23 ms·
US travel firm $4.5M ransom negotiation open chat
- fblp 6y agoWow. $4mil just like that.
- person_of_color 6y agoWe are in the wrong business
- k2enemy 6y agoBut now you have $4 million in a bitcoin address linked to criminal activity. Then what? How much do you lose along the way to having laundered cash in hand?
- ivalm 6y agoAren’t there mixer services for that or just convert to monero? This is off an exchange so lots of shenanigans to make things less traceable. I am guessing these people know what they are doing.
- runawaybottle 6y agoI’d imagine the feds are involved at this point. They paid to get their data, but the feds have to be tracking the addresses from this juncture and examining the breach. I hope.
- ivalm 6y agoI hope the hackers are caught too. But from bitcoin perspective, I am not sure how traceable things are if the hackers use mixing services or convert to actually anonymous currency such as monero. The main problem is converting untraceable bitcoin back to fiat, since most exchanges now follow KYC and will track bitcoin both before and after it touches the exchange.
- peteretep 6y ago> The main problem is converting untraceable bitcoin back to fiat Got to imagine there’s a well-established laundering system for just that
- qserasera 6y agoWe are truly in the age of rich data pirates. I dont see them becoming extinct any time soon with decent ROI like this. I would be curious to learn the % of origins for most attacks. [1] Incompetence by dumb employees [2] Insider attacks [3] Paid cybersecurity protection racket that take down strong systems with stolen tech [4] Unskilled or understaffed security employees
- ars 6y agoThe US needs to pass a Federal law making it personally (not just "corporately") illegal to pay ransom. That would stop them because it would kill the market. Historically it's how they stop kidnapping in countries where it's common. It REALLY sucks for the first few people after the law is passed, but after that things get better.
- yrral 6y agoBut wouldn't the payments just end up being passed through? For example, one way to get around that is you could sign a contract with a foreign consultant firm for "security services", say for 1 year, and they would take your money, and pay a portion of it to the ransomware authors and profit on the rest.
- somehnguy 6y agoWouldn't that be extremely obvious though?
- learc83 6y agoNot when it's done through several layers of employees and then potentially multiple layers of foreign companies. It's very hard to find individuals to hold criminally liable for things like this. When was the last time you saw a CEO go to jail when their company killed someone?
- justapassenger 6y agoCountries where kidnapping was common, are also usually countries with weak government and very ineffective policing, so it's not that simple. Laws like that are in the end pushing responsibilities of law enforcement on the companies and citizens. I'm against ransoms, but if I was CEO of company that's about to release COVID19 vaccine, or provides jobs to 100k of people, you bet I'd pay that ransom. But even if that would happen, it's naive to think that corporations wouldn't work around it. They already do, by outsourcing payments to 3rd party companies - they can proxy it via other countries, fake identities, etc, etc.
- machinelearning 6y agoThis is basically an advertisement for a career in black hat hacking.
- projektfu 6y agoOr online money laundering.
- Havoc 6y agoGotta love that they pitch this as a "service" they provide. The person talking to them must have been seething at having to treat them like "professionals" too.
- saalweachter 6y agoIsn't that almost a cliche of organized crime? It's not enough to be rich, powerful, feared, people also have to pretend to like and respect you?
- Havoc 6y agoHaha possible. Haven’t had much encounters with organized crime thus far thankfully
- saalweachter 6y agoI mean, neither have I, but it definitely shows up in pop culture depictions of the mafia and drug lords and oligarchs and warlords.
- jkinudsjknds 6y agoI don't see backups in that list. Backups would have avoided the need for decryption, yes?
- jstanley 6y agoMaybe I just don't understand either the ThreadReader or Reuters article, but I couldn't find a transcript of the chat linked anywhere? Does anyone else know where it is?
- PragmaticPulp 6y agoThis story is going to be used by every security consultant selling their services for a long, long time.
- adamparsons 6y agoWhen I started my career I'd always hear old greybeards talk about "oh this one time.. some certain thing happened, and everyone learnt a lesson" and I feel like I just witnessed one of those come into existence
- paulcole 6y agoDon’t be surprised if companies would rather roll the dice than pay whatever it costs to prevent the problem. $4 million once times the risk of getting hit vs. the up-front and ongoing costs of dealing with an overly paranoid IT guy. Tough call.
- 29083011397778 6y agoDepends if it really does end up being one time or not, I'd say
- enneff 6y agoHow many times would you need to do a security audit before this paid for itself?
- skolsuper 6y agoA company of this size? Just 10 or 20 times I'm guessing, which really doesn't seem like a high multiple. This is why laws are required to correct the incentives here.
- wccrawford 6y agoNot just the audits, but the work to follow through on the audits, too. And follow through correctly.
- noodlesUK 6y agoWhilst paying the ransom is often advisable in specific cases like these, it’s absolutely a bad thing for society as a whole. Seeing successes like this will encourage organised crime to keep doing this, as they know there’s gonna be a big reward. It’s like the prisoners dilemma. If people didn’t pay the ransom, there wouldn’t be ransomware. But people don’t take precautions, so they have to pay the ransom, leading to more ransomware... it’s a vicious cycle
- dannyw 6y agoTo be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. The money is funnelled to a criminal group, but what difference does it make? Some people consider the USG to be a criminal group; many people are out on the streets for that. My tax dollars directly go to corrupt crooks and nonexistent companies claiming billions for nonexistent PPE. As a member of society, I don’t care if I’m paying a professional ransomware group, or a professional corruption gang.
- ryan_j_naughton 6y ago> It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. That argument could be used to justify any theft or even kidnapping. I know many people who grew up in countries where kidnapping was a very real concern. Consequently, they had to adopt "greater security practices" and it had a very real, negative effect on their lives. There are real harms to randomware. Companies go out of business, people lose their jobs, people lose their service providers, etc. To say, "it serves them right for not following proper security" literally can be said for a mom/pop business in a poor neighborhood who didn't have bulletproof glass or bars on their windows. It is negating the fact that (a) the harms are very real and (b) security costs money and resources, which is effectively another tax on their business. If instead the government made it illegal to pay such ransoms and actively audited large BTC transactions and charged people accordingly, then we could get rid of the incentives to do this in the first place. The government should similarly hold firms accountable when they are hacked (due to the harms on consumers) and require prompt disclosure of any hacks. There are ways to incentivize the preferred outcomes without supporting the active theft of property and destruction of someone's business.
- TrackerFF 6y agoSo what's the current optimal solution, as far as precautionary measurements go - for these kinds of scenarios? The more companies that shell out, the more it's going to happen / motivate these pirates to continue with such rackets.
- arkadiyt 6y agoTake backups, practice restoring them, invest in a security program.
- stu2b50 6y agoJust having backups isn't enough. It's ransomware 101 to wait and try to encrypt all of their online backups and any recent offline backups. You really need comprehensive, air-gapped backups that date to years back.
- drdaeman 6y ago> It's ransomware 101 to wait Not really. A sister company of my previous company had ransomware incident, and as far as I've heard this was not the case. They had just purged local backups. The attack was stopped quite early by an engineer noticing abnormally high IO activity and shutting the whole infrastructure down as soon as they realized what's going on - while a lot of data was lost and had to be restored from backups, most of the files were untouched. Still, the recovery took really long while to audit every machine before they could be even powered on again. Poisoning backups requires backup systems receiving encrypted data for a while. Which means live systems running off the encrypted data (and most ransomware encrypts at the file level, which is much harder to do transparently, compared to the block device level). Which requires effort to make sure this is extremely transparent and goes unnoticed. Doubt that attackers do expend their resources unless they see a necessity.
- john_moscow 6y agoThat's why you want incremental off-site backups that trigger alerts when too many files change at once.
- yrral 6y agoBased on other articles, it appears they didn't hire specialty ransomware consultants for the negotiation but still got a 55% discount. Wonder if they did, if they would have been able to get a better all-in cost.
- nlh 6y agoFor some context about CWT (I was curious about these figures) -- via Wikipedia[1]: * US$1.5 billion in revenue * 18k employees For a firm like this, the payment probably amounts to a small uptick in a small portion of their IT budget and won't even come close to hurting them (and, frankly, neither would the $10m figure). It's insane that this is the case and that companies are willing & able to pay ransoms like this, but the hackers were right - the payment is much less than lost business, bad PR, etc. if the actual information had leaked. Such is where we are. [1] https://en.wikipedia.org/wiki/CWT_(company) https://en.wikipedia.org/wiki/CWT_(company)
- stu2b50 6y agoI don't know about that. For one, travel margins are not exactly the same as SaaS margins. Secondly, there's the global pandemic and all, kinda hurts the free cash of most travel companies. I wouldn't be surprised if they genuinely would have trouble coughing up 10 million two days after the attack hit.
- nitrogen 6y agoCWT is used by corporate travel systems. I'd expect their margins to be similar to enterprise software vendors, rather than other travel agencies.
- rs41 6y agoIt depends if they report revenue gross or net. If it is gross that means they recognize all booked travel as revenue (and earn a margin on top of that) instead of just recognizing their fee as revenue. In that case it would be much worse margins than a mature SaaS company. If I had to guess based on the figure, I would guess gross but I'm not sure.
- nlh 6y agoSorry I should have clarified -- according to Wikipedia, they had $1.5 billion in actual net revenue by processing $23 billion in transaction volume (aka GMV).
- nradov 6y agoIt should be a criminal offense punishable by prison time for companies to pay for ransomware keys. While that might cause some businesses to fail in the short term, it would benefit society as a whole by eliminating the financial incentive for such attacks.
- toomuchtodo 6y agoMaybe require cyber insurance instead, pricing premiums based on audits performed by infosec practitioners. Similar to auto insurance, and what happens when you’re a high risk driver; you still have insurance, but you’re paying out the nose for it. Our current legal framework doesn’t support such a draconian suggestion as presented imho. You want poor security practices to be painful, not fatal, to the corporate entity.
- nradov 6y agoOur legal framework already contains many prohibitions on financial transactions with criminals and terrorists. It wouldn't be difficult to add one more.
- toomuchtodo 6y agoMy point is there are better, more reasonable ways to arrive at the same end goal: effective infosec practices that prevent ransomware attacks (among other threat actors). Banning ransomware payments just makes it more difficult; someone will still find a way to save their business by paying. You want to resolve the root issue: a business not taking security seriously.
- ChrisMarshallNY 6y agoAs a business owner, I can tell you that having a “cyber” rider on a business E&O policy can be eye-wateringly expensive.
- toomuchtodo 6y agoAs an infosec practitioner, I can’t tell you how many times I’ve seen someone have insurance and their security posture be effectively nothing, or the insurance not pay out even with reasonable measures in place. Market failure in my opinion, needs more regulation.
- yrral 6y agoHere's a link to (photos of an lcd screen of) more of the chat, does anyone know where to get the full transcript? Feels like it has to be available somewhere. https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W https://www.reuters.com/article/us-cyber-cwt-ransom/payment-...
- tolbish 6y agoIsn't CWT the company that handles travel details of employees of Amazon, Facebook, etc?
- stirlo 6y agoThis is a very recent event (ransom was only paid on 07/28). They're not out of the woods yet. Whats the bet they get crypto locked again next week?
- xuki 6y agoFrom what I read, the hackers always keep their words. Otherwise nobody will pay them next time.
- gorbachev 6y agoThis particular hacker. What's preventing another hacker group doing the same? The company is not able to fix all of the security issues immediately.
- smabie 6y agoWhy would the hackers do that? It wouldn't help them in any way.
- stirlo 6y agoNot necessarily the same attacker but unless the flaws that led to the attack are patched then copycats will target them now they know they will pay up
- hellotomyrars 6y agoWhile these stories are becoming all too common I’d like to think that while we’re in a golden age of being a ransomware payouts, it will lead to actually caring about security by many of the high-profile affected companies. While the overall cost may be low for them, if they don’t make meaningful changes to prevent these issues in the future, it’s not hard to imagine it might add up quickly. I don’t support these attacks and some of the targets in particular are insidious, like hospitals where an attack could lead to an actual death toll, but it might actually be the kick in the ass many organizations need to actually care. It’s sad that it’s come to this point but the end result may be better for everyone.
- StavrosK 6y agoIt definitely makes the costs of bad security immediately obvious to the company, rather than just taking the data and selling it, which externalizes the cost to the user.
- walrus01 6y agoTo me this seems kind of like a company that has a big warehouse full of product that intentionally (or carelessly) neglects its fire alarm and fire suppression system. Or a warehouse of valuable product (say, many pallets of $5000 DSLR cameras) that has very lax security. It's the network security and endpoint security version of that. It's not absolutely guaranteed that your warehouse is going to catch on fire, or that some guys are going to back up a box truck and clean out your valuable inventory at 3am, but there is a high likelihood of it occurring.
- greesil 6y agoThink of it as a very expensive bug bounty.
- sqrt17 6y agoBug bounties work well for publically accessible systems, e.g. a site's web service. As a result, many of the more visible break-ins occur through phishing or spear-phishing and combine social engineering with malware as well as classical intrusion techniques from within the network perimeter.
- reminddit 6y agohow did they get bitcoins that fast?
- teruakohatu 6y agoWhat are the chances this is a $4.5m transfer to North Korea?
- 9nGQluzmnq3M 6y agoLow. The hackers are likely European, since there are telltales like European number formatting ("10.000.000$") and awkward phrases like "make a step forward" (perhaps Italian fare un passo avanti?).
- teruakohatu 6y agoWould you really expect state sponsored hackers to drop references to Korea? They are either European and don't mind anyone knowing, Europeans who accidently dropped hints, or not European and want people to think they are.
- 9nGQluzmnq3M 6y agoHypothesis A: These are European hackers. Hypothesis B: There are North Korean hackers who have mastered English, an enemy language whose speakers they have almost no interactive exposure to, to such an extent that they can, in real time, simulate the subtle mannerisms of another, completely unrelated set of non-native speakers of English. Take your pick.
- deleted 6y ago[deleted]
- projektfu 6y agoGoogle translate seems to jump to "take a step" for most languages I've tried that usually say "make/do a step". So this is likely someone with a little English but not knowing the idioms. Might have done better with Google translate.
- rmujica 6y agoit seemed weird to me that the hacker's messages were right-justified, maybe from a country with RTL input method?
- walterbell 6y agoWhat is the total size of the backup software industry, compared to the total size of the security industry? Is backup software undervalued, if "offline backup" is the only known defense against ransomware?
- ponker 6y agoAs much as I hate seeing douchebag criminals get rich, I do like that they establish a financial Cost of poor security.
- momokoko 6y agoLet this be a lesson to those that say bitcoin and other cryptocurrency has no real value outside of speculation. This kind of attack would be almost impossible in the pre-bitcoin era. The difficulty of receiving that volume of money in that short of a period of time in a difficult to trace manner is a new thing. We are entering a new era where crime can pay in very large sums with orders of magnitude less complexity. Instead democratizing currency, we're democratizing large scale crime. Previously only large organized crime organizations could perform such an attack. Now, almost anyone can.
- chrisseaton 6y ago> n a difficult to trace manner is a new thing I still don’t understand - how is Bitcoin difficult to trace when there is a global immutable public record of all transactions?
- RangerScience 6y ago1) You need to be able to tie a BTC address to a human 2) Mixers
- runawaybottle 6y agoCan you really not follow the trail from the mixers?
- jonathanliu 6y agoCipherTrace says they lost the trail on the twitter hackers when they threw the btc they scammed into mixers. On the other hand, the Feds arrested a kid in Florida, so my question is... how did they find him?
- unangst 6y agoFeds = mixers
- 6y ago
- kumarski 6y agoMalta is Binance's location. Malta enables Binance to enable users to "clean" approximately ~2 bitcoins/day per an account. Binance has ~5 times the daily trading volume of the 2nd leading exchange.
- 293984j29384 6y agoI found it interesting none of these sites actually provided the alleged bitcoin wallet address. I found it @ https://www.blockchain.com/btc/address/13nmJ3SsNB5pSyQrmX3e6zveY9kHGw8Vs3 https://www.blockchain.com/btc/address/13nmJ3SsNB5pSyQrmX3e6...
- jhgorrell 6y agoKinda funny to see 1BTC sent to check it worked before they sent the rest. Cant undo it like a wire transfer...
- gruez 6y agoBut why 1 BTC? That's worth more than 10k. Surely they could have sent a fraction? Or maybe they didn't know bitcoins can be split?
- vdfs 6y ago10k out of 4.3m
- csomar 6y ago1 BTC is a fraction of 400BTC
- uncleputin 6y ago10k is not that much considering they are ready to pay out 5M
- dopamean 6y agoNo but isn't it just as easy to send a fraction of a bitcoin? Why spend a whole one to do something you could do with 1/100th?
- hartator 6y agoCan the money be followed here? How they are going to spend it if it’s marked as stolen?
- dudus 6y agoWho's to say this isn't an internal job? Random developer that is unsatisfied with his job sees blatant security hole and exploits it himself for ransom. Let the money sit in a Bitcoin wallet for a while. Maybe move it around a bit here and there and cash out a few years down the road. Good retirement egg.
- imglorp 6y agoAnother windows local admin/group/domain thing. When are IT departments going to take it off their networks? Why have LANs at all, for most back office work? Immutable, versioned files in managed cloud storage eliminates the locker threat (not the disclosure one though).
- throwaway28848 6y agoWhen work for a big IT team at a company that's already invested a fortune in on-prem storage and your job depends on pre-cloud procedures, you keep your mouth closed and do what's asked of you. After all, if the company gets hacked, it's usually just the CISO that gets fired. Not you. You made a very good point about Windows GPOs. The delivery mechanism for them vs. how macOS does it shows how dated of a paradigm they are. It's bringing back memories to me of importing ADMX templates, gpupdate.....
- projektfu 6y agoScenario 1: Keep head down, company gets attacked, shrug shoulders. Scenario 2: Sell solid security and backup principles to management, fighting annoying budget and corporate culture battles along the way. Company does not get attacked. Nobody notices. Scenario 3: Quietly set up an immutable backup service with hourly backups for your enterprise without anyone really noticing. Company gets attacked. "Actually, we do have backups. We can just reformat all those Windows machines." Hero!
- canada_dry 6y ago> backup service with hourly backups for your enterprise without anyone really noticing Well, except this is similar to #2 as it will likely stand out in the budget - especially the initial setup. IT being a cost centre has to fight for every penny in most non-IT-centric organizations. Plus, the hackers will still threaten to release your corporate data (i.e. emails, client info) which would compel most companies to pay-up. Bottom line: every company needs good backups, intrusion detection, and system hardening (with 3rd party review).
- glandium 6y agoWhat's amazing to me is that even though it stings, you get better "customer" service from these criminals than from e.g. Google.
- robjan 6y agoIf your account is worth a few million dollars you get a direct line to someone in Google.
- wombatpm 6y agoSo could a state actor force enough miners to act in concert and conduct a 51% attack and steal the bitcoin back?
- marmshallow 6y agoA lot of people here are asking the government to make payment of ransoms illegal. Makes sense to me, but can someone explain the potential downsides, and why it may not be as simple as it sounds (I'm sure it's not)?
- asdfasgasdgasdg 6y agoI wonder if this is a good argument to use cloud service providers. I'm sure if someone got into your network they could probably delete everything from your corporate Google Drive/Microsoft Office accounts, but these big companies are more likely to be able to restore from backup than you are. Similarly, good managed cloud databases will have backup and restore options that are much easier than setting up immutable backup infrastructure for your company, which might encourage companies to back up more often.
- megablast 6y agoThat website is cancer. Someone has managed to make twitter look ok good.
- jb775 6y agoI constantly hear talk about Bitcoin not being completely anonymous, but it seems like these ransomware attacks are always requesting Bitcoin. How are they managing the Bitcoin so it's untraceable?
- KingOfCoders 6y agoWhen I was running some IT for our startup we used FreeNAS with ZFS (and had off site, borg backups), from my understanding we could just get to the last snapshot for the (unencrypted) data? (sorry, no IT admin but developer ;-)
- Element_ 6y agoAnyone know what exchange would allow them to purchase 4.5m of bitcoin on short notice? I wonder if anyone can find the ransom payment transaction in the block chain.
- unixhero 6y agoHow about stop using Windows servers in enterprise environments???
- mudiadamz 6y agoBitcoin turn to be ugly currency, the price will slump very soon.
- atlbeer 6y agoI’ve always been curious about the “on-ramp” here How does a legit company purchase $4.5M of BitCoin in 24 hours? I would assume using a “K&R” style broker but, without one of those how would you do it?
- Geezus_42 6y agoHow about good offline back ups? Then you don't have to pay and hope you get your data back. Of course you still need to to figure out how they got in and lock it down so it doesn't happen again and there will be downtime as things are restored. However your are already down at that point so that doesn't really make a difference and by paying you are encouraging the behavior.
- DownGoat 6y agoThey don't just start encrypting stuff as soon as they have a foothold. They spend some time on your network siphoning out valuable data, compromise backups, and staging for re-entry.
- SergeAx 6y agoGarmin, now this, in one week. I beleive it is much easier to pull a trick like this with the help from the inside. If so, with malicious insider's incentives in a ballpark of hundreds of thousands we are doomed :(
- dx034 6y agoAnd yet, these hacks tend to be done with some social engineering and no insider knowledge. Many companies aren't well protected, you don't need an insider to hack them.
- SergeAx 6y agoI think this is just a beginning. Word is out you can extort millions with internet connection and some scripts, no guns and police chase involved. And it looks like chances of getting away with the money are quite high. Compare it with Getty III ransom story.
- danbmil99 6y agoWhy not pay the ransom, then track down the perpetrators for an uncomfortable private chat with hired paramilitary types? There has to be a stick or these folk will keep demanding more carrots.
- scandox 6y agoWhat spend another few million on an illegal adventure well outside their area of expertise? Great idea. Why not reintroduce blood feuds to the Toy manufacturing business too!
- anonymousDan 6y agoWhat exactly do the EDR tools recommended by the attacker give you?
- unionpivo 6y agoThey are probably now on a priority target list for other groups, since they do pay out. So they have to get their security in order, or this is just the beginning of their problems.
- historyremade 6y agoHad used a MAC, none of this would happen.
- noisy_boy 6y agoI'm waiting for the "Ransomware Negotiator with min. 15+ years experience" jobs to show up.
- drkrab 6y agoLooks like Garmin also payed https://www.bleepingcomputer.com/news/security/confirmed-garmin-received-decryptor-for-wastedlocker-ransomware/ https://www.bleepingcomputer.com/news/security/confirmed-gar...