9 ms·

Ransomware Infects 100K PCs in China, Demands WeChat Payment

150 points by known 8y ago

otoburb 8y ago
Ironically, because of government reach and close technology company collaboration, including significant minority stakes in such companies, it would seem that malware groups operating in China have to be a lot better than their counterparts operating in other countries to remain at large for very long.
- duxup 8y ago
  Is that actually the case?
- gruez 8y ago
  how is any of that relevant when malware authors are from from random countries and accept payment via cryptocurrency?
- onetimemanytime 8y ago
  Russia is probably the best bet, not China. No extradition and pay FSB their share, and you may have the best chance on earth to get away with these things.
hkai 8y ago
How is it done if every WeChat account has to be tied to a real life ID and vouched for by several established users?
- fredley 8y ago
  Real life IDs can be forged/bought, multiples can be forged to verify others. There is no technical barrier to attacks on this sort of system, only financial barriers.
  - deleted 8y ago
    [deleted]
- pixelperfect 8y ago
  I've heard this before but I created a WeChat account last week and didn't have to provide anything other than a phone number for a SMS verification code.
  - quadrature 8y ago
    I created an account last week and had to have my registration verified by an existing user who also had wechat pay enabled.
  - dangrover 8y ago
    In China, when you get a phone number, you have to give them your national ID/身份证. So anything you authenticate with a phone number could be traced back to you.
gruez 8y ago
what's the point of this when the money is obviously going frozen/siezed by the authorities?
judge2020 8y ago
Since WeChat is a central authority, it would be foolish to ask for payment to the ransomware author's actual WeChat ID. It's very likely whatever ID they're asking for payments to is automatically generated/pulled/guess/etc so that the ransomeware's only purpose is to cause havoc and/or waste the government's time. If the ransomware was created to earn money it would ask for cryptocurrency like all the others, but then it wouldn't have made as many headlines.
- dec0dedab0de 8y ago
  It's very likely whatever ID they're asking for payments to is automatically generated/pulled/guess/etc If that's true then it's kind of like the robin hood of malware.
  - jobigoud 8y ago
    Twist: use the previous victim as a recipient for the payment. This would create an interesting spread incentive for the attack: once you are infected and you pay, you can still be reimbursed if you manage to infect someone else. You could even make this into a pyramid where several person's payment go to a parent carrier, and people will even want to be infected quickly to be closer to the top of the pyramid. Or just use a random previous victim id. Now it becomes a viral non-consensual lottery and you benefit from spreading it.
- itake 8y ago
  I think you make sense, but the hacker may control some percentage of the "lucky" account holders.
- zero_iq 8y ago
  Alternative possibility: given the simple, traceable, almost begging-to-be-caught nature of the malware, and that it so easily led researchers to a name and address of a potential author, perhaps its goal is actually to frame someone... to take out a rival hacker, revenge, lulz, ...? Not saying it's what's actually happening here, but it's something that has crossed my mind before about malware - that it would be comparatively easy to lead one or more false trails to shift blame for whatever reason, and I wonder how many pieces of malware have actually managed to pull this off, and pinned the blame on an obvious target, e.g. Chinese government, "russian hackers", etc.
C1sc0cat 8y ago
Someone's familys going to get a bill for a 9mm pill.
cauldron 8y ago
"WeChat Payment" Although it's a little tricky here, but once you acquired necessary Chinese IDs with debit cards (more than easy), it's not too hard, old people in villages are more than willing to sell theirs for sevral hundred RMB. As for authorities, oh they are more busy maintaining social stability, if your case(assuming they allow you to register your case since it's obviously a dead end that effects their stats vital for promotion) are lucky enough to be included in an operation couple months later then maybe they can find out which countries these hustlers are at and cases closed.
- onetimemanytime 8y ago
  >>As for authorities, oh they are more busy maintaining social stability Never embarrass the powers that be though, 100K PCs and growing daily it's not a small incident.
  - notahacker 8y ago
    Yeah. I'm thinking the real issue with using a single set of probably bought/stolen ID and infecting a few hundred thousand PCs is that you attract just enough attention for the authorities to be motivated to track you down. And unlike cybercriminals attacking mostly Western targets, I doubt they're safely overseas.
omarforgotpwd 8y ago
Lol. THis is the programmer equivalent of dumb crooks 1. Sends money to a centralized service that can track his account, must share info with Chinese government 2. Forgot to register domain privately 3. Instead of using DES or RSA, he just XOR’d the file with a key he hard coded in the file 4. He apparently left his name a and phone number in the code? 5. When they looked at what servers it was pinging, they were able to gain access because it had not been properly secured Am I missing anything else?
- lifeformed 8y ago
  Hmm... What if it was intentional, to frame someone else?
  - chaostheory 8y ago
    You're probably right... but I wouldn't underestimate the power and prevalence of 差不多.
    - pbhjpbhj 8y ago
      Translation? I'm guessing "close enough" as in "sloppy work"?
      - chaostheory 8y ago
        pretty much here's more context: https://aeon.co/essays/what-chinese-corner-cutting-reveals-about-modernity https://aeon.co/essays/what-chinese-corner-cutting-reveals-a...
      - hnzix 8y ago
        Chabuduo - "near enough is good enough". Said when defending a half-assed solution that barely hangs together. Now that I think about it, I see this in codebases all the time.
        iwiririwo 8y ago
deleted 8y ago
[deleted]
gcbw2 8y ago
for anyone saying this is outright dumb, remember they are criminals. They are probably receiving the money in different, probably years old, honest accounts. Which the real owner is compromised (e.g. hacked. or being coerced to send the payment out as soon as it is received under threats, etc) Not seeing this is why developers should not assume they can wear the threat modeler hat. Also, when you are a B2C like ransonware folks are, it is very hard to make the victim get bitcoins even if their life depends on the data you are holding hostage. Using weechat in china gets them zero attrition.

150 points by known 8y ago

Ironically, because of government reach and close technology company collaboration, including significant minority stakes in such companies, it would seem that malware groups operating in China have to be a lot better than their counterparts operating in other countries to remain at large for very long.

duxup 8y ago
Is that actually the case?
gruez 8y ago
how is any of that relevant when malware authors are from from random countries and accept payment via cryptocurrency?
onetimemanytime 8y ago
Russia is probably the best bet, not China. No extradition and pay FSB their share, and you may have the best chance on earth to get away with these things.

hkai 8y ago

How is it done if every WeChat account has to be tied to a real life ID and vouched for by several established users?

fredley 8y ago
Real life IDs can be forged/bought, multiples can be forged to verify others. There is no technical barrier to attacks on this sort of system, only financial barriers.
- deleted 8y ago
  [deleted]
pixelperfect 8y ago
I've heard this before but I created a WeChat account last week and didn't have to provide anything other than a phone number for a SMS verification code.
- quadrature 8y ago
  I created an account last week and had to have my registration verified by an existing user who also had wechat pay enabled.
- dangrover 8y ago
  In China, when you get a phone number, you have to give them your national ID/身份证. So anything you authenticate with a phone number could be traced back to you.

gruez 8y ago

what's the point of this when the money is obviously going frozen/siezed by the authorities?

judge2020 8y ago

Since WeChat is a central authority, it would be foolish to ask for payment to the ransomware author's actual WeChat ID. It's very likely whatever ID they're asking for payments to is automatically generated/pulled/guess/etc so that the ransomeware's only purpose is to cause havoc and/or waste the government's time. If the ransomware was created to earn money it would ask for cryptocurrency like all the others, but then it wouldn't have made as many headlines.

dec0dedab0de 8y ago
It's very likely whatever ID they're asking for payments to is automatically generated/pulled/guess/etc If that's true then it's kind of like the robin hood of malware.
- jobigoud 8y ago
  Twist: use the previous victim as a recipient for the payment. This would create an interesting spread incentive for the attack: once you are infected and you pay, you can still be reimbursed if you manage to infect someone else. You could even make this into a pyramid where several person's payment go to a parent carrier, and people will even want to be infected quickly to be closer to the top of the pyramid. Or just use a random previous victim id. Now it becomes a viral non-consensual lottery and you benefit from spreading it.
itake 8y ago
I think you make sense, but the hacker may control some percentage of the "lucky" account holders.
zero_iq 8y ago
Alternative possibility: given the simple, traceable, almost begging-to-be-caught nature of the malware, and that it so easily led researchers to a name and address of a potential author, perhaps its goal is actually to frame someone... to take out a rival hacker, revenge, lulz, ...? Not saying it's what's actually happening here, but it's something that has crossed my mind before about malware - that it would be comparatively easy to lead one or more false trails to shift blame for whatever reason, and I wonder how many pieces of malware have actually managed to pull this off, and pinned the blame on an obvious target, e.g. Chinese government, "russian hackers", etc.

C1sc0cat 8y ago

Someone's familys going to get a bill for a 9mm pill.

cauldron 8y ago

"WeChat Payment" Although it's a little tricky here, but once you acquired necessary Chinese IDs with debit cards (more than easy), it's not too hard, old people in villages are more than willing to sell theirs for sevral hundred RMB. As for authorities, oh they are more busy maintaining social stability, if your case(assuming they allow you to register your case since it's obviously a dead end that effects their stats vital for promotion) are lucky enough to be included in an operation couple months later then maybe they can find out which countries these hustlers are at and cases closed.

onetimemanytime 8y ago
>>As for authorities, oh they are more busy maintaining social stability Never embarrass the powers that be though, 100K PCs and growing daily it's not a small incident.
- notahacker 8y ago
  Yeah. I'm thinking the real issue with using a single set of probably bought/stolen ID and infecting a few hundred thousand PCs is that you attract just enough attention for the authorities to be motivated to track you down. And unlike cybercriminals attacking mostly Western targets, I doubt they're safely overseas.

omarforgotpwd 8y ago

Lol. THis is the programmer equivalent of dumb crooks 1. Sends money to a centralized service that can track his account, must share info with Chinese government 2. Forgot to register domain privately 3. Instead of using DES or RSA, he just XOR’d the file with a key he hard coded in the file 4. He apparently left his name a and phone number in the code? 5. When they looked at what servers it was pinging, they were able to gain access because it had not been properly secured Am I missing anything else?

lifeformed 8y ago
Hmm... What if it was intentional, to frame someone else?
- chaostheory 8y ago
  You're probably right... but I wouldn't underestimate the power and prevalence of 差不多.
  - pbhjpbhj 8y ago
    Translation? I'm guessing "close enough" as in "sloppy work"?
    - chaostheory 8y ago
      pretty much here's more context: https://aeon.co/essays/what-chinese-corner-cutting-reveals-about-modernity https://aeon.co/essays/what-chinese-corner-cutting-reveals-a...
    - hnzix 8y ago
      Chabuduo - "near enough is good enough". Said when defending a half-assed solution that barely hangs together. Now that I think about it, I see this in codebases all the time.
      - iwiririwo 8y ago

deleted 8y ago

[deleted]

gcbw2 8y ago

for anyone saying this is outright dumb, remember they are criminals. They are probably receiving the money in different, probably years old, honest accounts. Which the real owner is compromised (e.g. hacked. or being coerced to send the payment out as soon as it is received under threats, etc) Not seeing this is why developers should not assume they can wear the threat modeler hat. Also, when you are a B2C like ransonware folks are, it is very hard to make the victim get bitcoins even if their life depends on the data you are holding hostage. Using weechat in china gets them zero attrition.