The OPM breach was 11 years ago and apparently the incompetence still reigns.
That really stuck with me. My internal thought was "it's easier to kick over a sand castle than to build one." It seems to ring true for infosec, societal structures, and kinetic cases. Is this just a base truth?
Try kicking over a building sometime. (Or don't - you'll stub your toe).
Tangent aside, entropy favors the attacker even in the case of a building that has PE stamps on the plans and passes all codes at time of construction. Just leave it alone for a while with no maintenance, it will fall. Or, hire one man to correctly place charges. Far less work than what it took to build it.
Eh, kinda. The defenders have the advantage of playing on the home turf. They know their infrastructure, can have sensors and traps everywhere. The bad guys are stumbling in the dark. They have no idea what's real and what's a honeypot, what signals you're watching, etc.
The problem is that almost no one takes this advantage seriously. If you're not paying attention to your infra, yeah, you're gonna get owned.
18F -> https://ndstudio.gov
As seen credited on recent publications like real realfood.gov.
(Ill note that this design studio is being led by newly proud white nationalist Joe gebbia who apparently blames illegal aliens and their ‘anchor babies’ for high housing costs apparently while unironically forgetting he cofounded airbnb: https://substackcdn.com/image/fetch/$s_!VCGY!,w_1272,c_limit... - I mean look at these posts back to back, I wonder why they’re unable to recruit anyone: https://substackcdn.com/image/fetch/$s_!ArmA!,w_1272,c_limit...)
Ridiculous that scumbags like this are tarnishing that space.
Thanks!
For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.
Other actors though have a reputation to uphold to get paid and they know it.
An example of the process is something like:
1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.
2. Negotiators notified.
3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.
https://www.bleepingcomputer.com/news/security/ransomware-re...
https://complexdiscovery.com/a-48-month-federal-benchmark-re...
https://neal.fun/absurd-trolley-problems/
We all gotta do what we can to get through the day, but you can't live next to someone who has the same challenge but a different answer to some trolly problem? Is your future world just a bunch of closed communities where outsiders and ideas and their differ skin color and economic background aren't welcome?
Or we pay the criminals, not let innocent people die because turbo nerds care about rewarding cyber criminals who will exist no matter what.
So I guess we should just let people die though, atleast the feds will have jobs and be able to go on vacation and not those damn criminals!! Although I fail to see much difference between US law enforcement and cyber criminals, both of their existence relies on the threat of violance and the extortion of the public with that violence.
Also I'm pretty sure the FBI gave birth to the shiny hunters if you look into it for more than 10 minutes. Its a bunch of kids they basically have chosen not to punish at various points in their criminal evolution. Its almost like they need these phenomenons to exist.
My ideal society is one without crooked cops, but alas I dont think that's likely either so in the meantime, until we can find a solution to that problem we probably shouldnt punish the innocent patients of hospitals.
It seems to me that money and the status of criminals is more important to you than human life, so we should probably deal with whatever brain worm has infected you too.
> When disagreeing, reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."
https://news.ycombinator.com/newsguidelines.html
Linked at the bottom of the page.
It's a stupid what-if scenario and there are endless variations. What if the ransomware attack doesn't kill anybody? What if the ransomware attack ends up saving a patient because the surgeon is given more time to think about a case so they don't make the mistake they would have? What if that hospital being shut down means a patient was sent to a different ER where the attending on duty was able to save the victim because of something unique to them from their past.
What if the cybercriminals doesn't use the money to buy nicer clothes but instead uses it to go on vacation but gets themselves killed? Are we supposed to be sad someone who inflicted pain on others died? Is all life sacred or not? Or is some more sacred than others? What if they use it to fund terrorists that end up killing lots of people, possibly even someone you know? Was it still worth it then? What if the criminals use to bomb churches and subways? What if one of the cyber criminals uses it to buy people? or kill homeless people for fun?
Another direction we can go is, I forget where this is from off the top of my head, but a human life is calculated to be worth about $10 million. So then if we're going to do another different point of view and put this into economics, we should figure out how many people shutting down the hospital will kill and see how much the group is charging and compare the two, right?
Talk is cheap and it's easy to spend other people's money or dismiss it as bits of paper. How much of your money are willing to give the criminals for the hospital to stay open? How many nights are you willing to go hungry and stay in so that the criminals can walk free? Because if it's arbitrary money that's not yours, of course it's easy to give away. It's based on a facile understanding of the world though.
If nothing is more important than saving human lives, what are you doing on HN, not curing cancer right now? People are dying!
It's not a contest, we all can care and think deeply and still come to different conclusions.
One way to prevent this type of crime is to ensure that it is never profitable. The downside is that there will be losses until the message is thoroughly communicated.
Who cares if criminals have nice things, Id rather innocent people dont die. Most criminals tend to find ways to ruin their own lives at some point anyways. Peoples lives > pieces of paper.
Its like you're proposing a trolly problem where you choose the 5 people on a track to die because you don't want the single guy on a track to have nice clothes.
[0]: FBI arrests Canadian cybersecurity expert in ShinyHunters hacking case (6 points, 8 days ago) https://news.ycombinator.com/item?id=50066759
I wouldnt really trust them under any admin, but yeah this current regime is definately will to play fast and loose with people's lives to make themselves seem competent.
Thered need to be changes in how lobbying and certain countries are registered to make a dent. Everyone says age but I dont think that matters as much as the lobbying industry. Young people are every bit as corruptible as the old.
