return to table of content

After Boeing declines to pay up, ransomware group leaks 45 GB of data

legitster
120 replies
21h6m

I struggle to see how this business model would work in the first place. They pay you and you pinky swear not to release it? All you are doing by negotiating is to buy the victim time to harden their systems.

This sounds liked a failed ransomware attack. They encrypted the systems - Boeing says "no thank you, we have backups". There were no valuable zero-days to sell to GRU, so give a last ditch offer to try to salvage something.

RandallBrown
82 replies
21h4m

They pay you and you pinky swear not to release it?

Yes. If any of this information does end up getting leaked, it kills the credibility of the ransomware group and they'll never get paid again. Sort of mutually assured destruction.

Now of course, most people don't really trust criminals anyway so the business has a pretty strong bargaining position and I believe many of the ransoms are negotiated way down.

tanelpoder
44 replies
20h58m

Wouldn't it be easy to just pick a new name for the ransomware group then?

(or do we need eBay-like "seller ratings" and customer reviews for ransomware groups?)

paulcole
11 replies
19h38m

My brother did this with lawn care and HVAC companies. The first business lesson he learned was never name your business after yourself. He was about 16 when he learned this and ever since it’s been like AAA Lawn Care or Aces HVAC until he gets so many negative reviews he can’t get more business.

frandroid
7 replies
19h31m

So lesson of the story, avoid the AAA named companies because they've been in the respawning business for a long time

jstarfish
3 replies
18h52m

Nah, back in the old days A1 Locksmith or AAA Windshields were just competing for top placement in the (alphabetized) phone book.

Look to Amazon for new ideas on DGA-derived names for your fly-by-night business.

mr_toad
1 replies
17h18m

A lot of cowboys used AAA-Something to bring in rubes.

foxylad
0 replies
16h49m

And now AI-Something.

magarnicle
0 replies
13h42m

That's why Asus isn't called Pegasus.

sfink
1 replies
19h0m

The lesson is that hiring "ZZZ Lawn Care" is a really bad idea.

paulcole
0 replies
18h45m

This was a plot point in The Accountant starring Ben Affleck.

He’s a criminal who launders money through small businesses he owns and the accounting firm he runs. He names it ZZZ Accounting so it doesn’t get a lot of calls through people looking up accountants in phone book.

Tyr42
0 replies
19h3m

Or at least the ZZZ corps if they made it that far down the alphabet.

temporarara
2 replies
19h25m

Your brother is the hero this world deserves. And this is why I generally trust only those small businesses who have their full real name on display.

paulcole
0 replies
18h42m

When he was a teenager and had a business under his own name he’d get in trouble sometimes because he’d close all the deals himself then hire other kids to go out and do the work.

Some homeowners thought it was going to be him cutting their lawns and would get upset because the contract said he’d do it. So he’d just rip up the contract in front of them and refuse to cut their lawn ever again.

In Florida there were so many houses with lawns in so many subdivisions he was always busy anyway. Plus he liked getting into fights with adults. Win win, I guess.

HeyLaughingBoy
0 replies
19h7m

You're assuming it's their real name...

Jaepa
8 replies
20h6m

From what I understand there's a market for ransomware negotiators, and reputation (and tooling) is very much a thing that affects settled price.

Understand: For the ransomer's point of view this is another monday, albeit one where a big fish walked away.

FirmwareBurner
6 replies
19h46m

So there's honor among thieves.

ben_w
4 replies
19h39m

There's an iterated prisoner's dilemma, I wouldn't go as far as calling that honour.

GuB-42
3 replies
19h24m

That's fundamentally what honor is.

ben_w
2 replies
19h17m

The result may be the same, but I think honour requires a state of mind where you do the "honourable" thing even if nobody will know.

deaddodo
0 replies
10h51m

"states of mind" are all externally influenced. If you have a fundamentally "honorable" mindset, it's because your history has reinforced that acting honorable nets you an overall positive outcome.

Which just reinforces the "honor = iterative prisoner's dilemma" argument.

__MatrixMan__
0 replies
19h9m

Agreed. Honor may have its roots in a prisoner's dilemma, but you're not actually practicing it until you have Stockholm syndrome.

barryrandall
0 replies
19h37m

Only to the extent that they derive value from being perceived as consistent.

LastTrain
0 replies
16h44m

I’m not doubting this - but can you provide anything to substantiate that reputable ransomeware negotiators are a thing? [edit - nm I googled it, it’s a thing]

adolph
7 replies
20h32m

5 star would hostage again

Superhost for my datas

echelon
6 replies
20h29m

Amazing satire, but I shudder to think that's how companies actually treat ransomware.

All companies and governments should take the stance that any randomwared or compromised data is now public. And if they don't have the backups, then they should consider it permanently lost.

Write it off as a business loss and hire better ops people.

dkjaudyeqooe
4 replies
20h3m

Govts should make funding ransomware groups a criminal offense. The money likely going to RU and NK anyway.

sweetjuly
2 replies
18h10m

That probably wouldn't have a good outcome. If a company gets hit very hard, their options are either to pay or die. If you make it illegal to pay, their options are either to commit a crime (which will not kill the company even if they get caught) or die. All this will do is push companies into hiding when they get hit and not reaching out to the government and security companies for help, which makes catching these groups way harder. So, at best you kill some domestic businesses and at worst you kill domestic businesses AND help the attackers hit more companies.

octacat
0 replies
17h41m

Options to configure backups and spend the money on isolating their network and computers to begin with are not considered.

dkjaudyeqooe
0 replies
16h14m

To the contrary: the first company to die (or so) would set a fire under any companies who were not prepared. It's complacency and ignorance that creates problems.

The attackers attack for money, not to kill their prey, that's not profitable.

tatersolid
0 replies
12h48m

OFAC has made paying many ransomware deploys illegal in the USA for several years.

https://ofac.treasury.gov/recent-actions/20210921

tonyarkles
0 replies
18h12m

All companies and governments should take the stance that any randomwared or compromised data is now public.

That's a somewhat reasonable stance. You definitely have no guaranteed assurance that it won't be leaked. However... depending on what you do have set up, you may have some reasons to believe that 45GB of encrypted data has not left your internal network (i.e. was only encrypted-in-place)

And if they don't have the backups, then they should consider it permanently lost.

That's easy to say but way harder in practice. If the data in question is the design artifacts from a billion dollar project... it'd be a pretty hard sell to convince everyone "woops, we fucked up, billion dollars gone, time to close the doors and go home, we definitely shouldn't consider paying $500k or $1M or whatever they want to get all this data back".

ceejayoz
6 replies
20h39m

A no-name ransomware group is less likely to be trusted to hold up their end of the bargain than one with an established reputation.

Didn't Silk Road have eBay-style ratings/reviews?

yieldcrv
2 replies
19h48m

all the darknet markets have eBay style ratings, but for the vendor and products purchased, not for reviews on negotiating with a randomware group that weaponized it

Silk Road was 10 years ago that would have been like the smallest one ever since then, just curious why it is referenced at all, and in such an odd way

“I heard eBay has bulletin board like reviews” you know you can just go look, in a web browser “woah thats crazy talk, I prefer 10 year old hearsay”

anyway, they often have a separate forum where one could ask more about a group

progmetaldev
1 replies
14h30m

Most people are inexperienced with the dark web. I would hazard a guess that even most of the HN crowd, as far as having actually used the dark web. There is a lot of fear and misinformation, even when it comes to a tech-literate crowd. People fear government agencies infiltrating the servers that they might visit, and that server dropping malware/spyware that reveals their identity. Even just having your name associated with visiting a darknet market could be disastrous for your reputation, and I assume this is the line of thinking most people give to the idea of visiting these servers. Unfortunately, this line of thinking keeps people away, which actually reduces the ability to stay anonymous as compared to having lots of traffic moving through Tor.

yieldcrv
0 replies
13h44m

its fascinating how media driven this is if people are still talking about the silk road based on its media coverage

Department of Justice and Europol have lots of press releases about other markets and busts and ways they failed to bust them, and how their size eclipsed Silk Road

I guess as long as the media doesnt parade it around or makes movies about it nobody knows

jeron
2 replies
20h24m

What good are the reviews? “5 stars, didn’t leak data after ransom paid”

csydas
0 replies
19h24m

SilkRoad was a dark web market, so the comparison from the parent is a bit strange for me, but regarding your comment on reviews, yes they're very important and for the sites I've used, the reviews have been very reliable and useful.

My understand is that since it's a much more limited market, access is very difficult even under normal circumstances (not because of security but just because dark web markets usually have awful performance for various reasons), so it's a far different review landscape than say shopping on Amazon, at least the ones I have used. The markets themselves were fantastic about refunds/conflict resolution, better than most normal online shops. Reputation is key for basically everything dark web, and the main actors in this space are notoriously petty and bold towards anyone that makes it harder to conduct business.

I imagine it's very similar with Ransomware as there has to be some reason for the targets of the attack to believe paying the ransom is worth it, and anyone who upsets that balance for the ransomware gangs unexpectedly becomes rapidly unpopular, and usually a target for the other gangs. It very much so is heavily relying on the honor system, but it seems the groups are committed to such a system.

barryrandall
0 replies
20h16m

It's more like, "Security Company X says this gang has behaved predictably in their previous interactions."

red-iron-pine
5 replies
20h18m

Depends on what their SOP is. Attribution is hard but there are a lot of really, really smart people trying really hard to identify orgs by their TTPs.

You can rebrand as CaTBUTT, or Indrik Spider 2.0, or whatever, but if you're using some custom version of Mirai they'll eventually tag your M.O. and the threat intelligence briefings will reflect that.

And then no ransom.

Exuma
3 replies
20h8m

What is Mirai? Can you re-explain what you said in plain english?

red-iron-pine
1 replies
18h9m

Mirai is malware that was written by a college student but their code was released to the public, and a lot of other malware uses it as a base.

It (and other malware) tend to behave in specific ways and follow specific patterns, and those patterns can be analyzed. Ditto for the servers they use, targets they hit, etc.

These approaches are known as TTPs, and documenting them is how you attribute an attack to a specific group or actor. Even if you change your org and start using servers in a different country eventually your MO will give you away.

These approaches are cataloged by IT security types, and many cybersecurity orgs release publications about Group X using approach Y.

So when you get hacked by Group Z, but they sound like X and Y, you guess it was them. And if Group X has a history of burning ransom payers then you don't pay -- they'd fuck you anyway, so save the money and start rebuilding.

Exuma
0 replies
15h49m

Very interesting.. so what makes Mirai so important as a base that they can't just rewrite it of sorts? Is it just a lot of work/boilerplate? Or would it be too time consuming to rewrite some base code so the fingerprint is different?

not2b
0 replies
20h0m

You could have Googled it, but you can start with https://en.wikipedia.org/wiki/Mirai_(malware)

tanelpoder
0 replies
20h14m

Didn't think of that, thank you.

tgsovlerkhgsel
0 replies
17h42m

It would, but publishing the data of someone who paid gives the ransomware gang almost nothing, and the downside would be to start as a no-name.

On the other hand, holding their side of the promise allows them to build a reputation, which makes it easier to get future victims to pay. Why would they leak the data if someone paid?

barryrandall
0 replies
20h18m

They'd need to burn all their tools, techniques, and practices for this kind of rebrand to be successful.

mysterydip
9 replies
20h55m

Couldn't the ransomeware group just come back under another alias to clean their slate?

rtkwe
6 replies
20h53m

If any group does it it kills the credibility new entrants too so there's still incentives to not do it.

cjaybo
4 replies
20h39m

Are these rational actors who would even care about the collective long term effects? Eg the same could be said for drug dealers ripping off their customers, but that still happens daily because they often prioritize short term self interest over long term/collective concerns.

rtkwe
0 replies
19h50m

It's not consistent across the broad category of criminal for sure but they're probably not the most long term oriented people as a rule now. Initial groups were more, for a lack of a better word, professional about the process with some groups even having a kind of tech support for helping victims to make sure people would believe they'd get their files back if they paid. Better preparation on the corporate side and a democratization of the tools to perform it has lead to some changes it looks like where ransomware groups didn't exfiltrate often before because it wasn't their main playbook.

galangalalgol
0 replies
20h16m

And Boeing could never know Airbus hadn't been given the opportunity to buy the data, as they would never disclose that.

csydas
0 replies
19h11m

Yes, mostly because the other actors are notoriously vengeful and petty; ransomware gangs, dark markets, etc, they don't just register complaints with each other, they typically look to ensure the bad actors are removed from the space entirely.

regarding drug dealers, I wouldn't consider it a good comparison. the actions of one dealer typically doesn't affect others, they're just not that connected beyond professional recognition/courtesy. If dealer A is shorting their customers, dealer B absolutely wouldn't care as why would they? they have no relationship, and it'd probably mean the customers go to dealer B instead. business will continue as usual even if one bad actor is doing shitty stuff to their customers.

with ransomware that is not the case -- if public opinion overwhelmingly tells there's no sense in paying because the ransomware gangs never follow their word, that affects all the gangs, not just the bad actor. the gangs already have a hard enough argument to make as to why the targets should pay so anything that frustrates that further is frowned upon.

NegativeK
0 replies
20h19m

Many ransomware groups have learned that acting more like a business results in higher payouts. They're not all going to do it, but they have payment portals, negotiators using professional language, attempts to maintain reputation, etc.

Obviously this behavior doesn't apply to all of them, but it's a clear effort by some of them to immediately appear more palatable to random IT worker, the execs, and the lawyers who are watching the who process play out.

And it also lines up with the fact that ransomware groups have freaking HR departments to handle their employees.

callalex
0 replies
20h37m

By that logic, illicit food and drugs wouldn’t have a problem of being cut with fillers. A tragedy of the commons doesn’t really reign in the behavior of criminal organizations.

neodymiumphish
0 replies
18h9m

Only if they completely rebuild their malware and infrastructure so that researchers can't correlate them together.

micromacrofoot
0 replies
20h17m

a clean slate also means rebuilding reputation

bastawhiz
5 replies
19h55m

it kills the credibility of the ransomware group and they'll never get paid again

I don't buy it. There's nothing to stop the group from rebranding themselves. The company has no proof nobody else got a copy of the data. And the group could simply hang onto the data, extort a bunch of money from other companies, then start back at the beginning and demand even more (knowing that the data is worth _at least_ what was already paid for it).

sofixa
3 replies
19h54m

I don't buy it. There's nothing to stop the group from rebranding themselves

Apart from the fact that nobody would pay them if they have no reputation.

raincole
1 replies
19h26m

Then how did they get "reputation" from the first place? Quite chicken and egg problem, right?

hot_gril
0 replies
19h22m

By starting with smaller ransoms. Same way any new business gets off the ground without rep, it's not easy or very profitable at first.

tshaddox
0 replies
19h13m

Surely that can't be completely true. The reputation has to be bootstrapped somehow.

neodymiumphish
0 replies
18h10m

New groups can't demand as much as the next. Also most of the big groups are RaaS (Ransomware as a Service), meaning their affiliates get approval to operate using LockBit's name, infrastructure, and software.

If LockBit does something to taint their image in the media and among security organizations, then rebrands to avoid their negative history, forensics will still eventually tie their new name back to their old org, and victim's will have to decide whether they should trust that their data will be handled correctly after payment.

As for re-victimizing old organizations, there's almost zero chance of that working. Most data is only sensitive for a certain time frame, long enough that they can make the proper notifications, change credentials, etc.

Lastly, there still needs to be someone to download and abuse the data they leak. I've monitored ransomware torrents a few times and not observed any downloads completed over the course of a couple weeks following a data leak.

miohtama
3 replies
20h0m

I am sure there are discreet nation state buyers, like Russia and China, who are happily to use the information without causing an incident. Russia does not even need to ask, as most ransomware gangs operate under the blessing of Putin.

justsomehnguy
2 replies
19h11m

[citation needed]

At least for 'most'.

miohtama
1 replies
9h40m
justsomehnguy
0 replies
5h43m

A portion of actors involved with Conti ransomware are based in Russia and some criminals operating from there already have documented ties with Russian intelligence apparatus

So a part of one gang made some claims and some other not-gang claims they have ties with FSB or SVR => all gangs are operating under personal Putin blessing. Even North Korean and Ukrainian, right?

jowea
3 replies
20h39m

I wonder why they don't make into a recurring payment instead of a one time deal. Turn it into an iterated game theory game.

timeon
1 replies
20h14m

RaaS

neodymiumphish
0 replies
18h6m

That's not what this means.

augustulus
0 replies
19h39m

more risk of exposure presumably

kspacewalk2
2 replies
20h19m

credibility of the ransomware group

Hilarious.

waynesonfire
1 replies
20h6m

It's your naive comment that I find hilarious. it's a business like any other that puts food on peoples plates. in fact, a mature business with a deep and sophisticated industry. it benefits all participants when everyone behaves reliably and predictably. These aren't amateurs.

kspacewalk2
0 replies
43m

it's a business like any other that puts food on peoples plates.

So is murder for hire. However, both being firmly within the "crime" category of business, all allusions to legitimate business concepts such as "reputation", "contract" and "predictability" are illusory, rhetorical and rarely survive first contact with some felonious scumbag who wants to screw you over. Particularly when one side of the interaction is not an experienced and dangerous criminal.

dkjaudyeqooe
2 replies
20h5m

it kills the credibility of the ransomware group

There are review sites for ransomware groups?

"honored promise not to disclose, didn't gloat or taunt, would pay again, 10/10"

arnvald
1 replies
19h57m

Not sure about review sites, but there are companies specializing in ransomware negotiations on behalf of the victims and they can advise not to pay a group that is known to release the data anyway

hot_gril
0 replies
19h24m

Either way, seems like something that a government or other actor could mess with, thus making it harder for hackers to profit.

JohnFen
2 replies
20h16m

it kills the credibility of the ransomware group

There are people who consider these groups credible?? The world really has gone insane.

neodymiumphish
0 replies
18h5m

Many of these groups have better bug bounty programs, SOPs, and organizationsla structure than your average company.

RandallBrown
0 replies
16h57m

"Credible" here means that they stick to their word.

legitster
1 replies
20h46m

Data ransoms have existed for a long time before "ransomware" was even really a thing - there's just never been a market for ransoms for the "stolen" data. Once it's out you can't put that genie back in the bottle.

The reason ransomware worked was you didn't have to trust the group long-term - just enough to give you a copy of your data back.

It's the difference between you making a copy of my car keys and stealing them. Yes, I will pay for "a" key back - I only have to trust you enough to hand it over.

mcmoor
0 replies
18h0m

But you don't only want your data back, you want the data disappear from circulation. While ransomware ensures the former transaction, it still in no way ensures the latter, making it still a dubious transaction.

mvkel
0 replies
19h21m

Meh. They don't knowingly release it. But they could certainly continue to try to sell the data on the black market to competitors, etc, which the competitor would never disclose.

ibejoeb
0 replies
18h18m

I believe many of the ransoms are negotiated way down.

LockBit just did a sort of collective bargaining with affiliate groups that resulted in guidance for setting initial ransom amounts and rules restricting discounts about 50%.

hnthrowaway0315
18 replies
21h5m

I wouldn't be surprised if some ransomeware gangs are frontends of national (in)security agencies. They don't care about profits. Sure it's good to have some.

jasonwatkinspdx
7 replies
20h23m

It's an open secret that FSB et all work with ransomware gangs. As long as they don't target Russian companies they don't care what they do otherwise. So it's not so much they're a front as they're in a sort of quasi officially sanctioned middle ground.

sofixa
2 replies
19h51m

As an example, the DarkSide malware (the one used against the Colonial Pipeline) explicitly checks if it's running on a computer in the CIS (Russia+countries nostalgic of the Soviet Union / without a better choice) and exits.

prmoustache
0 replies
10h12m

Well, this doesn't mean they work for FSB but rather they want to stay away from them.

If I was based in a country I would not want to target those that can more easily get me into jail and/or kill me.

I have no idea if FSB work for them, this is more speculation than open secret, but they certainly do tolerate them and see them in a good eye as long as they target western companies and agencies. The enemy of my enemies is my friend.

jasonwatkinspdx
0 replies
15h2m

Oh interesting, I'd not heard that. Thanks.

terminous
0 replies
20h17m
sfink
0 replies
18h59m

privateers

r00fus
0 replies
20h18m

Digital privateers

hnthrowaway0315
0 replies
20h15m

Yeah. I'm also thinking about ways to "promote" malware without getting impacted.

Let's say some three digit agencies create sort of malware distribution forums in the darknet. They make sure to only broadcast to people who wants to play with malwares so the net catches the "bad guys" mostly, except for a few curious researchers or journalists maybe. Then they start to share recent generarion malwares they created. They don't need to distribute them by themselves because they already have the CCC servers. Some malware gangs would eventually be the frontend and start the distribution.

In this way you not only distribute the malwares without getting impacted, you also get to know the gangs so whenever you want to catch a few fishes you just pull the net.

Once the darknet forum dies out or they need to wipe the records, they would just leave and create a new one.

Just my wild thought.

kramerger
6 replies
20h56m

Well, every time Boeing tried to bribe a country, someone leaked emails and audio recordings from their secret meetings.

Usually we blame the Chinese, but in this case I think its a toss between CIA and NSA.

(I think I'm on some kind of list now)

Edit: I am an idiot. I was thinking of Airbus, see @perihelions comment below

emodendroket
2 replies
20h16m

Why exactly would the CIA or NSA want to do that? Boeing works so closely with the security apparatus they're practically an unofficial member so I don't understand what the motivation would be.

hnthrowaway0315
1 replies
19h56m

It doesn't hurt to hack into any corporation. You never know what kind of intelligence you might get out. There are also considerations of different factions I guess.

emodendroket
0 replies
18h14m

But we're not talking about getting information and keeping it but actually making it public. One doesn't get much leverage that way so the only real aim would seem to be damaging the target.

perihelions
1 replies
20h40m

Which incident are you referring to? The NSA took credit for hacking Airbus, but that's Boeing's foreign competitor—not Boeing.

https://www.economist.com/special-report/2003/06/12/airbuss-...

- "According to a European Parliament report, published in 2001, America's National Security Agency (NSA) intercepted faxes and phone calls between Airbus, Saudi Arabian Airlines and the Saudi government in early 1994. The NSA found that Airbus agents were offering bribes to a Saudi official to secure a lion's share for Airbus in modernising Saudi Arabian Airlines' fleet. The planes were in a $6 billion deal that Edouard Balladur, France's then prime minister, had hoped to clinch on a visit to see King Fahd in January 1994. He went home empty-handed."

- "James Woolsey, then director of the Central Intelligence Agency, recounted in a newspaper article in 2000 how the American government typically reacted to intelligence of this sort. “When we have caught you [Europeans]...we go to the government you're bribing and tell its officials that we don't take kindly to such corruption,” he wrote. Apparently this (and a direct sales pitch from Bill Clinton to King Fahd) swung the aircraft part of the deal Boeing's and McDonnell Douglas's way."

kramerger
0 replies
20h12m

You are correct. I think my brain was on a break while I was writing that :)

bee_rider
0 replies
20h16m

I imagine at least some (probably many) of the engineers who work for Boeing have a basically lawful-good/lawful-neutral temperament and are just disgusted by things like bribery. Maybe one of the parties in the conversation leaked it, no intelligence agencies needed.

nimih
0 replies
19h43m

They don't care about profits.

This isn't really true in general: intelligence agencies often want access to funds with less/no oversight from (or to skirt controls enacted by) other parts of the government. As an example, that was the dynamic at the basis of the Iran-Contra affair in the US.

jowea
0 replies
20h36m

For North Korea sure quite believable. Some links existing also sound likely for the Russian gangs.

beambot
0 replies
20h19m

How North Korea’s Hacker Army Stole $3 Billion in Crypto, Funding Nuclear Program

https://www.wsj.com/articles/how-north-koreas-hacker-army-st...

matthewdgreen
8 replies
20h14m

That’s why you secret share the data across six Intel SGX instances using software that only reveals the plaintext if it doesn’t receive a blockchain-based payment after 30 days. (No, nobody does this. But they could!)

adriancr
7 replies
19h47m

why would anyone trust the data is only on those instances?

matthewdgreen
6 replies
19h38m

Because you write your ransomware to encrypt to a hardcoded set of public keys that include an SGX attestation from those instances. This can be verified forensically and the unencrypted plaintext never leaves the victim organization.

crotchfire
3 replies
19h24m

...and then Intel will simply have their HSM sign the cheat-code firmware for the EPIDs of those six chips.

Trust isn't all-or-nothing. When I ride a bus I'm trusting the driver with my life, but I wouldn't trust them to babysit my kids.

Mutability is deniability. I don't trust hardware companies with that. And I don't have to, either.

Stop hawking this SGX snakeoil. Except maybe to ransomware authors, who deserve what they'll get.

matthewdgreen
2 replies
18h35m

Intel could presumably help the ransomware authors bypass SGX protections but that’d be dumb. They might have some capability to trace attestations to a specific motherboard but I doubt any sophisticated ransomware group will be foiled by this.

crotchfire
1 replies
15h52m

I was implying that Intel would help the victims.

Attestations are quite certainly traceable to the EPID, which is a fuse array -- it's on the die, not the motherboard. In order to attest, the key that encrypts the victim's data would have to be SGX-generated. What kind of RNG do you think it uses? Maybe Dual_EC_DRDBG?

Dylan16807
0 replies
11h51m

Help the victims how? If the CPUs have been captured, there's no need for altered firmware. If the CPUs have not been captured, then how is the altered firmware going to get installed?

I suppose it helps them in the former case, if they also had no backups. But the hackers are already in a very bad place if the CPUs get captured, so I don't think they care about SGX at that point. The hackers don't need to trust SGX. They only need the victims to trust it.

adriancr
1 replies
18h59m

hardcoded set of public keys that include an SGX attestation from those instances.

You mean:

1. generate a public/private key in enclave

2. generate attestation from SGX enclave with public key hash.

3. seal the public/private key somewhere so it can be reused later, otherwise pc restart or app failures / no data.

4. publish source code that generates mrenclave somewhere that can be audited.

5. encrypt in place and assume remote trusts you when you say data was only exfiltrated encrypted or not at all.

Now, 5 is the problem i mentioned. Why would anyone trust that data was not exfiltrated unencrypted and copied a few times.

and the unencrypted plaintext never leaves the victim organization.

You also mentioned this to be fair. Why would this be trusted?

6. Release data if no payment on bitcoin.

SGX enclaves do not have magic trusted access to network to get bitcoin payments data.

It can be man in the middled or fooled by omission by who controls machibe.

So key can be releases by feeding it bad data (payment was not done and time expired - release to the world).

There's also the problem that attestation might lead to the originating group if cpu is identifiable.

matthewdgreen
0 replies
18h12m

Malware encryptors can be left on the system for forensic investigation to discover. You’re correct that there’s no perfect guarantee the ransomware group didn’t also exfiltrate data using another method, but that would be kind of stupid; the idea of this would be to reduce a hard problem (trust a criminal to secure your data and eventually safely delete it) to a simpler problem (trust a criminal group not to do something economically irrational that also requires extra work and stealth at infection time.) You don’t need network access to verify a PoW blockchain transcript is correct, provided the cost of forging that blockchain segment is high enough (plus you can script payment redemption so it requires a signature from the enclave attesting that the information was destroyed.) I’m pretty sure a resourceful ransomware group can source a few motherboards and CPUs that can’t be traced back to them.

jasonfarnon
2 replies
19h55m

What benefit is it to the ransomware group to release the data? They may be sloppy or careless with their data (like their victims) but I don't see a for-profit/non-ideological ransom group reneging and intentionally leaking the data. And plenty of reasons eg repeat actors to do their best not to.

Actually I'm often surprised that many ransomers/hostage-takers go through with their threats when they don't get their demands. The only reason I can see them doing it is if reputation matters to them for future negotiations. more than the risks from the greater liabilities they incur by going through with the threats.

michaelt
1 replies
19h44m

The benefit would be getting paid a second time, by extracting a second ransom.

It doesn't have to be the whole group; perhaps one guy decides to branch out on his own, and grabs the data on his way out the door.

jasonfarnon
0 replies
19h40m

You mean "yeah we were lying yesterday about this same thing, but we're telling the truth right now" type of negotiation? Has that ever worked for ransoms (of any kind) anywhere?

emodendroket
2 replies
20h17m

You could say the same about any "ransom"-based business, really. Kidnappers could decline to release the kidnapped person after they get their money.

JohnFen
1 replies
20h13m

And they often do.

emodendroket
0 replies
18h15m

Yet it is not unusual for the ransoms to be paid.

willseth
1 replies
20h19m

You'd think that, but in practice these ransomware groups are pretty reliable, and actually many rasomees have remarked on how good the customer service is! Their ability to make money is dependent on them maintaining a reputation for being in the business for money, not lulz, and tmk the pinky swears are typically upheld.

jameson
0 replies
18h49m

in practice these ransomware groups are pretty reliable

Hard to say...

You're effectively trusting the liar they wont lie again

Its possible they leak it to high profile customers without publicly announcing it

Business should make decision assuming the data will be leaked eventually regardless of random paid or not

Perhaps only thing business can assume is the data wont be publicly released in short amount of time

NoPicklez
0 replies
18h3m

It's a business model that has certainly been working. If your business has been crippled due to your systems having been encrypted then you do often consider paying the ransom.

However if you have adequate backup and recovery mechanisms in place then you're not the best to prey on.

It's a business model that works until the majority of targets have appropriate backup and recovery processes.

npalli
64 replies
18h4m

For an external party, having access to the 45 GB is the easy part. Now, you will need to create a company and supplier base the size of Boeing to make any use of this :-)

hrdwdmrbl
21 replies
17h59m

China

npalli
19 replies
17h40m

1. They probably already have it :-)

2. Imagine the sheer pain of duplicating every single process and spec to the minutest detail, nobody is flying an airplane that only 'works' 99.99% of the time. Probably easier to start from scratch and learn it. BTW, this was tried by Russia in the all through the '80s, they tried to steal all advanced tech. but by the time they duplicated the stolen technology, the next generation appeared. A losing battle.

ethbr1
10 replies
16h42m

nobody is flying an airplane that only 'works' 99.99% of the time

Might I introduce you to the Tupolev Tu-134?

https://en.m.wikipedia.org/wiki/List_of_accidents_and_incide...

throw0101b
4 replies
16h25m

Might I introduce you to the Tupolev Tu-134?

Also perhaps the 737-MAX. :)

* https://en.wikipedia.org/wiki/Maneuvering_Characteristics_Au...

verdverm
3 replies
14h7m

Given how much the max family and 8 are flown, I don't think this holds up.

Some searching says...

1. >1000 flights per day for the family

2. 2 US carriers accounting for more than 200 Max 8 per day

So one would have to get to 20,000 flights after two crashes to get 2 nines. We're well past that threshold

throwaway318
1 replies
11h53m

The probability of not having a crash after 20,000 flights, with 99.99% chance per flight, assuming no serial correlation, is 13%.

verdverm
0 replies
7h21m

Yes, there is a better, more accurate method than my napkin math, which was only to provide a baseline most could understand to see we are well beyond the two nines

Xixi
0 replies
12h57m

From inception to the second crash, numbers were abysmal. The 737 Max was crashing at a rate of about one per hundred thousand flights, two order of magnitude worse that the 737 NG (one fatal crash per 10 million flights).

Said differently, the Max 8 was working safely 99.999% of the time, while the 737 NG was working safely 99.99999% of the time. An order of magnitude better than 99.99%, but two orders of magnitude worse than expected...

It is certainly a lot safer now. Hopefully even better than the 737 NG.

xcdzvyn
1 replies
9h56m

I disagree that it's possible to estimate how dangerous an aircraft is based on its incidents/flight ratio. There's lots of other factors: Russian weather, inadequate training, inadequate maintenance, and far more landings on poorly maintained and even totally unpaved runways:

Capable of operating from unpaved and gravel airfields with only basic facilities, it was widely used in the extreme Arctic conditions of Russia's northern/eastern regions, where other airliners were unable to operate.
KHRZ
0 replies
8h46m

Russian weather? Is this an euphemism for Russian air defense?

NL807
1 replies
16h8m

Kinda scary how many times I flew with those in 80s.

ethbr1
0 replies
1h11m

I was thinking about that... but even with a relatively abysmal safety record... on average it's still an incredibly safe way to travel.

Air safety seems the quintessential "discounting the horror of extremely rare accidents from the actual total safety rate" mental trap.

When it's years between incidents, and that widely used? Yeah, I'd still fly on one if I needed to.

But I swim in the pool during thunderstorms too, so not really a zero risk type person.

sterlind
0 replies
10h1m

not to mention the Tu-144, aka the "Concordski":

https://en.wikipedia.org/wiki/Tupolev_Tu-144

though that one was so defective that even the Soviets didn't want to risk flying it. it could barely get into the air, and that'd be with several major faults and alarms blaring.

thret
2 replies
16h18m

Boeing are a major defence contractor, I'm sure at least some of the information is secret.

newuser94303
1 replies
15h33m

A defense contractor should have better security

martinsnow
0 replies
9h58m

Really

reactordev
1 replies
17h31m

Sounds a lot like software forks… cough

Not the ones that were forked due to abandonment, but the forks due to “irreconcilable differences”.

denimnerd42
0 replies
16h21m

or hadoop

johann8384
1 replies
16h22m

nobody is flying an airplane that only 'works' 99.99% of the time

The 737 Max 8.

deaddodo
0 replies
11h0m

Already addressed in another thread:

https://news.ycombinator.com/item?id=38358542

SomeRndName11
0 replies
6h21m

1. It was USSR, not Russia. For many who were USSR citizen till 1991, but neither ethnically or geographically Russians, this rubs very wrong way.

2. Aviation in the USSR was developing completely independent, and you can accuse USSR in stealing technology in many areas but certainly not in aviation.

bozhark
0 replies
17h54m

Already had it

est
17 replies
13h57m

Now, you will need to create a company and supplier base the size of Boeing to make any use of this

China: hold my baijiu

paledot
16 replies
13h11m

Guaranteed they already have the data they want.

SR2Z
15 replies
12h51m

Then why hasn't COMAC produced a viable jetliner?

testrun
5 replies
11h5m

According to Wikipedia Comac has orders in the range of $26 billion for the C919.

elsonrodriguez
3 replies
10h12m

The same article notes that they are using an engine by GE/Safran, and that there was espionage involved in the development of the C919.

vidarh
0 replies
8h56m

And? Neither of these things change what was being claimed and disputed above.

lozenge
0 replies
7h36m

Apparently, the engines might be 20% of the cost of the plane. https://aviation.stackexchange.com/a/16018

coldtea
0 replies
6h57m

Happens to the best of them:

Economic and industrial espionage has a long history. Father Francois Xavier d'Entrecolles, who visited Jingdezhen, China in 1712 and later used this visit to reveal the manufacturing methods of Chinese porcelain to Europe, is sometimes considered to have conducted an early case of industrial espionage.[16]

Historical accounts have been written of industrial espionage between Britain and France.[17] Attributed to Britain's emergence as an "industrial creditor", the second decade of the 18th century saw the emergence of a large-scale state-sponsored effort to surreptitiously take British industrial technology to France.[17] Witnesses confirmed both the inveigling of tradespersons abroad and the placing of apprentices in England.[18] Protests by those such as ironworkers in Sheffield and steelworkers in Newcastle,[clarification needed] about skilled industrial workers being enticed abroad, led to the first English legislation aimed at preventing this method of economic and industrial espionage.[19][18] This did not prevent Samuel Slater from bringing British textile technology to the United States in 1789. In order to catch up with technological advances of European powers, the US government in the eighteenth and nineteenth centuries actively encouraged intellectual piracy.

SR2Z
0 replies
1h31m

From Chinese airlines that are being told in no uncertain terms that they need to place some orders. Most of that order book is protectionism.

protomolecule
4 replies
9h1m
Hissigh
3 replies
7h14m

I flew with this 2 years ago. Looks like a standard boing/airbus from the inside but the sound isolation is so bad, it's very loud inside

est
1 replies
3h55m

I flew with this 2 years ago

You sure? C919 didn't start commercial flights until this year (2023)

SR2Z
0 replies
1h28m

That was my understanding, too.

coldtea
0 replies
6h58m

Well, if you've managed to create an airliner, starting from not having made one at all before, then the sound isolation would be the most trivial thing to improve in an update.

dghlsakjg
0 replies
11h59m

Because having the plans for something and having capability, materials and funding to do it are two different things.

coldtea
0 replies
7h0m

Because it takes time, not just data. To set up infrastrcuture, to do tests, to train, etc. Hell, it takes Boeing itself several decades to design a new aircraft model, even though they have done it several times before.

The US for example trying to get back some of its domestic manufacturing prowess, after decades which has outsourced it to China which has gotten really good at it, has a 10-20 year barrier to overcome before it can even start to get to the same level, and that's if all goes well and no stupid decisions are made. Which is not very likely.

SiempreViernes
0 replies
2h33m

They have just gotten recent Boeing data /s

M3L0NM4N
0 replies
10h20m

If they had the money to, they could.

lallysingh
10 replies
16h53m

I can imagine this complicating any supplier contract negotiations. "you pay X $50/unit more for the same device, etc."

alexpotato
8 replies
15h25m

I remember taking a procurement class in graduate school(MBA).

One of the more interesting points of discussion was that when big companies negotiate purchase agreements for parts, the actual cost of the parts can be very transparent. The negotiation is generally about the actual markup e.g. "I think we should pay X% over cost.

Someone, logically, brought up: "What if the company is not willing to share the cost upfront?".

The professor responded: "Well, if it's a public company you can generally deduce a rough cost/part and use that as your starting point in the negotiation"

Student: "Well what if the company says we're wrong?"

Professor: "No problem: ask them what the correct number is. If they don't want to give it to you, ask them how you expect to have a long term partnership if you are not willing to talk openly and honestly about things like parts costs."

wordpad25
3 replies
15h19m

That's kind of a softball, can easily be counted with "part costs vary a lot based on the market" or something like, regardless of cost we guarantee you this price point

No business wants to share it's internal costs, it's their prime competitive advantage

nullindividual
0 replies
13h45m

When your only business is the Lazy B, you’re going to cooperate.

deaddodo
0 replies
11h5m

Their prime competitive advantage is their product and quality:cost ratio. For a product company, at least.

If your business' primary competitive advantage is that it gets ICs for 1c less/per thousand, your business is built on shaky foundations. One that you would still want to disclose during negotiations ("yeah, our product is the exact same quality as Widget Co; but we've found a supply for some internal parts at slightly below market value").

aksss
0 replies
13h33m

If the deal is big enough, it’s absolutely on the table. These are “cost plus” contracts. See Walmart and the federal government for examples of consumers that require these terms.

Now, the federal government, particularly with drugs pricing, turns a blind eye towards the suppliers just jacking up the purported cost. E.g. Pharma:“we want to make $100 per pill, it costs us $5 to produce”. Fed: “we demand cost + 10%, because the people”. Pharma:”Fine, let’s say it costs $90 to produce.” Fed:”Where do I sign?”

Whereas Walmart would say to somebody like Nabisco, “GFY; if you want your product on our shelves, you’ll open your books and give us audited cost + 10%”.

deaddodo
3 replies
11h10m

The idea that someone could hide parts/manufacturing costs is ridiculous on its face. You, as a consumer, can get a general BOM for most any device. It's how we know that the original Beats headphones were "worth" 7-8usd.

Just as we as consumers know we pay extra to the company (even if the numbers aren't oblique), businesses know the same. It's about how much you're willing to spend, not how much they spent to build it.

traceroute66
2 replies
8h35m

You, as a consumer, can get a general BOM for most any device.

I wish this dumb naïve argument would just die quietly in a corner.

A the value of a device is not its BOM. It has never been and it will never be.

There are so many other additional costs to factor in. Costs related to the manufacturing plant, its people, its tooling and its processes. Logistics costs related to bringing in parts. QA costs. R&D costs. Software maintenance costs. Marketing costs. Certain parts and software may have royalty fees associated with them. The list goes on, and on, and on.

So please, enough of the dumb "$device is only $2USD because its only a bunch of 2c resistors and capacitors on a PCB".

deaddodo
0 replies
7h6m

So please, enough of the dumb "$device is only $2USD because its only a bunch of 2c resistors and capacitors on a PCB".

The thread was about literal parts costs and how knowing those means nothing to the value of a produced item. In which case, a BOM is directly and literally applicable.

No one is saying what you're so annoyed and frustrated about. Literally the entire thread is about how the value of a product is far greater than it's actual parts cost and why knowing that is useless for negotiation.

Learn to listen/read before you get yourself into a tissy about a made up sleight.

ChrisRR
0 replies
7h0m

R&D definitely forms a huge part of many product costs, and not for many products where you just churn them out by the millions

For a plane, it's going to be the former

That and the reason it's easy to get a BOM of cheap products is because you can buy them and tear them down. I can't see Airbus managing to buy a boeing and tear the entire thing down without Boeing noticing

quench
0 replies
5h28m

In aviation it does not work like that usually. Supplier provides a full BOM including all labour and invoices for materials. Company pays x% over the top of the costs

qwertox
4 replies
16h5m

It could be a real security issue, depending on the kind of data.

photochemsyn
3 replies
13h42m

"Security by obscurity alone is discouraged and not recommended by standards bodies."

qwertox
0 replies
6h42m

I'm not sure you could really add some kind of protection to somewhat unprotected cables, hoses or pipes which must run behind the passenger compartment walls.

justinclift
0 replies
11h58m

This is Boeing we're talking about. They stopped being any kind of competent a few decades ago. :(

clnq
0 replies
13h31m

Ah, well so long as it's discouraged... I'm sure no one's critical systems would depend on it, right?

lolive
2 replies
8h44m

Airbus needed a corpus to train its LLM. Now they have.

Thervicarl
1 replies
8h25m

This should guide them if they want to modify existing airliners so they are better equipped to crash into the ground, 737 MAX style. No thanks.

KRAKRISMOTT
0 replies
8h9m

They just need to ask the British Prime Minister. His father in law's company is where those jobs get outsourced to for cheap.

baz00
2 replies
17h38m

That wouldn't even help. It'd have to be part of the original supply chain and certification chain for anything to be allowed out of the country that cloned any parts.

panarky
1 replies
16h40m

If it doesn't matter that it's public, then why did Boeing try to keep it secret?

worthless-trash
0 replies
15h14m

Because they can't tell the future, its better to have the cards than not.

toasted-subs
0 replies
16h28m

Yeah the margins in that enterprise are pretty small not something you can franchise.

pyuser583
0 replies
12h2m

If only .001% of the population of China bought a 747.

SahAssar
22 replies
19h27m

Can we stop using disk size as a measure of leaked data?

There are bluray movies larger than this leak and there are files smaller than 10kb a lot more critical in most businesses.

It'd be nice if there was some sort of scale for data leaks like (just spitballing here):

1. Leak destroys all core company functions (crypto-exchange leaks all wallet keys, CA leaks all root keys and becomes banned from all trust stores, etc.)

2. Leak causes regulatory issues criminal enough to shut down company

3. Leak severely hinders core company functions (deploy keys for a cloud computing SaaS are deleted which stops all new deployments until all infra is reconfigured)

4. Leak severely looses company competitive advantages (new products leak that are replicable by competitors)

5. Leak causes severe PR disaster

6. Leak shows embarrassing internal company communication without any of the above

tyingq
10 replies
19h26m

Would be nice, but there would quite a lot of analysis needed to be able to determine any of that. Which you can't start until the file is public.

SahAssar
5 replies
19h20m

Sure, but instead of saying "Boeing leaked 45GB" it would say "Boeing leaked files of undetermined severity".

The disk size does not matter, and when the severity was actually determined it would show up in the headlines as "Boeing leak determined to be a level 3 leak" instead of just being "That boeing leak 5 months ago was kinda bad".

Either way, listing the size says very little.

xcv123
4 replies
18h40m

These are journalists publishing breaking news. They are not autistic IT professionals.

Relevant quote from the article: "I haven’t gone over the whole data set but Boeing emails and a few others stand out as useful for those with malicious intent"

SahAssar
2 replies
18h33m

Journalists are almost never deep experts of the fields they report on (although I hope well versed), but given the tools to report the news in a way that is more understandable to the public I think they will use them.

Both journalists and the public need a better way to understand how different breaches affect them.

xcv123
1 replies
18h29m

As someone wrote earlier, they won't know the severity until it is analyzed. That could take a long time. Days or weeks. This is just the breaking news. Also what incentive does anyone have to waste their free time analyzing the data and issuing a report to you after this headline that the general public will not give a shit about a few days later?

SahAssar
0 replies
18h22m

I'm not saying to delay the report. I'm saying to not headline the size of the leak unless it has some sort of significance. If the severity is later known report that as news.

If anything this would create two stories where there now is one, so journalists would not have less or later to report.

vinaypai
0 replies
18h31m

They are not autistic IT professionals.

What does autism have to do with having the professional integrity to understand what it is you're writing about before publishing sensational claims?

rebolek
1 replies
19h18m

I believe that Boeing already did than analysis and determined it’s #6.

tyingq
0 replies
18h50m

At this point, I think there's quite a lot of "breach fatigue" now where the general public doesn't care about these stories. It's just "oh, I guess I get another year of free identity theft services".

cvoss
1 replies
19h8m

Well, first, I'd expect Boeing already had some idea of the scope of what was compromised simply by investigating their own systems. After all, they knew enough to declare there was no impact on flight safety.

And second, even if a company has no idea of the scope, the hackers would somehow want to prove at least privately what the scope was, else their threat is not as manipulative as it could be. On the other hand, the hackers can't credibly bluff and inflate the scope too far beyond reality because the company can just say "prove it or I don't believe you and I won't pay." And the hackers want to get paid.

It's a business deal after all. A really crappy one involving criminals. But at the end of the day, the company must have already assessed the value of the leak in order to reach a decision.

tyingq
0 replies
18h51m

I'd expect Boeing already had some idea of the scope of what was compromised

I've seen companies say this sort of thing with high confidence. But that seems hard to me, assuming some level of administrative access was breached.

FridgeSeal
1 replies
19h6m

Because half the time companies can’t be trusted to even admit there’s a leak, let alone the severity of it.

Groups that leak are likely to want to inflate the severity of the leak to ensure they get paid.

The larger a leak, the higher the probability there’s sensitive information in there, and the better opportunities/more time attackers had to exfiltrate it.

SahAssar
0 replies
18h54m

Agreed, but journalists need a better way to communicate. Saying 45GB sounds like a lot of emails to a technical person and nothing to someone who bought a bargain-bin 64GB USB memory stick the other day and filled it with a single HD movie.

The info says nothing, it conveys nothing. Even skipping the size and saying it leaked "emails" says more in the headline than the size.

A single video recording of an all-hands meeting could fill that size but it could also be emails containing the keys for accessing a large part of DOD.

ssss11
0 replies
19h12m

You’re describing a risk matrix. What level of risk does this data hold for the company.

I think that is a good way of measuring it.

porompompero
0 replies
19h24m

Nice, it sounds to me similar to the earthquake Richter scale.

phasnox
0 replies
18h58m

"After Boeing declines to pay up, ransomware group releases DEFCON 3 leak"

Could be the alternative headline.

neodymiumphish
0 replies
17h56m

They leak this stuff on their Tor leak site. Downloading 45GB from LockBit's site takes something like a week. Then you have to review the contents to determine its value.

No news org is going to go through that effort.

msmith
0 replies
19h11m

This sounds like how we use a CVSS score to gauge the severity of software vulnerabilities.

Maybe the world needs a standardized place to catalog and rank all the data breaches that have been disclosed.

fishtacos
0 replies
18h34m

I was working (very recently, during the 5000+ companies that were hacked via some what I presume were zero day hacks) for an MSP. 600 GB of data were exfiltrated from a law firm with several terabytes of storage of customer data kept due to data retention laws.

They asked for almost a million USD. FBI got involved, everything was restored from backups (thankfully, a month loss of digitalized work, and absolutely nothing was given to the ransomware group.

To your point, there are severe regulatory issues that have to be addressed due to the exfiltration. I no longer work for them, so I don't know the extent of their cost in 1. notifying affected clients and 2. providing credit protection coverage due to leaking of personal data.

dylan604
0 replies
19h4m

Or at least say what the 45GB (for this example) of data compromises. As you say, if it were video files, that would add up pretty quick, but if it were 45GB of emails, then that's a hellalotuvdata. That would be the equivalent of a hostile law firm dumping a truck load of banker boxes on a smaller law firm to bury the lede.

Kind of like saying I have 10. 10 what? As my math/science teachers always said, don't forget to include your units.

_visgean
0 replies
18h32m

This happened now, you can't assess right now any of these statements.

ForkMeOnTinder
0 replies
18h24m

For me the disk size is interesting because it tells me how long I'd have to wait if I wanted to download the leak myself, which I do from time to time. (not downloading this one though)

ThinkBeat
19 replies
20h8m

My memory is not the greatest and simple Google searches are not helping right now.

Have there ever been massive problems from one of these leaks for the targeted company?

I seem to remember quite a lof of similar leaks over the past two years where the market and public shrug it off.

Clearly 45gig is a lot. I would think if there was a major horrible thing to find that Boeing would have paid the ransom (and told no one).

Will it have any real negative consequences for Boeing?

It is a black mark against them that they were vulnerable. I guess it is favorable point for many that they didn't pay.

jacekm
13 replies
18h2m

Competition will love to have a look at this data but obviously they won't announce it to the whole world that they are digging through the files. One day Airbus will build a new plane before Boeing or just win a lucrative contract and we will never know whether this happened naturally or because of the knowledge they got from this data.

Denvercoder9
11 replies
17h59m

Airbus won't touch this data with a 90ft pole. Their lawyers will make sure of that, as even just downloading it opens them up to tons of lawsuits.

The ones looking at this will be China, Russia and their associates that don't care about (Western) law.

omnimus
3 replies
17h51m

Airbus is not a person but a company. Of course some of the employees will look at this data. They will all pretend that they dont but companies pay for industry secrets why would they stay away from free ones.

PedroBatista
1 replies
17h26m

To be fair, 60s tech is widely known and Boeing would profit much more from Airbus tech than the other way around.

Let's not even bring project Echelon into this..

dghlsakjg
0 replies
11h53m

I didn’t know that Boeing was making carbon fiber wide bodies like the 787 back in the 60s…

TillE
0 replies
16h43m

Random low-level employees looking at stuff out of curiosity won't have the power or even the motive to act on that data.

For higher-level people it really just isn't worth the risk, unless there's some incredibly valuable secret.

aborsy
1 replies
16h15m

You can download it securely and anonymously. There is no way to find out.

Actually, the French government intelligence agency is famous for IP theft. This one is placed at their feet.

jjeaff
0 replies
14h50m

that doesn't matter. if an employee were to read it and perhaps glimpse some trade secret and include that, even inadvertently into a future product, that could open them up for litigation.

userinanother
0 replies
13h38m

Rumor has it airbus used to have a secure cabinet of Boeing analysis data that people would go reference once in a while in the 90s but I doubt that happens anymore

toss1
0 replies
1h43m

YES

If you are under defense industry rules, viewing data is generally on a Need-To-Know basis. For any data that is classified, or CUI (Controlled Unclassified Information), EVEN IF that data becomes publicly available, it is illegal to view it.

Now, I'm sure if a headline came up in a Google search you wouldn't get busted, but if you go ahead and download it, that is at least putting your ability to continue working with classified/CUI at risk.

So yes, it's a hot potato which no one (smart) in the civilized democratic world will touch.

m000
0 replies
17h21m

For what you don't want your direct employees to do, you can always hire a contractor who will do the dirty job and give you the (in this case literal) TL;DR.

billfruit
0 replies
14h50m

Why wouldn't Airbus not look into it, Boeing has often acted agressive in getting US government to put tariffs on Airbus.

ThinkBeat
0 replies
2h20m

That will be the guidance from the legal department for sure. and I would hope most bigwigs would know this without being told.

If however, a completely separate company, perhaps in a different country, that has no business associations with Airbus in any manner, and there will never exists payments between Boeing and this company went through all of it would be no problem.

If a specific bigwig later on received among photos and videos, a steganographic encrypted document whilst visiting an anonymous sex site then read it and deleted it, nobody would ever know. (lest someone talks, always the human factor)

I made up all of the second paragraph. Companies specializing in what i described over to exist. They are not of course limited to ransomware leaks.

raverbashing
0 replies
17h10m

What would Airbus learn from it?

How to shoot yourself in the foot with bad management?

(On the other hand maybe some other company's board went through the docs, hmm)

Thorrez
1 replies
12h56m

When Sony was hacked by North Korea, the leaked payroll revealed women were paid less than men for the same job. I'm not sure what the ramifications of that leak were though.

https://slate.com/human-interest/2014/12/sony-pictures-hack-...

deadbeeves
0 replies
2h33m

What that article says is that one woman with the same job title as a man makes 1 million dollars less than the man. I doubt that's just a fixed salary, so it's hard to say how damning it is.

It also says that a spreadsheet from 2004 states that 85% of the top earners were men. This is unrelated to the pay gap argument.

The rest of the article is fluff completely unrelated to the leak. I'm no surprised there were no ramifications from this. If this is all that was found, it pretty much says there's no or practically no pay gap at Sony.

vidarh
0 replies
8h53m

My personal mail is 10GB+ despite having moved providers in the last couple of years.

45GB can be a lot, or it can be a couple of people's worth of marketing presentations.

gosub100
0 replies
14h26m

I bet the internal emails would be infinitely more valuable than design docs. let's see what the last link on the chain (of responsibility) actually said when they were told MCAS wasn't working. Let's hear how they worded the spin on the first batch of ~150 deaths to do damage control, and then how they reacted to the next. I'd fire up my popcorn maker for that!

anitil
0 replies
18h14m

I think it would be a problem if people started digging, but I suspect most people just don't have the time, inclination, or willingness to take the legal risk.

whatever1
17 replies
20h26m

Like how can one download so many files from a company network and no alarm is set off ? What do the useless IT departments set up? Just employee spyware ?

JoblessWonder
7 replies
20h16m

I mean, depending on the data type... 45GB isn't really all that much. They probably have 45GB individual CAD files...

Now, if it is 2,000,000 text files totaling 25gb, then that is harder to explain away.

(I just read the article and saw that it deals with a vendor we use daily... so... great news.)

bunabhucan
6 replies
20h9m

I remember an engineer telling me the physical drawings for the 747 weighed ten times as much as the plane itself.

Invictus0
5 replies
19h42m

1000 sheets of paper weighs 10 lbs, the 747 weighs 910,000 lbs, so there were 91 million sheets of paper describing the 747? Does not seem accurate

avar
1 replies
19h28m

The 747 has around 6 million individual parts, 15 sheets of paper per part doesn't seem unreasonable.

Just detailed schematics of a given plastic knob in the cockpit should take at least a few pages, nevermind something more complex or critical like turbine blades.

Invictus0
0 replies
16h13m

The 6 million figure includes fasteners. Half of the parts of fasteners and there are only 75k engineering drawings. Engineering drawings rarely run more than a few pages per part.

https://www.boeing-747.com/fun_facts_from_boeing.php

38321003thrw
1 replies
19h25m

Construction drawings are not done on A4. Typical drafted drawing is uses handful of ft by ft range, say 3x4. So that should give ~2 orders of mag less sheets. Does 10,000 sheets of drafting paper sound more reasonable?

Internet says 747 has 6,000,000 parts, half of which are fasteners. So 3m individual components. “171 miles” of wiring. Blah blah. I can easily see 10k drawings to cover that beast, soup to nuts.

buildsjets
0 replies
18h31m

3x4 is about right, but the original 747 drawings were not drawn on paper, they were inked on thick thermal and humidity stable mylar. Some detail parts may have been defined multiple (up to a half dozen) E sized (36”x48”) mylars. Then there were separate drawings for each assembly of detail parts. Then there was all the manufacturing planning and detailed work instructions to fabricate each level of assembly. Then there is all the documentation associated with lab qualification testing prior to flight. I have personally authorized qual test reports in excess of 3000 pages, where ~100 pages was my content and the rest was all backup data.

joemi
0 replies
18h4m

If you adjust the size of the paper, it can be true no matter how many or few parts there are.

jstarfish
2 replies
19h34m

Sadly, this is pretty routine for us (not Boeing). Every goddamn day we have somebody plugging in a USB stick and copying 1-20 GB of data to it. We see similar volumes "accidentally" uploaded to iCloud whenever someone syncs their work laptop to their personal iCloud account.

We watch it happen. We have the tools to stop it. But we're not empowered to use them, for the exact same reasons that led to Equifax's fuckup-- we're not allowed to do anything that might impact production/pursuit of new revenue.

Lately, I'm not convinced this is even the "wrong" approach. Espionage was not invented alongside the Internet. If we build a Thing and it's the only Thing we sell, data concerning it will inevitably be stolen by someone in some way. But if we iterate on it fast enough, the value of older versions leaked diminishes. We're in the market of building and selling a moving target.

It also creates an inflated volume of data. You can't just break in, grab "the_flag.zip" and run like hell-- you have to exfiltrate a fuckton of data, make sense of it, and carve something usable from it. Like, checking binaries into a git repo makes the size bloom, but it doesn't add a proportionate amount of "value" to stealing that repo. It's padded with drafts and garbage.

cryptonector
1 replies
19h26m

You need to disallow all USB devices not on an approved list, which must all be keyboards and mice and nothing more.

lokar
0 replies
19h15m

I worked somewhere that filled all the usb ports with epoxy. They maintained a large stock of ps/2 keyboards and mice.

lgeorget
0 replies
20h12m

We don't know how and over how much time the data was exfiltrated.

demondemidi
0 replies
19h46m

I just had to download a 69 GB database to my laptop of CAD design files (mostly libraries). I'm glad I have 1 Gbit download speeds, but peers aren't so lucky. Granted, if IT saw remote employees downloading TBs of data it should really raise red flags.

cyrnel
0 replies
19h52m

So many of the security monitoring tools that purport to detect things like that only work if the attacker is brainless. Modern networks are complex enough where a clever attacker (like a professional ransomware gang) can make malicious traffic look like any other traffic.

Unless this was just a public S3 bucket, there was probably some lateral movement involved, and I'd say time/money would be better spent reducing that particular risk in the future.

barryrandall
0 replies
19h23m

Like how can one download so many files from a company network and no alarm is set off ?

Slowly, hidden among legitimate traffic, and indirectly. For example, most companies don't notice 100 kb/sec increases in DNS traffic, slight increases in web server image sizes, or changes to server MOTDs.

ajcp
0 replies
20h15m

If the FileShare server itself was compromised one could mount it in a way that wouldn't show leakage, or just image the thing and bork the original.

Otherwise you could have a crawler that just traverses the FileShare and makes duplicates at a rate slower than what would look like BAU traffic. Given that most enterprise network shares host a TON of legitimate batch dump/upload file traffic it might be easy to skate by.

GartzenDeHaes
0 replies
20h18m

Let's say you have 6TB a day going through your perimeter firewall. It's kind of hard to pick out a 40GB stream(s) on HTTPS going to some US cloud provider.

ceejayoz
17 replies
21h17m

I wonder if this counts as an ITAR violation on Boeing's part.

da_chicken
16 replies
20h50m

How do you figure that?

ceejayoz
15 replies
20h48m

There's almost certainly ITAR-subject data in a Boeing data dump of this size; I'm curious as to whether not paying a ransom counts as releasing it.

hiharryhere
6 replies
20h19m

I doubt it. Here in Australia at least companies with large gov contracts are prevented by gov policy from paying ransoms.

tsujamin
2 replies
19h29m

Out of curiosity what's the source on that? AFAICS there's no clear legislation restricting it (although a lot of talk about such a bill in the future). It is in standard contract terms?

hiharryhere
1 replies
17h2m

Source is a close relative involved in responding to a recent, well publicised data breach.

They service several large commonwealth departments and were instructed by them not to pay.

hug
0 replies
11h9m

They instruct you not to pay, but that instruction has absolutely no binding.

The Australian orgs I have deal with in large compromises have universally opted to pay to prevent release, where it was financially feasible.

ceejayoz
2 replies
20h16m

It wouldn't be the first catch-22 scenario caused by conflicting laws.

jacquesm
1 replies
18h1m

The 'easy' solution is not to let your data leak.

generic92034
0 replies
17h41m

Certainly different companies put a different effort into their IT security measures, but I doubt any of them would claim that their system is "unhackable". So, I am not sure that not letting your data leak is an option you can really choose. You might be able to influence the probability of a hack, though.

brookst
2 replies
20h8m

I think ITAR covers exporting, which is necessarily intentional. At least I'm not aware of any espionage victim also being subject to ITAR prosecution.

kevin_thibedeau
0 replies
17h43m

It also covers reexporting. You're still responsible for ITAR and EAR articles after they've been exported and the recipient wants to transfer them somewhere else.

annoyingnoob
0 replies
19h6m

In the case of ITAR, not exporting means limiting access to US persons only. I suspect this could be a violation, even if unintended.

lesuorac
1 replies
20h22m

I'm more curious why failing to secure it doesn't count as a ITAR violation.

kenjackson
0 replies
16h46m

I think you need to do reasonable effort. Perfect security doesn’t exist.

tgsovlerkhgsel
0 replies
17h44m

Letting it get stolen in the first place might count, I highly doubt not paying the ransom counts.

estiaan
0 replies
10h22m

I really hope this is not the case. Paying randsome is unethical, in some cases it’s also illegal. At best you’re funding a criminal organisation, at worst you’re in collaboration with a criminal organisation.

In the case of digital files there is absolutely no guarantee that they delete the file, it’s like paying someone to go back in time.

The act has been done, the data is stolen, your negligence and wrongdoing is in the past and the only ethical option is to not fund the bad actors who are actually primarily responsible.

dymk
0 replies
19h8m

Size of the dump means nothing, on one extreme it's a single 45GB video file of a security camera looking at nothing.

cosmojg
14 replies
11h52m

As someone who works in the defense industry, I can assure you that 45 GB of unencrypted emails is next to worthless from a commercial standpoint and a total non-event from a national security standpoint. This is probably more of a threat to individual employees than it is to anybody else.

To put it another way, if this data had value, the ransomware group wouldn't be leaking it for free.

IndySun
4 replies
8h47m

As someone who works in the defense industry, I can assure you...

Defence industry is broad, though, perhaps you needed to be for security reasons. However, stating your job then saying individual people don't matter but commercial entities do may make you unfit for certain defence careers.

haliskerbas
2 replies
3h48m

The people who think individual human lives have value usually opt out of working in “defense”.

solardev
0 replies
3h30m

Well, they could be in the "all are equal, some are more equal" camp. Lives have value, but some have more value... especially "ours".

Realistically, most people aren't going to spare more than an internet comment or a weekend protest for some atrocity going on across the world, anyway. The world teaches us to compartmentalize evil in order to go on living...

edgyquant
0 replies
2h26m

Middle school generalization

bigbillheck
0 replies
3h18m

may make you unfit for certain defence careers.

Only in that they're saying the quiet part loud, and in defense you're not supposed to say it at all.

leftcenterright
3 replies
6h45m

To put it another way, if this data had value, the ransomware group wouldn't be leaking it for free.

This is entirely incorrect and just speculation.

Most likely reason for not paying up is that law enforcement (involved in this case as well) does not like it and have even been considering a ban on ransom payments. This in no way implies this data has no value, it is very probable this data contains credentials (Citrix appliances) and might allow future compromises unless Boeing improves their security posture.

- https://www.techradar.com/pro/security/a-huge-hoard-of-boein...

- https://hbr.org/2023/08/how-a-federal-ban-on-ransomware-paym...

ggeorgovassilis
1 replies
5h46m

... just speculation.

The formulation (3rd conditional) makes it clear the author is aware they're speculating.

This [the dump is worthless] is entirely incorrect

Which isn't telling us why (the dump is valuable). You say that there's a legal ban on ransom, so the ban supposedly reduces market value. Black market participants evade bans, there is a black market value which clearly is the prime market for such loot. You write "it is very probable this data contains credentials" which is plausible, but the article you linked mentions logs and configs, not credentials. Maybe (before you point it out: that is also speculation) there were no credentials in the first place (dump was of low-value), or the hackers filtered them out for later use (seller filleted the fish), either way the resulting merchandise is of low value.

tejohnso
0 replies
3h48m

The formulation (3rd conditional) makes it clear the author is aware they're speculating.

If the author had meant to convey speculation, their sentence would have included a modal verb or expression for speculation.

suprfsat
0 replies
5h11m

By demanding a ransom, they've already notified the customer that the credentials have been stolen. The value doesn't lie in releasing them.

If they wanted to be paid to steal credentials they should have gotten hired as a red team.

visarga
0 replies
11h8m

Maybe we can get another email corpus like Enron for NLP from all of this.

fakedang
0 replies
9h56m

Still useful to find weak links as a foreign adversary.

Yizahi
0 replies
3h10m

A few years ago I had to clean up my work account because I hit a 50 Gb capacity. Today I have 20 Gb used again. And I'm a single low level (in the hierarchy) engineer. Emails from different automated systems and confluence produce gigantic amount of not-quite-spam (because it is sometimes very useful).

If they had 500 Tb of emails, maybe it was a concern, but 45 Gb looks like a single account breach. Maybe some interesting confidential emails sent company wide, or department wide, but probably hardly anything worth it. That's why I think Boeing didn't pay and was right to do so.

RandomLensman
0 replies
6h2m

45 GB of email isn't that much to start with... maybe a few accounts for a 5-10 years and you'd be at that level

ChrisRR
0 replies
7h2m

I wouldn't be so sure. It's like criminals who steal passwords. Sometimes they just want to bulk sell the passwords at a lower value rather than delving into the accounts for higher gain. Sometimes they just want rid.

In this case, I wouldn't be surprised if the group want to make it clear that they're serious for other high-value targets

strangattractor
12 replies
22h21m

Didn't a ransomware gang just renege on a deal and release the data anyway. Seems like they are killing their own business model. If company X cannot depend on the gang delivering why pay in the first place. Boeing will have to pay for any fallout form the data breach - why have the added expense of paying the criminals for the privilege?

barryrandall
5 replies
21h19m

They do that all the time. The first ransom is to get the decryption keys to the target's data, the second ransom is to prevent them from publishing the decrypted data.

CivBase
4 replies
21h12m

If they're going to publish the data publicly, what do you need decryption keys for? Seems like it's basically an all-or-nothing deal to me.

sandworm101
0 replies
20h59m

> If they're going to publish the data publivally, what do you need decryption keys for?

Because they will publish the bad stuff, the stuff you really don't want public, but likely withhold the boring stuff, the stuff the business really needs to function. And whatever they release might not be in the format that it was taken.

contravariant
0 replies
21h10m

I think that's why you ransom the decryption key first. If I understood correctly.

bretpiatt
0 replies
21h9m

Perspective as CEO of a backup and disaster recovery company...

A lot of folks now have ransomware protected backups for critical data so they aren't paying for decryption keys.

This has escalated to hack and release, the attackers are now exfiltrating data and threatening to make it public in addition to encrypting it on the host system.

barryrandall
0 replies
20h49m

They only tell you about the second extortion attempt after the success of the first. As I understand it, each gang operates differently, but most are consistent in their approach (e.g. x will always double ransom, but y will never).

xeckr
2 replies
16h51m

This opens up an interesting (albeit highly unethical and illegal) strategy to combat ransomware, which could be implemented by state actors:

1. hack targets and hold their data for ransom

2. get the ransom and release the data anyway

This would largely discredit the actual ransomware gangs. A way to make this more ethical would be to have the data be insignificant or encrypted. The media will still have their story, and public perception will be changed.

An even better way would be to secretly coordinate with the "targets" of the hacks, turning the whole thing into a harmless spectacle that nevertheless decreases the incentive to hold data for ransom.

rdtsc
0 replies
8h34m

Very nice. Create something like a lemon market for ransomware. I like it.

It always felt funny how these criminal groups in this case have to project an image of trustworthiness and honesty.

M3L0NM4N
0 replies
10h17m

The latter could have been the case here and we would never know...

asdfman123
2 replies
20h6m

Tragedy of the commons. We need to establish a centralized judicial system to identify and shut down bad ransomware actors.

op00to
1 replies
19h28m

let's hold off on advocating for a New World Order just yet.

asdfman123
0 replies
16h23m

No, this would be a shadow government by ransomware companies to govern other ransomware companies. We can all get along!

kh49
11 replies
21h11m

The never ending cost of low quality outsourced digital transformation. Pathetic how many large corps have been hit. And tax payer has to foot the ever growing bill to investigate and defend these useless orgs.

hnthrowaway0315
6 replies
21h9m

Basically every large, traditional business is relying on some offshore gig for certain key technical responsibilities. They probably don't consider it the real key as they are cost centers, but hey ransomewares are reminding them.

It's not even just offshore. Some onshore consultancies are really of agasp quality.

pid-1
5 replies
21h4m

Is there any case of a company suffering significant financial backlash due ransomware attacks?

My current impression is: consumers don't care, regulators don't care... so why should CEOs care?

punkybr3wster
1 replies
20h35m

The MGM ransomware supposedly cost them $100mil

whatever1
0 replies
20h28m

Is it a tax write off ?

rileyphone
0 replies
20h48m

Customers care if your business is in security, especially b2b. Though the biggest downstream effects are probably from security tightening making it more difficult to get anything done.

Source: my company was hit a couple months ago

hnthrowaway0315
0 replies
20h58m

Yeah you have a good point.

dimitrios1
0 replies
20h46m

I don't think in the case of airlines we have the option to care. We are just kind of stuck with whatever the government-backed airline oligarchy chooses to do. The airlines would be the ones to have to care for it to matter. When the 737-MAX crashes occurred many frequent travelers, including myself, flat out refused to fly 737-MAX even after we were given assurances by the regulatory bodies. But after a while it just didn't matter. Life goes on, your company will book you on the plane that's the cheapest or part of their plan or whatnot, and you just get stuck being a cog in the wheel again.

stillwithit
0 replies
20h46m

And tax payer has to foot the ever growing bill…

You might be put at ease to read all that debt is a hallucination humanity has no obligation to pay.

Also after decades in IT hearing about one lapse in security after another (including entire iron mountain trucks being robbed back in the day) yet society seems capable of shrugging them off, it’s hard to take the anxiety seriously.

It’s possible the CEOs are not the only people in IT inflating the value of their contributions and ideas.

newswasboring
0 replies
21h4m

This attack originated from an acquired company by Boeing. No outsourced party seems to be involved. Am I missing something in the article?

barbazoo
0 replies
20h42m

Are there any signs to suggest that this was being made possible by "low quality outsourced" work?

CatWChainsaw
0 replies
20h54m

"digital transformation" was such a hot buzzword too, and yet the biggest market players don't want to spend enough to ensure it goes well, apparently.

ars
9 replies
21h5m

The US should make it illegal to pay ransom, with a penalty of prison for anyone paying a ransom or authorizing payment.

The purpose of the law is that now ransomware gangs will be less likely to target US companies because companies are unlikely to risk paying them.

ironmagma
4 replies
20h58m

It's maybe already illegal[1][2].

That doesn't stop companies from paying for it. If you're a hospital, you're weighing breaking the letter of the law with killing a bunch of people.

[1] https://www.gma-cpa.com/technology-blog/paying-ransom-on-a-r...

[2] https://cbs12.com/news/cbs12-news-i-team/hospital-ransomware...

gregwebs
2 replies
20h14m

Paying ransomware is not in any way illegal in the United States. Making payments to sanctioned entities (ransomware or otherwise) is. If companies go to their insurer, etc, they will probably get help to do the compliance to check to see if the payment requested would go to an OFAC sanctioned entity or not.

bee_rider
1 replies
20h9m

Is the duty to make sure you know you aren’t paying to a sanctioned entity, or is it to not know whether or not you are?

Given the sources of many of these attacks, one should reasonably assume they are likely to be doing business with a sanctioned entity, right?

gregwebs
0 replies
18h45m

There isn't necessarily a way to know who you are actually dealing with. Maybe in some cases there might be some information to figure this out to some degree. But normally the only information that is certain is where the payment is going. Which is just a bitcoin wallet address.

bee_rider
0 replies
20h11m

If you aren’t a hospital, you are helping the ransomware gangs amortize the cost of their R&D. Thus directly helping those who hit hospitals, and, as a result, contributing to those deaths.

ploum
1 replies
20h45m

— If you don’t give me 10k$, I will tell the authorities that you have paid a ransom of 100k$. — Ok, here’s the money. — Thanks. If you don’t give me 10k$ more, I will tell the authorities about our previous deal.

M3L0NM4N
0 replies
10h14m

That's stupid. If you don't actually pay them, there would be no evidence of you paying them. Their case would hold absolutely no water.

smith7018
0 replies
20h6m

There are instances where that doesn't make sense. For example, there was that plastic surgery office that got hacked a couple weeks ago. I get why they think it's better to at least try to prevent such private information from getting out. making it illegal to pay the ransom means that every patients' medical history and pre/post op photos would be leaked. That's a nightmare.

phpisthebest
0 replies
20h41m

No I did not pay a ransom, I paid a 7 figure consulting fee to a cyber security company not based in the US, who somehow magically resolved the issue for us...

incahoots
8 replies
19h10m

I'm at an en-passe here, on the one hand I think Boeing sucks as it's primary business is now hyper focused for defense purposes. On the other, ransomware generally hurts companies and municipalities that generally don't deserve it.

Boeing, Lockheed Martin, Facebook, etc...deserve it

justrealist
5 replies
19h3m

Boeing sucks as it's primary business is now hyper focused for defense purposes

This is a childish 2000s take. The world is rougher, Pax Americana is over, we need effective defense contractors because the world is full of assholes. Grow up.

mach5
3 replies
18h58m

its rougher because of america, not in spite of it. its a self-reinforcing feedback loop. implying you are the grown up in the room because you are 'realist' about this or whatever is a classic dimwit take.

justrealist
1 replies
18h52m

Let me guess, Russia invaded Ukraine to eradicate the US biolabs breeding nazi GMO mosquitos.

mach5
0 replies
17h30m

no and also i just noticed you have “realist” in your username, i didn’t even do that on purpose, lmao bozo

cscurmudgeon
0 replies
18h38m

Yep, so true. Before 1776 there were no wars and the world was deaf due to sound overload from globally synchronized Khumbaya singing.

phpisthebest
0 replies
18h41m

No this is a very 2023 take, everything has to be looked at from the lens of the Oppressor vs oppressed narrative, and since America, the great satan, is always the "oppressor", America is always bad and must be opposed

Any company that helps support America is also bad and most be opposed

Any person that that does not view America as bad is a bigot alt-right extremist and must be opposed

That is the state of politics for 2023, and anyone born after the year 1990 or so

zogrodea
0 replies
9h23m

Thank you for making this comment. I completely agree that Boeing and Lockheed suck. They are some of the most immoral companies in the world and I'm happy for any damage done to them, but I didn't see anyone else comment their dislike of these companies in this thread which concerned me.

verandaguy
0 replies
19h7m

Nit: it’s an impasse, not an en-passe.

freedude
8 replies
19h35m

45GB of data could be like a dozen employees' or less Outlook PST files. For this to be astounding we would need to know the quality of the data. Otherwise it is a bunch of hype and hoopla.

anitil
3 replies
18h17m

I'm not sure about the legality and ethics of training models on stolen data, but for reference, but so far as I can tell the Enron email data set is about 1.5GB (much lower than I expected to be honest!).

And I believe some of the more interesting things found in that data set (outside of the fraud) were people cheating on their partners.

https://www.kaggle.com/datasets/wcukierski/enron-email-datas...

primax
1 replies
18h15m

Sure, but that was leaked in 2004. A very different time for email, and where attachments were generally smaller.

jmalicki
0 replies
17h49m

The Enron dataset was not leaked - it was made public by the US government as evidence from an investigation by the Federal Energy Regulatory Commission.

https://www.ferc.gov/electric/industry-activities/addressing...

justsocrateasin
0 replies
18h15m

I do believe that 1.5GB is tarred and gzipped though, so it is a fair bit bigger. That's also supposedly half a million emails, so 45gb is quite a bit.

seventytwo
0 replies
12h21m

I was just gonna say, there’s probably single CFD simulation files that are larger than 45GB.

justinclift
0 replies
11h45m

Could be the porn stash of the Boeing directors. That could make some of them pretty nervous. ;)

campbel
0 replies
19h4m

You better pay up or we'll delete all of Marge and Victors email backups!

JCharante
0 replies
4h3m

or it could be a single finite element analysis file

carabiner
8 replies
20h53m

When Boeing can't match the salaries of Seattle tech companies, this is what happens.

klyrs
6 replies
20h44m

Speaking as a native Seattleite with multiple friends and family at the company, Boeing stopped being a Seattle company in 1997.

jmbwell
4 replies
20h24m

TIL: Although Boeing still has manufacturing facilities in the Seattle area, they moved their HQ from Seattle to Chicago in 1997.

klyrs
2 replies
20h16m

To rephrase: As McDonnell Douglas was crumpling under the ineptitude of its management, Boeing merged with McDonnell Douglas, keeping Boeing's name and McDonnell Douglas's management.

massysett
1 replies
20h2m

The classic joke here is that McDonnell Douglas bought Boeing with Boeing's money.

voxadam
0 replies
8h15m

Welcome to McBoeing, would you like fries with that?

I really wish I could find the McBoeing stickers I was given when I worked as an outside contractor during the time of the merger. The stickers weren't standard issue swag but rather made by a frustrated employee, that said they were a common sight on toolboxes at various plants.

I worked installing, qualifying, training on the use, and maintaining CNC machine tools in many shops spread across multiple plants. The folks in the shops where I worked were seriously displeased about the merger. Many of the people I had the pleasure working with had decades of service under their belts and were worried what would come of the combined company. It turns out their fears were entirely valid, though, I suppose most of them retired years ago and are enjoying their pensions.

carabiner
0 replies
20h11m

Moved HQ from Chicago to DC area last year.

Cacti
0 replies
14h5m

Man, that was 25 years ago. Time to move on.

1-6
0 replies
19h34m

Sounds like the future of Tesla / SpacefleetX

kramerger
5 replies
20h48m

Is there anything "useful" in this dump?

The article mentions citrix and emails, but that could be anything

steponlego
3 replies
18h23m

Now that it's out there somebody will doubtless download it and check it out eventually. Stuff that goes onto the Internet rarely goes away.

jacquesm
2 replies
18h2m

Except when you want to preserve it.

Gigablah
1 replies
15h11m

There should be a law for this. (Law as in Murphy’s law)

ttrrooppeerr
0 replies
5h26m

Jacques's Law

dmix
0 replies
20h4m

Useful to whom? Email dumps and other data could be useful for further breaches and attacks against personnel. I'm sure their infosec will be going through everything but they could miss stuff and personal information is exploitable for fraud even with awareness.

Govs like China and aircraft/defense competitors to Boeing probably got a goldmine if they didn't already have their own access. Boeing does plenty of NATSEC and space stuff.

gehwartzen
4 replies
11h5m

Out of curiosity how do you guys mentally interpret the data size when reading about a hack/leak story? 45GB? Do you think 10s of millions of text files? A few DVD rips? a server backup?

It seems so useless but is always portrayed as the "wow look at that number!" part of any leak/hack story

hadlock
1 replies
10h46m

At one Very Corporate job I had, there was a file share that somehow had never been culled, had a bunch of coworkers (current and previous) vacation photos, even a couple episodes of seinfield and I think the movie Die Hard. This was pre-snowden and the ripped videos were very pre-snowden. This share was like 8 or 9gb. Two or three .ISOs from a POC (proof of concept) with a vendor could easily push it over 16gb. If they compromised the share the marketing department kept their 2006 era .wma files of the company team building activity from That One Time it might result in not a lot of actual text files. I've had my gmail account for almost as long as you've been able to have one (almost 19 years?) and I've only managed to accrue 17GB in that time.

offices
0 replies
6h42m

Comparing my personal email account with my work email account, the latter has a lot more 'waste'. An email for every meeting, daily office grumblings, JIRA spam, CI spam, etc. And most of these also apply to aerospace engineers. 45 GB is nothing.

vidarh
0 replies
8h49m

4x my current inbox, accumulated over 2 years since I moved providers.

45GB and a a lot of it's just text. If it includes documents, it could be next to nothing.

riffraff
0 replies
9h46m

"three times my Gmail inbox accumulated in about 20 years"

Xcelerate
1 replies
6h0m

The government should just make it illegal for companies to pay ransomware groups. There, now the ransomware business model evaporates and companies have to actually focus on security rather than hoping they can pay their way out of a potential problem. It’s short-term pain for society in exchange for a better long-term solution.

PhilipRoman
0 replies
1h56m

I believe circumvention of such measures is already common, companies hire expensive "experts" and "consultants" who just quietly pay the ransomware group.

worthless-trash
0 replies
15h14m

I have grown respect for boeing after not paying this.

workfromspace
0 replies
8h22m
runeks
0 replies
7h55m

New security-through-obscurity tactic: make sure to automatically send lots of fake emails between employees, containing importantly-sounding words such as "classified", "secret" and "important" — with some identifying characteristic that makes the employees' email clients ignore them.

Then an email dump of 45 GB of useful information could instead be 4.5 TB (with 1% useful information), and wading through all the non-information to find something useful will not be worth the time of the adversary. The more important information you have in emails the more you need to increase the misinformation-to-information ratio.

pcurve
0 replies
15h56m

The market seems to think this is inconsequential.

newuser94303
0 replies
15h31m

The bigger problem for Boeing will be that they probably have fraud evidence in the 45G.

monkeydust
0 replies
10h5m

LLM training fodder?

m3kw9
0 replies
14h4m

lol no sht man, pay up and they’d still sell it behind their backs. Someone always have a copy

gist
0 replies
18h36m

A writer contacted me about my thoughts (unrelated and separate from this event) about how the disclosure of vulnerabilities and methods of hacking (of all types and in almost all situations) aids bad actors vs. helps companies protect their systems (by knowing vulnerabilities that are often so obscure they would reasonably never be exploited).

Point is what is the upside of disclosure (I think) vs. the downside. Nobody is suggesting no disclosure but the writer seemed to think that the security industrial complex has lawmakers believing that everything should be open and there should be constant white hat hacking which seems to feed and benefit the security industry.

I am curious if anyone has a thought on this topic.

extheat
0 replies
13h14m

The best way to mitigate attacks like this is simple: don't hold the data in the first place. Beyond that, encrypting and limiting who has access to what, and logging who opens what when makes it much harder for attacks like these to go under the radar. Obviously, not every company is Google and having super sophisticated security practices is both hard to do from an engineering standpoint (requires lots of infra) _and_ requires staff to have a security focused mindset. This is not something a lot of places have, not even tech companies by trade. The cost benefit analysis isn't high, so you end up with orgs that do things akin to dumping all corporate code into one Github account and then wonder how things went wrong when something bad happens.

Boeing Co, as a government contractor being hacked is obviously more concerning than a breach at $x company. It's a shame. I'd say this is a learning opportunity, but it likely won't be. Onto the next round of "cybersecurity" speak...

chakintosh
0 replies
6h52m

I wonder if anything here is related to the MCAS disasters

augustulus
0 replies
19h35m

we should be careful making the assumption that this is all the data they exfiltrated. this could easily just be the first tranche to prove that they’re serious

Spk-17kek
0 replies
16h47m

What if it is false information to harm opportunists?

2OEH8eoCRo0
0 replies
21h14m

Being a Russian-linked cyber gang, anything sensitive in there should be treated as public information now anyway. Why bother paying then?

1-6
0 replies
19h53m

The moment a company pays good money, that legitimizes the hacking group and emboldens them to keep going. You can’t trust that they’ll not leak even after they get paid.