8 ms·

I like to think that they know anything they implement will eventually get blocked, so they have a big collection of unexploited evasion tricks and just introdu

by 13of40 9y ago

I like to think that they know anything they implement will eventually get blocked, so they have a big collection of unexploited evasion tricks and just introduce them one by one.

nray 9y ago
I like to think wankers who stop hospitals go to jail and never work with a PC again. It would be nice if those BTC were hard to cash out too.
- 13of40 9y ago
  I've seen ransomware that explicitly tried to avoid hospitals, schools, government, etc., so there's that. I always assumed it was out of self interest though.
  - walshemj 9y ago
    Yes screwing some Radom punter over is quite different that triggering an attack that meets the crtiteria for a CNI attack. All this means instead of pc plod being unable extradite the perps from eastern Europe to you get the serious players involved.
- meowface 9y ago
  Not that it exonerates them whatsoever, but these kinds of attacks (including Wana Cryptor) usually aren't tailored for hospitals or any particular institution. They just harvest as many email addresses as they can (from leaks and purchased lists from spammers, etc.) and try to get as many infections as possible. Hospitals just happened to be disproportionately affected by this attack because a lot of them have ineffective IT departments/mangement and never applied the MS17-010 patch. Of course, these people are still felons and are likely responsible for millions of lost family photos, work and school documents, etc. They just aren't going out of their way to target hospitals.
  - toyg 9y ago
    > never applied the MS17-010 patch. Until today, there was nothing to apply if your computers were running XP or 2003. Guess which Windows versions are the most popular in UK hospitals? So I think your sentence should read like "Hospitals just happened to be disproportionately affected by this attack because they were forced to trust Microsoft would never put corporate profit before social responsibility."
    - meowface 9y ago
      XP and 2003 have been end-of-life for years. They both were released 14+ years ago. So you can just change what I said to: "because a lot of them have ineffective IT departments/mangement and never applied the MS17-010 patch or are running ancient operating systems." edit: And in fact, Microsoft did release a special XP hotfix for this vulnerability yesterday: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ https://blogs.technet.microsoft.com/msrc/2017/05/12/customer...
      - stuartd 9y ago
        > because a lot of them are running ancient operating systems that are the only ones that can interoperate with legacy hardware FTFY
        linkregister 9y ago
        What news reports said anything about legacy hardware? The BBC and Reuters articles claimed the NHS suffered infection of their patient records servers and their reception computers.
        ptaipale 9y ago
        Apparently the impacted XP and 2003 machines were accessing the same disk servers as the patient record systems. Thus an infected CAT scanner controller (or whatever) was able to destroy the patient records. That doesn't tell a story of missing money or maintenance contracts. It tells of poor or even irresponsible and incompetent deployment procedures. You shouldn't allow your CAT scanner to write over your patient records at a server. You shouldn't even have them in the same network segment.
- smitherfield 9y ago
  It probably originated in Russia or one of the other cybercrime-heavy ex-Soviet states (Ukraine, Belarus, etc), so outside the jurisdiction of UK authorities. Although this time it appears to have done most of its damage in Russia, so the perpetrators might not benefit from the usual blind eye.
- idonotknowwhy 9y ago
  Nah, let's not jeopardize the fungibility of bitcoins please. Besides, with anon-coins like zcash, what you're proposing would not be possible.
- mirimir 9y ago
  No argument about the hospitals. But making BTC hard to cash out is a hard problem. Although particular addresses can be blacklisted, mixing services are now mainstream. Some return fresh BTC from miners. Even so, it's problematic to mix humongous quantities. For example, the Sheep Marketplace owner/thief overwhelmed Bitcoin Fog with 10^5 BTC. The trail went dead after that, but he got busted while cashing out. His girlfriend was receiving huge international wire transfers, and could not explain where the money was coming from.

by 13of40 9y ago

I like to think that they know anything they implement will eventually get blocked, so they have a big collection of unexploited evasion tricks and just introduce them one by one.

nray 9y ago

I like to think wankers who stop hospitals go to jail and never work with a PC again. It would be nice if those BTC were hard to cash out too.

13of40 9y ago
I've seen ransomware that explicitly tried to avoid hospitals, schools, government, etc., so there's that. I always assumed it was out of self interest though.
- walshemj 9y ago
  Yes screwing some Radom punter over is quite different that triggering an attack that meets the crtiteria for a CNI attack. All this means instead of pc plod being unable extradite the perps from eastern Europe to you get the serious players involved.
meowface 9y ago
Not that it exonerates them whatsoever, but these kinds of attacks (including Wana Cryptor) usually aren't tailored for hospitals or any particular institution. They just harvest as many email addresses as they can (from leaks and purchased lists from spammers, etc.) and try to get as many infections as possible. Hospitals just happened to be disproportionately affected by this attack because a lot of them have ineffective IT departments/mangement and never applied the MS17-010 patch. Of course, these people are still felons and are likely responsible for millions of lost family photos, work and school documents, etc. They just aren't going out of their way to target hospitals.
- toyg 9y ago
  > never applied the MS17-010 patch. Until today, there was nothing to apply if your computers were running XP or 2003. Guess which Windows versions are the most popular in UK hospitals? So I think your sentence should read like "Hospitals just happened to be disproportionately affected by this attack because they were forced to trust Microsoft would never put corporate profit before social responsibility."
  - meowface 9y ago
    XP and 2003 have been end-of-life for years. They both were released 14+ years ago. So you can just change what I said to: "because a lot of them have ineffective IT departments/mangement and never applied the MS17-010 patch or are running ancient operating systems." edit: And in fact, Microsoft did release a special XP hotfix for this vulnerability yesterday: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ https://blogs.technet.microsoft.com/msrc/2017/05/12/customer...
    - stuartd 9y ago
      > because a lot of them are running ancient operating systems that are the only ones that can interoperate with legacy hardware FTFY
      - linkregister 9y ago
        What news reports said anything about legacy hardware? The BBC and Reuters articles claimed the NHS suffered infection of their patient records servers and their reception computers.
        ptaipale 9y ago
        Apparently the impacted XP and 2003 machines were accessing the same disk servers as the patient record systems. Thus an infected CAT scanner controller (or whatever) was able to destroy the patient records. That doesn't tell a story of missing money or maintenance contracts. It tells of poor or even irresponsible and incompetent deployment procedures. You shouldn't allow your CAT scanner to write over your patient records at a server. You shouldn't even have them in the same network segment.
smitherfield 9y ago
It probably originated in Russia or one of the other cybercrime-heavy ex-Soviet states (Ukraine, Belarus, etc), so outside the jurisdiction of UK authorities. Although this time it appears to have done most of its damage in Russia, so the perpetrators might not benefit from the usual blind eye.
idonotknowwhy 9y ago
Nah, let's not jeopardize the fungibility of bitcoins please. Besides, with anon-coins like zcash, what you're proposing would not be possible.
mirimir 9y ago
No argument about the hospitals. But making BTC hard to cash out is a hard problem. Although particular addresses can be blacklisted, mixing services are now mainstream. Some return fresh BTC from miners. Even so, it's problematic to mix humongous quantities. For example, the Sheep Marketplace owner/thief overwhelmed Bitcoin Fog with 10^5 BTC. The trail went dead after that, but he got busted while cashing out. His girlfriend was receiving huge international wire transfers, and could not explain where the money was coming from.