After Boeing declines to pay up, ransomware group leaks 45 GB of data
itbrew.com
itbrew.com
To put it another way, if this data had value, the ransomware group wouldn't be leaking it for free.
This is entirely incorrect and just speculation.
Most likely reason for not paying up is that law enforcement (involved in this case as well) does not like it and have even been considering a ban on ransom payments. This in no way implies this data has no value, it is very probable this data contains credentials (Citrix appliances) and might allow future compromises unless Boeing improves their security posture.
- https://www.techradar.com/pro/security/a-huge-hoard-of-boein...
- https://hbr.org/2023/08/how-a-federal-ban-on-ransomware-paym...
Never pay the ransom...ever.
Paying the ransom only funds the operation, prompting growth and incentives
If they wanted to be paid to steal credentials they should have gotten hired as a red team.
The formulation (3rd conditional) makes it clear the author is aware they're speculating.
> This [the dump is worthless] is entirely incorrect
Which isn't telling us why (the dump is valuable). You say that there's a legal ban on ransom, so the ban supposedly reduces market value. Black market participants evade bans, there is a black market value which clearly is the prime market for such loot. You write "it is very probable this data contains credentials" which is plausible, but the article you linked mentions logs and configs, not credentials. Maybe (before you point it out: that is also speculation) there were no credentials in the first place (dump was of low-value), or the hackers filtered them out for later use (seller filleted the fish), either way the resulting merchandise is of low value.
If the author had meant to convey speculation, their sentence would have included a modal verb or expression for speculation.
That’s a significant semantic shift from “have even been considering a ban“.
Defence industry is broad, though, perhaps you needed to be for security reasons. However, stating your job then saying individual people don't matter but commercial entities do may make you unfit for certain defence careers.
Realistically, most people aren't going to spare more than an internet comment or a weekend protest for some atrocity going on across the world, anyway. The world teaches us to compartmentalize evil in order to go on living...
Only in that they're saying the quiet part loud, and in defense you're not supposed to say it at all.
If they had 500 Tb of emails, maybe it was a concern, but 45 Gb looks like a single account breach. Maybe some interesting confidential emails sent company wide, or department wide, but probably hardly anything worth it. That's why I think Boeing didn't pay and was right to do so.
In this case, I wouldn't be surprised if the group want to make it clear that they're serious for other high-value targets
China: hold my baijiu
The US for example trying to get back some of its domestic manufacturing prowess, after decades which has outsourced it to China which has gotten really good at it, has a 10-20 year barrier to overcome before it can even start to get to the same level, and that's if all goes well and no stupid decisions are made. Which is not very likely.
One of the more interesting points of discussion was that when big companies negotiate purchase agreements for parts, the actual cost of the parts can be very transparent. The negotiation is generally about the actual markup e.g. "I think we should pay X% over cost.
Someone, logically, brought up: "What if the company is not willing to share the cost upfront?".
The professor responded: "Well, if it's a public company you can generally deduce a rough cost/part and use that as your starting point in the negotiation"
Student: "Well what if the company says we're wrong?"
Professor: "No problem: ask them what the correct number is. If they don't want to give it to you, ask them how you expect to have a long term partnership if you are not willing to talk openly and honestly about things like parts costs."
Just as we as consumers know we pay extra to the company (even if the numbers aren't oblique), businesses know the same. It's about how much you're willing to spend, not how much they spent to build it.
I wish this dumb naïve argument would just die quietly in a corner.
A the value of a device is not its BOM. It has never been and it will never be.
There are so many other additional costs to factor in. Costs related to the manufacturing plant, its people, its tooling and its processes. Logistics costs related to bringing in parts. QA costs. R&D costs. Software maintenance costs. Marketing costs. Certain parts and software may have royalty fees associated with them. The list goes on, and on, and on.
So please, enough of the dumb "$device is only $2USD because its only a bunch of 2c resistors and capacitors on a PCB".
No business wants to share it's internal costs, it's their prime competitive advantage
Now, the federal government, particularly with drugs pricing, turns a blind eye towards the suppliers just jacking up the purported cost. E.g. Pharma:“we want to make $100 per pill, it costs us $5 to produce”. Fed: “we demand cost + 10%, because the people”. Pharma:”Fine, let’s say it costs $90 to produce.” Fed:”Where do I sign?”
Whereas Walmart would say to somebody like Nabisco, “GFY; if you want your product on our shelves, you’ll open your books and give us audited cost + 10%”.
If your business' primary competitive advantage is that it gets ICs for 1c less/per thousand, your business is built on shaky foundations. One that you would still want to disclose during negotiations ("yeah, our product is the exact same quality as Widget Co; but we've found a supply for some internal parts at slightly below market value").
2. Imagine the sheer pain of duplicating every single process and spec to the minutest detail, nobody is flying an airplane that only 'works' 99.99% of the time. Probably easier to start from scratch and learn it. BTW, this was tried by Russia in the all through the '80s, they tried to steal all advanced tech. but by the time they duplicated the stolen technology, the next generation appeared. A losing battle.
Might I introduce you to the Tupolev Tu-134?
https://en.m.wikipedia.org/wiki/List_of_accidents_and_incide...
Also perhaps the 737-MAX. :)
* https://en.wikipedia.org/wiki/Maneuvering_Characteristics_Au...
> Capable of operating from unpaved and gravel airfields with only basic facilities, it was widely used in the extreme Arctic conditions of Russia's northern/eastern regions, where other airliners were unable to operate.
https://en.wikipedia.org/wiki/Tupolev_Tu-144
though that one was so defective that even the Soviets didn't want to risk flying it. it could barely get into the air, and that'd be with several major faults and alarms blaring.
2. Aviation in the USSR was developing completely independent, and you can accuse USSR in stealing technology in many areas but certainly not in aviation.
Not the ones that were forked due to abandonment, but the forks due to “irreconcilable differences”.
The 737 Max 8.
Have there ever been massive problems from one of these leaks for the targeted company?
I seem to remember quite a lof of similar leaks over the past two years where the market and public shrug it off.
Clearly 45gig is a lot. I would think if there was a major horrible thing to find that Boeing would have paid the ransom (and told no one).
Will it have any real negative consequences for Boeing?
It is a black mark against them that they were vulnerable. I guess it is favorable point for many that they didn't pay.
https://slate.com/human-interest/2014/12/sony-pictures-hack-...
It also says that a spreadsheet from 2004 states that 85% of the top earners were men. This is unrelated to the pay gap argument.
The rest of the article is fluff completely unrelated to the leak. I'm no surprised there were no ramifications from this. If this is all that was found, it pretty much says there's no or practically no pay gap at Sony.
https://www.theguardian.com/film/2014/dec/12/sony-email-hack...
https://www.theguardian.com/film/2015/may/28/george-clooney-...
The ones looking at this will be China, Russia and their associates that don't care about (Western) law.
Actually, the French government intelligence agency is famous for IP theft. This one is placed at their feet.
If however, a completely separate company, perhaps in a different country, that has no business associations with Airbus in any manner, and there will never exists payments between Boeing and this company went through all of it would be no problem.
If a specific bigwig later on received among photos and videos, a steganographic encrypted document whilst visiting an anonymous sex site then read it and deleted it, nobody would ever know. (lest someone talks, always the human factor)
I made up all of the second paragraph. Companies specializing in what i described over to exist. They are not of course limited to ransomware leaks.
If you are under defense industry rules, viewing data is generally on a Need-To-Know basis. For any data that is classified, or CUI (Controlled Unclassified Information), EVEN IF that data becomes publicly available, it is illegal to view it.
Now, I'm sure if a headline came up in a Google search you wouldn't get busted, but if you go ahead and download it, that is at least putting your ability to continue working with classified/CUI at risk.
So yes, it's a hot potato which no one (smart) in the civilized democratic world will touch.
How to shoot yourself in the foot with bad management?
(On the other hand maybe some other company's board went through the docs, hmm)
45GB can be a lot, or it can be a couple of people's worth of marketing presentations.
1. hack targets and hold their data for ransom
2. get the ransom and release the data anyway
This would largely discredit the actual ransomware gangs. A way to make this more ethical would be to have the data be insignificant or encrypted. The media will still have their story, and public perception will be changed.
An even better way would be to secretly coordinate with the "targets" of the hacks, turning the whole thing into a harmless spectacle that nevertheless decreases the incentive to hold data for ransom.
It always felt funny how these criminal groups in this case have to project an image of trustworthiness and honesty.
A lot of folks now have ransomware protected backups for critical data so they aren't paying for decryption keys.
This has escalated to hack and release, the attackers are now exfiltrating data and threatening to make it public in addition to encrypting it on the host system.
Because they will publish the bad stuff, the stuff you really don't want public, but likely withhold the boring stuff, the stuff the business really needs to function. And whatever they release might not be in the format that it was taken.
The article mentions citrix and emails, but that could be anything
Govs like China and aircraft/defense competitors to Boeing probably got a goldmine if they didn't already have their own access. Boeing does plenty of NATSEC and space stuff.
The purpose of the law is that now ransomware gangs will be less likely to target US companies because companies are unlikely to risk paying them.
That doesn't stop companies from paying for it. If you're a hospital, you're weighing breaking the letter of the law with killing a bunch of people.
[1] https://www.gma-cpa.com/technology-blog/paying-ransom-on-a-r...
[2] https://cbs12.com/news/cbs12-news-i-team/hospital-ransomware...
Given the sources of many of these attacks, one should reasonably assume they are likely to be doing business with a sanctioned entity, right?
In the case of digital files there is absolutely no guarantee that they delete the file, it’s like paying someone to go back in time.
The act has been done, the data is stolen, your negligence and wrongdoing is in the past and the only ethical option is to not fund the bad actors who are actually primarily responsible.
It seems so useless but is always portrayed as the "wow look at that number!" part of any leak/hack story
45GB and a a lot of it's just text. If it includes documents, it could be next to nothing.
And I believe some of the more interesting things found in that data set (outside of the fraud) were people cheating on their partners.
https://www.kaggle.com/datasets/wcukierski/enron-email-datas...
It really depends upon how it is used, misused or abused.
https://www.ferc.gov/electric/industry-activities/addressing...
This sounds liked a failed ransomware attack. They encrypted the systems - Boeing says "no thank you, we have backups". There were no valuable zero-days to sell to GRU, so give a last ditch offer to try to salvage something.
Yes. If any of this information does end up getting leaked, it kills the credibility of the ransomware group and they'll never get paid again. Sort of mutually assured destruction.
Now of course, most people don't really trust criminals anyway so the business has a pretty strong bargaining position and I believe many of the ransoms are negotiated way down.
(or do we need eBay-like "seller ratings" and customer reviews for ransomware groups?)
Understand: For the ransomer's point of view this is another monday, albeit one where a big fish walked away.
You can rebrand as CaTBUTT, or Indrik Spider 2.0, or whatever, but if you're using some custom version of Mirai they'll eventually tag your M.O. and the threat intelligence briefings will reflect that.
And then no ransom.
Didn't Silk Road have eBay-style ratings/reviews?
Superhost for my datas
On the other hand, holding their side of the promise allows them to build a reputation, which makes it easier to get future victims to pay. Why would they leak the data if someone paid?
There are review sites for ransomware groups?
"honored promise not to disclose, didn't gloat or taunt, would pay again, 10/10"
The reason ransomware worked was you didn't have to trust the group long-term - just enough to give you a copy of your data back.
It's the difference between you making a copy of my car keys and stealing them. Yes, I will pay for "a" key back - I only have to trust you enough to hand it over.
I don't buy it. There's nothing to stop the group from rebranding themselves. The company has no proof nobody else got a copy of the data. And the group could simply hang onto the data, extort a bunch of money from other companies, then start back at the beginning and demand even more (knowing that the data is worth _at least_ what was already paid for it).
Apart from the fact that nobody would pay them if they have no reputation.
If LockBit does something to taint their image in the media and among security organizations, then rebrands to avoid their negative history, forensics will still eventually tie their new name back to their old org, and victim's will have to decide whether they should trust that their data will be handled correctly after payment.
As for re-victimizing old organizations, there's almost zero chance of that working. Most data is only sensitive for a certain time frame, long enough that they can make the proper notifications, change credentials, etc.
Lastly, there still needs to be someone to download and abuse the data they leak. I've monitored ransomware torrents a few times and not observed any downloads completed over the course of a couple weeks following a data leak.
LockBit just did a sort of collective bargaining with affiliate groups that resulted in guidance for setting initial ransom amounts and rules restricting discounts about 50%.
Hilarious.
At least for 'most'.
There are people who consider these groups credible?? The world really has gone insane.
Hard to say...
You're effectively trusting the liar they wont lie again
Its possible they leak it to high profile customers without publicly announcing it
Business should make decision assuming the data will be leaked eventually regardless of random paid or not
Perhaps only thing business can assume is the data wont be publicly released in short amount of time
Let's say some three digit agencies create sort of malware distribution forums in the darknet. They make sure to only broadcast to people who wants to play with malwares so the net catches the "bad guys" mostly, except for a few curious researchers or journalists maybe. Then they start to share recent generarion malwares they created. They don't need to distribute them by themselves because they already have the CCC servers. Some malware gangs would eventually be the frontend and start the distribution.
In this way you not only distribute the malwares without getting impacted, you also get to know the gangs so whenever you want to catch a few fishes you just pull the net.
Once the darknet forum dies out or they need to wipe the records, they would just leave and create a new one.
Just my wild thought.
Usually we blame the Chinese, but in this case I think its a toss between CIA and NSA.
(I think I'm on some kind of list now)
Edit: I am an idiot. I was thinking of Airbus, see @perihelions comment below
https://www.economist.com/special-report/2003/06/12/airbuss-...
- "According to a European Parliament report, published in 2001, America's National Security Agency (NSA) intercepted faxes and phone calls between Airbus, Saudi Arabian Airlines and the Saudi government in early 1994. The NSA found that Airbus agents were offering bribes to a Saudi official to secure a lion's share for Airbus in modernising Saudi Arabian Airlines' fleet. The planes were in a $6 billion deal that Edouard Balladur, France's then prime minister, had hoped to clinch on a visit to see King Fahd in January 1994. He went home empty-handed."
- "James Woolsey, then director of the Central Intelligence Agency, recounted in a newspaper article in 2000 how the American government typically reacted to intelligence of this sort. “When we have caught you [Europeans]...we go to the government you're bribing and tell its officials that we don't take kindly to such corruption,” he wrote. Apparently this (and a direct sales pitch from Bill Clinton to King Fahd) swung the aircraft part of the deal Boeing's and McDonnell Douglas's way."
https://www.wsj.com/articles/how-north-koreas-hacker-army-st...
This isn't really true in general: intelligence agencies often want access to funds with less/no oversight from (or to skirt controls enacted by) other parts of the government. As an example, that was the dynamic at the basis of the Iran-Contra affair in the US.
Actually I'm often surprised that many ransomers/hostage-takers go through with their threats when they don't get their demands. The only reason I can see them doing it is if reputation matters to them for future negotiations. more than the risks from the greater liabilities they incur by going through with the threats.
It doesn't have to be the whole group; perhaps one guy decides to branch out on his own, and grabs the data on his way out the door.
However if you have adequate backup and recovery mechanisms in place then you're not the best to prey on.
It's a business model that works until the majority of targets have appropriate backup and recovery processes.
Point is what is the upside of disclosure (I think) vs. the downside. Nobody is suggesting no disclosure but the writer seemed to think that the security industrial complex has lawmakers believing that everything should be open and there should be constant white hat hacking which seems to feed and benefit the security industry.
I am curious if anyone has a thought on this topic.
Then an email dump of 45 GB of useful information could instead be 4.5 TB (with 1% useful information), and wading through all the non-information to find something useful will not be worth the time of the adversary. The more important information you have in emails the more you need to increase the misinformation-to-information ratio.
It's not even just offshore. Some onshore consultancies are really of agasp quality.
My current impression is: consumers don't care, regulators don't care... so why should CEOs care?
Source: my company was hit a couple months ago
You might be put at ease to read all that debt is a hallucination humanity has no obligation to pay.
Also after decades in IT hearing about one lapse in security after another (including entire iron mountain trucks being robbed back in the day) yet society seems capable of shrugging them off, it’s hard to take the anxiety seriously.
It’s possible the CEOs are not the only people in IT inflating the value of their contributions and ideas.
There are bluray movies larger than this leak and there are files smaller than 10kb a lot more critical in most businesses.
It'd be nice if there was some sort of scale for data leaks like (just spitballing here):
1. Leak destroys all core company functions (crypto-exchange leaks all wallet keys, CA leaks all root keys and becomes banned from all trust stores, etc.)
2. Leak causes regulatory issues criminal enough to shut down company
3. Leak severely hinders core company functions (deploy keys for a cloud computing SaaS are deleted which stops all new deployments until all infra is reconfigured)
4. Leak severely looses company competitive advantages (new products leak that are replicable by competitors)
5. Leak causes severe PR disaster
6. Leak shows embarrassing internal company communication without any of the above
Kind of like saying I have 10. 10 what? As my math/science teachers always said, don't forget to include your units.
Maybe the world needs a standardized place to catalog and rank all the data breaches that have been disclosed.
The disk size does not matter, and when the severity was actually determined it would show up in the headlines as "Boeing leak determined to be a level 3 leak" instead of just being "That boeing leak 5 months ago was kinda bad".
Either way, listing the size says very little.
Relevant quote from the article: "I haven’t gone over the whole data set but Boeing emails and a few others stand out as useful for those with malicious intent"
And second, even if a company has no idea of the scope, the hackers would somehow want to prove at least privately what the scope was, else their threat is not as manipulative as it could be. On the other hand, the hackers can't credibly bluff and inflate the scope too far beyond reality because the company can just say "prove it or I don't believe you and I won't pay." And the hackers want to get paid.
It's a business deal after all. A really crappy one involving criminals. But at the end of the day, the company must have already assessed the value of the leak in order to reach a decision.
I've seen companies say this sort of thing with high confidence. But that seems hard to me, assuming some level of administrative access was breached.
Groups that leak are likely to want to inflate the severity of the leak to ensure they get paid.
The larger a leak, the higher the probability there’s sensitive information in there, and the better opportunities/more time attackers had to exfiltrate it.
The info says nothing, it conveys nothing. Even skipping the size and saying it leaked "emails" says more in the headline than the size.
A single video recording of an all-hands meeting could fill that size but it could also be emails containing the keys for accessing a large part of DOD.
They asked for almost a million USD. FBI got involved, everything was restored from backups (thankfully, a month loss of digitalized work, and absolutely nothing was given to the ransomware group.
To your point, there are severe regulatory issues that have to be addressed due to the exfiltration. I no longer work for them, so I don't know the extent of their cost in 1. notifying affected clients and 2. providing credit protection coverage due to leaking of personal data.
I think that is a good way of measuring it.
Could be the alternative headline.
No news org is going to go through that effort.
Boeing, Lockheed Martin, Facebook, etc...deserve it
This is a childish 2000s take. The world is rougher, Pax Americana is over, we need effective defense contractors because the world is full of assholes. Grow up.
Any company that helps support America is also bad and most be opposed
Any person that that does not view America as bad is a bigot alt-right extremist and must be opposed
That is the state of politics for 2023, and anyone born after the year 1990 or so
On the contrary, it's less violent than previous decades. The difference is you get to hear about EVERYTHING due to nearly ever human on earth has a smart phone and access to the web.
This is a blessing and a curse. Given your handle, I'm surprised you haven't figured that out.
I know you're better than that.
We watch it happen. We have the tools to stop it. But we're not empowered to use them, for the exact same reasons that led to Equifax's fuckup-- we're not allowed to do anything that might impact production/pursuit of new revenue.
Lately, I'm not convinced this is even the "wrong" approach. Espionage was not invented alongside the Internet. If we build a Thing and it's the only Thing we sell, data concerning it will inevitably be stolen by someone in some way. But if we iterate on it fast enough, the value of older versions leaked diminishes. We're in the market of building and selling a moving target.
It also creates an inflated volume of data. You can't just break in, grab "the_flag.zip" and run like hell-- you have to exfiltrate a fuckton of data, make sense of it, and carve something usable from it. Like, checking binaries into a git repo makes the size bloom, but it doesn't add a proportionate amount of "value" to stealing that repo. It's padded with drafts and garbage.
Now, if it is 2,000,000 text files totaling 25gb, then that is harder to explain away.
(I just read the article and saw that it deals with a vendor we use daily... so... great news.)
Slowly, hidden among legitimate traffic, and indirectly. For example, most companies don't notice 100 kb/sec increases in DNS traffic, slight increases in web server image sizes, or changes to server MOTDs.
Otherwise you could have a crawler that just traverses the FileShare and makes duplicates at a rate slower than what would look like BAU traffic. Given that most enterprise network shares host a TON of legitimate batch dump/upload file traffic it might be easy to skate by.
Unless this was just a public S3 bucket, there was probably some lateral movement involved, and I'd say time/money would be better spent reducing that particular risk in the future.
Boeing Co, as a government contractor being hacked is obviously more concerning than a breach at $x company. It's a shame. I'd say this is a learning opportunity, but it likely won't be. Onto the next round of "cybersecurity" speak...