4 ms·

These are the three Bitcoin addresses referenced in the article: https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn https://blockchain.info/add

by sowbug 9y ago

These are the three Bitcoin addresses referenced in the article: https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNX... https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8is... https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6N... As of now, the three addresses have received a total of about 20 BTC, or about $36,000 at current exchange rates. The most typical transaction sends about $300 to the addresses. No funds have left the addresses yet.

martinko 9y ago
how is a specific computer linked to a payment if they reuse addresses? If they do not reuse addresses, why did those 4 receive so much btc?
- sowbug 9y ago
  I don't know, but I can think of a few possibilities: 1. The amount demanded varies from incident to incident. Bitcoin is fractional to 8 decimal places, so it's possible to narrow down the list of victims by the last N digits of the payment. 2. The original demand for payment includes instructions to list the address you sent from. This would be a lame solution for many reasons, including (1) these victims are probably all new to Bitcoin and would have no idea what an address is, and (2) according to an article I read, some security consultants keep a Bitcoin wallet handy to pay on behalf of their clients, leading to duplicate payer addresses. 3. Same as #2 but demanding that the victim include the transaction ID, which is a long hex string. Similar usability issues. 4. It's possible to embed metadata into Bitcoin transactions. As with the prior approaches, victims would likely get this wrong. Most likely there's a human criminal on the other end of the exchange, and that human matches up victims and payments. Because the paying victims are surely unsophisticated about Bitcoin and terrified about what is happening to them, it seems likely that the risk of one victim claiming another victim's payment is small, so the manual match-up method is probably the most practical solution from the criminals' standpoint.
  - Scoundreller 9y ago
    > Because the paying victims are surely unsophisticated about Bitcoin and terrified about what is happening to them, it seems likely that the risk of one victim claiming another victim's payment is small, so the manual match-up method is probably the most practical solution from the criminals' standpoint. Is it really that small? What's stopping a victim from claiming someone else's payment by watching transactions and notifying the criminal that "their" payment has been sent?
    - deleted 9y ago
      [deleted]
    - sowbug 9y ago
      If you barely understand how computers work, but you know your business's accounts receivables file is gone, and somebody is saying they will retrieve it if you send them some weird internet money, you're probably going to do exactly what they say rather than view this as a great opportunity to scam a scammer. Plus, the criminals they might be trying to scam are almost certainly the victims' only hope of obtaining the symmetric encryption key (there are exceptions; some of these programs have been shown to be written by people not entirely clear on how crypto works -- single global key, obfuscated key on client machine, etc.). By definition, the only people interested in paying are the people who have no backups of data they need, so they have no options, and taking the risk of pissing off the criminal doesn't really make sense. Moreover, for all we know, some victims haven't figured out that they're paying the same people who did the encryption in the first place. From their point of view, this is just like buying antivirus software or taking their computer to Geek Squad.
      - SolarNet 9y ago
        > not entirely clear on how crypto works Sometimes they accidentally weaken the algorithm (like by chopping it's key bits in half through a weak RNG). Crypto is hard, even when the scammer probably has a good grasp. Which is useful in this case.
Scoundreller 9y ago
What's with the people sending 0.0001 BTC (~17 cents), and paying a .0004 transaction fee (~82 cents) all about?
- awake 9y ago
  Possibly researchers? Or people who don't know how bit coin works. No idea though...
- pmorici 9y ago
  This is pretty common whenever there is a Bitcoin theft people sent small amounts of Bitcoin to the suspected theft address. I believe they do it as a means to tracking what happens to the stolen funds. It keeps them from having to keep track of every address instead they just send a small amount of BTC to it and then they just need to remember their wallet address in the future to track to all the addresses they "marked".
  - Scoundreller 9y ago
    Another theory is that it's Law Enforcement. In order to get a conviction, their case is improved if they can show a trail of money just in case they can't get a witness that paid the ransom to testify with proper documentation.
easilyBored 9y ago
"...or about $36,000 at current exchange rates" Not enough to make up for having every spy agency on your back. Is there a realistic way to get the funds free and clear even if NSA /FBI /CIA / et al are on your trail?
grkvlt 9y ago
So, it would seem reasonable to assume that around ~120 people/entities have caved in to the ransom demand and paid the USD 300? I wonder if they all actually got their files decrypted?
- mcv 9y ago
  What surprises me about this case is how little information there is about that. Has anyone paid? Did they get their content back? If so, that would encourage others to pay up, making this attack more profitable, and more likely in the future. So I suppose that's why everybody keeps quiet about this. But for important systems, $300 is very cheap compared to restoring the system from backup including all the missed operation time, so I can imagine a lot of people would be tempted to pay. If really only 120 people paid, I'd find that quite surprising.
  - liberte82 9y ago
    A lot of people probably don't know how to pay by bitcoin. I expect this number to jump up as deadlines approach and people figure it out.
  - deleted 9y ago
    [deleted]
dmix 9y ago
It's up to 32BTC / $55,400 today. Not much given the global outcry but I guess the ransom part wasn't the interesting thing. Is this just from the one version? Or are there other addresses in use?

by sowbug 9y ago

martinko 9y ago

how is a specific computer linked to a payment if they reuse addresses? If they do not reuse addresses, why did those 4 receive so much btc?

sowbug 9y ago
I don't know, but I can think of a few possibilities: 1. The amount demanded varies from incident to incident. Bitcoin is fractional to 8 decimal places, so it's possible to narrow down the list of victims by the last N digits of the payment. 2. The original demand for payment includes instructions to list the address you sent from. This would be a lame solution for many reasons, including (1) these victims are probably all new to Bitcoin and would have no idea what an address is, and (2) according to an article I read, some security consultants keep a Bitcoin wallet handy to pay on behalf of their clients, leading to duplicate payer addresses. 3. Same as #2 but demanding that the victim include the transaction ID, which is a long hex string. Similar usability issues. 4. It's possible to embed metadata into Bitcoin transactions. As with the prior approaches, victims would likely get this wrong. Most likely there's a human criminal on the other end of the exchange, and that human matches up victims and payments. Because the paying victims are surely unsophisticated about Bitcoin and terrified about what is happening to them, it seems likely that the risk of one victim claiming another victim's payment is small, so the manual match-up method is probably the most practical solution from the criminals' standpoint.
- Scoundreller 9y ago
  > Because the paying victims are surely unsophisticated about Bitcoin and terrified about what is happening to them, it seems likely that the risk of one victim claiming another victim's payment is small, so the manual match-up method is probably the most practical solution from the criminals' standpoint. Is it really that small? What's stopping a victim from claiming someone else's payment by watching transactions and notifying the criminal that "their" payment has been sent?
  - deleted 9y ago
    [deleted]
  - sowbug 9y ago
    If you barely understand how computers work, but you know your business's accounts receivables file is gone, and somebody is saying they will retrieve it if you send them some weird internet money, you're probably going to do exactly what they say rather than view this as a great opportunity to scam a scammer. Plus, the criminals they might be trying to scam are almost certainly the victims' only hope of obtaining the symmetric encryption key (there are exceptions; some of these programs have been shown to be written by people not entirely clear on how crypto works -- single global key, obfuscated key on client machine, etc.). By definition, the only people interested in paying are the people who have no backups of data they need, so they have no options, and taking the risk of pissing off the criminal doesn't really make sense. Moreover, for all we know, some victims haven't figured out that they're paying the same people who did the encryption in the first place. From their point of view, this is just like buying antivirus software or taking their computer to Geek Squad.
    - SolarNet 9y ago
      > not entirely clear on how crypto works Sometimes they accidentally weaken the algorithm (like by chopping it's key bits in half through a weak RNG). Crypto is hard, even when the scammer probably has a good grasp. Which is useful in this case.

Scoundreller 9y ago

What's with the people sending 0.0001 BTC (~17 cents), and paying a .0004 transaction fee (~82 cents) all about?

awake 9y ago
Possibly researchers? Or people who don't know how bit coin works. No idea though...
pmorici 9y ago
This is pretty common whenever there is a Bitcoin theft people sent small amounts of Bitcoin to the suspected theft address. I believe they do it as a means to tracking what happens to the stolen funds. It keeps them from having to keep track of every address instead they just send a small amount of BTC to it and then they just need to remember their wallet address in the future to track to all the addresses they "marked".
- Scoundreller 9y ago
  Another theory is that it's Law Enforcement. In order to get a conviction, their case is improved if they can show a trail of money just in case they can't get a witness that paid the ransom to testify with proper documentation.

easilyBored 9y ago

"...or about $36,000 at current exchange rates" Not enough to make up for having every spy agency on your back. Is there a realistic way to get the funds free and clear even if NSA /FBI /CIA / et al are on your trail?

grkvlt 9y ago

So, it would seem reasonable to assume that around ~120 people/entities have caved in to the ransom demand and paid the USD 300? I wonder if they all actually got their files decrypted?

mcv 9y ago
What surprises me about this case is how little information there is about that. Has anyone paid? Did they get their content back? If so, that would encourage others to pay up, making this attack more profitable, and more likely in the future. So I suppose that's why everybody keeps quiet about this. But for important systems, $300 is very cheap compared to restoring the system from backup including all the missed operation time, so I can imagine a lot of people would be tempted to pay. If really only 120 people paid, I'd find that quite surprising.
- liberte82 9y ago
  A lot of people probably don't know how to pay by bitcoin. I expect this number to jump up as deadlines approach and people figure it out.
- deleted 9y ago
  [deleted]

dmix 9y ago

It's up to 32BTC / $55,400 today. Not much given the global outcry but I guess the ransom part wasn't the interesting thing. Is this just from the one version? Or are there other addresses in use?