Vegas casinos are still reeling from a cyberattack

https://www.fastcompany.com/90954120/vegas-casinos-are-still-reeling-from-a-massive-cyberattack

by Hary06 • 3 years ago

64 47 3 years ago

fastcompany.com

bell-cot• 3 years ago

"I rob banks because that's where the money is."

(attributed to bank robber Willie Sutton)

bookofjoe• 3 years ago

Interesting to me how quickly casinos ponied up ransom money compared to refusal by hospitals etc.

tcbawo• 3 years ago

Casinos — more than anyone — understand the cost for disrupting their revenue streams. There is also the possibility of damaging future revenue streams if they take much of a reputational hit. They have all probably anticipated such an event and are prepared to negotiate and act quickly.

prng2021• 3 years ago

Then how do you explain MGM not negotiating and acting quickly?

ozaark• 3 years ago

As far as reputation goes it looks like Caesars paid the $10m ransom after having the loyalty member db exposed with drivers licenses and social security numbers. They also have no real guarantee the data stolen will be deleted.

Still might be better for them being a "quiet" incident as opposed to disrupting operations like mgm.

tracerbulletx• 3 years ago

I think more than that, they wouldn't want to embarrass their whales by having data leak on them like the amount that they lose every year.

TechBro8615• 3 years ago

Yeah, rather than take a reputational hit, they've now got a reputation for paying ransoms to hackers. They will now be targeted by more hackers wanting ransoms.

fbdab1032• 3 years ago

Casinos are a luxury vice where participation is optional. Hospitals are a necessity of society who know that they will be supported by the government if required. I also believe it is technically illegal to pay the ransom, and given the tight connection between hospitals and government, may have more red-tape to sign off on such an action.

dehrmann• 3 years ago

Hospitals can also shame the criminal organization better. Shutting down hospitals gets more eyes on you, and as criminals, you don't want that. I'm sure MGM is a major political donor, but most people don't have much sympathy for them in this case, either.

tetrep• 3 years ago

My understanding is that a small minority of a casino's users are responsible for the bulk of their revenue and if you take a small leap of faith and assume that many or most of that subset of users are gambling addicts, you can see how a casino might be heavily incentivized to need to be operational again quickly before their addicts seek a new source of gambling.

woobar3• 3 years ago

Bulk of their revenue comes from non-gambling. 69.8% of casinos revenue is non-gambling. [1] For gambling revenue, slots are responsible for 67%. [2] I doubt that it is a small minority that is gambling away at thousands and thousands of the slot machines.

[1] https://igamingbusiness.com/casino/more-bullishness-for-las-...

[2]https://www.forbes.com/sites/willyakowicz/2023/02/01/nevada-...

toyg• 3 years ago

Whales are important, but I expect most Vegas casinos rely on income from the masses. Otherwise they wouldn't be as big as they are.

pengaru• 3 years ago

Interesting to me how quickly casinos ponied up ransom money compared to refusal by hospitals etc.

"easy come, easy go"

RcouF1uZ4gsC• 3 years ago

That’s because the mafia behind the casinos is already assembling hit teams to go make an example of these hackers.

ohdannyboy2• 3 years ago

What are you basing this on other than Hollywood movies? Was an example made of the Caesars Palace hackers?

instagib• 3 years ago

In the article, yet another leak notification as well. Maybe we’ll see how much data casinos really have on us.

Caesars was hacked a month ago.

>Caesars told the SEC it had “determined that the unauthorized actor acquired a copy of, among other data, our loyalty program database, which includes driver’s license numbers and/or social security numbers.

s17n2• 3 years ago

It's crazy to me that paying ransoms is legal.

thatguy09002• 3 years ago

If it's illegal then companies will still pay ransoms, just quietly and the feds don't get any chances to investigate it.

russdill• 3 years ago

And bonus double hit. After payment, blackmail

s17n2• 3 years ago

I doubt it, especially if you make the executives personally liable. There are lots of other profitable things that companies generally don't do because they are illegal.

toobeary• 3 years ago

Such clear Game theory. If nobody pays ransom, the group suffers less over all. But targeted individuals suffer greatly. Targeted individuals have a high incentive to pay, which encourages more attacks on the group.

A previous company I worked for took the “high road”. Mostly cause the CIO was a delusional psychopath. She refused to pay the mere 1 mil ransom. Told the CEO the disaster recovery systems would bring the company back online in a few hours (everybody, except her apparently, knew the DR system was a total joke). Hackers wiped the encrypted drives of every machine in the company and said good day.

4 weeks later they had the website, basic email and server operations functioning again. 3 months later they had restored business continuity more or less.

She was fired a week after that.

I’m guessing it cost the company 10’s if not over 100 million.

gmonk• 3 years ago

It's a gray area - most big companies will get cybersecurity insurance - Then the insurance company pays the ransom (assuming your policy covers it.). When working at a Small Cap financial services company, our policy cost north of $2MM a year.

skilled3• 3 years ago

I should have stayed in the trenches in the 2000s and waited until Satoshi releases Bitcoin which makes all of this possible. But I didn’t.

A lot of what was happening back then compared to today is just such a stark difference. The kind of attack vectors I was chasing myself are now so obsolete that most of these gangs will just give you that info for free… I mean holy shit… you can just load up Tor and go download terabytes of information in any industry imaginable. Free of charge. No need to spend endless weeks or months planning out the perfect attack (although that process is rewarding in its own way) …

This year has been huge for ransomware attacks, how long until one of the major FAANG companies get toppled over?

beebmam• 3 years ago

Unlikely. Startups are way easier to attack than big tech.

devwastaken• 3 years ago

Big tech has a significantly larger and more lucrative attack surface. Do not mistake size for competency.

thedougd• 3 years ago

I've found it darn near impossible to successfully download any large dump via Tor because of the low bandwidth and interruptions.

fragmede3• 3 years ago

If they were, how much do you think they'd pay for it to not leak to the public? (which is illegal, but that doesn't stop corporations from acting that way). If, say, Netflix got hacked (not ransomware, but user+credit card db dumped) but they paid to hush it up, how would we know? If the thieves were smart, they wouldn't use all of that dump simultaneously, so it couldn't be correlated.

skilled3• 3 years ago

For sure. I mean who knows how many big corps have been owned that we don’t know about. I suppose if you dump something like Gmail users, hypothetically, then there is no way Google wouldn’t cough up the money.

But by the looks of it a lot of these groups are after specific targets, for example - chipmakers. No way they want their secrets out in the public so they’ll happily pay up, especially if they are from places outside of the US.

I sometimes see on my Twitter feed, alerts of big Bitcoin transactions that are never disclosed publicly but are associated with well known laundering networks.

mighmi• 3 years ago

load up Tor and go download terabytes of information in any industry imaginable

How do you find any of it?

skilled3• 3 years ago

I don’t want to endorse this practice at all but because it is public knowledge,

https://ransomwatch.telemetry.ltd/#/recentposts

I trust you will be able to figure out the rest.

rudolfwinestock• 3 years ago

On July 2013, Robert X. Cringely wrote an article on a Def Con crackers' conference that took place in Las Vegas.

https://www.cringely.com/2013/07/30/the-origins-of-defcon/

The events in that article took place in 1993. Read the whole article, but here's the best bit.

Hotel security had mistakenly kicked out attendees at that conference, so they decided to get revenge by hacking their system. The is from Cringely:

***

The meeting reconvened at 9 or 10 with the topic suddenly changed to Revenge on the Sands. Gail Thackeray, then a U. S. Attorney from Arizona who at that moment had approximately half the room under indictment, rose to offer her services representing the kids against the hotel management.

Thackeray had been invited to speak by the very people she wanted to put in jail. I told you this was surreal.

Adult assistance might be nice, but a potentially more satisfying alternative was offered by a group that had breached the hotel phone system, gained access to the computer network, obtained root level access to the VAX minicomputer that ran the Sands casino, and were ready at any moment to shut the sucker down. It came to a vote: accept Thackeray’s offer of assistance or shut down the casino.

There was no real contest: they voted to nuke the casino. Not one to be a party pooper, I voted with the majority.

Gail Thackeray, feeling her lawyer’s oats, was perfectly willing to be a party pooper, though. She explained with remarkable patience that opting en masse to commit a felony was a move that we might just want to reconsider, especially given the three strikes implications for some of the older participants.

We could accept her help or accept a date with the FBI that afternoon. The Sands (now the Venetian), which was ironically owned by the same folks who used to run Comdex, never knew how close it came to being dark.

It was a thrilling moment like you’d never see today. Everyone who was in that room shares a pirates’ bond. And though I can’t defend what we almost did, I don’t regret it.

And like the others, I wish Gail Thackeray had stayed in Arizona and we’d shut the sucker down.

linsomniac• 3 years ago

I'm curious to see if this most recent Def Con will be the last one allowed in Vegas...

birdyrooster2• 3 years ago

I hope so, I hate going to the hottest spot in the US every year. This year Toxic BBQ was acceptable in terms of heat but other years has been miserable. I would love a more outdoor friendly hacker conference. I’m so tired of Vegas. I know Toor Camp exists but we need so much more.

fragmede3• 3 years ago

Off the top of my head, there's also LayerOne, RSA, and SchmooCon. (BlackHat doesn't count)

Vegas casinos are still reeling from a cyberattack

Related Stories