Clive Robinson • August 10, 2017 3:29 AM

With regards,

As for blame, we should place it where it really lies: on the criminals who intentionally and maliciously assembled this destructive ransomware and released it on the world.

Much as people dislike it he is correct, in that,

I assume nobody forced those who wrote the ransomware to write it. That is it was they alone who deliberately and with forethought created the ransomware with an intent to commit a criminal act, or appear to so do[1].

So yes as a criminal act those who wrote the ransomware software are solely to blaim in the legal sense for what they chose to do with it.

What most people here are arguing about is what and whom knowingly or unknowingly contributed to the crime. Which is where you fall into Richard Ledgett’s argument logical trap.

Richard Ledgett is pulling a fast one on the security community and he is getting away with it. He has deliberatly focused on a criminal act and then used it to excuse other behaviour. It’s something that the better paid lawyers and polirical players do constantly.

So lets argue not as he does about the criminal act and who is legaly responsible for it, but more as crash investigators do that is to investigate and find those who knowingly or unknowibgly contributed to the state of affairs that allowed the criminals to commit their particular act of criminality.

From what we know in reverse order,

1, The NSA exploit was released.
2, The NSA exploit was obtained.
3, The NSA used the exploit.
4, The NSA developed the exploit.
5, The NSA chose to weaponise the vulnarability.
6, The NSA obtained the vulnarability.
7, The NSA set up a weponisation unit.
8, The NSA chose to manufacture cyber-weapons.
9, The NSA decided on offence not defence.

But for all that to be viable and happen we have to look at why step 6 was posible.

Put simply the software industry is predicated on churn. That is to produce software at the low price point it does, it needs to generate continous income by high volume sales. Thus the industry is focused on rapid development of product and incentivising people to spend a little money frequently. Part of that is removing from the development process anything that is unnecessary to that process.

As we know security is not something the general market has so far wanted to pay for.

It could be argued that those who chose other OS’s are doing so for security or other reasons. The biggest use of *nix is currently the Linux kernel and GNU software, tucked out of sight behind the Android front end. None of which is very secure as jail breaking and malware via applications is actively engaged in.

When you line up the commercial and FOSS OS’s on consumer level products you find that there is a general trend that indicates security is a low priority for end users. Similar trends show for applications.

Thus it’s going to be hard to argue against the observation that security is not something that people generaly want to put on their purchasing choices.

However as with the general perversity of humans, when something goes wrong they don’t wish to blaim themselves, “It has to be the other guy who’s to blaim” and “It’s the person to blaim that must make restitution”…

Yes there are a lot of people who are to blaim in very many ways so many in fact that we are nearly all to blaim. It is our patronage and money that sets the direction of the market. The market dynamically responds, thus we get what we pay for.

Unfortunatly there is a non linear effect in progress which is akin to the economic effect noticed and attributed to the English economist William Stanley Jevons. Known as the Jevons Paradox it dates back to 1865. It describes an effect technology has on a market that appears perverse. Jevons noted that as a fuel became more efficiently used due to improvments in technology the demand for the fuel would rise not fall. The reason is that the effective reduction in cost made it a more viable powersource than alternatives as well as making new processes viable. Thus economic activity increased and demand became higher.

Almost the entire ICT industry is now a similar economic paradox as well as showing other anomalies[2]. Which tends to suggest that the usual economic measures are not likely to work the way we might predict from other markets.

Thus we are left with the question of how to change an anomalous market for the better.

The answer is possibly to be found by market regulation and legislation.

As has been pointed out before the automobile market was undesirable and as a result we ended up with changes in legislation. Quite contrary to the usuall free market mantra the legislation moved the market into a different operating position. It stopped being what was a race to the bottom and became inovation led.

I suspect that the answer lies in “appropriate” market regulation legislation. However we have to be carefull what we wish for, most ICT legislation since the 1980’s has been entirely the wrong sort.

[1] The jury is still out on weather it realy was a ransomware attack or a cyber-weapon designed to look like ransomware. Because as many have pointed out both the software and ransom backend implementation was amaturish in nature, but very effective in attack.

[2] Another anomalous behaviour of the ICT market is the inherant “deflationary activity”. The usuall argument is that due to inflation the price of a “good” will rise with time. Thus it is better to buy now than later as you will get a given “good” at a lower price. The ICT market is different in that it has “price points” that remain more or less stable, however as time goes forwrds you get more for the price rather than less. Thus you have the argument that it is better to wait to buy as you will get more for your money. Simple economics would indicate that such a market would fail as nobody logically would buy today, thus there would be no income to sustain the market. The fact the ICT market survives and apparently thrives suggests that simple economics is missing something…

Clive Robinson • August 15, 2017 3:28 PM

@ Hahaha,

And as far as defense, I think almost every one of these threads leads to a single evolution of thought… custom encryption and screw the brickwall called Uncle Sam.

No some of the threads here go further, way further than that.

At the end of the day encryption custom or otherwise is vulnerable, very vulnerable when run on modern computer hardware.

People talk about how wonderful the latest encryption app is… But forget or don’t realise that the display and keyboard are in the plaintext space not the ciphertext space. Which in turn is inside the scope of the computer. So the encryption counts as nothing if they can get to the computer I/O via an “end run attack”. Any computer in “on-line mode” –connected to a communications channel of some form– is vulnerable to end run attacks. Even if it’s off-line when used for ciphering all computers have semi-mutable memory, be it the Hard Drive or the flash inside a SoC used for say part of an I/O device. Malware can hide there and “store and forward” plain text or KeyMat at some future time. Such as when the computer is used in on-line mode, or an “Evil Maid” or “Secret Squirrel technician” briefly have physical access. Think of it like one of those “key loggers” from the end of the last century.

It’s solving such issues that are where the real action is not custom encryption.

Clive Robinson • August 16, 2017 4:29 AM

@ Wael,

Perhaps @Clive Robinson would like to blow his cover?

Is that some veiled reference to a “Bean and Cabbage Supper”?