5 ms·

They only wanted 1,500 EUR? That seems like an awfully low number for something this serious.

by eridius 10y ago

adevine 10y ago
They were very smart to make it that low. At that cost, it becomes a simple no-brainer for the hotel, because it's cheaper than even just one booking refund. It also means it's very low priority for law enforcement.
joshmn 10y ago
That's my first reaction too. While I'm not condoning this action... 10x that.
pushECX 10y ago
I believe the strategy is usually to demand an amount that is enough to be annoying but not so much that it is prohibitive. Ideally, the target is willing to quickly pay the money to unlock their systems. > The manager said it was cheaper and faster for the hotel to just pay the Bitcoin.
- phil21 10y ago
  Yep, you want something the manager of the local enterprise can authorize out of his petty cash - not something he has to call the CEO in on for a decision. Even better if the guy tries to hide it out of fear of being fired for incompetence - which is the general way these things go.
rdtsc 10y ago
Seemed low as as well, but making it too high would have meant the hotel might have just called a locksmith to break the locks and then decided to replace the system. Any good parasite knows not to disturb the host system too much.
Taek 10y ago
If you ask for too much you'll have serious law enforcement coming after you. Ask for only a little bit and the focus is more on the fact that the hotel was idiotic for letting this happen then it is on the hackers. Especially with the standard policy of "we do not negotiate". That policy is really hard to justify when the amount is so small compared to the damage of delaying payment.
dredmorbius 10y ago
It's a useful way to, say, speculating wildly, provide an honest signal to someone not convinced of your hacking capabilities that you've actually got the technical skills claimed. Now ... if only I could think of, say, some geopolitically significant hospitality enterprise, possibly with widespread or global operations, against which such a proven attack might be of interest.
cube00 10y ago
Don't forget the back door they put in, they were going to repeat this a few times by the sound of it.
tom_mellior 10y ago
> They only wanted 1,500 EUR? That seems like an awfully low number for something this serious. Besides the argument of picking a sum that makes it relatively easy for a business to cough up, this is 1500 EUR tax-free. https://en.wikipedia.org/wiki/List_of_European_countries_by_average_wage https://en.wikipedia.org/wiki/List_of_European_countries_by_... lists average net monthly income in Austria as 2000 EUR; pull something like this off twice a month and you're doing fine.
- mseebach 10y ago
  It's not "tax free", it's illegal income to which tax is a pretty orthogonal concern. You have to consider a fairly high discount on any non-trivial illegal income, as there are many things you can't do with it without laundering them first (which is very expensive to do at scale).
BuuQu9hu 10y ago
RT article reports it's 1.5 million EUR;claims to quote "Local" https://deutsch.rt.com/newsticker/45871-osterreichisches-hotel-zahlt-hackern/ https://deutsch.rt.com/newsticker/45871-osterreichisches-hot...

They only wanted 1,500 EUR? That seems like an awfully low number for something this serious.

by eridius 10y ago

They only wanted 1,500 EUR? That seems like an awfully low number for something this serious.

They were very smart to make it that low. At that cost, it becomes a simple no-brainer for the hotel, because it's cheaper than even just one booking refund. It also means it's very low priority for law enforcement.

joshmn 10y ago

That's my first reaction too. While I'm not condoning this action... 10x that.

pushECX 10y ago

I believe the strategy is usually to demand an amount that is enough to be annoying but not so much that it is prohibitive. Ideally, the target is willing to quickly pay the money to unlock their systems. > The manager said it was cheaper and faster for the hotel to just pay the Bitcoin.

phil21 10y ago
Yep, you want something the manager of the local enterprise can authorize out of his petty cash - not something he has to call the CEO in on for a decision. Even better if the guy tries to hide it out of fear of being fired for incompetence - which is the general way these things go.

rdtsc 10y ago

Seemed low as as well, but making it too high would have meant the hotel might have just called a locksmith to break the locks and then decided to replace the system. Any good parasite knows not to disturb the host system too much.

Taek 10y ago

If you ask for too much you'll have serious law enforcement coming after you. Ask for only a little bit and the focus is more on the fact that the hotel was idiotic for letting this happen then it is on the hackers. Especially with the standard policy of "we do not negotiate". That policy is really hard to justify when the amount is so small compared to the damage of delaying payment.

dredmorbius 10y ago

It's a useful way to, say, speculating wildly, provide an honest signal to someone not convinced of your hacking capabilities that you've actually got the technical skills claimed. Now ... if only I could think of, say, some geopolitically significant hospitality enterprise, possibly with widespread or global operations, against which such a proven attack might be of interest.

cube00 10y ago

Don't forget the back door they put in, they were going to repeat this a few times by the sound of it.

tom_mellior 10y ago

> They only wanted 1,500 EUR? That seems like an awfully low number for something this serious. Besides the argument of picking a sum that makes it relatively easy for a business to cough up, this is 1500 EUR tax-free. https://en.wikipedia.org/wiki/List_of_European_countries_by_average_wage https://en.wikipedia.org/wiki/List_of_European_countries_by_... lists average net monthly income in Austria as 2000 EUR; pull something like this off twice a month and you're doing fine.

mseebach 10y ago
It's not "tax free", it's illegal income to which tax is a pretty orthogonal concern. You have to consider a fairly high discount on any non-trivial illegal income, as there are many things you can't do with it without laundering them first (which is very expensive to do at scale).

BuuQu9hu 10y ago

RT article reports it's 1.5 million EUR;claims to quote "Local" https://deutsch.rt.com/newsticker/45871-osterreichisches-hotel-zahlt-hackern/ https://deutsch.rt.com/newsticker/45871-osterreichisches-hot...