And in my opinion it's only a matter of time till something so crucial will be affected that the big guns will be rolled out. (I.e. targeted 3 letter agencies efforts) The podcast argued that touching the energy delivery / pipeline was already it - Fox asking daily how the current administration fails to deal with securing energy may be the point when some real action happens.
Solarwind was fun for that. They provide safe update of signed binaries . But their build system is corrupt, builds tampered stuffs and sign them.
I’m a just a user of those things: it seams that cryptography is not what is breaking the chain of trust. It’s the usage? But go fix phishing.
Maybe gov agencies should opt in for some tightly manage environments?
But you're right that it wouldn't help with the solarwind situation. Once installed and given privileges, a trusted app can do whatever it wants.
I remember reading how supposedly adding a Russian or a few other keyboard layouts might fool some of the malware to ignore the machine [1].
I guess one idea for the Western intel agencies could be to play off of that, and somehow disable that check (infect their malware) such that it can and does attack the Russian infrastructure.
[1] https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
Show: https://www.risky.biz/RB624/
Media: https://chtbl.com/track/383384/media3.risky.biz/RB624.mp3
The attackers no longer steal a password and log in with it, they kindly ask someone to please run their malware.
[1] https://www.wired.com/2010/03/manipulated-stock-prices/ [2] https://www.reuters.com/article/us-cybercybersecurity-hackin...
Ransomware appears to be a less profitable and less clever use of hacking.
It wouldn’t surprise me at all if our systems are on average far less secure simply because so much more is online now, to speak nothing of increases in the complexity of and opportunities for errors and misconfigurations in today’s systems.
Linux has a far wider attack surface than my baremetal embedded firmware. Like 10^6 wider. There's a single mqtts service mostly, or just passive senders (sensors, controllers). Zero attack surface.
Linux is way too big, with thousands of drivers, services and patches.
Yes but once an exploit is found it can be tried on a whole lot more systems and the weakest link becomes a target. There is also a lot more interest hence brains in hacking/ransomware.
I lot of critical systems should simply be airgapped
I am inferring (perhaps incorrectly) that you're saying this is an argument against cryptocurrencies. I think that's beside the the point: even outright outlawing cryptocurrencies wouldn't stop the technology from existing, and wouldn't discourage extortionists from using it to anonymously receive payments.
It would make it harder to pay, since you'd have to go outside of safe, legal channels to get money into the system.
If the best strategy when being extorted is to never pay or negotiate, then I suppose that could be a benefit. But, in that case it would be more efficient to just make it illegal to cooperate with extortion in the first place.
For all I know, this is already true. If not, let's try that first. If it is, it doesn't seem to matter, since people are paying ransomware hackers. Still, if paying at all is illegal, but people still do it, then making paying less convenient probably won't make much of a difference: they'll still ask for payment in crypto, and leave the logistics up to the victim.
'Don't negotiate with terrorists' or:
> It is wrong to put temptation in the path of any nation,
> For fear they should succumb and go astray;
> So when you are requested to pay up or be molested,
> You will find it better policy to say:—
> "We never pay any-one Dane-geld,
> No matter how trifling the cost;
> For the end of that game is oppression and shame,
> And the nation that plays it is lost!"'
Of course, even better would be a physical switch for incremental backups, so a disk drive works like tape - it can physically only be appended to if that switch is "off".
Come on, security professionals. None of this has any technical or cost barriers. Demand it from drive vendors. My older drives have such a switch.
This is "there are no backups."
(Even if you don't anticipate a problem with your IT staff, it's just good engineering to automatically turn off the write-enable. Nobody's perfect. I've gone to the airport without my passport once. It really sux when you do that.)
Backups get pushed from devices between 1AM and 3AM each day, so the primary backup server enables it's network card at 1 and disables it at 3.
Primary backup server also has a second network card, that in turn is attached to a small subnet containing it and the secondary backup server only. The secondary backup server pulls a copy from the primary on a weekly basis in a similar manner as the primary, disabling it's network card once it has finished.
Maybe they can hit the primary if the infection takes place overnight, but the odds of getting the secondary are pretty low.
One thing you could do is get one of those mechanical lamp timer clocks from the hardware store, and have it turn the power on/off the network card on schedule.
Many (if not most) companies have file shares with fairly wide-open access and/or a complete lack of backups so peer-to-peer spreading within the company is enough to cause a lot of trouble.
At its root these are technological problems that we could choose to solve:
1. The program is not the user. Code running as a user shouldn't necessarily have permission to access everything the user can access. 2. New code is not treated with suspicion when it should be. New code should have its file access throttled in proportion to how many files it accesses. 3. Our systems do a terrible job of spotting unusual behavior. How many processes actually need to rewrite every file the user has access to? Almost none... rewriting 10% of the user's files should trigger an automatic throttle/stop and raise red flags. 4. As a variation on #3, most OSes these days ship parsers for a lot of common file formats... if the OS sees lots of user documents being rewritten and the parsers can no longer parse them stop allowing new rewrites and alert the user. If the user is encrypting their content on purpose they can approve it. If not you can at least limit the damage. 5. Similarly a network user that usually accesses a limited set of files should not be able to suddenly start rewriting thousands of files without some kind of intervention. 6. Our systems completely fail to take advantage of ancient technology called "file versions" (see VMS). Excess disk space should store old versions of files in a way that cannot be deleted (or the ransomware would just call that API or generate random writes to consume the space). Combine with 2/3: when there is suspicious activity on the system move into CoW mode and preserve previous versions of all files or an entire system snapshot and don't allow purging the snapshot without special intervention (eg rebooting into a special mode). 7. To go along with all of the above code should be tagged with its provenance in a system-tracked way. If a process writes a new binary to disk track that responsibility. Track it all the way back to the URL or email it came from. This entire audit trail should be attached to any of the mechanisms listed above. It should also be attached to any sort of activity monitoring program that shows you disk accesses, including historical accesses. If I see 50GB of disk reads/writes from a process group "JGjthjsfgl.exe, downloaded from p0wnme.example.farts" that is a huge red flag. Let me suspend that entire process group with a single click.
I'm sure smarter people could come up with even better ideas... but ransomware is absolutely something we can and should make nearly impossible. We could engineer operating systems to be resilient and limit the damage (eg: macOS prompting you to approve access to Desktop/Documents/Downloads) but it means giving up some sacred beliefs about how desktop operating systems should work that tends to make a subset of the HN audience extremely angry.
Zero days are indeed often not required, however, IMHO the initial attack is less preventable than that lateral movement and further exploitation - if attackers are in your systems for a week while they spread everywhere and kill your backups preparing to pull the switch to "ransomcrypt" everything at once, then that was your opportunity to detect it and kick them out, but the victim organizations obviously were not capable of that. This needs to be fixed, perhaps by methods similar as you describe.
As how much is being spent on these payments overall each year? How would that compare to the massive IT fortification project people are demanding?
We don't meaningfully fight bike theft for this reason. The cost of doing so relative to the benefits is just too high. We can debate whether that is reasonable, but that is essentially what has been decided as a society. Most low level crime is not meaningfully investigated.
And this erodes trust in society and rule of law, and gradually leads to vigilantism, privatization of security, and segregation due to middle-class flight from high-crime areas.
I don't disagree, but I hear very little discussion about low solve rates for smaller crimes.
No, I would say that a few counties have decided this, but the majority of counties have not. In most places, you do get arrested for property crimes, you still serve prison time for this, police still do things like use bait cars and exert resources to catch those who steal, and the idea that property crime should not result in jail time is not widely accepted by the majority of the population.
Having a physical write-enable switch on the backup devices costs about three cents.
With the way I understand ransomware works, merely connecting a backup to the system will corrupt it. This is where a write-enable switch really comes into play, it cannot corrupt the backup when you're trying to restore from it. And if you have online archival databases, they can't be corrupted, either. After all, how much of your company data really needs to be writable? Certainly not last week's payroll records.
With append-only incremental backup systems, enforced by hardware, it'll take a lot longer to need to recycle the backups and risk them. Tape backup already does this inherently.
Another thing you can do with a backup drive, is attempt to read it from a clean system that has never been connected to the network. If you can read it, it isn't corrupted. Then, have a process where once a week see if the backup can be read. Then your worst case is a week lost.
Second, where is this idea coming from that corrupted backups are the issue? You're solving a problem that doesn't exist and creating a real one.
When I read about how ransomware encrypted every drive attached to it, and encrypted the backup drives when they were attached. This was why the ransomware waited some length of time before shutting off access to the user - they wanted to get the backup drives encrypted, too.
> You're solving a problem that doesn't exist
Now you know!
If you meant write some software to activate the switch, that kinda misses the point!
War analogies are inapplicable, privateer analogies are inapplicable. Create the incentives, organizational and software structure required to stop this or it will continue. Holding single companies accountable shifts the burden without solving the problem.
Have standards, standards bodies, defensive organizations.
Like for foods, hostels, stuffs on the roads. There is some analogies.
Or do you mean banning both the US on-ramps and the foreign off-ramps? Are you optimistic that the US could get, for instance Russia, to enforce such a ban?
I'm not necessarily opposed to this "just ban cryptocurrency" talking point, but I'm never sure I understand what people mean by it in practice.
This would immediately destroy the entire cryptocurrency industry, and mining power in most or all networks would collapse to the point that the networks would essentially be defunct. Transaction volume and coin price on surviving networks could collapse to the point that it would be infeasible to pay an $XX million ransom, and ransomware developers would be back to where they were circa 8 years ago, with no real mechanism to untraceably receive millions of dollars.
What differentiates a cryptocurrency key from a non-cryptocurrency key? Would this criminalize the holding of any private key at all, even if intended for non-cryptocurrency applications?
What happens if I generate a key for non-cryptocurrency use and then someone later sends cryptocurrency to it? Am I going to jail? Do I need to rekey immediately? Is it my duty to monitor for this situation? If I'm evil, can I cause trouble by "spoiling" an enemy's known public keys in this way?
Here's an exhaustive list of all bitcoin keys; you're now in possession of all bitcoin in circulation: https://lbc.cryptoguru.org/dio/
These are solved legal problems. Cryptographic possession is a well understood legal concept that comes up all the time in contexts like custody of financial instruments or digital evidence.
> What differentiates a cryptocurrency key from a non-cryptocurrency key? Would this criminalize the holding of any private key at all, even if intended for non-cryptocurrency applications?
Intent, primarily, so no. The applicability of intent to the criminality of an action is also a well understood legal principle.
> What happens if I generate a key for non-cryptocurrency use and then someone later sends cryptocurrency to it? Am I going to jail? Do I need to rekey immediately? Is it my duty to monitor for this situation? If I'm evil, can I cause trouble by "spoiling" an enemy's known public keys in this way?
In this thought experiment with this hypothetical ban, this feels analogous to mailing cocaine to someone's house. Again, well-understood legal principles around intent cover this without issue. Based on relevant precedent for physical contraband, you'd presumably have no obligation to monitor for it, but you would have an obligation to report it if you discovered it and turn it over to authorities.
Blockchain ledger technology makes relinquishing contraband very straightforward. Once you discover that you are in possession of cryptocurrency, you can simply send it directly to a government-controlled blackhole address, and investigators will be able to trivially verify that this transaction is the only one you initiated while in possession of the cryptocurrency.
> Here's an exhaustive list of all bitcoin keys; you're now in possession of all bitcoin in circulation: https://lbc.cryptoguru.org/dio/
The legal system has been around the block on this one. The concept of criminalization of the possession of certain bit sequences when they correspond to some meaningful embedding is well understood. Child pornography is the classic example. Any arbitrary sequence of bits could in principle be child porn expressed in some highly unusual binary format, and yet somehow the legal system has successfully avoided criminalizing the possession of arbitrary random numbers. But if you happen to have a decoder for said highly unusual binary format, then you are going to jail.
Likewise if you happen to know that your "random numbers" are in fact cryptocurrency-controlling key pairs and you harbor an intent to traffic in cryptocurrencies, lo and behold, those "random numbers" suddenly transmute into a cognizable thing that can be criminalized.
Intent matters in law.
Previously you said I had to destroy the key. When is key destruction necessary and when is transfer to government necessary?
What if the transaction to my address is timelocked to 5 years in the future? Does that create any custody responsibilities on my end between now and 5 years from now when it becomes spendable and I can surrender it to the government?
What if I'm sent $50,000 worth of "dust" outputs that are only spendable by paying a $49,500 miner fee? Do I really need to pay miners to incur $49,500 worth of carbon emissions in order to cleanse my secp256k1 private key of $500 worth of bitcoin-ness so that I may continue using it in peace?
> Child pornography is the classic example. Any arbitrary sequence of bits could in principle be child porn expressed in some highly unusual binary format, and yet somehow the legal system has successfully avoided criminalizing the possession of arbitrary random numbers
This is true only because the "child pornography-ness" of the data is a property of the data itself, even if it's in an obscure format. Any arbitrary cryptographic key can be imbued with "cryptocurrency-ness" by anyone else, which means that revealing your non-cryptocurrency public keys now exposes you to risk, as long as some cryptocurrency out there uses the same type of public key.
If we're dead-set on banning it, why ban "possession" instead of use? If it's illegal to send cryptocurrency, but still legal to "possess" it, a lot of these problems go away. Making it illegal to sign a bitcoin transaction is a lot simpler than creating a new class of illegal number, and seems like it would be just as effective at ending the behavior it's trying to end. Maybe even better at it, since it would not incentivize additional "surrendering coins to government" transactions.
We need to start holding companies criminally liable having security vulnerabilities that get breached. It is true that there will always be exploits but the issues are usually much more wildly irresponsible security practices and not “didn’t know about the latest 0day”
There needs to be a statutory liability to customers and required insurance. Let the insurance company figure out the regulations instead of bureaucrats and politicians, insurance company rules are optional and noncompliance is just more expensive.
It is an increasing trend but the current uptick in awareness is mostly media coverage. This stuff has been going on forever, a few particularly newsworthy things happened now everyone is going out of their way to report each new instance. Trends in reporting instead of trends in exploits (to a degree)
Further, you don’t throw a party with a list of people not invited. It’s super ineffective to try to globally block an infinite list of bad.
Fungibility of a currency is actually important for it to be effective as a store of value. If my 1 USD is somehow worth more at the supermarket because it previously was owned by Elon Musk.
That said it’s not entirely impossible to track the source of origin of a Bitcoin transaction. It’s just computationally very expensive. Since you can programmatically create wallets and transactions that can obfuscate the origin of transactions. So by the time the funds reach any exchange the money has changed hands too many times for them to reasonably be able know if the origins of digital coin came from illegal activity. Then, by the time they do know it was stolen the funds are gone.
Here’s the punchline though, since most exchanges do in fact keep records and the blockchain is an immutable list it’s only a matter of time till the software/computing resources adapt.
We're asking how to tell if the destination of a bitcoin payment is on the restricted list, not the source origin. You are not going to be able to fine/sue someone for making a bitcoin payment to an anymous address by claiming the address is on a sactions list. This is my point. Thus any such laws banning the payment of ransom to restricted entities are unenforceable.
This is true even if, after the payment is made, it is discovered who the wallet belongs to, as the person making the payment under US jurisdiction didn't know who they were paying.
Even on HN it's the same knee-jerk reactions every time one of these stories hit.
This is one of the most pressing technology issues of this moment and the discourse just sucks.
* Does banning ransom payments do anything? Good idea/bad idea? Historical analogues?
* Do we need to pay rewards to cyber privateers to take down cyber criminals?
* Is this an issue that can only be solved at the geopolitical level because of the role states play in enabling this activity?
* Will the hardening brought about by this eventually outpace the crappy attacker software?
* Is this a phase or the new reality?
* How much of this is enabled by technology vs the geopolitical situation?