The article is unclear: Do they "attack" the GenX managers and encrypt their stuff, or do they simply contact GenX managers in order to get paid faster?
In that case, the managers aren't "victims" and aren't "attacked", that would be the company..
If the article was written by an actual human, we may have had the answer. Instead, we got this non-sense
> By the time the ransom note lands, the crooks may already know who approves invoices, who signs contracts, who runs HR, and who reports to whom. The encryption is just the bit that victims notice.
I'm unclear what part of that sentence you didn't like, it was quite well formed. It's pointing out that the attackers do homework in advance and understand the victim company they target. It's illustrating the asymmetric information aspect of the attack, it's targeted with a lot of pre-work rather than a random victim.
Because this sentence is "well formed" but meaningless. Most of the things mentioned is not sensitive or even private data for a company, and some (eg "who runs HR") are probably available in the public internet. Most is findable/guessable even without data from breaches. The breaching/encryption part is not what people "notice", it is the whole point of the whole operation, and without it the rest is not a threat. You cannot contrast finding publicly available info in the internet with losing access to data. And it still did not answer if this info is used in the attacks or for contacting for the ransom, as the article mixes these 2 all the time. The whole article is a mess, and it is not because I am GenX (I am not) or sth.
Is not saying that this info is private or difficult to obtain. The paragraph is claiming that the criminals studied the victim first to launch the ransom.
> Zscaler says they combine information from compromised systems with publicly available data to map reporting lines and identify the employees most likely to influence a company's response.
And commercially-available data: enterprise salespeople, for example, can buy this intel from data brokers (directly, or with layered services catering to sales funnels specifically).
It's another way that surveillance capitalism can be a national security threat against the US. You have countless US companies collectively mapping out people networks and assembling often intimate dossiers on individuals... and saving international organized crime and geopolitical adversaries a ton of work, which they might not have the resources to otherwise do.
They've learned from how real businesses operate. Ever talked to a salesperson? Notice how much the initial conversation is geared to trying to figure out whether you have any real purchasing authority, and who does if it isn't you?
They ask something along the lines of “What does the process look like on your end” to figure out who makes the technical, legal, executive and financial decisions.
Because often in larger companies you got approval, then you go testing and the users approve as well, and suddenly either legal, finance or your manager pulls back. So they want these people in the loop and signing off as early or quickly as possible, to avoid wasting their time.
That’s also why the sales people usually state how important it is to have clear small and measurable goals. It’s not only for you to figure out if the solution works, but to have you set up small and clear internal criteria to sign off on as quickly as possible.
They pretty much just ask. "If there's an opportunity here, who makes the decision?" And they'll want to know if there's a technical decision maker and a financial one.
US consumers are more valuable which makes their data more valuable and therefore collected. It applies to other first world nations without robust enough data protections.
Companies hope that training will protect them from cyber threats, while ignoring that their most vulnerable employees are the ones that lost the motivation to care about their job.
Yes there would. It makes perfect sense to refresh one’s understanding. You’re within your right to be grumpy about doing training, but that’s not the same thing as there not being legitimate intent behind it, let alone it actually being a good idea overall. Not everything on earth is catered to you specifically.
Impressive how many people posting here love the gen [XYZ] categories and feel offended when they are not put in the correctly labeled drawer. ...Shouldn't we move on from this and obsess about something more fun?
The label unless you grew up in the Anglo sphere is also especially meaningless, yet certain people insist in labelling the rest of us :) I got to enjoy Phreaking well into the era most others already had ADSL…
> Xennials, also called Xillenials, are a social cohort encompassing people born on the cusp of or during the later years of Generation X and the early years of the Millennials generation.
> Many researchers and popular media use birth years from 1977 to 1983, though some extend this further in either direction. Xennials are described as having had an analog childhood and a digital young adulthood.
Depends a lot on your background. I was online in 1994 as a kid, but my peers weren’t until nearer 1999. Same age. We all got mobile phones when we went to university in sep 2000
> Xennials are described as having had an analog childhood and a digital young adulthood.
Pretty bang on description actually. As a 46 yo, sometimes I can't believe I have actual memories of using a rotary phone, or when my family first got a microwave or even VHS recorder. Yet I do. Feels like eons ago.
People on the borderlines often are overlooked. I'm an old GenX, a few years too young to be a Boomer, and even the younger Boomers grew up with a quite different experience than the mainline Boomer generation. And I was already an adult and married by the main part of the GenX era.
Precise boundaries are clearly problematic but you can’t claim that someone born in the late 60s had the same type of global view that someone born in the late 80s did.
I'm slightly younger than that, but certainly shared parts of their experiences. Closer to Jones than Boomer for sure. And my father was too young for WWII and too old for Vietnam so I have no direct ties to either of those experiences.
The article is unclear: Do they "attack" the GenX managers and encrypt their stuff, or do they simply contact GenX managers in order to get paid faster?
In that case, the managers aren't "victims" and aren't "attacked", that would be the company..
If the article was written by an actual human, we may have had the answer. Instead, we got this non-sense
> By the time the ransom note lands, the crooks may already know who approves invoices, who signs contracts, who runs HR, and who reports to whom. The encryption is just the bit that victims notice.
I'm unclear what part of that sentence you didn't like, it was quite well formed. It's pointing out that the attackers do homework in advance and understand the victim company they target. It's illustrating the asymmetric information aspect of the attack, it's targeted with a lot of pre-work rather than a random victim.
Because this sentence is "well formed" but meaningless. Most of the things mentioned is not sensitive or even private data for a company, and some (eg "who runs HR") are probably available in the public internet. Most is findable/guessable even without data from breaches. The breaching/encryption part is not what people "notice", it is the whole point of the whole operation, and without it the rest is not a threat. You cannot contrast finding publicly available info in the internet with losing access to data. And it still did not answer if this info is used in the attacks or for contacting for the ransom, as the article mixes these 2 all the time. The whole article is a mess, and it is not because I am GenX (I am not) or sth.
Is not saying that this info is private or difficult to obtain. The paragraph is claiming that the criminals studied the victim first to launch the ransom.
“By the time … lands”
“The crooks…”
”… is just the bit…”
LLM tells.
But LLMs talk like that because people talk like that. The Register regularly uses the work "crooks".
> Zscaler says they combine information from compromised systems with publicly available data to map reporting lines and identify the employees most likely to influence a company's response.
And commercially-available data: enterprise salespeople, for example, can buy this intel from data brokers (directly, or with layered services catering to sales funnels specifically).
It's another way that surveillance capitalism can be a national security threat against the US. You have countless US companies collectively mapping out people networks and assembling often intimate dossiers on individuals... and saving international organized crime and geopolitical adversaries a ton of work, which they might not have the resources to otherwise do.
They've learned from how real businesses operate. Ever talked to a salesperson? Notice how much the initial conversation is geared to trying to figure out whether you have any real purchasing authority, and who does if it isn't you?
I have never talked to sales. How do they find this out smoothly, without insulting the person being talked to for not having any actual authority?
They ask something along the lines of “What does the process look like on your end” to figure out who makes the technical, legal, executive and financial decisions.
Because often in larger companies you got approval, then you go testing and the users approve as well, and suddenly either legal, finance or your manager pulls back. So they want these people in the loop and signing off as early or quickly as possible, to avoid wasting their time.
That’s also why the sales people usually state how important it is to have clear small and measurable goals. It’s not only for you to figure out if the solution works, but to have you set up small and clear internal criteria to sign off on as quickly as possible.
They pretty much just ask. "If there's an opportunity here, who makes the decision?" And they'll want to know if there's a technical decision maker and a financial one.
So why is this only a threat to US companies and not for businesses in other parts of the world?
US consumers are more valuable which makes their data more valuable and therefore collected. It applies to other first world nations without robust enough data protections.
Companies hope that training will protect them from cyber threats, while ignoring that their most vulnerable employees are the ones that lost the motivation to care about their job.
Training is basically just for legal and insurance reasons... If not there would be no reason to do yearly training of the same bs courses.
Yes there would. It makes perfect sense to refresh one’s understanding. You’re within your right to be grumpy about doing training, but that’s not the same thing as there not being legitimate intent behind it, let alone it actually being a good idea overall. Not everything on earth is catered to you specifically.
Hey! As a 46 year old I am offended by this - I am definitely not Gen X. We’re a weird X/Millenial hybrid I’ve seen referred to as Xennials.
Also F ZScaler - we use this officially sanctioned MTM attack at work and all it does is make my job harder.
Impressive how many people posting here love the gen [XYZ] categories and feel offended when they are not put in the correctly labeled drawer. ...Shouldn't we move on from this and obsess about something more fun?
The label unless you grew up in the Anglo sphere is also especially meaningless, yet certain people insist in labelling the rest of us :) I got to enjoy Phreaking well into the era most others already had ADSL…
you were born in 1980 you are gen x https://en.wikipedia.org/wiki/Generation_X by definition.
But also:
> Xennials, also called Xillenials, are a social cohort encompassing people born on the cusp of or during the later years of Generation X and the early years of the Millennials generation.
> Many researchers and popular media use birth years from 1977 to 1983, though some extend this further in either direction. Xennials are described as having had an analog childhood and a digital young adulthood.
https://en.wikipedia.org/wiki/Xennials
Depends a lot on your background. I was online in 1994 as a kid, but my peers weren’t until nearer 1999. Same age. We all got mobile phones when we went to university in sep 2000
Yeah, I grew up in N. GA in a rural area and my family still had a rotary until the mid or late 90s. lol. No internet either
> Xennials are described as having had an analog childhood and a digital young adulthood.
Pretty bang on description actually. As a 46 yo, sometimes I can't believe I have actual memories of using a rotary phone, or when my family first got a microwave or even VHS recorder. Yet I do. Feels like eons ago.
I’m quite a bit younger and have the same experience.
I feel blessed for this actually. It’s like I lived 3 generations at once.
Can't be really strict with the dates, the generation thing is cultural and depends on the time and environment of your socialisation.
ngl as a 45 y.o. Gen Y i was not so surprised to read what stupid things 46 y.o. Gen X do
I am definitely more triggered by the mention of ZScaler than the Gen X scope creep
Yeah, by most definitions at least 50% of “40-somethings” are solidly millennial.
People on the borderlines often are overlooked. I'm an old GenX, a few years too young to be a Boomer, and even the younger Boomers grew up with a quite different experience than the mainline Boomer generation. And I was already an adult and married by the main part of the GenX era.
Dividing generations across decades might work for marketing to them in general, but it's otherwise about as useful as horoscopes and the BMI scale.
Duodecades are superior to decades, and we can take overlapping pairs of duodecades as "generations" to solve the dividing line problem.
Duodecades:
Overlapping generations:Precise boundaries are clearly problematic but you can’t claim that someone born in the late 60s had the same type of global view that someone born in the late 80s did.
The BMI scale is useful. Yes, athletes and bodybuilders it may not be accurate for, but being on HN I think you are neither :)
Currently, I am at 20 BMI, for reference.
I feel like looking at a photo to judge how fat they are is probably equally effective tbh. It is a rule of thumb at best.
You might be Generation Jones: https://en.wikipedia.org/wiki/Generation_Jones
I'm slightly younger than that, but certainly shared parts of their experiences. Closer to Jones than Boomer for sure. And my father was too young for WWII and too old for Vietnam so I have no direct ties to either of those experiences.
I believe the term is xennial: https://en.wikipedia.org/wiki/Xennials
Rare and intersectionally have an unfair advantage.
[dead]