US To Give Ransomware Hacks Similar Priority as Terrorism (reuters.com) 66
The U.S. Department of Justice is elevating investigations of ransomware attacks to a similar priority as terrorism in the wake of the Colonial Pipeline hack and mounting damage caused by cyber criminals, a senior department official told Reuters. From the report: Internal guidance sent on Thursday to U.S. attorney's offices across the country said information about ransomware investigations in the field should be centrally coordinated with a recently created task force in Washington. "It's a specialized process to ensure we track all ransomware cases regardless of where it may be referred in this country, so you can make the connections between actors and work your way up to disrupt the whole chain," said John Carlin, acting deputy attorney general at the Justice Department.
Last month, a cyber criminal group that the U.S. authorities said operates from Russia, penetrated a pipeline operator on the U.S. East Coast, locking its systems and demanding a ransom. The hack caused a shutdown lasting several days, led to a spike in gas prices, panic buying and localized fuel shortages in the southeast. Colonial Pipeline decided to pay the hackers who invaded their systems nearly $5 million to regain access, the company said.
Last month, a cyber criminal group that the U.S. authorities said operates from Russia, penetrated a pipeline operator on the U.S. East Coast, locking its systems and demanding a ransom. The hack caused a shutdown lasting several days, led to a spike in gas prices, panic buying and localized fuel shortages in the southeast. Colonial Pipeline decided to pay the hackers who invaded their systems nearly $5 million to regain access, the company said.
Heavily Regulate Cryptocurrency (Score:1)
Cryptocurrency has only made it much easier for ransomware to work. Before they could only request depositing some money in a bank account located in some shitty country with poor rule of law somewhere.
Re: (Score:1)
Computer viruses that didn't ask for money have still done plenty of damage. Until they start giving all hacks at least the same priority as basic theft, trespassing, or vandalism, people are still gonna keep losing money on this shit one way or another.
Re: (Score:3)
Financial incentive does build up the scope and scale of attacks. It's probably not a good thing for most of us that writing malware is a viable career choice.
Re: (Score:2)
Well its now same priority as "terrorism".
So yeah, powerful disincentive. They wont be fearing a cop turning up threatening to take their fingerprints. They'll be fearing an anonymous security contractor in flipflops and 3 day growth waterboarding them in an egyptian black site.
Re: (Score:2)
Same argument could be made for credit cards or Paypal.
Re:Heavily Regulate Cryptocurrency (Score:4, Interesting)
Re: Heavily Regulate Cryptocurrency (Score:2)
Re: (Score:3)
Re: Heavily Regulate Cryptocurrency (Score:2)
Re: Heavily Regulate Cryptocurrency (Score:4, Informative)
Actually in the criminal underworld, HSBC is THE place to go if you need to wash your money
https://www.investopedia.com/s... [investopedia.com]
They've been caught very blatantly participating in money laundering so many times that you'd figure they would have lost their charter in the US by now, but nope. They're too big to jail because they're too big to fall.
Re: Heavily Regulate Cryptocurrency (Score:3)
*fail
Re: (Score:2)
I think you had it right the first time.
Yo Grark
Re: (Score:1)
This from the website that used to post the DeCSS code in defiance of court orders.
Re: (Score:1)
There's a big difference between violating copyrights, especially when you would have never paid for the crap in the first place, versus fucking over power plants, hospitals, etc. which affects society at large dumbass...
Re: (Score:2)
Bitcoin is fucking over power plants and hospitals? Ransomware is a symptom of bad security practices and Windows.
hahahah right? (Score:2)
Least Privileged Model (Score:5, Insightful)
When are are we going to learn from our mistakes and start taking a proper approach to protecting our systems?
Good IT is expensive. Bad IT is costly (-- We are here).
1) Business systems should be running ONLY applications needed to do the job, and no others.
2) Business systems networks should be isolated from operations networks. Air Gapped as needed
3) Systems that need access in / out should be properly firewalled, including blocking entire countries/regions as needed.
It is much easier to do nothing and pay the BITCOIN bills when they come in. But it isn't cheaper.
Re:Least Privileged Model (Score:5, Insightful)
It is much easier to do nothing and pay the BITCOIN bills when they come in. But it isn't cheaper.
It isn't cheaper in the long run. But in this quarter, where we haven't been ransomwared, it's way cheaper. That quarter over there 9 months down the road may very well be someone else's problem so why should I waste company money on preventing that quarter from having that issue when I may not even be here anymore.
Yay MBA mentality!
Re: (Score:3)
Re: (Score:1)
It is much easier to do nothing and pay the BITCOIN bills when they come in. But it isn't cheaper.
It isn't cheaper in the long run. But in this quarter, where we haven't been ransomwared, it's way cheaper. That quarter over there 9 months down the road may very well be someone else's problem so why should I waste company money on preventing that quarter from having that issue when I may not even be here anymore.
Yay MBA mentality!
backup, Problem Solved
Re:Least Privileged Model (Score:4, Insightful)
...until you realize your org hasn't tested backup resources/processes to this needed extent, like ever, and now its an emergency once again.
Backups have unfortunately become a red-headed stepchild for many companies, a checkbox for the auditors and little more.
Re: (Score:3)
Exactly, this quarter savings will generate a nice bonus for the decision maker, once the s. hit a fan, he/she will jettison on a golden parachute for a new position or a nice retirement.
BTW, wasn't this Colonial Pipeline ransom only for their financial system, so that they were not able to charge customers, so they decided to stop pumping?
Re: (Score:2)
Colonial Pipeline was air gapped (as far as I know). It was their billing system was hacked, so they turned off the spigot for fear of not getting paid. Two wrongs don't make a right, but they sure make a 50% spike in gas prices.
Re: (Score:2)
If we "really" treated it the same as terrorism... (Score:1)
seal team 6 treatment? (Score:2)
CYBERPUNK DYSTOPIA, HOORAY! (Score:2)
Maybe they'll finally drone strike that bitch Rachel from card services
I welcome the War on RansomWare (Score:1)
So shit the NSA has known about for years (Score:2)
But rest assured, nobody responsible will be held responsible, and any head that rolls will be those morons who hit the alarm but weren't higher enough to actually make a difference.
this is nothing less than SOCIALISM! (Score:1)
The free market has found a comfortable equilibrium where insurance companies can help the so-called "victims" negotiate in exchange for a nominal subscription fee. This way, both parties benefit and grow, and the insurance industry employs more people. It's a win-win-win!
Mewling liberal communists might try to claim that one side are "criminals", when really both sides have been incentivized by market conditions. We should celebrate the productivity of humanity with $, not criminalize it!
Extra Judicial Killings (Score:2)
Drone strikes, CIA covert ops on the table now.
Re: (Score:2)
While am not against Tomahawking the living hell out if these fucks there is the small problem of them being on Russian territory. And cruise missiles violating their airspace might attract the professional interest of the Red Army.
Context (Score:5, Interesting)
Historically, before the breakup of the USSR into discrete states, there was a significant migration of ethnic Russians into what is now Ukraine and in particular the east of that country. Many living in Eastern Ukraine consider themselves Russians, not Ukrainians.
After February 20, 2014 [the date of Russia's invasion] the West [the US and Europe] imposed a raft of sanctions on Russia. This has included limiting the abilities of wealthy, politically-connected Russians to get money out of the country, limiting the ability of Russia to purchase the technology to help them exploit arctic oil and other minerals and so on.
If you look here [wikipedia.org], you can see that Russia's GDP is 11th in the world, behind Italy and Canada. In fact, based on GDP alone, Russia would no longer be eligible, for example, to be a member of the G8.
Since 2014, Russia has been conducting multiple campaigns in an attempt to circumvent the sanctions. They make use of "Oligarchs" - i.e. puppets that are hand-picked and approved by Putin to be "fabulously wealthy" and trade internationally, with the thinking being that behind each of these puppets there is a route to get funds and goods past the sanctions line imposed by the west.
But the other tactic that Russia has been engaged in, with growing tenacity, has been, for want of a better term, "mischief-making". Their concerted effort to undermine the mechanisms of government in the United States has been both extensive and wildly successful, beyond their wildest dreams. Whether you want to point to the relationship between Putin and former President Trump, or the way that Russia tried to inject hundreds of millions of dollars into Kentucky for Mitch McConnel [until the plan came apart at the last election] (see here [bloomberg.com]), or the ludicrous idea that Putin would allow Russian citizens to carry firearms and have a Russian NRA, or whether you want to point to the almost endless string of ransomware criminals, there's a pattern here.
All of these initiatives are designed to harm the United States and her allies - particularly Europe. They are designed to fracture and break up alliances [witness former President Trump and his attacks on NATO]. They are designed to cause harm to western interests.
There's a reason that so many of these cyber criminal gangs operate inside Russia with impunity. In fact, earlier this year security researcher Brian Krebs wrote an interesting piece [see here [krebsonsecurity.com] - though I'll concede I haven't attempted to find corroboration for his claims] that some of the most dangerous malware strains today have a "do not install" list that includes most of the former Soviet states.
This is not by accident. Now, it's up to you whether you want to believe that this is because Putin and the Russian government are willing to turn a blind eye to the Russian organized cyber criminal gangs because they tacitly approve of the way the gangs attack the west, or whether you want to ratchet up the conspiracy theory to the idea that these "cyber criminal gangs" are in fact Russian government hackers... but there does seem to be a growing suggestion that ransomware is being supported, to a certain extent, by the current Russian administration.
Of course, there's a huge problem with discussing and trying to understand what is going on here, which is simple. Neither Russia nor the United States are going to public admit that they are even now engaged in cyber warfare campaigns against each other. And with news of successful cyber attacks likely to be suppressed in Russia, we may not know if Uncle Sam is
THIS. IS. NOT. HARD! (Score:4, Interesting)
Re:THIS. IS. NOT. HARD! (Score:4, Insightful)
Firstly, you are treating the victims like the criminals. Not a great way to start.
Secondly, in many cases, time is a critical factor. What if lives are on the line? What about all the hospitals and doctors’ surgeries that have been infected? Now what?
Sadly, we’re all debating the consequences of having inherently insecure computer systems. If we are really serious about ending the threat of malware, we need a ground-up rethink on pretty much all our current OS platforms. A bitter pill, to be sure. But we simply won’t get to “secure” with our current infrastructure, because it is inherently impossible to do so.
Re: (Score:2)
Re: (Score:1)
Embarrassment is the cure. Let everyone in the chain of sloppiness have a permanent stain on ther CV's, and their works, risk plans, and outcomes put up on public display for all to see. Names. Professional qualifications. Who approved.
And the institution that awarded all of them their MBAs.
Re: (Score:2)
The dual challenges it would face would be ignorance and arrogance. In some cases people are going to be too ignorant to understand the risks the are taking. Stop and ask yourself how many people today use a computer without understanding how it works.
But by far the biggest problem here would be the number of people that do have a working idea of the risks and are still willing to play the odds. Fact is that far too many people wo
We tried that, and found an issue (Score:3)
We tried that for about a decade. If anyone funds out you were hacked, it's a big embarrassment. Solution - don't let anybody find out.
We tried it, and we discovered that disincentives to open discussion of threats is counter-productive.
We don't have it all figured out yet, but we have learned that it works MUCH better when I can post for my counterparts at other companies "we got hit, but thankfully didn't have any significant damage because it was caught just in time. The bad guys got in through a rogue R
Re: (Score:3)
Embarrassment is the cure. Let everyone in the chain of sloppiness have a permanent stain on ther CV's, and their works, risk plans, and outcomes put up on public display for all to see. Names. Professional qualifications.
Then all the blame will fall on the understaffed, under-budgeted IT employees who had no time and/or formation to build a bulletproof network. And whose security measures were circumvented at the 1st opportunity by higher ups on 'special request'.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You aren't really jailing them for saving someone's life though. You're jailing them for putting those peoples' lives at risk in the first place.
As it stands, nobody is held responsible legally for running critical infrastructure off an insecure and publicly-exposed network. As a side-effect, nobody is held responsible for feeding ransom money to criminals, either. I think slashmydots is actually correct. If you did make a felony of paying a ransom, you'd get the people high up the executive chain that
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
As you suggest, it might be “more statistically likely” For the scenario we are contemplating to be caused by operator error, but are you therefore suggesting that you are happy to impose a criminal penalty for human error?
Perhaps more importantly, what about the minority of cases were the root cause of the problem is something other than lack of cyber training.
I’d prefer that we didn’t turn this in to a circular deba
Re: (Score:2)
We could do this to stop all kinds of things. Just make it a felony to sell drugs. Just make it a felony to buy prostitutes. Just make it a felony to subvert elections! THIS IS NOT HARD!
Re: (Score:2)
There's not a zero percent chance, just a lower percent chance.
Some people will definitely still pay, they just won't tell anyone about it.
Re: (Score:2)
Can't track unreported events (Score:2)
Well that must mean (Score:1)
That must mean that they're going to fund them, give them weapons, and call them allies, until they no longer want to do Americas dirty work, then they'll become terrorists and need to be wiped out?
Talk is cheap (Score:1)
Hack Putin (Score:2)
We need to turn the hackers on Putin: Offer a presidential pardon and US citizenship (via National Interest Waiver) to anyone who can prove they hacked Putin and got at least $1,000,000. Sign this petition. [chng.it]