Hacker News Reader

Comment by viraptor | Hacker News Reader

The Risky Business podcast #624 talks about pretty much all your questions if your want to listen to it. But here's some relevant info: Hardening can help, but we'll always have new exploits and some of the time the intrusion comes from standard fishing rather than automation, so tech can't solve it. Crypto coins enable payment at scale, but Russia enables the operation to not worry about consequences (a lot of ransomware will disable itself on Russian computers to avoid local prosecution).

And in my opinion it's only a matter of time till something so crucial will be affected that the big guns will be rolled out. (I.e. targeted 3 letter agencies efforts) The podcast argued that touching the energy delivery / pipeline was already it - Fox asking daily how the current administration fails to deal with securing energy may be the point when some real action happens.

View on HN

This mentality of "there will always be new exploits" bothers me. Yes, there will always be exploits, but we can do a hell of a lot better at preventing them than we are. We know how to design systems that are really hard to get into – we just don't do that. Blaming a lack of IT funding is misguided in my opinion too.

Sure, there are ways that would pretty much nuke most of the ransomware business. For example application whitelisting. I wish it was more popular.

But then who whitelist the whitelister?

Solarwind was fun for that. They provide safe update of signed binaries . But their build system is corrupt, builds tampered stuffs and sign them.

I’m a just a user of those things: it seams that cryptography is not what is breaking the chain of trust. It’s the usage? But go fix phishing.

Maybe gov agencies should opt in for some tightly manage environments?

Windows application whitelisting in this context means your own list based on either paths or hashes of executables. https://www.bleepingcomputer.com/tutorials/create-an-applica...

But you're right that it wouldn't help with the solarwind situation. Once installed and given privileges, a trusted app can do whatever it wants.

> but Russia enables the operation to not worry about consequences (a lot of ransomware will disable itself on Russian computers to avoid local prosecution).

I remember reading how supposedly adding a Russian or a few other keyboard layouts might fool some of the malware to ignore the machine [1].

I guess one idea for the Western intel agencies could be to play off of that, and somehow disable that check (infect their malware) such that it can and does attack the Russian infrastructure.

[1] https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

If they could do that they might just as well disable the file-encrypting part.

If the goal is to put them the crosshairs of their own government's law enforcement. However, that said, in those parts the line between law enforcement and criminal organization is pretty gray and fluid.

Risky Business #624: Ransomware farce continues (19 May 2021)

Show: https://www.risky.biz/RB624/

Media: https://chtbl.com/track/383384/media3.risky.biz/RB624.mp3

Good 2FA (e.g. U2F) can solve most phishing. https://krebsonsecurity.com/2018/07/google-security-keys-neu...

In this context, "phishing" often means "random other forms of social engineering that people started calling phishing almost a decade ago".

The attackers no longer steal a password and log in with it, they kindly ask someone to please run their malware.

Reply on news.ycombinator.com