7 ms·

Next step (unless it is already there) could be affiliate marketing (pay 25% of the ransom to people who distribute the malware). If people start getting smart

Next step (unless it is already there) could be affiliate marketing (pay 25% of the ransom to people who distribute the malware). If people start getting smart with backups, the response could be to switch blackmailing (pay or we'll distribute your files). I find this whole thing quite scary. We all know how difficult it is to protect yourself from a determined and skilled adversary. Now that there is clear business model and opportunity to make hundreds of millions[1] this thing will probably attract more and more people. Building botnets was a mass market operation. Ransomware could become more targeted, since the value of single infected machine can be much higher. [1] http://thehackernews.com/2015/10/cryptowall-ransomware.html http://thehackernews.com/2015/10/cryptowall-ransomware.html

rahrahrah 10y ago
Doesn't work. The moment someone exposes the game the affiliate marketer will have his affiliate account closed by whichever company or network they're trying to work with.
- cryptarch 10y ago
  It won't be hard to set up a darknet-based affiliate service, e.g. one that upon retrieval of the Bitcoins sends 25% to the affiliate, 74% to the botnet herder and 1% to the affiliate service. Perhaps an Ethereum program could do it, but then it might be a good idea to set up a second Ethereum network for anonymous use over darknets.
  - rahrahrah 10y ago
    But at some point an actual company with an actual reputation on the line would have to be involved. Those are the people that would ban you.
    - cryptarch 10y ago
      How so? The darknet markets (e.g. Silk Road) seem to be doing great without "actual companies", but they do have an actual reputation. You don't need an actual company to accept Bitcoins. You don't even need a PO box or a telephone number. Just a computer connected to the internet.
      - rahrahrah 10y ago
        Weren't we talking about affiliate marketing? For affiliate marketing you need an actual company that is getting sales out of it. Most companies will immediately turn off affiliate marketers getting it sales by spreading malware/ransomware.
        jwatte 10y ago
        If you use the existing affiliate systems, yes. But building a darknet (or just distributed) affiliate program is not exactly rocket science. Note: the point of the affiliate marketing is to make your an affiliate of /spreading the infection/ not pumping some third party product.
        rahrahrah 10y ago
        I'm completely lost. I work in affiliate marketing and I don't understand what you're saying. Could you explain very slowly how this would work in your mind? Who is paying the money, and who is receiving the money?
        robjan 10y ago
        In a simplified model, a legitimate set of actors for a legitimate product would be a. publisher b. affiliate network c. person selling a product You are saying that the affiliate network would block the publishers for distributing malware. Yes, that's true. But what is stopping someone from creating another affiliate network? That would replace the actors with the following: a. malware distributor b. illicit affiliate network c. malware publisher selling key In this case, the "product" is the key to decrypt the files. The network could be anyone. It could even be the same person who wrote the malware.
    - meowface 10y ago
      You'd be surprised. Many of these illicit affiliate networks have been existing for years and continue to thrive. Especially with cryptocurrency nowadays, they have ways of safely cashing out.
    - lmm 10y ago
      At that point they're just cashing out bitcoins. And while I think that should be illegal (bitcoins can a priori be reasonably assumed to be the proceeds of either a) crime or b) "mining" i.e. being paid to run a network that's used primarily for crime, because those are the only use cases that makes sense), currently it doesn't seem to be seen that way.
- Sanddancer 10y ago
  There are a number of affiliate marketing companies who will "revoke" an account, but make no effort to keep bad actors from opening new accounts, make it as hard as possible to report affiliates using malicious tactics, etc. Once you start getting into the lowest tiers of banner sellers you start seeing a lot of real skeezy moves.
- foota 10y ago
  The OP meant affiliate marketing in a way separate from that of the traditional sense.
celticninja 10y ago
Already there, that's how some ransomware is already operating.
necessity 10y ago
Why scary? Are you dumb enough to get one of those?
- prodigal_erik 10y ago
  Like everyone I know, I run networking code written in C, so obviously the answer is yes.
- raptorfactor 10y ago
  Are you dumb enough to think a sufficiently motivated attacker couldn't infect someone without them being "dumb"? I guess you must be running a special OS and software that's bug-free and completely immune to exploits. Lucky you.
Taek 10y ago
All the more reason to emphasize security over the latest in features and upgradability. Why doesn't Microsoft get held accountable when a 0-day in Windows is exploited that results in loss of user funds? Without that, there's no incentive to build secure software in the first place. How do we get society to have more of a security-first approach when it comes to things connected to the internet? A lot of these vulnerabilities are scary in a systemic way. Cyber warfare would likely be as damaging as dropping napalm on cities, and it's all preventable by having more security oriented infrastructure.
- rtpg 10y ago
  Another angle to this: Why does Apple get away with something like 2 year support windows for their OS? We now have a bunch of people on OS 10.6.8 who will stop getting updates, but even 10.9 will fall out of support before Win7 Though I suppose the best solution would be to get everyone on the upgrade treadmill
  - mschuster91 10y ago
    > Though I suppose the best solution would be to get everyone on the upgrade treadmill No. The best solution would be to require Apple, Google and MS to split up their OSes into individual packages, that can be upgraded at will, and to unlink functionality from optics in all parts of the OS. The reason is simple: most people, especially corp environments, don't upgrade their software because they see on friends' machines (or phones) that the look and feel has changed too much for them / that retraining time for employees is too expensive. A good example is the clusterfuck MS committed with Win8 by replacing the taskbar, the unremovable phone-home/unstoppable auto updater in Win10 or the various "design improvements" / "performance improvements" Apple did on OS X/iOS. Oh, and with Apple there's the high risk of critical bugs or other incompatibilities with their newest OS. Software like the Adobe suite, music/video editor programs, and even office mainstream apps Lotus f..ing Notes and Cisco's programs tend to have boatloads of bugs each major OS X release. With MS, you can at least assume that you can run any old software that doesn't require drivers...
    - 10y ago
gruez 10y ago
>If people start getting smart with backups, the response could be to switch blackmailing (pay or we'll distribute your files). how does that work when most home connections have terrible upload? to make matters worse, if you upload at full speed, people will notice that their internet is getting sluggish and notice something is up.
- foota 10y ago
  You could probably get away with only uploading document-ish files. No one cares if you steal their windows operating system files.
- elorant 10y ago
  You throttle the bandwidth or you upload at full speed when the bandwidth consumption is idle. Or if you're into blackmail you develop an algorithm that searches for nudity in pictures and upload only those. Or you extract the text from documents, zip it and then upload it. Obviously if you're into this you develop some patterns, you don't just upload everything because then you'd have to spend an eternity browsing through all those files. How many chances are there that the average user will have a file called finance or something similar in their documents folder? You could simply upload a text file with all the file names and then make selective uploads.
pizza 10y ago
Finally, a use-case for Ethereum! /s
industriousthou 10y ago
This might only be sort of related to what you're talking about, but reansomware as a service already exists. You delivery a premade executable and get a cut cut of the profits. You could install it in systems where you have physical access like your work or at a friends house or systems that you have remotely compromised.

rahrahrah 10y ago

Doesn't work. The moment someone exposes the game the affiliate marketer will have his affiliate account closed by whichever company or network they're trying to work with.

cryptarch 10y ago
It won't be hard to set up a darknet-based affiliate service, e.g. one that upon retrieval of the Bitcoins sends 25% to the affiliate, 74% to the botnet herder and 1% to the affiliate service. Perhaps an Ethereum program could do it, but then it might be a good idea to set up a second Ethereum network for anonymous use over darknets.
- rahrahrah 10y ago
  But at some point an actual company with an actual reputation on the line would have to be involved. Those are the people that would ban you.
  - cryptarch 10y ago
    How so? The darknet markets (e.g. Silk Road) seem to be doing great without "actual companies", but they do have an actual reputation. You don't need an actual company to accept Bitcoins. You don't even need a PO box or a telephone number. Just a computer connected to the internet.
    - rahrahrah 10y ago
      Weren't we talking about affiliate marketing? For affiliate marketing you need an actual company that is getting sales out of it. Most companies will immediately turn off affiliate marketers getting it sales by spreading malware/ransomware.
      - jwatte 10y ago
        If you use the existing affiliate systems, yes. But building a darknet (or just distributed) affiliate program is not exactly rocket science. Note: the point of the affiliate marketing is to make your an affiliate of /spreading the infection/ not pumping some third party product.
        rahrahrah 10y ago
        I'm completely lost. I work in affiliate marketing and I don't understand what you're saying. Could you explain very slowly how this would work in your mind? Who is paying the money, and who is receiving the money?
        robjan 10y ago
        In a simplified model, a legitimate set of actors for a legitimate product would be a. publisher b. affiliate network c. person selling a product You are saying that the affiliate network would block the publishers for distributing malware. Yes, that's true. But what is stopping someone from creating another affiliate network? That would replace the actors with the following: a. malware distributor b. illicit affiliate network c. malware publisher selling key In this case, the "product" is the key to decrypt the files. The network could be anyone. It could even be the same person who wrote the malware.
  - meowface 10y ago
    You'd be surprised. Many of these illicit affiliate networks have been existing for years and continue to thrive. Especially with cryptocurrency nowadays, they have ways of safely cashing out.
  - lmm 10y ago
    At that point they're just cashing out bitcoins. And while I think that should be illegal (bitcoins can a priori be reasonably assumed to be the proceeds of either a) crime or b) "mining" i.e. being paid to run a network that's used primarily for crime, because those are the only use cases that makes sense), currently it doesn't seem to be seen that way.
Sanddancer 10y ago
There are a number of affiliate marketing companies who will "revoke" an account, but make no effort to keep bad actors from opening new accounts, make it as hard as possible to report affiliates using malicious tactics, etc. Once you start getting into the lowest tiers of banner sellers you start seeing a lot of real skeezy moves.
foota 10y ago
The OP meant affiliate marketing in a way separate from that of the traditional sense.

celticninja 10y ago

Already there, that's how some ransomware is already operating.

necessity 10y ago

Why scary? Are you dumb enough to get one of those?

prodigal_erik 10y ago
Like everyone I know, I run networking code written in C, so obviously the answer is yes.
raptorfactor 10y ago
Are you dumb enough to think a sufficiently motivated attacker couldn't infect someone without them being "dumb"? I guess you must be running a special OS and software that's bug-free and completely immune to exploits. Lucky you.

Taek 10y ago

All the more reason to emphasize security over the latest in features and upgradability. Why doesn't Microsoft get held accountable when a 0-day in Windows is exploited that results in loss of user funds? Without that, there's no incentive to build secure software in the first place. How do we get society to have more of a security-first approach when it comes to things connected to the internet? A lot of these vulnerabilities are scary in a systemic way. Cyber warfare would likely be as damaging as dropping napalm on cities, and it's all preventable by having more security oriented infrastructure.

rtpg 10y ago
Another angle to this: Why does Apple get away with something like 2 year support windows for their OS? We now have a bunch of people on OS 10.6.8 who will stop getting updates, but even 10.9 will fall out of support before Win7 Though I suppose the best solution would be to get everyone on the upgrade treadmill
- mschuster91 10y ago
  > Though I suppose the best solution would be to get everyone on the upgrade treadmill No. The best solution would be to require Apple, Google and MS to split up their OSes into individual packages, that can be upgraded at will, and to unlink functionality from optics in all parts of the OS. The reason is simple: most people, especially corp environments, don't upgrade their software because they see on friends' machines (or phones) that the look and feel has changed too much for them / that retraining time for employees is too expensive. A good example is the clusterfuck MS committed with Win8 by replacing the taskbar, the unremovable phone-home/unstoppable auto updater in Win10 or the various "design improvements" / "performance improvements" Apple did on OS X/iOS. Oh, and with Apple there's the high risk of critical bugs or other incompatibilities with their newest OS. Software like the Adobe suite, music/video editor programs, and even office mainstream apps Lotus f..ing Notes and Cisco's programs tend to have boatloads of bugs each major OS X release. With MS, you can at least assume that you can run any old software that doesn't require drivers...
  - 10y ago

gruez 10y ago

>If people start getting smart with backups, the response could be to switch blackmailing (pay or we'll distribute your files). how does that work when most home connections have terrible upload? to make matters worse, if you upload at full speed, people will notice that their internet is getting sluggish and notice something is up.

foota 10y ago
You could probably get away with only uploading document-ish files. No one cares if you steal their windows operating system files.
elorant 10y ago
You throttle the bandwidth or you upload at full speed when the bandwidth consumption is idle. Or if you're into blackmail you develop an algorithm that searches for nudity in pictures and upload only those. Or you extract the text from documents, zip it and then upload it. Obviously if you're into this you develop some patterns, you don't just upload everything because then you'd have to spend an eternity browsing through all those files. How many chances are there that the average user will have a file called finance or something similar in their documents folder? You could simply upload a text file with all the file names and then make selective uploads.

pizza 10y ago

Finally, a use-case for Ethereum! /s

industriousthou 10y ago

This might only be sort of related to what you're talking about, but reansomware as a service already exists. You delivery a premade executable and get a cut cut of the profits. You could install it in systems where you have physical access like your work or at a friends house or systems that you have remotely compromised.