Hacker News Reader

Comment by lettergram | Hacker News Reader

The U.S. needs to make it illegal to pay ransom. Then respond with force, arresting people, targeting however you can.

Further, this should be a wake up call. If you're a business harden your network and make backups.

> Then respond with force, arresting people, targeting however you can.

Yeah that's a nice fantasy. "Hands up, Russky bastards, the Navy Seal Bin Laden crew is here to take you out." Shoots up a row of laptops while bearded Russian hackers cower in fear.

Except for that to happen the Seals would have to have reliable intel from inside an uncooperative foreign state, and the ability to move freely, carrying guns, in that foreign state; and if they raided in it without permission, that would be an act of war.

Oh, so it's Russia the root of all evil again. Without a single piece of evidence. How convenient!

Thanks god we have nuclear weapons, otherwise we'd definitely experience another incursion like Iraq or Afghanistan, that were made under absurd pretexts and only led to great numbers of civilian casualties and some economical gain for the US and/or US government officials tied to the military complex.

> The U.S. needs to make it illegal to pay ransom.

They don't need ransom if they can buy put options.

See Matt Levine's 10 laws of insider trading. In particular, "5. Don’t do it by planting bombs at a company and shorting its stock." Somebody nicely put a non-paywall link here: https://github.com/0xNF/lawsofinsidertrading.com

Buying puts in this fashion will generally be a remarkable, traceable event. There's a reason ransoms typically go through cryptocurrency.

I believe it is illegal. But lacking enforcement.

There’s a reason people hire these intermediary “consultants” to pay the ransoms.

It's generally not illegal to pay ransom, though with ransomware you have the issue that the recipients may be subject to US sanctions and it could be illegal to send them money on those grounds.

more appropriately, it should be required to report ransom payments on balance sheet under separate heading.

"The U.S. needs to make it illegal to pay ransom."

Ugh. So you get attacked through some old wordpress install, freak out to get your company online, pay, now you also go to jail for paying a ransom. Not a fan of this plan.

Or the attackers even use the fact that you paid to blackmail you.

I think all of that has happened already, it is a wakeup call, and the US is making it illegal to pay. https://home.treasury.gov/system/files/126/ofac_ransomware_a...

Only if they violate existing international sanctions.

Or identify certain certain specific "hacks" and setup a bounty program. If you can gain root access by guessing the CEOs password, he should be punished not you.

Edit: doubly so if the company is question is part of important infrastructure (including food supply).

Even with backups we've seen companies are more than willing to pay a modest ransom, like the pipeline last month. It takes a long time to fully restore big infrastructure from backup--especially if it's something like old tapes.

But yeah, companies should stop viewing security and IT as a cost center and start paying up for good penetration testing every few years.

The US needs to make it illegal to have private data left in a database without a password (hello equifax), or on a old machine with obsolete OS with known vulnerabilities.

Or to sell routers, wifi printers, cameras and smart TVs with known security flaws, and to leave it without updates.

Then respond with force, arresting people, targeting however you can.

Most adversaries are in non extradition regions.

If those countries take away the legal system route of extradition for attacks on critical infrastructure, then in my mind its justifiable to go the batman style of extradition with a special forces team.

Or make hacking legal so that companies start taking appropiate measures instead of labelling themselves as victims.

White hat hacking, sure.

Because fixing the infrastructure couldn’t possibly work, we need renditions and live fire operations. Totally.

Fixing infrastructure won't get done because the people in charge are too stupid, lazy and greedy to fix it. Most of them are so wealthy they're completely insulated from the consequences of their actions (or inaction, as the case may be). Folks need to wake up and realize they're living in a global public-private idiocracy.

So, sign an extradition treaty or we'll declare war? Because that's what sending in troops without their consent means.

More like, don’t harbor or foster attacks on critical infrastructure or we will take action to bring those that do to justice. At what point do those actions by other countries become acts of war?

It's interesting to compare this to the physical-world analog. What if somebody shows up at the US-Canada border, start shooting rockets at Canada, and the US refuses to acknowledge this as a crime or extradite? What if the rockets are aimed at a critical piece of infrastructure near the border and can cause billions in damage? One could argue that if the US condones these attacks, they have effectively already declared war on Canada.

Well that's the main issue, currently the states do not consider such cyberattacks the equivalent of sending troops or rockets across the border that justify a "kinetic" response but rather the equivalent of earlier espionage activities which usually justifies only a diplomatic response. Of course, that might change in the future.

Go even further. Make it illegal to buy the instruments of ransomware - cryptocurrencies themselves.

Ransom is actually quite efficient (in a utilitarian sense) in scenarios like this. The net long-term result is an efficient allocation of resources towards computer security.

Reply on news.ycombinator.com