MGM losing up to $8.4M a day due to cyberattack, analyist says(reviewjournal.com)
reviewjournal.com
MGM losing up to $8.4M a day due to cyberattack, analyist says
https://www.reviewjournal.com/business/casinos-gaming/analyst-mgm-losing-4-2m-8-4m-a-day-because-of-cyberattack-2906379/
110 comments
This really feels like 1650's nautical piracy. Someone outside the reach of the law of the targeted country's merchants, making tons of money by theft and ransom. And like the pirates of old, often supported by the host nation so long as their attacks disrupt the activities of rivals nations' merchants.
Cyber privateering was mentioned like 10-12 years ago. Someone had a blog or similar referring to the 'Morgan doctrine'.
Edit: I found it. It looks more professionally edited and lengthy than when I first came across it in 2010(!).
Link: https://www.themorgandoctrine.com/2010/11/draft-01-cyber-pri...
The Cyber Privateer Code (draft 02—updated on 6/28/2013): - Any unauthorized attempt to access your computer or phish your data access privileges constitutes a crime punishable by the looting of the attacker's assets by an authorized cyber privateer. All assets. Within 6 months of the attack.
- If it is determined that the attacker is acting under explicit instructions from a larger organization or government, the assets of that organization or government are also forfeit to the extent that an authorized cyber privateer may confiscate them within a six month period of the original motivating attack. All assets.
- The individual whose assets were seized by a cyber privateer—or the publicly and legally designated spokesperson for the organization or government whose assets were seized by the cyber privateer—has the "right of parley" with the head of the cyber privateering organization, such meeting to take place online in a two-way video conference, such conference to be publicly recorded by one or both parties and before the disposition of the booty but no later than 10 days from the confiscation.
- Innocent victims whose assets are directly and mistakenly confiscated by cyber privateers (and whose funds are not returned within 10-days after the parley) shall be compensated in an amount equal to four times their loss, with interest accruing on the restitution amount at the rate of twelve percent per annum. This does not include victims of the cyber criminals, since they were already victimized.
- Notifications and requests for parley must be unambiguously left by the cyber privateer so as to allow the right of parley to be exercised in a timely fashion.
*These rules would of course lead to the worlds end in any significant conflict, imo. But it would certainly be fun for a minute.
Edit: I found it. It looks more professionally edited and lengthy than when I first came across it in 2010(!).
Link: https://www.themorgandoctrine.com/2010/11/draft-01-cyber-pri...
The Cyber Privateer Code (draft 02—updated on 6/28/2013): - Any unauthorized attempt to access your computer or phish your data access privileges constitutes a crime punishable by the looting of the attacker's assets by an authorized cyber privateer. All assets. Within 6 months of the attack.
- If it is determined that the attacker is acting under explicit instructions from a larger organization or government, the assets of that organization or government are also forfeit to the extent that an authorized cyber privateer may confiscate them within a six month period of the original motivating attack. All assets.
- The individual whose assets were seized by a cyber privateer—or the publicly and legally designated spokesperson for the organization or government whose assets were seized by the cyber privateer—has the "right of parley" with the head of the cyber privateering organization, such meeting to take place online in a two-way video conference, such conference to be publicly recorded by one or both parties and before the disposition of the booty but no later than 10 days from the confiscation.
- Innocent victims whose assets are directly and mistakenly confiscated by cyber privateers (and whose funds are not returned within 10-days after the parley) shall be compensated in an amount equal to four times their loss, with interest accruing on the restitution amount at the rate of twelve percent per annum. This does not include victims of the cyber criminals, since they were already victimized.
- Notifications and requests for parley must be unambiguously left by the cyber privateer so as to allow the right of parley to be exercised in a timely fashion.
*These rules would of course lead to the worlds end in any significant conflict, imo. But it would certainly be fun for a minute.
Many of us foresaw this (and much worse) when we first heard about Bitcoin in 2009-2011. Yes, Bitcoin has its anonymity issues, but cryptocurrencies in general is what typically enables this kind of crime.
Example:
https://www.bloomberg.com/news/articles/2023-09-13/caesars-e...
https://archive.ph/8BCDb
Caesars Entertainment Inc. paid tens of millions of dollars to hackers who broke into the company’s systems in recent weeks and threatened to release the company’s data, according to two people familiar with the matter.
Hacking gangs typically ask to be paid in cryptocurrency if they demand a ransom.
I don't want to live in a world with 100% anonymous and untraceable payments.
Example:
https://www.bloomberg.com/news/articles/2023-09-13/caesars-e...
https://archive.ph/8BCDb
Caesars Entertainment Inc. paid tens of millions of dollars to hackers who broke into the company’s systems in recent weeks and threatened to release the company’s data, according to two people familiar with the matter.
Hacking gangs typically ask to be paid in cryptocurrency if they demand a ransom.
I don't want to live in a world with 100% anonymous and untraceable payments.
> I don't want to live in a world with 100% anonymous and untraceable payments.
Cash is equally as capable of this, though. The hackers in this situation could demand cash and practically nothing would change about the technical aspects of their attack.
Cash is equally as capable of this, though. The hackers in this situation could demand cash and practically nothing would change about the technical aspects of their attack.
It's not.
They would have to travel from e.g. Russia to Las Vegas to pick up the cash though. Or, I suppose, demand delivery of cash to Russia, or some other place. Whichever way, it's a lot easier for law enforcement. Suddenly a particular country is responsible.
They would have to travel from e.g. Russia to Las Vegas to pick up the cash though. Or, I suppose, demand delivery of cash to Russia, or some other place. Whichever way, it's a lot easier for law enforcement. Suddenly a particular country is responsible.
Nah. Maybe $1000 bucks here or there, but you're not moving 8.1 million in paper money easily. And that money has to be laundered. Plus bills are traceable by number, and will often have markers on them. And they have to move, by hand, truck, package, etc., which means they can be found, often with little technical skill -- rando customs guy decides to open a box using the cutting edge tech of a letter opener.
BTC makes dealing with all of that a (potentially automated) bash one-liner.
BTC makes dealing with all of that a (potentially automated) bash one-liner.
God damn them all, I was told / we'd abuse the C's for American gold...
We'd file no bugs / thread no peers...
[deleted]
Will we see machineguns and hacker hanging cages installed in their buildings?
Merchants provide a value to society and pirates harm that. The thieves are providing a value to society in this case by damaging casinos, which provide no value to society and only harm citizens.
Casinos provide leisure and entertainment. If what you're actually trying to say is that they are overall a net harm, then I'd point out that imperial mercantilism was also quite harmful to many people. At least MGM hasn't overthrown any countries.
In exactly the same way a heroin dealer provides leisure and entertainment. Selling access to an inherently addictive substance should not be a for profit endeavor. The incentives are inherently biased towards harming people for profit.
You say this as if "addictive" and "harmful" are boolean concepts. These concepts have a wide spectrum in reality. People die every day from addictions to all kinds of socially acceptable products and services, whether it be the dopamine rush from an unhealthy or dangerous activity, a buzz from their favorite beverage, or the sugar rush from an unhealthy snack.
I encourage you to walk through some casinos and take stock of what you see. The scales of enrichment and addiction are nowhere near the balance of candy and soda.
The most harmful things inside of a casino are the bar, the buffet, and the cigarettes.
> I encourage you to walk through some casinos and take stock of what you see.
I have spent a lot of time at casinos with family members who love eating, drinking, smoking, and gambling. Know what I've seen? I've seen that gambling is the only one of the four that hasn't killed at least one of my family members.
> I encourage you to walk through some casinos and take stock of what you see.
I have spent a lot of time at casinos with family members who love eating, drinking, smoking, and gambling. Know what I've seen? I've seen that gambling is the only one of the four that hasn't killed at least one of my family members.
Lots and lots of gambling addicts die through suicide. Is there some reason this is less attributable to gambling as a cause than lung cancer is to smoking or drunk driving accidents are to alcohol?
Smoking related disease, obesity related disease, and alcohol related disease and deaths are much more common.
Depends on what the merchant is selling, I reckon.
More than casinos are being damaged. There's also hotels, restaurants, etc.
It never stopped, and the US is one of the worst offenders
Check out War is a Racket, by US general Smedley Butler
Also the Snowden documents and the whole Asange/Wikileaks case
Check out War is a Racket, by US general Smedley Butler
Also the Snowden documents and the whole Asange/Wikileaks case
[deleted]
The "World's Policeman" thesis really fell flat.
There is an urgent need to have effective international law-enforcement and justice.
There is an urgent need to have effective international law-enforcement and justice.
Urgent to whom? We live in a multipolar world now.
Countries already use criminals as political tools to advance their goals on the world stage. What makes you think expanding these efforts will somehow change existing geopolitical behavior?
All systems of law break down into the imposers, and the imposed upon. You don't have to impose anything on the voluntarily compliant, but what about those that refuse? Are you going to invade or kill innocent people just because a few leaders don't want to play by your rules?
Sanctions don't work for their intended political purpose. The only reason politicians talk about them is because it enables their corporate masters to swoop into markets and make a lot of money. (And if you disagree, I ask you find a study pointing to how sanctions were politically successful.)
Countries already use criminals as political tools to advance their goals on the world stage. What makes you think expanding these efforts will somehow change existing geopolitical behavior?
All systems of law break down into the imposers, and the imposed upon. You don't have to impose anything on the voluntarily compliant, but what about those that refuse? Are you going to invade or kill innocent people just because a few leaders don't want to play by your rules?
Sanctions don't work for their intended political purpose. The only reason politicians talk about them is because it enables their corporate masters to swoop into markets and make a lot of money. (And if you disagree, I ask you find a study pointing to how sanctions were politically successful.)
> Urgent to whom? We live in a multipolar world now.
What does that have to do with it? We should expect more of international institutions in a multipolar world.
It's urgent to anyone that has had to deal with ransomware gangs.
It's urgent for countries suffering from violent cartels.
It's urgent for Canada, which just accused India of assassinating one of its citizens on Canadian soil.
And so on.
What does that have to do with it? We should expect more of international institutions in a multipolar world.
It's urgent to anyone that has had to deal with ransomware gangs.
It's urgent for countries suffering from violent cartels.
It's urgent for Canada, which just accused India of assassinating one of its citizens on Canadian soil.
And so on.
> What does that have to do with it? We should expect more of international institutions in a multipolar world.
The whole reason why the world went from unipolar to multipolar is because the existing international organizations failed. What you're missing is these international organizations are political instruments used to obstruct and hinder Russia and China's development. The people in those countries don't share your supposition that more international organizations are a good thing.
> It's urgent to anyone that has had to deal with ransomware gangs.
What makes you think an international organization can do anything about ransomware? It's existed in this form for over a decade and nobody has done anything about it.
> It's urgent for countries suffering from violent cartels.
Why hasn't some international organization been formed to handled this then? Multipolarity is a very recent.
> It's urgent for Canada, which just accused India of assassinating one of its citizens on Canadian soil.
Do you think Canada is going to war with India over this?
The whole reason why the world went from unipolar to multipolar is because the existing international organizations failed. What you're missing is these international organizations are political instruments used to obstruct and hinder Russia and China's development. The people in those countries don't share your supposition that more international organizations are a good thing.
> It's urgent to anyone that has had to deal with ransomware gangs.
What makes you think an international organization can do anything about ransomware? It's existed in this form for over a decade and nobody has done anything about it.
> It's urgent for countries suffering from violent cartels.
Why hasn't some international organization been formed to handled this then? Multipolarity is a very recent.
> It's urgent for Canada, which just accused India of assassinating one of its citizens on Canadian soil.
Do you think Canada is going to war with India over this?
> The whole reason why the world went from unipolar to multipolar is because the existing international organizations failed.
They "failed" because they were gutted by a covert, powerful and violent "right-wing" alliance (imperialists, capitalists, white supremacists, all who felt tremendously victimized by recent global events incl. rise of communism). They were not about to throw away centuries of dominance to share international power with "inferior" classes of human.
The UN was rather effective in its initial decades.
Do you really think Hammarskjold, Kennedies, African(-American) leaders getting assassinated en masse in the 1960s was a spate of random coincidence? They were all united in opposing this covert alliance.
But the world is different now, the Global South is decisively emerging from under the imperial boot and multipolarity has a real chance.
They "failed" because they were gutted by a covert, powerful and violent "right-wing" alliance (imperialists, capitalists, white supremacists, all who felt tremendously victimized by recent global events incl. rise of communism). They were not about to throw away centuries of dominance to share international power with "inferior" classes of human.
The UN was rather effective in its initial decades.
Do you really think Hammarskjold, Kennedies, African(-American) leaders getting assassinated en masse in the 1960s was a spate of random coincidence? They were all united in opposing this covert alliance.
But the world is different now, the Global South is decisively emerging from under the imperial boot and multipolarity has a real chance.
> They "failed" because they were gutted by a covert, powerful and violent "right-wing" alliance (imperialists, capitalists, white supremacists, all who felt tremendously victimized by recent global events incl. rise of communism). They were not about to throw away centuries of dominance to share international power with "inferior" classes of human.
It seems no answer can satisfy you.
You're saying we need more international organizations (or more powerful ones) to prevent the problems described. But when we do form these international organizations, and they don't do exactly like you hoped it's because of intangible reasons that cannot be falsified.
> The UN was rather effective in its initial decades.
The League of Nations, which precedes the UN, was rather effective in the 1920s and didn't include the USA. It also completely dropped the ball by 1930. Historians partially blame the League of Nations for the outbreak of second World War.
> Do you really think Hammarskjold, Kennedies, African(-American) leaders getting assassinated en masse in the 1960s was a spate of random coincidence? They were all united in opposing this covert alliance.
You're vacillating between wanting more powerful international organizations, but at the same time don't want international organizations wielding their power in ways you personally don't approve of.
It seems no answer can satisfy you.
You're saying we need more international organizations (or more powerful ones) to prevent the problems described. But when we do form these international organizations, and they don't do exactly like you hoped it's because of intangible reasons that cannot be falsified.
> The UN was rather effective in its initial decades.
The League of Nations, which precedes the UN, was rather effective in the 1920s and didn't include the USA. It also completely dropped the ball by 1930. Historians partially blame the League of Nations for the outbreak of second World War.
> Do you really think Hammarskjold, Kennedies, African(-American) leaders getting assassinated en masse in the 1960s was a spate of random coincidence? They were all united in opposing this covert alliance.
You're vacillating between wanting more powerful international organizations, but at the same time don't want international organizations wielding their power in ways you personally don't approve of.
> It seems no answer can satisfy you.
What does this add?
> intangible reasons that cannot be falsified.
I assure you there is nothing intangible about a clear pattern of high-profile assassinations, to say nothing of other related global events.
> You're vacillating between wanting more powerful international organizations, but at the same time don't want international organizations wielding their power in ways you personally don't approve of
You really can't see the difference between overt, ratified international institutions, and shadowy, nameless, violent special-interest groups? Come now.
What does this add?
> intangible reasons that cannot be falsified.
I assure you there is nothing intangible about a clear pattern of high-profile assassinations, to say nothing of other related global events.
> You're vacillating between wanting more powerful international organizations, but at the same time don't want international organizations wielding their power in ways you personally don't approve of
You really can't see the difference between overt, ratified international institutions, and shadowy, nameless, violent special-interest groups? Come now.
I acknowledge there's pattern of high-profile assassinations in history that raise questions and seem interconnected. However, attributing them to a small covert group is a logical leap.
What would convince you they're not conspiring together?
As for international organizations, my point is that even ratified and official organizations are not immune to political pressures and special interests. How do we ensure transparency, efficacy, and fairness when the existing entities can't do that sufficiently well to maintain unipolarity?
What would convince you they're not conspiring together?
As for international organizations, my point is that even ratified and official organizations are not immune to political pressures and special interests. How do we ensure transparency, efficacy, and fairness when the existing entities can't do that sufficiently well to maintain unipolarity?
> There is an urgent need to have effective international law-enforcement and justice.
What makes you think any other organization given such privilege would do any better with it than the US? Even if they started out with good intentions, that kind of power will inevitably corrupt them.
Embrace multipolarity. Benevolent, wise and just unipolarity will never happen.
What makes you think any other organization given such privilege would do any better with it than the US? Even if they started out with good intentions, that kind of power will inevitably corrupt them.
Embrace multipolarity. Benevolent, wise and just unipolarity will never happen.
International doesn't mean unipolar. Effective international institutions are multilateral in nature.
If you have in mind the kind of international courts that already exist, e.g. the ICC,... well they already exist. I took your emphasis on "effective" to imply that you would like international courts to have substantially more power than presently exists. With enough power to truly be effective, that court would become the unipolar power. It would attract the power hungry like moths to a lightbulb.
Washington threatened the ICC with serious consequences if it carried out its mandate.
Powerful also does not mean unipolar/dominant. Checks and balances can exist. That's how the US government was initially designed.
Powerful also does not mean unipolar/dominant. Checks and balances can exist. That's how the US government was initially designed.
This is a good example of the kind of case study I will point to when someone starts to get cranky with my unyielding principle of putting the entire business inside a single SQL database.
When you have geo replicas and point-in-time restoration capabilities which can synchronously bring 100% of the business back from the dead in a matter of seconds/minutes...
How many $8.4m days before a complete rewrite of all systems would be justified? If you are going to entertain a rewrite, why not use one system to rule them all so you can audit one thing and move on with life?
This industry does not seem like a good fit for non-traditional technology stacks. I'd strongly consider putting my entire casino on a mainframe if I could. Any vendor who indicates a lack of willingness for integration with that tech stack would be instantly disqualified from selection. I feel like this is a really good technology bullshit filter for the kind of industry MGM is operating in. If it's not good enough for Visa or Amex, it's not good enough for a gambling operation.
When you have geo replicas and point-in-time restoration capabilities which can synchronously bring 100% of the business back from the dead in a matter of seconds/minutes...
How many $8.4m days before a complete rewrite of all systems would be justified? If you are going to entertain a rewrite, why not use one system to rule them all so you can audit one thing and move on with life?
This industry does not seem like a good fit for non-traditional technology stacks. I'd strongly consider putting my entire casino on a mainframe if I could. Any vendor who indicates a lack of willingness for integration with that tech stack would be instantly disqualified from selection. I feel like this is a really good technology bullshit filter for the kind of industry MGM is operating in. If it's not good enough for Visa or Amex, it's not good enough for a gambling operation.
>putting the entire business inside a single SQL database.
I too have a theory that you could get away with this and come out ahead of the industry. The problem is no CEO has the balls to try it in FinTech or any other heavily regulated industry.
I too have a theory that you could get away with this and come out ahead of the industry. The problem is no CEO has the balls to try it in FinTech or any other heavily regulated industry.
The business logic has to live somewhere, and triggers and stored procedures are just not the right place to do it.
Plus these guys apparently got majorly pwned. I don't think any particular blend of stack was to blame, more likely they have a lord-of-the-flies driven technology "architecture" and simply hoped nothing bad ever happened.
Plus these guys apparently got majorly pwned. I don't think any particular blend of stack was to blame, more likely they have a lord-of-the-flies driven technology "architecture" and simply hoped nothing bad ever happened.
It seems like a bug/wrong infra, nothing that mainframe could fix.
>it's not good enough for Visa or Amex, it's not good enough for a gambling operation.
We have multicloud/kubernetes
The hackers have taken down slots, cash registers and EPOS handhelds, controllers for doors and elevators, ATMs, kitchen ordering systems, display screens, etc.
Even if all their business data was 100% retrievable, they are losing money every day that customers are wandering around a casino full of darkened screens, and playing a working slot or getting a drink involves waiting 20 minutes for an employee with a pencil, notebook and a handful of cash.
Even if all their business data was 100% retrievable, they are losing money every day that customers are wandering around a casino full of darkened screens, and playing a working slot or getting a drink involves waiting 20 minutes for an employee with a pencil, notebook and a handful of cash.
What was their tech stack?
I'm curious if MGM fully understood their cyber risks. Many companies underestimate threats until something like this happens. After seeing MGM, if other hotels beef up security too (very likely), will overall costs for consumers go up?
Security is a SG&A line item, I am sure they are far more fixated on physical security due to their business vertical and had a gap. There will be many cyber companies chomping at the bit to get a piece of the inevitable (I made this number up) 100m MGM will spend on Cybersecurity over the next 5 years.
They won't make the same mistake twice and will build a comprehensive cybersecurity program, and it will succeed. Up until someone questions this cost and they forgot what they are paying for because everything was so smooth and repeat the cycle.
The objective of security is risk identification and management, not creating an impervious barrier for potential adversaries.
They won't make the same mistake twice and will build a comprehensive cybersecurity program, and it will succeed. Up until someone questions this cost and they forgot what they are paying for because everything was so smooth and repeat the cycle.
The objective of security is risk identification and management, not creating an impervious barrier for potential adversaries.
Ha, that is funny. I have literally never met a CISO who shares your confidence. Not a single one of the companies chomping at the bit can protect MGM against a multi-million dollar ransomware attack. Companies get hacked because commercial cybersecurity by the big names is useless against the modern, prevailing threat landscape of organized crime. The sum total of their ability is stopping unskilled children, and even then only sometimes.
Just ask any CISO if they would bet their job on surviving a $1M unrestricted red team exercise with a year-long timeframe. They would all be scared shitless by the thought. I bet if you asked the CISO of MGM three days before the attack: "How much would it cost to hack MGM and cripple operations?" they would answer like every other CISO I have heard answer that question and say something on the order of $100K. They know it does not work; they are there to be sacrificed and just hope it does not happen on their watch.
Just ask any CISO if they would bet their job on surviving a $1M unrestricted red team exercise with a year-long timeframe. They would all be scared shitless by the thought. I bet if you asked the CISO of MGM three days before the attack: "How much would it cost to hack MGM and cripple operations?" they would answer like every other CISO I have heard answer that question and say something on the order of $100K. They know it does not work; they are there to be sacrificed and just hope it does not happen on their watch.
You're mistaking compliance with a competent security program.
I am not. Name one competent security program certified and verified to stop total compromise by a $30M unrestricted red team exercise which is the ransom amount demanded by the attackers on Caesars just a few weeks prior.
Keep in mind that amounts to around 100 person-years of dedicated hacking labor. I get a team of 50 and 2 years to achieve total compromise. I get to burn 5-10 zero click RCE zero-days. The idea that any of the commercial cybersecurity companies or any commercial IT organization could design a system that could resist such an attack is laughable. This is not a question of resources, it is one of ability.
I agree, compliance is not an above-average security program. But an security program that is merely above-average is woefully underprepared for the modern threat landscape. You need a security program 100x better than “best practices” to stand a meaningful chance and you are not finding that amongst the charlatans in the big cybersecurity players.
Keep in mind that amounts to around 100 person-years of dedicated hacking labor. I get a team of 50 and 2 years to achieve total compromise. I get to burn 5-10 zero click RCE zero-days. The idea that any of the commercial cybersecurity companies or any commercial IT organization could design a system that could resist such an attack is laughable. This is not a question of resources, it is one of ability.
I agree, compliance is not an above-average security program. But an security program that is merely above-average is woefully underprepared for the modern threat landscape. You need a security program 100x better than “best practices” to stand a meaningful chance and you are not finding that amongst the charlatans in the big cybersecurity players.
“ They won't make the same mistake twice and will build a comprehensive cybersecurity program, and it will succeed. Up until someone questions this cost and they forgot what they are paying for because everything was so smooth and repeat the cycle.”
You couldn’t have said it better.
You couldn’t have said it better.
> Many companies underestimate threats until something like this happens
Speaking from my experience, many don't understand the threats even after an incident. The reaction is often to add 'more security' under any name. More restrictive policies, more scanning, more layers of MFA - just blindly layering on things because it's seen as 'more secure' without properly understanding how it affects risk is an awful approach to managing security.
Speaking from my experience, many don't understand the threats even after an incident. The reaction is often to add 'more security' under any name. More restrictive policies, more scanning, more layers of MFA - just blindly layering on things because it's seen as 'more secure' without properly understanding how it affects risk is an awful approach to managing security.
And I would say T-Mobile not only doesn't understand the threats after their many data breaches, they have continuously failed to improve Cybersecurity.
They have an incredibly crusty, buggy billing system written in PowerBuilder, and I swear it's a holdover from the Voice stream days
Disclaimer: Worked there in Tech Support.
They have an incredibly crusty, buggy billing system written in PowerBuilder, and I swear it's a holdover from the Voice stream days
Disclaimer: Worked there in Tech Support.
The goal is to make the boss feel more secure. And there are plenty of snake oil salesmen willing to sell to that boss.
> underestimate threats until something like this happens
And then, when it does, they blame the people who were pointing out the risks and suggesting solutions rather than the people who were ignoring those people the whole time.
And then, when it does, they blame the people who were pointing out the risks and suggesting solutions rather than the people who were ignoring those people the whole time.
I bet that right now there are at least 3 teams trying to understand this. One working for MGM's current IT vendor, one working for their cybersecurity insurance company, and another one hired by MGM's board independently to try to sort out exactly what the heck and make sure they aren't behind any info the insurance company finds out.
Unless they don't have cyber insurance
Unless they don't have cyber insurance
> Katz told investors in his Thursday and Sunday reports that damages from the cyberattack at MGM would be claimed against insurance, but it’s unclear just how much would be covered.
I'm curious to see how this plays out. After all, if MGM is audited and found to have been negligent, would insurance pay out at all?
I'm curious to see how this plays out. After all, if MGM is audited and found to have been negligent, would insurance pay out at all?
Presumably the insurance requires a security audit (yearly?) in order to get in the first place?
As long as the auditors OK'd it then the insurance should pay out. Unless they can show that MGM intentionally lied in the information they gave the auditors -- which will surely now be gone through with a fine-toothed comb.
(See that HN thread from a couple of days ago wondering if they were personally liable for fraud for producing a document lying about pentesting.)
As long as the auditors OK'd it then the insurance should pay out. Unless they can show that MGM intentionally lied in the information they gave the auditors -- which will surely now be gone through with a fine-toothed comb.
(See that HN thread from a couple of days ago wondering if they were personally liable for fraud for producing a document lying about pentesting.)
The audits you get for something like SOC2 are quite weak, I'm very curious to learn if the insurance team's audit is more thorough (if they perform one).
Exactly, often quite weak and might not even include an appropriate scope that covers cyber security/information security controls
How is it even possible for all aspects of such a massive enterprise to all share a single point of failure like that? And why can't they just cut their losses on the past N days of business, restore all these servers from snapshots and get back to business?
Often the attackers wait until the retention policy for backups has been hit before unleashing the payload of ransomware.
This way, even if you have a snapshot from 7 days ago, it's also infected.
Or even worse they have physical access to the backup server/storage and just delete backups infect them as well.
This way, even if you have a snapshot from 7 days ago, it's also infected.
Or even worse they have physical access to the backup server/storage and just delete backups infect them as well.
There are multiple things that are done here. Suppose you had great, immutable backups. They still have many things that can ruin your business
1. Restoring networks, servers, third party services with knowledge that anything you restore could be compromised as well. Keys
2. The attackers will then threaten to dump all of your private information.
It is more than just restoring data, it is restoring and resetting your entire infrastructure. And most places have backups, but they don't practice entire restores
1. Restoring networks, servers, third party services with knowledge that anything you restore could be compromised as well. Keys
2. The attackers will then threaten to dump all of your private information.
It is more than just restoring data, it is restoring and resetting your entire infrastructure. And most places have backups, but they don't practice entire restores
> And most places have backups, but they don't practice entire restores
Or worse, they only practice part of it. Only once in my career have I seen a "restore.txt" that didn't start with something along the lines of "connect to $server".
Ok, that assumes a LOT is already in place. Where is the "restore.txt" that goes over how to get $network up so that I can resolve the IP(s) for the server I need to restore?
I can't prove it, but I suspect that most businesses know deep down that they _cant_ do a "black start" and they know that even a practice run is likely to find some pretty basic and embarrassing issues that will just be too costly to address.
Or worse, they only practice part of it. Only once in my career have I seen a "restore.txt" that didn't start with something along the lines of "connect to $server".
Ok, that assumes a LOT is already in place. Where is the "restore.txt" that goes over how to get $network up so that I can resolve the IP(s) for the server I need to restore?
I can't prove it, but I suspect that most businesses know deep down that they _cant_ do a "black start" and they know that even a practice run is likely to find some pretty basic and embarrassing issues that will just be too costly to address.
to go one step further, then there are all the companies that have done a proper recovery plan, and even tested it.
several years ago.
hopefully there were no externally managed dependencies, as those can change.
hopefully the documentation was entirely written down, not just 80%, with that last 20% having retired, been laid off, or died since then.
how many companies are left at that point?
several years ago.
hopefully there were no externally managed dependencies, as those can change.
hopefully the documentation was entirely written down, not just 80%, with that last 20% having retired, been laid off, or died since then.
how many companies are left at that point?
Maybe they shouldn't have their corporate login page on the Internet.
https://mgmresorts.okta.com/app/mgmresortsprod_neocaseemploy...
https://mgmresorts.okta.com/app/mgmresortsprod_neocaseemploy...
“The DR planning meeting has been once again postponed until next quarter…”
Some middle-manager somewhere, probably.
Some middle-manager somewhere, probably.
I never like it when writers use the word "lose" to describe money not earned. Yeah, MGM is not earning as much as it could because of this attack. They are under pressure to settle with the attackers. Articles like this can increase that pressure. I'm glad that they aren't settling, and I'm certain that they will survive this attack.
It's a loss of income. This is a common use of the word.
Well, it's a loss of projected income, which in many ways is not real.
It is just plain normal language to refer to a loss as a comparison against a current trajectory or current state. It is reasonable to assume that the reader/listener knows that the future cannot be predicted exactly, because this is generally true. This is why it isn't said explicitly.
It would be silly to correct someone who said "I just accepted a $120,000/yr job" with "you don't really know for sure, you could get fired or die". The colloquial presumption is that the rate of future income cited is dependent on a steady trajectory without confounding variables.
It would be silly to correct someone who said "I just accepted a $120,000/yr job" with "you don't really know for sure, you could get fired or die". The colloquial presumption is that the rate of future income cited is dependent on a steady trajectory without confounding variables.
It's real enough that companies regularly borrow against it, which is about as real as anything is with money.
It's not even that, it's revenue.
> MGM Resorts International could be losing between $4.2 million and $8.4 million in daily revenue
> MGM Resorts International could be losing between $4.2 million and $8.4 million in daily revenue
Revenue is a measure of income. Unless speaking about specific types of revenue or specific types of income, they are synonymous.
Accounts don't think revenue and income are synomymous: income is revenue minus expenses. Now if you were to say that profit and income are synonymous, that I might be okay with.
[deleted]
> it's a loss of projected income, which in many ways is not real
About as real as money.
About as real as money.
It's more real than not.
If your salary was cut 20% next year, would you think you were not losing money because you had not yet earned it?
I have a contract that requires my employer to pay up.
Not the same think as avoiding shopping somewhere.
Not the same think as avoiding shopping somewhere.
There's an implied "losing $X [in comparison to expected revenue]" every time they say it.
It's a reasonable perspective from accounting and, in my mind, a reasonable shorthand. For a more literal version of losing, people would be saying misplacing or stealing.
It's a reasonable perspective from accounting and, in my mind, a reasonable shorthand. For a more literal version of losing, people would be saying misplacing or stealing.
You're getting a lot of comments to the contrary, but I agree with you.
There is a difference between losing money (like someone is actually stealing the money) and not getting money you were hoping/expecting to get. In this context it can even be a little bit confusing since there are criminals involved that could actually be stealing money.
Language has lots of ambiguities and despite this being a common way of describing this situation, I don't like it. Some people don't like the word "moist" either and that's just fine. It's an opinion.
There is a difference between losing money (like someone is actually stealing the money) and not getting money you were hoping/expecting to get. In this context it can even be a little bit confusing since there are criminals involved that could actually be stealing money.
Language has lots of ambiguities and despite this being a common way of describing this situation, I don't like it. Some people don't like the word "moist" either and that's just fine. It's an opinion.
Money not earned is equivalent to money lost in this case. It will affect their quarterly results the same way.
Huh? Google says MGM Resorts opex for 2022 11.6B or 31M/day, net income 1.4B or 3.8M/day.
It doesn't seem unreasonable to say they are, in fact, losing 8.4M/day to opex.
It doesn't seem unreasonable to say they are, in fact, losing 8.4M/day to opex.
The revenue may be going down, but that doesn't mean they have to operate at a loss (they could always cut their variable expenses to match the cut in revenue). It would be more accurate, but not as click-baity, to describe it as "MGM getting up to $8.4M less revenue a day".
A slightly more misleading use of "losing money" is for example when movie or music companies claim they are "losing" billions of dollars to piracy, when there is no reason to believe that every pirated copy would instead be purchased at full price, if only piracy were eliminated.
A slightly more misleading use of "losing money" is for example when movie or music companies claim they are "losing" billions of dollars to piracy, when there is no reason to believe that every pirated copy would instead be purchased at full price, if only piracy were eliminated.
There's lots of instances where I'd agree, but this one seems like a tried and true business with years of revenue to gauge how much they are in fact "losing" on average.
I also wonder how much pressure it puts on MGM - who are no doubt very much aware of the loss (every major outage I've been on eventually comes down to how much did this cost us - whether it's money, customer attrition, customer trust etc) vs how much pressure it puts on executives following along to maybe pay attention to their IT and security teams. Pipe dream.
I also wonder how much pressure it puts on MGM - who are no doubt very much aware of the loss (every major outage I've been on eventually comes down to how much did this cost us - whether it's money, customer attrition, customer trust etc) vs how much pressure it puts on executives following along to maybe pay attention to their IT and security teams. Pipe dream.
> I never like it when writers use the word "lose" to describe money not earned.
What the difference between not earning $8M and earning $8M and losing it?
Bank account looks pretty similar.
What the difference between not earning $8M and earning $8M and losing it?
Bank account looks pretty similar.
If your employer gives you 2 weeks notice of employment termination, did you lose your job?
After all, it only applies to future payroll periods.
After all, it only applies to future payroll periods.
Yes you lost your job, and will not receive money in the future. Money from a job is in exchange for services rendered to company. It's reasonable to say you can't lose something you haven't yet received, but it is also normal to say they're losing money given they had an incredibly high likelihood of actually receiving it.
I suspect that's just an initial breakdown. They're estimating 4.2 to 8.4 million a day out of the 42 million they normally make, but that's just on the revenue side.
Equipment, man hours, botched projects, and lawsuits are going to push that number waaay higher, and even then I feel like it's got to be pretty low given the vast amount of money that passes through every day. On a 15% hold 42 million would work out to 280 billion of flow through the slots max (and obviously that's estimating high and assuming all revenue is from slots).
So 8 million a day is $53 billion in coin in that's not occurring? Maybe that's correct.
Doing quick napkin math so pardon any errors.
Equipment, man hours, botched projects, and lawsuits are going to push that number waaay higher, and even then I feel like it's got to be pretty low given the vast amount of money that passes through every day. On a 15% hold 42 million would work out to 280 billion of flow through the slots max (and obviously that's estimating high and assuming all revenue is from slots).
So 8 million a day is $53 billion in coin in that's not occurring? Maybe that's correct.
Doing quick napkin math so pardon any errors.
People are saving up to $8.4M a day due to cyberattack, and gambling addicts are being spared, analysts say
Yep. They definitely can’t walk down the street to another casino to make poor decisions.
Ah yes, a physical addiction is "Poor decisions", like being born poor is a poor decision
They can walk somewhere else. They don't have a disease.
Their ability to walk to another casino remains unhindered by the terminology arguments of internet commentators.
MGM is smart for not paying.
You can't let the scammers dictate what a casino does, MGM is already in the business of scamming people. They'll build their whole system from the ground up and be incredibly resistant to future attacks.
You can't let the scammers dictate what a casino does, MGM is already in the business of scamming people. They'll build their whole system from the ground up and be incredibly resistant to future attacks.
Has ANYONE thought of air-gapping email from the rest of the corporate network?
This mania to "integrate everything" is dangerous.
If it's war, elevate your game. (business opportunity?)
This mania to "integrate everything" is dangerous.
If it's war, elevate your game. (business opportunity?)
This must be some kind of incompetence record. It's been weeks since it began.
> MGM is not earning up to $8.4M a day due not spending $333.3k a day for a proper measures against cyberattack, analyist says
Fixed
Fixed
analyist
Imagine being one of the guys in charge of cybersecurity of MGM. I would dig a hole and hide.
Or they have been telling management for years that security needs to be improved and more spending is needed to do that but management declined to provide funding.
It's still on the onus of the employee to properly state their viewpoint and deliver a proper business document, outlining the risks and benefits. Too many times I've seen security been increased and upgraded, at the cost of the entire business shutting down, or even worse, layoffs.
The cybersecurity team will probably take the fall for it, but if I had to take a guess, their budget was probably no where near where it should be for a team that is responsible for protecting $8.4M of revenue a day.
[deleted]
If you're the CISO or whatever it's basically your job to get fired when this happens tbh
This didn't age well:
"[Okta] is one of the things that I can put in my toolkit to say, ‘Hey, we're gonna move faster because we have this identity component nailed.
Scott Howitt, CISO, MGM Resorts International"
That's a testimony from Okta's website.
"[Okta] is one of the things that I can put in my toolkit to say, ‘Hey, we're gonna move faster because we have this identity component nailed.
Scott Howitt, CISO, MGM Resorts International"
That's a testimony from Okta's website.
It took a while to find their CTO, he's also head of "Strategy" and "Innovation"
https://investors.mgmresorts.com/investors/news-releases/pre...
https://investors.mgmresorts.com/investors/news-releases/pre...
I think those heads are on the chopping block no matter which hole they’re hiding in.
I'd say that responsible organizations know that a hack is inevitable and you evaluate based on the response, but I've heard from people who've worked at MGM in the past that the place is disgustingly cutthroat.
Bold of you to assume there was one (before the incident) /s