7 ms·
Global ‘Wana’ Ransomware Outbreak Earned Perpetrators $26k So Far
- jstanley 9y agoWhat a shame. They've surely done many orders of magnitude more than $26k worth of damage. They've done a really really bad job at monetising their impact.
- supernovae 9y agoTrue, the damages they have done far surpass the ransom income, but the inflation of the currency itself based on global attacks probably helps them over the long haul. Sort of crazy that bitcoin markets react to ransom hauls in a positive way and to me - that is the biggest danger to bitcoin and a large source of potential revenue.
- sonofgod 9y ago$55k, now. https://twitter.com/actual_ransom/ https://twitter.com/actual_ransom/
- mtgx 9y agoIt's because they asked for $300 when they could've asked for $30,000, considering they infected a lot of large organizations.
- celticninja 9y ago$300 per machine, not per network.
- gorbachev 9y ago$26K and the spot on every most wanted cyber criminal list on the planet. Congratulations guys, well done!
- AlwaysBCoding 9y agoThe flaw in their plan is that the intersection of people capable of figuring out how to pay a ransom payment in Bitcoin, and people still using Windows XP, is pretty small.
- alttab 9y agoAlmost makes you think the hysteria was the goal. The next illuminating question is "why," and the fallout the next couple of weeks will answer that. Problem -> Reaction -> Solution.
- sp332 9y agoThey have very detailed instructions in 20 languages. It's much more user-friendly than most software these days.
- josephorjoe 9y agoBut their price point was set too high for their market. Turns out that for a lot of victims wiping their old computer was deemed less expensive than the cost, nuisance, and risk of paying criminals through some shady internet fake money thing to possibly avoid having to wipe their computer. For anyone with a recent backup of their data, I can't think of why they'd pay.
- MR4D 9y agoI think you are way underestimating the percentage of people who have good backups of their data. HN'ers might, but HN would not be a representative sample.
- sp332 9y agoA lot of the high-profile systems getting hit are embedded mission-critical systems. They'd be getting some amount of IT attention. And systems that aren't that important might not be important enough to ransom - just wipe and start over.
- Retr0spectrum 9y agoConsidering nobody has had their files decrypted yet, I'm almost surprised how high this figure is. You'd think some people would do at least a bit of research before throwing $300 down the drain.
- sp332 9y agoThat's not true. The process to send out the decryption key is apparently manual and slow, and some people haven't received keys https://twitter.com/MalwareTechBlog/status/864181453759938563 https://twitter.com/MalwareTechBlog/status/86418145375993856... but some have. https://twitter.com/mikko/status/864107673146490880 https://twitter.com/mikko/status/864107673146490880
- Retr0spectrum 9y agoThanks, unfortunately it's too late to edit my comment now.
- alexc05 9y agoWhat would be really interesting to me is the reverse-engineering of the outbound bitcoin to trace this back to real/named individuals. Consider that every transaction is public information - so any bitcoin spent from that wallet has to go somewhere. A friend threw out a stat for me while we were discussing this the other day that something like 80% of existing wallets are owned within places like coinbase where they are associated with named individuals. (I don't know if that is true, but for the purposes of this strategy it's the assumption I'll stick with) Anyways - assuming 80% of wallets can be traced by law enforcement to named individuals. Imagine that you set an alert to watch all outbound transactions from any of those three wallets. After each transaction, do a lookup on the owner of the receiving wallet. If it is a named individual, interview them to find out how they got this money. Who just sent them a bitcoin? If the wallet is not owned by a named individual, add it to the watch-list. Repeat for all outbound transactions from that wallet until you can trace it back. I'm interested to know how many steps it would take to arrive at the actual criminal.
- matt-attack 9y agoIf bitcoin were truly that ineffective for use by extortionists, why is it so commonly used? Note: I'm truly asking a question, I know very little about the subject.
- moosingin3space 9y agoMy guess is that BTC, while not effectively anonymous, does make it easy to use temporary accounts for receipt of extortion money.
- marcosdumay 9y agoHonestly, I'm repeating this question for years. I still didn't come-up with a good answer. The best that I got is that those criminals rely on living in countries with weak rule of law, and Bitcoin makes for just enough obfuscation that those countries won't investigate them, while countries wiling to investigate don't want to disclaim they have the ability. Besides, anonymity is not the only feature of Bitcoin useful for criminals. There's also the fact that transactions can not be stopped or undone. Those may be even more important.
- api 9y agoWe really should make it illegal to pay ransom. The only ultimate solution to this problem is to eliminate the incentive.
- matt-attack 9y agoAh yes, the old: "This action harms no one but yourself, but we wish to protect you from yourself, so the solution is to turn you into a criminal when you perform said action. For your own good of course."
- dsp1234 9y agoThis action harms no one but yourself Paying a ransom is the opposite of this. The action only helps yourself, but harms everyone else, but providing funds to the ransomer.
- npongratz 9y ago> Paying a ransom is the opposite of this. The action only helps yourself, but harms everyone else, but providing funds to the ransomer. Reminds me of my relationship with the people who call themselves the taxing authorities.
- paulgb 9y agoIt's not to protect you from yourself, it's to protect you from others. It's like how some shops have "cashier cannot access safe" signs -- it's not necessarily that they don't trust the cashier, it's that it prevents the cashier from becoming a target.
- mootothemax 9y agoWould they make more money if they demanded $10 instead of $300? While $300 isn't crazy money, it's more than enough to be painful, and definitely feels like ransom. I wonder how many people facing a locked computer would sigh, say a few choice swearwords, and dig out their cards had it been a relatively low amount.
- vec 9y agoAsking to get paid in Bitcoin is already a stiff barrier to entry for most users, so probably not. $300 feels close to the upper threshold where people who already care enough to not balk at the Bitcoin requirement also won't balk at the sticker price.
- mootothemax 9y agoAhh, yeah you're totally right, I keep forgetting that the victims need to pay with bitcoin. Well. I guess it's good that there's not a more convenient way to give in to the criminals' demands!
- tyingq 9y agoThey probably would have made more by being quiet about the infection and renting it out as a botnet, or selling whatever interesting data they found.
- paulgb 9y agoThey passed up a good opportunity for price discovery: have the ransomware pick a random number between, say, 10 and 1000 and learn from that for future attacks.
- DenisM 9y agoThey could also make a machine learning model to take into account the part of the world, the hardware model, and other wealth indicators.
- 9y ago
- giis 9y agoDid they actually decrypted the files after getting money from victims? It would be interesting, if some white-hat security researcher, pays the $300 money and gets the solution (reverse engineering) . Make its available for free to everyone :)
- outworlder 9y agoCrypto doesn't work like that.
- Cyph0n 9y agoIt depends on the implementation. Even so, it's always easier for the authors to patch the malware than it is for researchers to reverse it.
- leggomylibro 9y agoAs much as parts of the worm do look kind of amateur-ish, it's probably still a stretch to assume that they used the same encryption key for every infection.
- suyash 9y agoReally good technical analysis of WannaCry for hackers (in a good sense): https://www.youtube.com/watch?v=d_j8UUQbJsc https://www.youtube.com/watch?v=d_j8UUQbJsc
- psyc 9y agoSure, Silicon Valley probably won't jump on this bandwagon. But it's ok for a lifestyle business to have modest goals.
- jmcdiesel 9y agoIs this a point to the downside of bitcoin? Im not against it at all still, but this does prove it to be a viable method of payment for shady business that can't reasonably be tracked... without bitcoin (or other crytocurrency), what methods would be in place to collect this money that wouldnt be easily tracked?
- ouid 9y agoIsn't tax evasion the whole point of bitcoin?
- datatan 9y agoDecentralization is the point of Bitcoin. It can still be taxed in any number of ways.
- ouid 9y agoThe only reason to care about centralized currency is the possibility that whoever owns the central bank will simply print more. This is equivalent to taxation. edit: >any number of ways what about zero?
- nonbel 9y ago"The warning informs the user that to unlock their system, they would have to pay a fine using a voucher from an anonymous prepaid cash service such as Ukash or Paysafecard. [...] By August 2012, a new variant of Reveton began to spread in the United States, claiming to require the payment of a $200 fine to the FBI using a MoneyPak card. [...] Rather surprisingly, Fusob suggests using iTunes gift cards for payment." https://en.wikipedia.org/wiki/Ransomware https://en.wikipedia.org/wiki/Ransomware Apparently at least Ukash, Paysafecard, MoneyPak card, and iTunes gift cards have all been used.
- tobyjsullivan 9y agoWestern Union? Scammers have had means of collecting payouts since the beginning of scams. One interesting counter point here is that the money hasn't disappeared. Literally every cent that has been paid to one of these Bitcoin addresses can be traced through all future purchases by anyone on the internet. The money will, of course, be combined with other amounts as transactions occur but that doesn't kill the trail. If any of it does end up in a wallet which a government can tie to a real person, an investigator can start working backwards. This is no different from marked bills in a more traditional ransom payment. Not perfect, but proven effective.
- kjsujwai 9y agoArticle is a couple of days old now. If you do the math right as im writing this it'd be 33.8 bitcoins. at $1721 per coin the total is over $58,000. All points Krebs mentions are still valid however.
- pasbesoin 9y agoIf this were me, I'd be running away from it as fast as possible. It's entered meatspace, with players like the FBI, FSB, China (not sure about their acronyms), and anyone else who feels they have a stake. If you aren't state-sponsored and protected (by a competent state, however corrupt), you aren't going to win against them. Not when you have a physical body, family, and friends to protect. (And even if you aren't state-sponsored, do you want to be on high-vigilance for 10+ years? No trips abroad? And how do you stay useful enough to maintain that protection? And how, regardless of internal political turmoil?) P.S. Not to mention, the competent (as opposed to the other) and very resource rich aspects of their intelligence services. Which can add up to a lot of haystack sifting.