TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Massachusetts Steamship Authority hit by ransomware attack; ferries delayed

189 pointsby SocksCanClosealmost 4 years ago

24 comments

usesalmost 4 years ago
I&#x27;d really like to see&#x2F;hear&#x2F;read a breakdown of some of related issues from some experts.<p>Even on HN it&#x27;s the same knee-jerk reactions every time one of these stories hit.<p>This is one of the most pressing technology issues of this moment and the discourse just sucks.<p>* Does banning ransom payments do anything? Good idea&#x2F;bad idea? Historical analogues?<p>* Do we need to pay rewards to cyber privateers to take down cyber criminals?<p>* Is this an issue that can only be solved at the geopolitical level because of the role states play in enabling this activity?<p>* Will the hardening brought about by this eventually outpace the crappy attacker software?<p>* Is this a phase or the new reality?<p>* How much of this is enabled by technology vs the geopolitical situation?
评论 #27373907 未加载
评论 #27373700 未加载
评论 #27373637 未加载
评论 #27374593 未加载
评论 #27377221 未加载
评论 #27374007 未加载
评论 #27373803 未加载
评论 #27374786 未加载
评论 #27374203 未加载
评论 #27376998 未加载
评论 #27374864 未加载
mrweaselalmost 4 years ago
I continue to wonder why more companies aren&#x27;t utilizing application whitelisting. Most, if not all, of the attacked companies run Windows, and Windows have been able to restrict system to only running whitelisted application for ages.<p>Sure, whitelisting is annoying to say the least, but these are critical systems, you don&#x27;t need to install new software daily or even monthly.
评论 #27374431 未加载
评论 #27373269 未加载
评论 #27378878 未加载
评论 #27377789 未加载
JumpCrisscrossalmost 4 years ago
A federal ban on paying ransomeware would reduce the incentive to commit these attacks.
评论 #27373087 未加载
评论 #27372886 未加载
评论 #27373650 未加载
评论 #27372899 未加载
评论 #27377694 未加载
评论 #27373785 未加载
评论 #27373570 未加载
评论 #27374607 未加载
评论 #27372961 未加载
评论 #27372842 未加载
joebergeronalmost 4 years ago
Interesting -- I was just in Woods Hole earlier today, and in fact saw this article pop up on Hacker News while walking by the Steamship Authority. Always strange to see your small slice of the world crop up in places like this. On that note, the Steamship Authority is such a fascinating choice of target for such an attack. Probably very low friction, as I can&#x27;t imagine they have any sort of sophistication behind their technology stack.
Decabytesalmost 4 years ago
I wonder if this will mean an increase in cyber security related postings in industries that have otherwise not had to worry about cyber security before (I.E the Steamship Authority, Meat industry etc)
评论 #27373393 未加载
评论 #27373201 未加载
评论 #27373341 未加载
owlbynightalmost 4 years ago
The US is going to end up tracking and assassinating these people, if we&#x27;re not already. Messing with the old money usually doesn&#x27;t turn out well for whoever&#x27;s doing it.
评论 #27373998 未加载
评论 #27376555 未加载
评论 #27374464 未加载
评论 #27374638 未加载
1970-01-01almost 4 years ago
This isn&#x27;t news anymore, its weather. If your company does not have a full time cybersecurity team, they soon will, even if they say they don&#x27;t need it.
评论 #27374259 未加载
评论 #27373662 未加载
评论 #27373822 未加载
endisneighalmost 4 years ago
How exactly are the ransoms even paid out? I would assume cryptocurrencies, but before those existed how did they pay out?<p>I&#x27;m not sure what it would be called, but has there been any investigation in a sort of &quot;transparent by default&quot; database system? Ideally if this were possible people wouldn&#x27;t need to care about data being stolen (though in this case it&#x27;s unclear what the attack did, but many times it&#x27;s more like we&#x27;ll reveal&#x2F;block your data unless you pay up)
评论 #27372754 未加载
评论 #27372717 未加载
评论 #27372767 未加载
评论 #27372796 未加载
jl2718almost 4 years ago
Well, I’ve been shouting this from the rooftops for a while now, and finally they got my lifeline.<p>Ransomware in cryptocurrency could be easy to stop naturally. Miners just need to know that there is a nonzero chance of their blocks being forked off if they help them. It’s a technical problem of out-of-band governance protocols among miners, not unlike what is already being done for positive gain (MEV) by FlashBots. That’s the incredible possibility of cryptocurrency. It’s designed to turn selfishness into a public good, with no coercion, recognition, or good will. And sure, they could include a massive reward to convince miners to include the block, but then that also goes for every coinbase and transaction afterward, until there is nothing left, and no incentive at all for ransomware.<p>The present reality, of course, is that miners are just not that sophisticated. For the most part they’re just aping the repos that are released by the foundations. But the foundations certainly should understand that it’s in their interest to protect their currency by at least giving the miners information about transactions in the mempool or utxos, and perhaps some kind of out-of-band signaling mechanism to indicate unwillingness to accept blocks that include them. Perhaps better yet, a price for inclusion demanded in the form of an MEV burn added to the next block, which would of course fetch its own price. There is some criticism of the foundations here, as there is also some criticism of some PoS implementations that do not allow fork selection, but ultimately I think that they can solve it.<p>So that takes care of economic hackers. I’m far more concerned with non-economic or peri-economic agents. There is a doctrine of “unrestricted warfare” that everybody should know about. It explains many things about how and why things do not make sense. It is because we are under attack, and it’s a truly brilliant offensive, for which all of our defenses only work in their favor. I don’t have the answers for this. But it does give a warning. The effect they seek is not the damage they’ve done, but our reaction to it. Our reaction, by regulation that cripples our competitiveness, by restricting our own freedoms, could be disastrous to our country and our way of life, which is exactly what they want. And these attacks, although they may be carried out by economic agents, almost certainly find their roots in exploits created by long-standing programs of infiltration. Nature too, has learned this trick; SARS kills by turning the immune system against the host.
jacquesmalmost 4 years ago
Interesting how everybody focuses on the things that they know about: technical solutions, legal solutions aiming at the victims, payment options and so on.<p>When the real failure is somewhere else: bringing these perps to justice. The fact that they can get away with this over and over again hiding behind anonymity is what enables these crimes.
评论 #27378218 未加载
评论 #27378215 未加载
评论 #27378058 未加载
tibbydudezaalmost 4 years ago
Clearly they are messing with the wrong people from Martha&#x27;s Vineyard :).
评论 #27374329 未加载
评论 #27373929 未加载
VectorLockalmost 4 years ago
Cyber privateers sounds like an interesting idea. Except instead of hunting criminals they hunt for victims. The government pays them bounties, then goes to the victims and says &quot;We&#x27;re fining you $X, and $Y per day until you fix this.&quot;
LatteLazyalmost 4 years ago
Has anyone looked at or tried to quantify the effects of paying ransoms for kidnap victims in the middle east and north africa? That&#x27;s the most comperable thing I can think of...
arduinomanceralmost 4 years ago
I&#x27;m curious if seeing headlines like this causes other companies to invest more in security.<p>Or is it more like &quot;well as long as it doesn&#x27;t hit us we don&#x27;t care&quot;
评论 #27373147 未加载
rurbanalmost 4 years ago
So why is HN steaming over this?<p>It&#x27;s the classic antagonist to the Colonial pipeline hysteria, which stopped their pumps because they would not be able to account for the exact gallons delivered to which customer. So they rather stopped a critical infrastructure. Hilarious. Plus Windows.<p>Here again the Windows office PCs were affected, but the steamships themselves didn&#x27;t care much. They kept going, you only had to pay for your ticket onboard, not online. Online reservations were not honored.
Animatsalmost 4 years ago
Oh, that&#x27;s going to annoy some rich people.
RobRiveraalmost 4 years ago
this is getting a little out of hand
评论 #27374164 未加载
the-dudealmost 4 years ago
Well, the <i>Steamship Authority</i>, what did you expect?
tacosaretastyalmost 4 years ago
As someone who works specifically in this subgenera of computer security (ir) I can say a few things that might add to conversation in a meaningful way.<p>1.) There is a cottage industry in this space that sells kits for these randomware compromises. Everything provided is off the shelf, this is why you’re seeing such an emergence in this space. It’s not that the barrier to exit from a ransomware attack cost decreased (cryptocurrency). The barrier to entry lowered, any jerk can pay a small amount of funds to buy a software kit and instructions on how to do it.<p>Furthermore this is also why you’re seeing so many public defacement go politically neutral (ironic given the times). It’s simply a relatively lucrative, with a low amount of risk, and only requires the technical aptitude of someone capable of using BitTorrent&#x2F;Tor&#x2F;Warez.<p>2.) Hiring &#x2F; Managing security teams - unless you’re in technology or selling security as a part of a product you can’t afford a quality team&#x2F;tools. Most business are trying to optimize their cost centers to maximize their profits. As such most of the time that means it’s a race to the bottom to get them to be “insurable”. Salary + Software is expensive. 500k minimum investment for an meat processing company or whatever is not the easiest pill to swallow.<p>3.) companies that pay this are not good judges of security talent. They don’t know if the herjavec group really is an effective detection company. They judge almost entirely on feeling. Same with that one fast talking hoodie wearing self proclaimed hacker talking out of their ass.<p>Not understanding what you’re hiring for also creates friction, since any deviation from the fantasy security hire they imagined will be met with extreme resistance. “I thought they were going to sure up our servers, why do we have to log in on our email every 8 hours now”. Often times when an executive leader does not understand why security trade offs are made they just make the decision themselves (pro tip they’ll accept the risk) and you’ve failed regardless as an employer and employee.<p>4.) the industry does very little in a practical sense in preparing people for these job functions (with a few exceptions). Security engineers often have technical skills in spades.However, if they don’t understand anything outside of security they are going to fail. Civil Communication&#x2F; debate, the ability to navigate political issues, understanding the business etc are actually super important. The biggest tragedy was that someone internally probably saw this coming but couldn’t actually get the messaging across.<p>When you combine all of these elements you have a confluence of shit. It’s once again getting less expensive to perform a wide attack with little know how intersecting an industry that has yet to course correct.
dredmorbiusalmost 4 years ago
There are threats which emerge when a viability threshold is crossed and realised.<p>For cities, recurring plauges began occurring during Roman times and limited maximum city populations to about 1 million until the advent of modern sanitation, hygiene, public health, waste removal, and food quality. (Actual medical care and treatment had little to do with this, though vaccines and antibiotics helped.)<p>Industrial pollution lagged industrial development by about 50--100 years, with air and water quality and material contamination (heavy metals, asbestos, organic solvents, synthetic hormone disruptors and other bio-active contaminants, etc.).<p>Increases in travel, transport, and communications almost always directly facilitate fraud. The Greek&#x2F;Roman gods Hermes&#x2F;Mercury represented communication, messages, travel, transportation, commerce, trickery, and theives. The term &quot;Confidence Man&quot; arose from Herman Melville&#x27;s novel of the same name, set on the first great highway of the United States, the steamboat-plied Mississippi.<p>Mail begat mail fraud. Telegraph and telephones begat wire fraud. Cheap broadcast radio and television, payola and game-show fraus. Email begat spam and phishing.<p>The 1990s and 2000s computerised business practices employed computers with shitty security, but those systems were saved by the general lack of networking, the relatively small size of global computer networks, limited disk storage, limited network bandwidth, and the effectual air-gapping of paper-driven steps in processing. Billing might be submitted or computed electronically, but a paper check still had to be cut and signed. Draining accounts or data simply wasn&#x27;t possibly without running up against the inherent limitations of computer infrastructure at the time <i>even had a payment mechanism similar to today&#x27;s cryptocurrencies been available.</i><p>If my assessment is correct, we&#x27;ll be seeing much more of this.<p>Attackers have low costs. Victims have highly-interconnected, but poorly-defended systems, comprised of multiple components, each complex on its own, and lacking any effective overall security accountability. End-to-end automation exists, facilitating <i>both</i> productive work <i>and</i> effective attacks. A viable and tracking-resistant payment mechanism exists. Regions from which attacks can be made with impunity exist, and are well-connected to global data networks.<p>Backups alsone are not an effective defence as these protect against data loss but not data disclosure. Full defence will require radically different thinking, protection, risk assessment, and law-enforcement capabilities.<p>Until then, get used to more of this, at both large and small scales.<p>There are some potential bright lights.<p>- I suspect attackers aren&#x27;t targeting specific facilities but are instead conducting automated and scripted attacks against vulnerable facilities.<p>- For data-encryption ransom attacks, this means that the <i>decryption</i> key is all but certainly derivable from information <i>on the attacked system</i>, perhaps encoded as filenames or contents. Determining this mechanism may at least allow for data recovery. (It of course does nothing against data disclosure, long-term surveillance, or access denial attacks.) The likelihood that attackers have some database of victims + passwords seems low.<p>- Attackers are themselves subject to trust and suspicion attacks, and turning members or safe-harbours against attackers is probably a useful countermeasure.<p>- State-level sanctions, flling <i>short</i> of military attacks, may also prove effective.
评论 #27375422 未加载
madcowsalmost 4 years ago
With the US under a constant barrage of attacks it makes sense to trash the &quot;space force&quot; and create a legitimate &quot;cyber security force.&quot;<p>This may be our last chance to maintain global power through the use of force at all, given that so many competitors are gaining foothold in every other area.<p>We need bullet proof IT infrastructure, instant backtracing, and effective retaliatory responses ready to deploy, yesterday!<p>Why the hell isn&#x27;t the attacker&#x27;s computer compromised when they access the data? (rhetorical)
评论 #27373296 未加载
评论 #27373181 未加载
评论 #27373133 未加载
评论 #27373199 未加载
评论 #27373143 未加载
COGloryalmost 4 years ago
I have to wonder:<p>Are there CTOs or IT heads going into board meetings or other meetings, and telling people that these systems are secure? Because if so, they need to be tried for fraud.<p>If it&#x27;s on the internet, it is not secure.
评论 #27372815 未加载
评论 #27372678 未加载
评论 #27372795 未加载
评论 #27373116 未加载
sebyx07almost 4 years ago
MS Windows is 100% to blame. How can a worm spread that easily in 2021 to pcs across the network? 0day trash windows exploits
user-the-namealmost 4 years ago
Time to ban bitcoin.<p><a href="https:&#x2F;&#x2F;newrepublic.com&#x2F;article&#x2F;162589&#x2F;ban-bitcoin-cryptocurrencies-stop-hacker-ransomware" rel="nofollow">https:&#x2F;&#x2F;newrepublic.com&#x2F;article&#x2F;162589&#x2F;ban-bitcoin-cryptocur...</a>
评论 #27372851 未加载
评论 #27372735 未加载