Instructure, the company that operates Canvas, has confirmed that it addressed the incident directly.

[r0k@mastodon.social]

@pa @cR0w those honorable criminals, always keeping their word... so adorable

[cr0w@infosec.exchange]

@r0k @pa giggles in LockBit

[ph_0x05@infosec.exchange]

@rossmadness @cR0w it's never not amusing whenever i read about a big organisations suddenly becoming naive when dealing with morally bankrupt people.

As though as they somehow managed to get to become a multi-million company by just a bunch of "trust us bro"

[phil@fed.bajsicki.com]

@cR0w@infosec.exchange So... Instructure will be on the hook if it does happen? I'm not sure how exactly this works on the legal side.

[rotopenguin@mastodon.social]

@rossmadness @cR0w hold onto that receipt, it's a deductible business expense

[nyanbinary@infosec.exchange]

@rossmadness @cR0w but but but... their business relies on being trustworthy! They need to, otherwise the industry suffers! And no one would ever act against their industries interest! All the cybertalkingheads told me!!!

[tati@eldritch.cafe]

@cR0w the terminator : 'i'll be back'

actually, wait, i'm still here

(brain: s/Free-for-T/hot for t/g)

#instructure #canvas

[remywhisker@mastodon.social]

@r0k @cR0w I doubt it. They probably just said they did. They just shift blame if anything or anyone contradicts their narrative.

[fuzzyfuzzyfungus@cyberplace.social]

@rossmadness @cR0w It turns out that seeing a way to pretend to solve your problem by spending other people's money and letting other people bear the ongoing risk just gives you a warm feeling of childish trust.

Plus, when you are lawful evil seeing chaotic evil probably just reminds you of your carefree younger days; when you would have been frolicking on the intertubes not being a saashole who has to do earnings calls.

[cr0w@infosec.exchange]

@phil IDK how it works either but I highly doubt they will be held responsible.

[phil@fed.bajsicki.com]

@cR0w@infosec.exchange Sad. There is a definite deficit of accountability.

[pa@hachyderm.io]

@tati @cR0w Oh that's nice to know! So I suppose Paid-for-Teachers can be leveraged instead now?

[cr0w@infosec.exchange]

@phil Isn't that the whole point of becoming a publicly traded company in America? It sure seems that way.

[rossmadness@infosec.exchange]

@nyanbinary @cR0w I was discussing the Instructure hack with a friend who works for a school district and he stated that almost exactly. I told him that yes, that makes sense if we believe they care about "organization reputation" in the same economic incentive driven context as a regular business. Which I highly doubt. But let's assume they do follow this logic.

What keeps them from selling a copy quietly to another criminal and then THAT criminal actions the data somewhere else without directly saying "Instructure". TAs double dip and keep their "reputation" intact.

[jackryder@infosec.exchange]

@cR0w The amount of comfort this provides me is *immeasurable.

* It's zero. The number is zero.

[mccovican@infosec.exchange]

@tati @cR0w

"Our offering was leveraged by an unauthorized actor in their activity."

I don't think even CNN could come out with a voice that passive. Dude had to completely mangle the semantic structure of that sentence just to thread the needle between the obvious truth, and a lie blatant enough to be visible from the moon.

Hey Steve, go apologise to your high school English teacher.

[log@mastodon.sdf.org]

@cR0w Gotta feel the seal on the certificate of deletion. If you can't detect the embossed edge around it, the seal is a forgery. That means the adversary did not pinky swear before the registrar of deleted hacks. Which only costs, like, $18. If they didn't spring for that, they definitely must be lying.

[fritzadalis@infosec.exchange]

@tati @cR0w
I think of all the patches that I've missed
But then the ransom was never quite like this!