logic, bank robbers are simply a manifestation of market forces. What did you expect to happen with all that cash in one place with no armed guards?
Re:US travel firm $4.5M ransom negotiation open chat by vmception on Monday August 03, 2020 @12:03AM (#24034111)
That analogy only works if banks were paying people to pretend to rob them all day every day and show them how they did it, and also underpaying them.

so, no.

Re:US travel firm $4.5M ransom negotiation open chat by istjohn on Monday August 03, 2020 @12:41AM (#24034294)
Actually, you're making my point for me. Banks don't typically hire physical pen testers at all, and yet our reaction to a bank robbery is not, "Well, that's just what you get for not taking security seriously." Nor is that our reaction when a gas station gets held up.

In a perfect world, everyone can be trusted, and we don't need locks on our doors or passwords on our phones. In a dystopia, everyone has to carry a gun or have a bodyguard to leave their fortified homes, and a quarter of GDP goes towards security measures. We're somewhere in the middle, but things like this push us a little further down the road to more sunk costs in security measures.

A locksmith might make a killing after a local crime wave, but they should understand that crime is bad for the neighborhood regardless. Cyber crime raises demand for white hat services, but what's good for white hats is not necessarily good for society at large.

Re:US travel firm $4.5M ransom negotiation open chat by vmception on Monday August 03, 2020 @06:09AM (#24035936)
Companies should be liable for negligence depending on the kind of hack. If they were hacked through use of an old package - defined by regulations - then they should be liable.

If it was a zero-day or something newer - defined by regulations - then the company is not liable.

Your analogies are cute but I want new laws, further making your analogies moot.

Re:US travel firm $4.5M ransom negotiation open chat by daveevad on Monday August 03, 2020 @12:13AM (#24034176)

  Bank Secretary : So, people hire you to break into their places... to make sure no one can break into their places?

  Martin Bishop : It's a living.

  Bank Secretary : Not a very good one.
Re:US travel firm $4.5M ransom negotiation open chat by spurdoman77 on Sunday August 02, 2020 @11:50PM (#24034049)
Market price? Interesting way to put it. You could say that the ransomware issuer has a monopoly to the data and will price it to the level where the company owners have higher return paying and continuing it than closing the company down.
Re:US travel firm $4.5M ransom negotiation open chat by vmception on Monday August 03, 2020 @12:04AM (#24034118)
its two order of magnitude better than the unilateral pricing set by companies to their white hack programs, which white hat people have to fight for.