Servers Seized at Ukrainian Firm Where Petya Attack Began, Charges Considered

http://gizmodo.com/servers-seized-at-ukrainian-firm-where-petya-attack-beg-1796622607

by jacquesm • 9 years ago

71 23 9 years ago

dmix3• 9 years ago

Col. Serhiy Demydiuk, the head of Ukraine’s national Cyberpolice unit, has not accused anyone at MeDoc of being involved with the attack. He has said that the company was warned multiple times about potential security vulnerabilities in its systems. “They knew about it,” Demydiuk told the Associated Press. “They were told many times by various anti-virus firms... For this neglect, the people in this case will face criminal responsibility."

Criminal charges for not fixing known vulnerabilities? That's a risky road to travel down. Especially given the general state of infosec among various governments around the world and the offensive first mindset of their security agencies.

This sounds like the result of being pressured to appear to be doing something about a very public problem rather than using the justice system to set a meaningful precedent. Especially if enforcement is going to be arbitrarily based on only exceptionally bad cases.

People love to use the courts as a knee jerk reaction to every problem without considering more effective or efficient alternatives first.

ryanlol2• 9 years ago

Criminal charges for not fixing known vulnerabilities?

Why not? Incompetent vehicle operators regularly face criminal charges too.

dmix3• 9 years ago

So you'd like to have agencies set up to fine every company that gets hacked through 'known vulnerabilities'? Enforcing this arbitrarily after big hacks is hardly an equivalent analogy to enforcing traffic violations. It'd have to be consistent, well defined, and widely enforced to be at all effective.

To me this is an emotional reaction that has no regard for cause/effect.

bitmapbrother• 9 years ago

In that case Microsoft should have been brought up on charges a long time ago for releasing the world's most insecure OS.

Pica_soO• 9 years ago

this amounts to enforcing whatever the software vendor of choice wants to install on your drive. Taking the choice out of a update by law- without a counter law enforcing that at least two suppliers of choice exist - that is really sinister.

averagewall2• 9 years ago

Criminal negligence usually has to cause death or something serious like that. Not sure why it shouldn't be extended to causing other types of harm. In this case, it seems like they were warned they were putting their customers at risk and did it anyway. That seems much more serious than just having a bug.

mirimir2• 9 years ago

It's perhaps more relevant that vehicle manufacturers face criminal and civil liability for faulty products.

zzzcpan2• 9 years ago

"appear to be doing something about a very public problem"

Well, that's what authoritarian governments do. They also use raids to project their power and get loyalty from the police in return for ignoring all the corruption and extortion.

smitherfield• 9 years ago

Sounds more like corruption than authoritarianism - questionable criminal charges that go away for the right price. (Authoritarianism would be questionable prosecutions, rigidly enforced).

pabloski• 9 years ago

Stay safe man. The current "democratic" ukrainian junta...ehm government...doesn't like to be criticized.

You can go to jail because you speak russian in public. I suppose they will send you to Soros' mansion if you criticize them xD

theworldisweird• 9 years ago

That's a risky road to travel down.

Nobody said that when we invented the Internet, yet here we all are, tromping down this dusty dangerous road.

dagenleg• 9 years ago

knee jerk reaction to every problem without considering more effective or efficient alternatives first.

You just described the current state of Ukrainian government there.

mirimir2• 9 years ago

Sure, criminal charges might seem like overkill here. But then, we're looking at ubiquitous software, which had government approval.

Conversely, is it reasonable that software TOS can exclude all liability for damages? Vehicle manufacturers, for example, can't do that.

jaclaz• 9 years ago

Criminal charges for not fixing known vulnerabilities? That's a risky road to travel down.

It is a risky road, but I believe that something (not necessarily this, and certainly not "criminal" charges) needs to be done to make these firms have some responsability.

Instead of the road comparison, let's make another one, you have an electrician (certified/authorized/whatever) come to your house, enter it and replace a wall socket.

By mistake (not intentionally) he mis-wires something or doesn't notice that the wires insulation is not good and as soon as you insert a plug, the wires go on fire and the fire extends to your home.

Would you ask him to reimburse the damages?

I would guess yes, and most probably he has a suitable insurance to cover this (hopefully rare) cases.

Wouldn't this infection by malware be a similar form of malpractice by someone that should know what they are doing?

This is not the case of someone downloading a new phone ringer from some unknown site, it is a professional software firm that provdes tax software to an almost whole country that sends you an update.

us0r• 9 years ago

Microsoft has had a patch out for months now. Should Mr. Demydiuk also be charged for not running a simple windows update on government systems?

Servers Seized at Ukrainian Firm Where Petya Attack Began, Charges Considered

Related Stories