12 ms·
Ransomware gangs now outing victim businesses that don't pay
- Miner49er 7y agoAnyone have a link to Maze's website?
- jacquesm 7y agoObviously even if someone did have that link they should not post it here. Giving wider visibility to this makes the problem worse, though I'm all for releasing the names of those companies.
- avthrow9 7y ago> Giving wider visibility to this makes the problem worse, though I'm all for releasing the names of those companies. Aren't these mutually exclusive positions?
- jacquesm 7y agoNo, because the data affects the data subjects but the names of the companies just affect the companies and gives their customers a fighting chance at limiting the damage.
- syntheticcorp 7y agoIt's indexed on Google and you can find it by searching for phrases from the posted screenshots. Be careful opening the files on there.
- lacker 7y agoJust imagine how much Facebook would pay up if a hacker had exfiltrated the database of all private Facebook messages, and was threatening to release them.
- Mirioron 7y agoFacebook is so big and so much money is involved there that I think a hacker wouldn't be able to get much out of Facebook. When you steal billions from people then rules sometimes get bent when dealing with you.
- bagacrap 7y agoWhat incentive would the hackers have for actually deleting their copy after receiving payment?
- sparrish 7y agoThey're not just outing them, they're dumping their data. That changes the risk dynamic significantly. Before, if you didn't pay, you didn't get your data back. Now, you don't pay, they expose all your data to the world. For some companies, that will be a significantly more compelling reason to pay the ransom.
- rev_null 7y agoIf you don't pay and they expose your data to the world, doesn't that mean you can effectively get it back without paying?
- turbostyler 7y agoBig brain time
- inetknght 7y agoWhat makes you think the data is complete and/or hasn't been poisoned?
- giancarlostoro 7y agoWhat if the data is highly proprietary and now all your competitors have access?
- simcop2387 7y agoThere are legal avenues you can use for that. the bigger danger (for most cases at least) is raised by your sibling, you can't trust the data anymore to be the same either innocently or maliciously.
- jacquesm 7y agoOn the plus side, you get your data back. Kidding aside, these are serious breaches and it would be good to at least have the names of the companies out there. By law they were required to report anyway and the local authorities in turn would publish / fine. So downloading this data would be strictly off-limits but the names of the companies should be public so that people at least have a chance to know that they have been affected.
- C1sc0cat 7y agoIs this not a confession, anyone connected to the domain and the hosting asn and the ISP is going to have good opsec or not ever travel outside certain countries.
- gruez 7y ago>anyone connected to the domain and the hosting asn and the ISP is going to have good opsec Why would the hosting company/ISP be at risk? Just run it from a non-US extradition friendly country, and say that you won't take any action unless there's a court order from your local court.
- C1sc0cat 7y agoConspiracy, computer misuse laws for one and if you targeted CNI sites - much stronger laws -)
- deleted 7y ago[deleted]
- buboard 7y agoSome of us mentioned that this would happen once GDPR came out. Not disclosing breaches is now a punishable offense, and this becomes a weapon in the hands of malicious hackers.
- kardos 7y agoViewed from the 'sometimes things have to get worse before they get better' lens, it might drive better security/backups/etc in the medium term.
- macintux 7y agoIf anything, this escalation would seem to _discourage_ backups. Backups are another way to leak data.
- mannykannot 7y agoAny adminstrator who thinks that is a rational policy should be fired.
- ls612 7y agoAgreed, but a lawyer who thought it is a rational policy may be right. And if the IT admin is arguing against the counsel he is unlikely to win that argument.
- mannykannot 7y agoIn what way would a lawyer who thought it is a rational policy be right?
- jessaustin 7y agoHe might be general counsel, in which case he would outrank any IT admin. In many organizations, that is another way to be "right".
- zelly 7y agoMaybe this will convince businesses to encrypt user data end-to-end. Either lose the pennies you would've made from data mining or lose real millions from getting ransomed. Your choice.
- elcomet 7y agoUsually you can't. Services depend on user data, so the company needs the key. It works only for storage service basically (or messaging, where the two have the keys).
- openasocket 7y agoFor many businesses that's not really possible. For your standard e-commerce website the majority of the data you have is what people are ordering. How do you end-to-end encrypt that? What about internal documents and memos? User names and email addresses (not as valuable as passwords but still useful if you join it against other data sets)?
- zelly 7y agoYes, it's very hard. They would have to completely re-architecture their systems. For e-commerce, the client can sign his or her address with the shipper's public key, so that only the shipper and the recipient are guaranteed to know the address. To the user, this could happen transparently without any change in UX, where the e-commerce website acts like a keyserver. For email addresses, phone numbers, names, etc. it is more difficult. You can't just store a hash of the email address if you want to ever be able to email your customers. Internal documents can be more trivially end-to-end encrypted. Imagine the whole company shares a WhatsApp group chat. Nobody has to ever hold a plaintext copy of an internal document. Only permit access on company devices which hold the keys in hardware.
- eli 7y agoI assume most of these occur through phishing and very few occur by someone sniffing unencrypted data in transit.
- 7y ago
- loup-vaillant 7y ago> Less than 48 hours ago, the cybercriminals behind the Maze Ransomware I'd rather just call them "criminals". The "cyber" prefix is generally unnecessary, and sometimes even misleading.
- catalogia 7y agoYeah but reporting on "cybercrime" sounds a lot more glamorous than reporting on "crime."
- Jach 7y agoAdd to your favorite text substitution add-on the mapping "cyber" -> "spider" and you'll be less annoyed at its pervasive use.
- sombremesa 7y agoSo, what'd you think of Elon's spidertruck?
- gbmor 7y agoSpidernetics Spiderterrorism Spider-espionage Spiderspace Spidercrime Yep, terrifying.
- moepstar 7y agoI recall a browser extension that replaced all instances of "cloud" with "butt" (or something like that)... Maybe it's time for an update? :)
- lainga 7y ago"ship-helmsmen-turned-criminals"
- _trampeltier 7y agoIf you had good backups, you didn't had to pay until now. But to make the data public, they have to download all the data first. This might be detected. I know from several companys who did set up the complete network again. The most prominent company I know at moment is Pilz (pilz.com). There website was almost down for a month. Now after 2 months it possible to download datasheets and manuals again.
- blackflame 7y agoTo be fair, if you are taken over by ransomware, it's probably the best decision to start from scratch and redesign your network so that this sort of thing is mitigated in the future.
- bboygravity 7y agoWho said these things come from "your" network?
- blackflame 7y agoBecause if it's an insider threat then you should have protections in place to identify bad actors so that they know they will be caught if they even try. If you don't then what are you even doing?
- WalterBright 7y agoOne thing to do to slow down such downloading is to add a great deal of bulk "junk" data, and have a rate limited network connection.
- throwawaysea 7y agoI can see this being a catastrophic outcome for hospitals. If the health and privacy of your patients is at stake, wouldn’t you pay up?
- gradschool 7y agoLet's hope this idea catches on with patent trolls too. It's about time they outed all the businesses that don't agree immediately to settle.
- freeflight 7y agoSome of those comments below the article are just scary. People demanding death sentences and that Iran/China/Russia/North Korea be nuked, over private business data leaks? It's like the problem of attribution never has existed, nowadays the "smoking cyber guns" are apparently everywhere.
- ourmandave 7y agoKrebs has a better measured reply to the "Nuke 'em all!" comments. https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/#comment-501971 https://krebsonsecurity.com/2019/12/ransomware-gangs-now-out... What needs to become the norm for the US Govt response to these gangsters is for them to get in the habit of doing what they did in the Evil Corp case: Once the offenders are positively identified, get the Treasury to issue financial sanctions on them that prevent the crooks from transacting with people and businesses outside their home country. https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/ https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-... This is perhaps the most effective tool in law enforcement’s hands to combat cybercrime — short of apprehending the bad guys. None of these dudes want to be stuck in Russia, and they sure as hell don’t want all their money kept their either. Rather, they tend to launder it by investing in properties and other businesses outside their own country. Making it a crime for others to accept their money is an extremely effective way of frustrating these criminals.
- big_chungus 7y agoOn the other hand, many nations are making a concerted effort to undermine America's position as the global financial hegemon (e.g. Europe's INSTEX). What would America's recourse be were she to lose her control over global financial markets?
- jacquesm 7y agoAs long as oil is traded in USD that won't happen.
- dmix 7y agoIf the US had a thing like the UK's CBE/knighting Krebs would be worthy of one for his constant public service exposing this stuff.
- jt2190 7y agohttps://en.wikipedia.org/wiki/Presidential_Medal_of_Freedom https://en.wikipedia.org/wiki/Presidential_Medal_of_Freedom
- dmix 7y ago> KrebsOnSecurity was able to verify that at least one of the companies listed on the site indeed recently suffered from a Maze ransomware infestation that has not yet been reported in the news media. I'd bet 90% of companies never publicly acknowledge they paid. Another checkmark in the category of not making paying ransoms illegal. This whole new data-dump threat vector just doubles down the threat to keep it quiet and pay it out. Law enforcement will rarely catch enough of these companies who do pay to make it meaningful. Most of these are small time private businesses who are more than capable of keeping it quiet, without information release obligations to investors. We need public education campaigns for backing up company data offsite and encouraging more companies investing in security firms to up the bar for these attacks. It's the only way they'll slow down.
- LifeLiverTransp 7y agoThe next big step - pyramid schemes, where you can drop your own price to pay, if you convince others to pay up or infect them.
- tinkertamper 7y agoI thought the big advantage of ransomware (for "the gangs") was that it didnt actually require them to be able to extract the data. To impact a company you only needed to be able to get your malware on their device; extracting the data was not necessarily for you to acquire a ransom. If my company is beset by ransomware, and they claim they will release it I can either assume: 1. They have extracted the data and therefor have to assume they arent just going to delete it because I sent them a check. 2. They are bluffing and have only encrypted my data. I dont think I can count on #2.
- thrownaway954 7y agothis could be a two fold disaster. correct me if I'm wrong, but isn't NOT reporting a breach a pretty heavy fine in some countries today? Worst, if they are dumping the data, people in the EU could be hit by GDPR fines as well if the exposed data shows they weren't keeping up with guidelines.
- jacquesm 7y agoAbsolutely, and this is problematic because now we end up with a set of incentives that works against the public interest. This will make it more likely for the companies affected to pay up. The one bit of light here is that it will show up in their accounting and auditors tend to have reporting obligations if they come across evidence of a crime.
- bagacrap 7y agoYes, if you read far enough the hackers point this out. They're asking for less money than the EU fine for non-disclosure.
- draw_down 7y agoIf you've been infiltrated and your systems have been compromised, it has always been the case that your data may also have leaked. A responsible organization in this situation would take that possibility seriously, including the potential disclosures and legal ramifications that may come along with it. Attempting to sweep such an incident under the rug should never have been a serious option, but of course organizations in this situation are usually looking to do as little as possible. So here we are. This is just taking that latent possibility and making it real and explicit.
- dang 7y agoRecent and related: https://news.ycombinator.com/item?id=21806821 https://news.ycombinator.com/item?id=21806821
- interestica 7y agoJust today, in Canada, LifeLabs released that they paid the ransom after info for 15 million people was stolen. https://customernotice.lifelabs.com/ https://customernotice.lifelabs.com/
- hhahah 7y agoThanks to the bitcoin without it Ransomware gangs can't do that
- justincredible 7y agoThis is like saying roads cause jaywalking.
- PleaseLoveMe 7y agoIf I understand correctly you are already required to report the data loss according to GDPR and you'll be fined accordingly, whether the data is then leaked or not. Isn't the clear course of action then to report, pay the fine and tell the criminals to get lost?