3 ms·

If there's an engineer who can pull this off why are they screwing around with ransomware? Have them send me their resume, if they can deploy code to our fronte

If there's an engineer who can pull this off why are they screwing around with ransomware? Have them send me their resume, if they can deploy code to our frontend transparently without customers or devops having to spend time or even noticing it we'll happily pay them more than they're asking for in ransom. Edit : thinking about it, this story doesn’t add up. Doesn’t this mean the client must have a copy of the decryption key, meaning any cached client would render the ransom demand worthless? It’s just also so much easier, if someone has that level of access, to make a copy of the database, encrypt it, then blow away the old one. Doing a silent deploy of client code with no one noticing seems way harder.

bin0 7y ago
Honestly, many of them are in nations where they are working for a state-sponsored cybercrime agency and have few other options, if any. North Korea and Iranian gov'ts are major purveyors of ransomware; I've known many clients who were breached by them (FBI guys said it was usually one of them each time). If not, it's probably Russia or China, especially if it's a higher-value target. If it's just a private citizen flinging exploits at ip ranges, it's possibly Brazil too. Honestly, it used to be Eastern Europe, until we started realizing they've got some serious programming talent and contracted some work out. Now it's less bad, though still a bit sketchy. Of course, this doesn't help nation-state attacks.
wildduck 7y ago
> if they can deploy code to our frontend transparently without customers or devops having to spend time or even noticing it we'll happily pay them more than they're asking for in ransom. Where should I send the resume?
ec109685 7y ago
The client only had the decryption key in memory (the curl part of their story). Where it breaks down is assuming only the web server that is compromised has access to the database.

bin0 7y ago

Honestly, many of them are in nations where they are working for a state-sponsored cybercrime agency and have few other options, if any. North Korea and Iranian gov'ts are major purveyors of ransomware; I've known many clients who were breached by them (FBI guys said it was usually one of them each time). If not, it's probably Russia or China, especially if it's a higher-value target. If it's just a private citizen flinging exploits at ip ranges, it's possibly Brazil too. Honestly, it used to be Eastern Europe, until we started realizing they've got some serious programming talent and contracted some work out. Now it's less bad, though still a bit sketchy. Of course, this doesn't help nation-state attacks.

wildduck 7y ago

> if they can deploy code to our frontend transparently without customers or devops having to spend time or even noticing it we'll happily pay them more than they're asking for in ransom. Where should I send the resume?

ec109685 7y ago

The client only had the decryption key in memory (the curl part of their story). Where it breaks down is assuming only the web server that is compromised has access to the database.