LockBit says it's leaked 50GB of stolen Boeing files after ransom fails to land
theregister.com
theregister.com
I’m seriously asking because a while ago, I had an interview that was explicitly about finding a business model for that type of data (flights, on-time, maintenance, etc.) for a reseller. I think I did a good job, but the company closed before they made an offer. I reached out to a friend who was working for a big airline to ask for his help on that, he was helpful but cagey: that’s because that was his job. A bit later, he mentioned that those were notoriously hard to buy because there wasn’t really any client — not a legitimate one.
The only potentially interested parties he could mention were people looking at tourist trends (they get overall hotel and restaurant stats: flights aren't the right breakdown) and possibly taxi companies to get on-time stats (that’s actually another project I worked on; small world). But landing data is public, or at least scrapable.
Chinese manufacturers (if you believe the rumors that they like to copy technology) care about R&D. Airbus, maybe, to price them out when competing on bids? But it would seem obvious and not that helpful. I’m not a sales guy.
This is “parts and distribution business” so, essentially, the business branch recently transformed by a lot of machine learning to predict failures. If another maintenance company could train a similar model, they would benefit, but is there such a company? Does anyone do that in both partnership and competition with Boeing?
I’m genuinely curious: Who would want that data?
It's not a rumor that China copies tech, they've been caught stealing corporate and military IP.
https://www.securitynewspaper.com/2021/08/23/how-chinese-apt...
Basically, I don't think enough people are seriously questioning the costs vs benefits of using the internet when dealing with sensitive data. You should assume anything that touches an internet-connected device will eventually be stolen, and plan accordingly.
For some it's a bitter pill to swallow when everyone is the bad guy, but we should just accept governments don't like being bound by international laws when breaking them can give them an advantage.
1) to view these data (nothing nefarious, just to see what they look like)?
2) to use these data for business?
Edit: I have no interest in using such data. I am asking to educate myself about legal ramifications that pertain to such leaks in general.
That data is copyrighted, so Boeing could go after you for that, using anti-movie-piracy laws that are quite draconian in the US: copying itself is bad but hard to prove; making it available is definitely worse.
Trade secret tends to extend more broadly, including soliciting, and corporate espionage carries real penalty including conspiracy, so I would avoid it.
Where I’m less clear is if that data would be protected under anti-terrorism laws: now that I’ve been thinking about it, such documents could help someone plan a terrorist attack by, say, planning a watering hole or supply-chain attack. In that case, the law gets far more open-minded for the prosecution, letting them try anything to prove their case, and the consequences go as far as extra-territorial non-US-jurisdiction legal nightmares. I’d stay away from it, but IANAL.
I'm not seeing much value in loads of Boeing-specific tech data for current generation civil aircraft though. Most of it isn't that secret, there's no viable market for copying Boeing parts without Boeing approvals stamped all over them, maintenance on Boeing aircraft is done at manufacturer-specified intervals regardless of whether it's a Boeing facility or a third party with Boeing approvals, competing aircraft have completely different needs, and if they really wanted to know how Boeing solved a problem that's bugging them they could just poach engineers...
They can get up to some stuff when it comes to classifying things as "new". Check out the financials. BGS is always swimming in money compared to the other divisions - that cash flow almost certainly helped along by pushing returned assemblies back out as "more new than they probably actually are, and should be according to the contract docs".
And there's just a joyous brown fountain of horse puckey when it comes to "equivalence", a whole other pile of dead fish. The stuff that the PLs claim is "electromechanically equivalent" makes my brain hurt. Like, does it have wires sticking out? "Oh, that's an ARINC 600 connector for sure!". It's harder to nail someone for false equivalence, though, since it's a pretty nebulous thing to define. Unlike "yo, this new part is actually old and busted".
I should add that Boeing isn't really alone here. Lot of suppliers do this stuff too, and Boeing, the damn fools, probably get caught covering for suppliers and subsidiaries.
From the file names it doesn't look like anything particularly interesting though.
* I just want to make my own jet engine
[1] https://old.reddit.com/r/Malware/comments/11gy7h1/list_of_ra...
> Elements of Boeing's parts and distribution business recently experienced a cybersecurity incident
Sounds like boring data for the curious mind, unless logistics is your vice.
That said, I'm learning a lot about digital forensics
Some victim has been violated by a criminal, with the breaking in and stealing and threats, but doesn't further violation happen when others pile onto that?
Also, isn't the threat of releasing the information that the victim will be further violated by others if the information is released, and so those others could arguably be seen as enforcers for the criminal threat?
My ideas of what's the right thing, and how determined I am about it, change over time.
One reason for change is receiving new information, or realizing a different way of looking at a situation.
A group called ALPHV (who AFAICT was responsible for the MGM resort outage) even makes an API available and indexes their leaks so users can search through them and download individual files. One particular leak for the 3-D Engineering Corporation caught my eye - I can see a bunch of Solidworks parts and assemblies from just a quick glance of the file list. I'm betting there's some ITAR violating files in there which makes me feel icky. Any serious leak from Boeing could contain stuff that's actually relevant to natsec.
That said, we are talking about Boeing here, which was recently responsible for negligently killing hundreds of people. I'm inclined to say "fuck their right to confidentiality."
Lose their right to confidentiality wrt public interest independent investigation of the 737 MAX 8 and/or other possible wrongdoing/dysfunction?
Or lose their right to confidentiality just in general, as a kind of mob justice lite?
In both cases, how clearly can we distinguish logical reasonings in pursuit of justice, and convenient rationalization for something we wanted to do anyway?
Juiciest potential bit is always going to be emails so you can see the human component of what people really think.
(DCS World is a combat flight simulation game, the consumer version.)
Boeing does not manufacture any engine that I'm aware of.
Probably won't be airworthy, but, that's a problem for later.
* aj76gb9 wip2
* 855a7vv wip
As aside, it's hard to believe this incident in particular didn't get full NSA attention.
(The only exception I know of is allowing illegally-obtained evidence in defense against defamation claims...IANAL.)
For example, if I break into your home and steal your safe, which contains evidence of fraud you're committing, then the cops catch me and seize the evidence of my crime, thus observing evidence of your crimes, the evidence they took from my case can be used against you.
In fact, if I'm talking to my cop friend and he tells me about the case against you and that they think there's evidence of your criminal activity in your safe, but they haven't obtained probable cause, I could break in, take the safe, and provide it to my friend and it still be admissible in court. Your defense would have to make a convincing argument that my cop friend asked or coordinated with me to commit the crime of breaking into your house/safe.
> files said to be related to [...] supplier details.
Supply chain attacks are the social equivalent of malware persistence. Now you know what parts they need, what vendors they source from, and maybe even for what products, so you've found a number of ways to get back in later.
OTOH, this isn't plain ransomware, it's exfiltration+ransomware. More and more bad actors ransom, and after being paid, sell anyway. Why pay if they're going to slap your other cheek regardless?
Sometimes the groups want a good reputation for not disclosing stuff if the ransom was paid. They earn that reputation over time.
j/k, of course.
One should assume at this point that it's not a question of whether the files will be leaked but when.
Often the data isn't exfiltrated at all, only encrypted in place, which should be relatively easy to prove.
If they delete the files, it's not out of decency. It's out of a desire to build a reputation of post-ransom trustworthiness so others will pay in the future.
They may be inappropriately handling the contents relative to their scope and potential damage, but that's actually not their prerogative or their concern. It should be a punishable offense beyond "ransom fees" to be in such a position that you can get so easily exfiltrated when entrusted with nationally secure data. Making a big display to the company to pay up a ransom means this has likely already happened silently multiple times to varying degrees without notice, and that anything after the initial public response is just theater. Its unfortunate that I have to feel embarrassed by the security posture of businesses that have absolutely no excuse.
The market price of how worth it is this stuff to the company
For now, the flogging continues until morale improves
the person creating a payload is compensated without doing the unauthorized access
the person doing the unauthorized access is compensated without selling the things they found
the person selling the things they found didn’t do the unauthorized access, and is not trying to weaponize the information (lets use an example of identity theft here and below)
the person weaponizing the information is only guilty of using someone else’s credentials or making new credit cards
in comparison, white hat is undervalued when respected, a gamble for being respected enough for compensation at all, and comes with threats of prosecution anyway
Convince me I am wrong about this.
Those are reasons why I think it's unlikely such a legislation would appear, not why it's a bad idea. Liability, personal at that, for lack of cybersecurity should absolutely be introduced globally.
I suspect an alliance of western countries may happen. When the criminals are based in Russia, China and North Korea, we can expect those countries to already have a copy of all the leaked data, and paying ransoms is essentially just funding enemy spy agencies.