Major Swedish supermarket chain hit by cyberattack
wionews.com
wionews.com
https://www.voanews.com/europe/major-swedish-supermarket-cha...
It's truly scary that you can get into these kinds of situations (completely relying on a 3rd party IT), but it's also very costly to have a doubled setup :/
This cyber attack will probably result in a doubling down of the same technology that put them into this position. Perhaps, in addition, they should look for a lower tech fall back approach.
The difference between less (manual) & more (computerized) efficiency is probably less important than the difference between stopping & continuing operations, in exceptional times.
Waffle House and Home Depot (among others) are pretty good at internalizing this, and have processes for running on shoestrings, but still running, until normal support can be restored.
Also these days I think you're legally required to use some sort of government fiscalisation service where each receipt is uploaded as issued or something like that.
They're pretty cheap, I even have one myself.
I find that to be a smart move.
I really hope so.
If not, just pretend you didn't see this message :-)
In this case the answer is that I live in Drammen.
May I ask why you want to know, and what you will do with this information?
Sure. The reason I asked was that I just want to get a feeling for who all you folks are. Also since I live in Horten it would have been the closest one I knew except people at work.
As for what I want to do with the information I guess it depended on the answer, but probably nothing.
If there was a place to meet HNers near home or work I'd probably visit it once a year or something (depending on how it turned out the first time).
Might lose some payments to overdrafts or cancelled cards. But they lived with that with credit cards up until 2000ish.
Buy-on-board on Aircraft and trains take advantage of this.
Offline payments is baked into EMV payments. It can at least verify the PIN and that the card was valid at its last phone-home.
https://www.google.com/search?q=mastercard+emv+offline+payme...
You could still fraud hit them in this circumstance, but they have some kind of info printed on your card with your name on it and how long you've been a member, and somewhere in the background, a phone# and address.
If one wanted to commit retail crime, easier to just take stuff and walk out without paying.
Once, while waiting to check in for a British Airways flight from Manchester (UK), I noticed several large plastic boxes behind the check-in counters labelled "manual check-in".
Presumably someone at BA not only thought about but actually implemented a plan for how to check in passengers when (not if) all the check-in computers go down.
This is a classic case of layered out sourcing as I'd like to call it, and no redundancy. They'll learn.
They are victims of a ransom attack, it's spread through the software in the checkout tills.
There is a message on the client, for example on the till when you log in.
There are surely people out there who know security, but how does someone who doesn’t know security choose the right people to hire?
The very software that was the vector of this attack is produced by a company claiming to improve security.
How do I spend the least amount to get "security"? Rather than, what risk mitigation is appropriate for my business, and how can I gain value from approaching or exceeding that?
It feels like part of the problem is not blending IT security into a peer level with the Operations org, as that's what it functionally is to most companies these days, and looking at it from a revenue risk mitigation perspective makes more sense for funding it appropriately.
I think it’s worse than that. It’s not just security that lacks investment, it’s the whole IT infrastructure.
Obviously the observations of one lowly employee can’t be generalised much, but creaky infrastructure seems too common.
I understand why security is important but the majority of staff (particularly non-technical) see you as a blocker.
Security is everyone’s responsibility and creating an environment where it’s like this, and making it as easy as possible to get people to report stuff they see without playing the blame game is key to getting trust and demonstrating that togetherness.
There’s only really hate in them v us type environments (I’ve seen it also in other cross team interactions like Dev v Ops for e.g.) or security teams blindly giving teams lists of controls to implement without having even done any kind of risk assessment with the asset owner (and quite possibly without taking other business risk priorities into account).
As for convincing non-technical staff of the importance: The technical vulnerability (or whatever) needs relaying in business risk terms they can understand.
I'm curious cause while I'm not on my company's security team, due to heightened awareness and wanting to ensure we're protecting our trade secrets, etc, we've ramped up security in basically every way across the entire organization, and it's been basically a pleasant ride internally for all few thousand members of the company across the globe. The technical teams (dev, support) had some speed bumps, but a frank discussion with IT Security to discuss what our need was and why it wasn't being met, we found acceptable new routes. If anything, we've used the locking down of potential security risks as a leap-board to overhaul and optimize a LOT of workflows for the better.
Our customers now, that's another story, and it's like trying to make a pet take medicine. Our largest customers are fine and understand (even appreciating) the security changes we made for our interactions, but a lot of the small business customers only care about the fact that they can't do what they previously used to in some cases.
But I'm fairly curious what resistance people are seeing from their implementations and what these implementations are.
For example, try building a new website for a company, only to have the security team insist that you fix "defects" such as not tying sessions to IP addresses. Yeah, fuck all the people on mobile phones hopping between networks. It would make sense for accessing internal data, but not for what amounted to a marketing site for public consumption.
Like I said at the open, this can happen with any department or team- security, I think, might tend to happen a little more frequently, if only because it is logical that they do need a certain amount of autonomy to do their jobs well.
Good Infosec people are as rare as hen’s teeth.
Infosec employees follow the same anemic HR compensation song and dance, often lumped in with all engineering as a category.
Security startups are known as "cockroaches," they never die but are a hard bunch to grow into unicorns.
Contracting really only seems amenable to a small bump in lifestyle business level rates.
What's wrong with being large enough to live well,
but still do the job correctly, and not botch your email migration?
In recent years I’ve seen no evidence “Infosec people” are worth more than general engineers, and quite a lot that they are worth considerably less. And yes, this is when it comes to security matters.
The industry, as far as I can tell, is about 80% chancers who got into Infosec because they couldn’t cut it creating software.
The other 5% are super smart and are basically engineers who specialize in security.
I feel like many cyber people get certs and then hope for nothing bad to happen. When something bad happens, they claim that someone else didn’t do something right or get fired and move on.
Have you considered starting a ransomware gang?
The best way for a practitioner to personally capitalize depends on their background. For instance, someone with infrastructure support experience may make an excellent incident responder. Someone who deeply understands how systems would could be a talented pentester.
Edit: From a compensation perspective the solution is to take your growing experience to the next company willing to pay for it.
As a piece of software grows in length, the releases must be fewer and further apart. Otherwise, the team is taking shortcuts and the liability will eventually catch up with them.
With that framework in mind: if large software company X stretches out their release schedule, their share price will fall, eventually appealing to activists who want to control/replace leadership (ironically for doing the right thing).
I’m a true and through capitalist—please don’t get me wrong, but this is creative destruction at its finest!
Thoughts?
If you find yourself in a SOC a where everyone is stressed out and nobody has any mobility, learn what you can then move on.
1. MFA all the things
2. don't disable windows updates
3. don't give Domain Admin rights to half the company
4. don't use shitty software
For some reason, companies refuse to do these simple steps, and then they get hacked. It's not a technical problem, it's a political problem. Sysadmins naturally want to run their networks in the least secure way possible, and in shitty orgs, there's no one there to stop them. Over and over again, it's the same thing, and it's hard to have sympathy when standard security posture seems to be getting more and more lax as time goes on.
Most large corporate ransomware attacks spread by hosting into the Active Directory Domain server. It will slowly spread to each corporate machine as the users log in.
It seems this was the way Software AG, the second largest German software company, was hit by Clop.
As they did not pay the ransom their private emails are available on the internet, scans of their CEO passport etc...
https://www.cpomagazine.com/cyber-security/clop-ransomware-a...
Maybe ransomware gangs will finally prompt the industry to fix security practices...Also, maybe the technical stack that most companies hit by these ransomware attacks use, should be mentioned every time we see these news ;-)
Absolutely. Microsoft is a mess. I could go on for hours about how Windows networks are fundamentally insecure, and cannot be fixed without a massive psychological shift. Sysadmins love it though for some reason, probabally because it gives them way more power than they should ever need over their users.
I love hearing war stories from people who worked offense at places like Google, with almost zero AD footprint. Even the most basic attacks take SOOO much more effort. I would love it if a ChromeOS centric Zero Trust model actually became a thing, but it's not going to happen naturally. Maybe if we let all these ransomwared companies fail spectacularly, and refuse to bail them out, then the only companies that will be left will be those who care.
Unfortunately telling people not to use Windows rarely goes over well. To that main point, as bad as Microsoft is, there are so many companies that are so much worse. This Kaseya thing is essentially a rootkit with shitty authentication. Installing this thing on endpoints is a fundamentally flawed concept, yet here we are.
As for machine administration, it's ChromeOS, what needs administration? Just keep logs of auth and app usage on the server side and you have all the logs you ever need to track down bad behavior. Nothing can be installed on a majority of client systems, and nothing needs to be installed, as it should be.
[1] https://unlimitedhangout.com/2021/02/investigative-reports/f...
Quotes below are from a different article from a source that HN won't let me post. Looks like only conspiracy theory sites are applying any scrutiny to this.
> "The simulation, called Cyber Polygon 2021, was announced by Russia’s largest state-run bank Sberbank in February.
> “The key message voiced by experts at WEF and other international platforms is that supply chain security is to become a major cybersecurity issue in 2021,” Sberbank stated. "
Could even do offline simple verification of payment with the debit/credit happening at a later time.
I think you'll find that it varies throughout the world. In Sweden, I've been to a couple of restaurants when their payment network was down and had it not been for them also being hooked up to the Swish app (which is connected to a separate payment network), no one during those lunch seatings would've been able to pay at all (both of these were cash-less restaurants, which are super common in Sweden, where almost no one uses cash anymore, sadly*).
Just to give you a picture of how seldom we come into contact with cash here: The Swedish Central Bank redesigned the artwork and form factor of the hard currency here, I think even introduced some new denominations, back in 2015. 6 years later, I still haven't seen or touched one of these new bills or coins out in the wild. That's how much people use cash here.
*: I may lament it, but I'm the same. It's so damn convenient, but I am of course aware of the drawbacks.
Visa and MasterCard EMV have offline transactions baked in. Your bank could disable it on your card, but then you wouldn’t be able to buy a beer on an airplane.
I’m not sure if all terminals can be configured this way (or more likely, if anyone nearby would know how), but the functionality is baked into the visa and MasterCard standards.
But it seems like there’s only a few manufacturers of payment terminals out there and they just interface to the POS.
Here’s a popular US/Canadian restaurant software with instructions on how to put your payment terminal into store-and-forward mode when network/wifi goes down: https://www.touchbistro.com/help-articles/offline-payments-i...
I guess the cryptographic verification is slow, at least for that particular implementation.
The modern ones have these portable card terminals that are chip+PIN only. These customers would have to come back another day to pay.
So, in the former, catching up is much harder - you might need to take an inventory if the outage is lengthy, which is a PITA. The requirements probably didn't include offline mode.
It isn't that long since i've seen Norwegian cashier machines running in offline mode. While Norway isn't Sweden. I'm under the impression that our payments systems are almost identical.
But as we see here it doesn’t matter whether I use cash since stores close when the systems go offline anyway. I doubt they’d even set up a cash fallback if this continues for months.
When you buy food/beer on a plane/train, this is probably happening. Ryanair would rather eat the cost of a fraudulent payment than pay for data and slow down their salespeople.
[1]. https://www.coop.se/butiker-erbjudanden/vara-butiker/
[2]. https://sv.wikipedia.org/wiki/Coop_Butiker_%26_Stormarknader
Unlike other distributed databases you don't have one store selling an item of food from another store (especially if your online system is down) and need to do a split brain recomp.
[1] https://www.youtube.com/watch?v=a7wutgAlNHk
A few years ago, during a power outage, a stores clerk actually used one of these for/on me. I was pretty shocked ;)
They did the same thing in the 70's if your card was worn down. This is a solved problem.
There are a couple of approaches that could involve multiple payment providers over redundant networks so switch to something else.
For inventory, since it’s likely only temporary transactions can be stored locally and then synced when back online.
Theoretically the design could be distributed all the time and just keep working the same while disconnected with some potential reorders and restocks slowed down or delayed.
Or, you know, blockchain inventory or something.
2. Have clerks write down what is needed on the shelfs.
They'd have to make that very clear at the entrance to the store. This is just a guess, but I think most Swedes don't carry enough cash to even pay for groceries when they go shopping. I haven't had any paper money in years, just a few coins.
But Swish (mobile payments) could work.
I think you're underestimating how little we use cash. There aren't even ATMs in some parts of town and there are plenty of villages without one for tens of miles. Nobody uses cash anymore. It's all either debit cards or direct transfers (either via and app or the bank.)
offline-first PWA
Manual fallback option when the most predictable failure scenario happens (only backend server fails)
OTOH until the incident is resolved one could instead go shopping at ICA, Hemköp, City Gross, ÖoB, Tempo or independent stores.
I guess the customers that are hit the hardest are the ones who aren’t mobile and only have a Coop store nearby.
Ban cryptocurrency.
More information:
* https://news.ycombinator.com/item?id=27718529
* https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689
* https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransom...
How's that working for you?
[0] https://www.atera.com/what-is-an-msp/
Note: It's interesting that the above quote, copied directly from the DDG search for "MSP", differs from what is currently at the url listed in the search item.
They are big on intigrity att least.
On top of that, we'll also reduce electricity and computer chip waste, since mining activity will decrease as the price plummets.
Its a lot harder to justify huge attacks when your payment is in gift cards, compared to semi-anonymous crypto that can be cashed out in your 2nd world country of choice.
Why cant the hackers tell the victims to transfer dollars/ruble to a Russian bank or some other bank in a country which is not friendly to the US?
Russia Gov is involved, but not publicly.
The disease is a broken software/security industry, these people taking advantage of the situation are just an inevitable symptom.