Rendered at 02:57:26 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
kevin_thibedeau 4 hours ago [-]
> In late September, ShinyHunters hacked the FBI recruitment website fbijobs.gov
The OPM breach was 11 years ago and apparently the incompetence still reigns.
jacquesm 3 hours ago [-]
The quality of offensive tooling has somewhat improved during that period.
consumer451 1 hours ago [-]
In one of Sean Carroll's AMA's, he once said something along the lines of "entropy favors the attacker over the defender."
That really stuck with me. My internal thought was "it's easier to kick over a sand castle than to build one." It seems to ring true for infosec, societal structures, and kinetic cases. Is this just a base truth?
jacquesm 1 hours ago [-]
Yes, I've worded this as 'the asymmetry between creation and destruction'. Any idiot can destroy a piece of glass, it takes a whole raft of experts to make a pane and then some more to properly mount it.
maxbond 55 minutes ago [-]
Per the IRA after an unsuccessful attempt to assassinate Thatcher, "Today we were unlucky, but remember we have only to be lucky once, you will have to be lucky always."
nradov 2 hours ago [-]
So why have government employees and contractors been so lazy and incompetent as to not improve defenses by a similar margin?
mikeyouse 2 hours ago [-]
The vast majority of the competent people got DOGE’d. CISA lost like 40% of their staff including much of their red team specialty. 18F was completely eliminated (“Deleted” as Musk put it). If some specialist in the FBI who could have helped prevent the hack happened to have been assigned to work on the Classified Docs case, they were also fired because the most corrupt, incompetent group of morons is running things in DC for the next few years.
esalman 2 hours ago [-]
One of the most spectacular pieces of self-own for the current administration. Restructuring/deleting the directorate for biodefense during the previous administration (of the same color) would be up there.
jacquesm 2 hours ago [-]
I can see quite a few not-so-good reasons why they wanted to weaken the cybersecurity capability of the federal government.
vkou 1 hours ago [-]
It's not a self-own if they aren't the ones why have to deal with the consequences.
Do you think Donnie loses a second of sleep over this?
If they're incompetent and lazy as you say then probably because they couldn't...
mmooss 3 hours ago [-]
Even before the current administration, federal law enforcement's leaks of suspects, especially in high-profile crimes, have been highly unreliable and have ruined lives. See Wen Ho Lee, Richard Jewell, etc.
vntok 3 hours ago [-]
Breaking Bad vibes here. "You don't want a ransom negociator, you want a ransom negociator!"
taneq 3 hours ago [-]
Better than some random negotiator.
Waterluvian 2 hours ago [-]
You can have $1,000,000 in unmarked bills as requested. Or you can have whatever is in the mystery box!
ofjcihen 3 hours ago [-]
Working in the IR space I’ve had a lot of opportunities to work with negotiators before. Most of them are extremely professional and worth their weight in gold for what they provide to their clients.
Ridiculous that scumbags like this are tarnishing that space.
gregsadetsky 3 hours ago [-]
Can you shed a light on what this process looks like? Are negotiations are alike or completely unique? What does it boil down to..?
Thanks!
gregglain 3 hours ago [-]
The book "Never split the difference" is a great read on hostage negotiations.
gregsadetsky 3 hours ago [-]
I do (half) remember reading that book! I actually meant to ask (in my question above) whether that book is actually "accurate"/representative of malware negotiations.
gregglain 37 minutes ago [-]
ah. No idea.
ofjcihen 2 hours ago [-]
No honestly, most of the time it’s very formulaic. You can usually tell how it’s going to go once you know who has your data.
For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.
Other actors though have a reputation to uphold to get paid and they know it.
An example of the process is something like:
1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.
2. Negotiators notified.
3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.
cobbzilla 3 hours ago [-]
based on history, expect more ridiculous scumbags in the future:
Very cringe of you to automatically believe what the FBI tells you, especially when they're embarassed and trying to save face.
ahelwer 3 hours ago [-]
Nothing is yet proven and other articles have painted this arrest as shocking.
nradov 2 hours ago [-]
Ransom negotiators are all scumbags. Their actions perpetuate further criminality and place others at greater risk. Paying a ransom should always be a criminal offense, even if not paying means that people die and businesses are destroyed.
ofjcihen 17 minutes ago [-]
“Well then it’s a good thing I wasn’t paying a ransom but instead a pentesting fee!”
lifeisloving 1 hours ago [-]
[flagged]
solyin 1 hours ago [-]
Reading their comment strongly, as the guidelines suggest, it seems they want criminals to make $0 so they stop doing that. Is it not equally "cringe" to say society can't put up with some discomfort so assholes don't get free vacations and nice toys. It's a disguised trolley problem, and there's no agreed upon answer for that one either.
We all gotta do what we can to get through the day, but you can't live next to someone who has the same challenge but a different answer to some trolly problem? Is your future world just a bunch of closed communities where outsiders and ideas and their differ skin color and economic background aren't welcome?
lifeisloving 4 minutes ago [-]
Or we pay the criminals, not let innocent people die because turbo nerds care about rewarding cyber criminals who will exist no matter what.
So I guess we should just let people die though, atleast the feds will have jobs and be able to go on vacation and not those damn criminals!! Although I fail to see much difference between US law enforcement and cyber criminals, both of their existence relies on the threat of violance and the extortion of the public with that violence.
Also I'm pretty sure the FBI gave birth to the shiny hunters if you look into it for more than 10 minutes. Its a bunch of kids they basically have chosen not to punish at various points in their criminal evolution. Its almost like they need these phenomenons to exist.
My ideal society is one without crooked cops, but alas I dont think that's likely either so in the meantime, until we can find a solution to that problem we probably shouldnt punish the innocent patients of hospitals.
It seems to me that money and the status of criminals is more important to you than human life, so we should probably deal with whatever brain worm has infected you too.
nradov 54 minutes ago [-]
Yes, I would absolutely rather have that. Preventing criminals from receiving additional money prevents them from having the resources to attack others in the future. Unlike you, I actually care about my community and think deeply about the consequences.
maxbond 36 minutes ago [-]
Alternately they may not believe starving out the criminals will actually work and so foresee different consequences. Like when Google penalized SEO, and so spammers used their networks for extortion instead of spam. Similarly if we killed ransomware, the machinery built to conduct these attacks would not just lie fallow. It's capital that will continue to be leveraged to generate returns. We may not like the next business model they come up with.
It's not a contest, we all can care and think deeply and still come to different conclusions.
allenrb 52 minutes ago [-]
It sounds like you don’t understand the problem very well. Forgive me if that’s an incorrect interpretation.
One way to prevent this type of crime is to ensure that it is never profitable. The downside is that there will be losses until the message is thoroughly communicated.
lifeisloving 9 seconds ago [-]
And a new method is invented in about 24 hrs.
Who cares if criminals have nice things, Id rather innocent people dont die. Most criminals tend to find ways to ruin their own lives at some point anyways. Peoples lives > pieces of paper.
Its like you're proposing a trolly problem where you choose the 5 people on a track to die because you don't want the single guy on a track to have nice clothes.
aleksandrm 2 hours ago [-]
[flagged]
Aurornis 47 minutes ago [-]
Did everyone in this comment section just miss the fact that the contents of the article are primarily Krebs’ research? The feds haven’t actually said anything publicly. Krebs cites someone close to the investigation, but that’s it.
gnabgib 44 minutes ago [-]
They've confirmed the part that this article is specific on[0]. The part that's vague.. is, I guess, to be announced soon?
Yeah we just need to vote in the other half of the uniparty, right guys? Let's vote even harder next time! I'm gonna voooooote hnnngh
rustystump 1 hours ago [-]
As much as this is a bit of a shit post I dont think it is wrong. Both sides behind the scenes are in pretty strong lockstep.
Thered need to be changes in how lobbying and certain countries are registered to make a dent. Everyone says age but I dont think that matters as much as the lobbying industry. Young people are every bit as corruptible as the old.
potsandpans 1 hours ago [-]
Nobody should trust the feds ever. It's mostly through privilege and circumstance that they help anything ever.
lifeisloving 2 hours ago [-]
Yeah it feels like this guy is probably innocent and refused to be an informant of some kind. He probably was approached to help entrap them, stayed out of it and now the FBI is ruining his life for it.
I wouldnt really trust them under any admin, but yeah this current regime is definately will to play fast and loose with people's lives to make themselves seem competent.
cuttysnark 3 hours ago [-]
[flagged]
Grosvenor 3 hours ago [-]
That wikipedia page says David Hogg's father is Kevin Hogg.
The OPM breach was 11 years ago and apparently the incompetence still reigns.
That really stuck with me. My internal thought was "it's easier to kick over a sand castle than to build one." It seems to ring true for infosec, societal structures, and kinetic cases. Is this just a base truth?
Do you think Donnie loses a second of sleep over this?
18F -> https://ndstudio.gov
As seen credited on recent publications like real realfood.gov.
Ridiculous that scumbags like this are tarnishing that space.
Thanks!
For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.
Other actors though have a reputation to uphold to get paid and they know it.
An example of the process is something like:
1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.
2. Negotiators notified.
3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.
https://www.bleepingcomputer.com/news/security/ransomware-re...
https://complexdiscovery.com/a-48-month-federal-benchmark-re...
https://neal.fun/absurd-trolley-problems/
We all gotta do what we can to get through the day, but you can't live next to someone who has the same challenge but a different answer to some trolly problem? Is your future world just a bunch of closed communities where outsiders and ideas and their differ skin color and economic background aren't welcome?
So I guess we should just let people die though, atleast the feds will have jobs and be able to go on vacation and not those damn criminals!! Although I fail to see much difference between US law enforcement and cyber criminals, both of their existence relies on the threat of violance and the extortion of the public with that violence.
Also I'm pretty sure the FBI gave birth to the shiny hunters if you look into it for more than 10 minutes. Its a bunch of kids they basically have chosen not to punish at various points in their criminal evolution. Its almost like they need these phenomenons to exist.
My ideal society is one without crooked cops, but alas I dont think that's likely either so in the meantime, until we can find a solution to that problem we probably shouldnt punish the innocent patients of hospitals.
It seems to me that money and the status of criminals is more important to you than human life, so we should probably deal with whatever brain worm has infected you too.
It's not a contest, we all can care and think deeply and still come to different conclusions.
One way to prevent this type of crime is to ensure that it is never profitable. The downside is that there will be losses until the message is thoroughly communicated.
Who cares if criminals have nice things, Id rather innocent people dont die. Most criminals tend to find ways to ruin their own lives at some point anyways. Peoples lives > pieces of paper.
Its like you're proposing a trolly problem where you choose the 5 people on a track to die because you don't want the single guy on a track to have nice clothes.
[0]: FBI arrests Canadian cybersecurity expert in ShinyHunters hacking case (6 points, 8 days ago) https://news.ycombinator.com/item?id=50066759
Thered need to be changes in how lobbying and certain countries are registered to make a dent. Everyone says age but I dont think that matters as much as the lobbying industry. Young people are every bit as corruptible as the old.
I wouldnt really trust them under any admin, but yeah this current regime is definately will to play fast and loose with people's lives to make themselves seem competent.