Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

https://www.nationalcrimeagency.gov.uk/news/retail-cyber-attacks-nca-arrest-four-for-attacks-on-m-s-co-op-and-harrods

by sandwichsphinx • 1 year ago

70 62 1 year ago

nationalcrimeagency.gov.uk

clort• 1 year ago

Little information there about them, but I find it kind of surprising that the suspects are even UK based..

beepboopboop• 1 year ago

Why is that surprising?

golan2• 1 year ago

I guess I’d expect them to be in a country where it’d be difficult to be apprehended and extradited. Being in the UK seems like a stupid move to me, but what do I know!

RainyDayTmrw• 1 year ago

Cybercrime is usually international, cross-border, because (1) it's all online anyways, and so it's approximately equally difficult from any country, and (2) to disincentivize your own local law enforcement from getting involved.

dboreham• 1 year ago

You have to buy underwear or prawn sandwiches in the UK to know M&S exists?

gluten_guardian• 1 year ago

Crazy how young all these cyber criminals are. When I was their age, the peak of my criminal career was scoring booze by lying about my age. I wish they shared a little bit on what cyberattacks they were conducting.

pekim• 1 year ago

I suspect that it is related to the M&S and Co-op attacks. https://www.bbc.co.uk/news/articles/cwykgrv374eo

MisterTea4• 1 year ago

Young people have little fear of repercussion as they cant really fathom the consequences. Either they learn from this misadventure or go on being a career criminal. All of this depends on their home lives.

scott_w10• 1 year ago

This simply isn’t true. Yes, teenagers are morons by the standard of a well adjusted 30 year old, but they’re more than capable of understanding consequences for their actions.

I hate to sound like my parents/grandparents but I absolutely knew that causing millions of pounds of damage and attempting to blackmail a major corporation could have huge negative consequences for people and myself at 17.

nkrisc• 1 year ago

Not sure I'd agree. I'm sure most people reading here at HN had some computer-related incident as a teenager that made them realize there could be real consequences goofing around with a computer. And I would guess of those that did, most heeded that warning.

miohtama2• 1 year ago

How bad your system be if it can be hacked by a kid?

socalgal2• 1 year ago

A kid can break all the windows in your house, smash in your door, set your house, car, bike, clothing on fire. I guess all those things are bad

I'm not saying the system wasn't poorly implemented but, society doesn't work when people abuse everything either. Maybe that just means we're doomed but most of society works because people don't go around smashing and/or taking everything they possibly can.

Aurornis2• 1 year ago

3/4 of them were over 18. The other was 17.

It’s also unclear if this was everyone, or just who they caught. It’s not unknown for hacking groups to position the youngest (least experienced, most desperate for recognition) people in the most vulnerable positions.

lyu072823• 1 year ago

Apparently they pretended to be an employee and the help desk reset the password for them. Once in the door, active directory imploded as usual, with full access they encrypted everything and demanded ransome.

Source: https://specopssoft.com/blog/marks-spencer-ransomware-active...

Hilift2• 1 year ago

Reminds me of Maersk. They had poor endpoint hygiene and no EDR. In 2017 about 90% of their infrastructure was wiped in less than one minute. They had to reinstall a lot of things due to backups weren't up to par. Usually level 1 merchants (> 6 million transactions per year) are put on an audit and improvement plan if this occurs. In the UK, there could be an investigation and penalty from the ICO for the data breach.

roywiggins• 1 year ago

They had to reinstall a lot of things due to backups weren't up to par.

"After a frantic search that entailed calling hundreds of IT admins in data centers around the world, Maersk’s desperate administrators finally found one lone surviving domain controller in a remote office—in Ghana. At some point before NotPetya struck, a blackout had knocked the Ghanaian machine offline, and the computer remained disconnected from the network. It thus contained the singular known copy of the company’s domain controller data left untouched by the malware—all thanks to a power outage... So the Maidenhead operation arranged for a kind of relay race: One staffer from the Ghana office flew to Nigeria to meet another Maersk employee in the airport to hand off the very precious hard drive. That staffer then boarded the six-and-a-half-hour flight to Heathrow, carrying the keystone of Maersk’s entire recovery process."

https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...

aaronrobinson• 1 year ago

This stinks of foreign sponsorship. I can see how they could pull off the social engineering but being able to work their way around a foreign system like they did - no way.

lyu072823• 1 year ago

Active directory has become an invaluable tool for ransome gangs, it not only gives them effortless root access on every system, but also documents the company structure so you can focus your resources. This isn't sophisticated at all.

casenmgreen• 1 year ago

Evil Tor used are blocked. Can't read site.

jancsika• 1 year ago

I only read sites that are written in Rust, and I can't load this one either.

Can someone post a String Literal for us, please?

golan2• 1 year ago

Related Reddit thread : https://www.reddit.com/r/cybersecurity/s/LXb88TKC4M

bargainbin• 1 year ago

This doesn’t surprise me. I work for a company that hires a substantial headcount from TCS, probably one of their biggest clients, and the quality of the work is astonishingly bad.

I’d recommend avoiding at all costs but we all know these companies are brought in by non-technical people.

toomuchtodo• 1 year ago

+1 from first hand experience with TCS

miohtama2• 1 year ago

In a proper capitalistic system, those who build low quality e-commerce services, including hackable ones, should go out of business and replace more competent companies. This includes buying services from bad suppliers.

This Reddit post hints that many shortcuts were taken, security not taken seriously when they should have, and now they reap what they sow.

skippyboxedhero• 1 year ago

There has been no reaping. MKS shares were largely unimpacted (despite this costing at least £300m). Management have tried to deflect, said this was a highly sophisticated attack, said that other firms had been hacked but just didn't report it, endless amounts of lying.

The reality is that decreasing costs is a far easier lever to pull than increasing revenue so managers will be heavily incentivised to do this if you give them profit-based incentives. This happens every few years with listed companies in the UK now, no-one ever changes their behaviour (retail, in particular, is ground zero for bluffers in the UK, managers are exceptionally bad, and even worse are comp committees that set targets that cannot be achieved without damaging long-term value).

There is no efficient market here. It is as simple as managers understanding the world we now live in, and that is unlikely because all these companies view IT as a cost and their managers are people who rotate through executive roles and politics despite leaving a flaming wreck in their wake. Things will stay the same.

immibis4• 1 year ago

In capitalism-as-explained-by-capitalists, that would happen. In actual capitalism, it would not.

lyu072823• 1 year ago

That's a very naive view of capitalism, there is nothing inherently preventing companies from being negligent in infosec no matter how "proper" that system is. Also wouldn't defunding the ICO make it more proper?

chrisweekly• 1 year ago

"go out of business and replace more competent companies"

... be replaced by more competent companies

helloooooooo• 1 year ago

They do. Security is about risk management. It’s all very actuarial. If the damages from an attack are severe enough (ie. a company makes it go bankrupt), that’s capitalism working.

Aurornis2• 1 year ago

In a proper capitalistic system, those who build low quality e-commerce services, including hackable ones, should go out of business

If the impact is large enough, they do.

This not a case where binary thinking works for most situations, though. The costs associated with the attack will hurt them by damaging their balance sheets a little bit, taking capital away from more productive opportunities, and distracting their employees from more fruitful tasks.

There’s always a public thirst for immediate blood in these situations, but the damage is more subtle and manifests more as opportunity cost than a sudden collapse of the company. The demand for sudden stock market collapse of companies is ironic, given all of the criticisms thrown at companies for putting too much emphasis on short term stock results.

mattigames• 1 year ago

"proper capitalist system" aka fantasy capitalism, an utopic capitalism that lacks operations/tasks where deceiving is cheaper than doing things correctly, yes I am one of those that don't believe that such thing is compatible with human nature.

SheinhardtWigCo• 1 year ago

In 3 of 4 calls, the service desk reset passwords and re-enrolled MFA with zero resistance. The caller simply gave a name – no validation, no callback, no check. On the 4th call, the attacker requested access to a privileged group. The TCS agent asked for an employee ID. The ID given didn’t even match our company’s format; and yet, the access was granted anyway.

Yikes

djaychela2• 1 year ago

A friend of mine is senior management at one of these companies. His life has been a real nightmare trying to get things back on track - there are so many interconnected systems that they needed to get back up 'clean' and running just to get their normal business running, let alone the online side. And he's not even directly responsible for any of this, but it's all so embedded in a modern retail business that if something like this happens it's your problem to deal with to a degree. The stress caused by this sort of thing is immense.

mtkd• 1 year ago

it's your problem to deal with to a degree

How is it not the responsibility of senior management at a major retailer to ensure an exploit at a vendor can't take the whole house of cards down?

Many other major enterprise clients out there are all over vendor security/compliance ... auditing and reauditing vendors to minimise chance of this happening or worst-case, if does happen, containing it and recoverying quickly

djaychela2• 1 year ago

How is it not the responsibility of senior management at a major retailer to ensure an exploit at a vendor can't take the whole house of cards down?

I think you may be misunderstanding their organisation layout - his job is entirely to do with the quality of the products that they offer (and he's very good at it). He's nothing to with sales or online or any of that, but part of the 'normal' retail chain that people would never think goes anywhere this stuff. But their systems were all taken out because of this.

devwastaken2• 1 year ago

Cyber crime does not exist. Only deficient systems intentionally designed to be exploited exist. if you want your “cyber infrastructure” to not be attacked, dont make it vulnerable. All tech is artificial, not of nature.

Require software to be developed by licensed engineers. no more offshoring. no more importing of cheap labor. make tech corps pay instead of acruing mass wealth. Make the corps pay when the vulnerabilities they put in it are exploited.

tsm• 1 year ago

Theft does not exist. Only deficient windows intentionally designed to be breakable exist. if you want your "personal possessions" to not be taken, dont make them vulnerable. <etc>

Yes, the companies involved should take some responsibility for terrible security practice (though I'm sure they wish this had never happened!) but victim-blaming doesn't justify crime.

devwastaken2• 1 year ago

More like if the store had the information of every customer sitting there for anyone to take. yes, theyre responsible for their negligence.

When you know its going to happen, and then it happens because you did nothing - yeah, its your fault.

cedws• 1 year ago

The focus will be on these teenagers but the real story is one of security negligence by these companies.

Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods

Related Stories