Schneier on Security

Clive Robinson • January 25, 2022 11:09 AM

@ Bruce,

Merck argued that the attack was not “an official state action,” which I’m surprised wasn’t successfully disputed.

I’m not.

As I say from time to time “show the court admissable evidence?”

I know civil court proceadings have lamentable evedentiary standards, but…

It is argued that NotPetya was used against the Ukraine, as part of Russian attacks. But was it the Russia state? Probably not evidence at the time suggested it was “criminal Ransomware” that had bern “improved” but by whom? And why?

No one has yet provided actual evidence, just at best “association” claims that have not been substantiated.

Also somwthing everyone tends to forget is that NotPetya spread back to Russia, striking the state oil company Rosneft and similar quite hard.

Most state level agencies/actors usually take quite a bit of care not to “shoot themselves in the foot”.

The fall out from that, with regards malware comming from Russia was the criminals started putting detection methods in to ensure they were not attacking Russian computers.

Suggesting that Putin “put the word out” to those criminals acting under the protection of Russian Law.

And that’s the problem… The reality is that the software was not as far as we know to any evedentiary level, made by the Russian state, aquired by the Russian state or deployed by the Russian state. In fact evidence suggests it was a criminal gang “joining in the fun” or as a “favour”.

Yes the UK and US “attributed” it to Russia, but evidence was not forthcoming… In fact they appeared to be simply following a suggestion from the Ukraine,

https://www.bbc.com/news/technology-40442578

The important thing to note, is that much was made of the fact that rather than encrypt files it simply wiped the Master File Table. Thus it was a “wiper to destroy data” rather than “ransomware for money”. But wiping the MFT infact leaves the data intact and could with a little knowledge be recovered. But also milage was made on the fact it was FiveEyes malware” that was being used that had “escaped from the NSA”. So both the UK and US Governments were keen to distance themselves in any which way they could.

Then a year later,

“NotPetya malware attack: Chaos but not cyber warfare”

Was the effective finding of global cyber insurance and risk-management firm Marsh. In a the report they published thay indicated, that

“NotPetya doesn’t meet the requirements to be classed as cyber warfare because the main impacts were only economic, focused on civilian infrastructure and that the goal of the attack wasn’t ‘coercion or conquest’.”

https://www.marsh.com/us/insights/research/notpetya-was-not-cyber-war.html

So not something that is going to get argued to well in court even for 1.4billion…

Clive Robinson • January 25, 2022 7:26 PM

@ Dorothea, ALL,

The only part I’m surprised at is that this was done on summary judgement, which, as I understand, means the evidence was so weak and/or irrelevant that there wasn’t even a reason to hold a trial to consider it.

It’s a bit more complicated than that. A sumary judgment can be called for at any time during a proceeding often during the early stages when something becomes apparent that was not previously clear or considered by either party.

In this case it appears the judge decided that as the issuing agency had not changed the terms and conditions in the policy. Then they could not subsequently claim they ment something else when faced with a claim.

The question now as 1.4billion is on the line, is are the policy issuers going to be able to find grounds to appeal.

To things are almost certain,

1, That scratching noise you hear is lawyers rewriting policy terms that have been used for nearly a century.

2, With 1.4billion at stake on this case and potentially more on others, the lawyers of both sides will be burning the midnight oil for days to come.

In the past I’ve mentioned I thought cyber security insurance issued would be bad news, but for a different reason (though it could yet come to apply).

Ordinary “physical risks” like fire or burst pipe tend to be random in nature at the individual level, however they quickly “average out” so risk can be reasonably calculated over time.

Cyber attacks however are not in anyway random that averages over time in human terms. A bad news worm will hit thousands at the same time, not over a long period of time of weeks, months or decades.

The way insurance works traditionaly they are not set up for this kind of “break the bank” risk…

Clive Robinson • February 2, 2022 11:41 AM

@ ResearcherZero,

Any evidence is a state secret.

Which is the making of a punch line of a political joke (of whom we have to many in power currently).

But seriously though,

1, Whilst “secret evidence” may be a “secret”.
2, It is not “evidence” in the expected manner of a court proceading…

If the US want to play stupid games, then they ought not sully the name of their legal system whilst doing so…

There is a reason over a thousand years ago why evidence had to be presented infront of a “tribunal of peers”, and independent adudicator. That reason has not become any the less in that time, in fact rather more.