23 ms·
Ransomware gang threatens to expose police informants if ransom is not paid
- DyslexicAtheist 5y agooff-topic // off-topic // off-topic therecord.media get's a lot of attention now on HN presumably because it's new and Catalin joined them. It's not a big deal, but I think it needs to be pointed out (especially to the audience outside the US) that they are CIA funded. They should be more transparent about this.
- sillysaurusx 5y agoCool! Is there someplace you can apply for CIA funding? (I'm only partially joking.)
- DyslexicAtheist 5y agothey're obviously a threat-intel company first. So create something that generates value (that receives the funding) and then set up a company blog that poses as a "legitimate journalistic outfit without an agenda". Final step is to produce only quality content 98% of the time and the 2% of times when you should be critical to your own side turn a blind eye. Classic playbook for all propaganda operations (regardless if they're US/RU/CN/whatevs). the tragedy of all cyber reporting is that there can be no neutral party. the moment you need to call out your own camp you'll lose support/protection and legitimacy to exist (e.g. imagine Bellingcat being vocal of anything that happens within FVEY. Unthinkable!)
- nurgasemetey 5y agoThis. I stopped reading Bellingcat reports. I don't remember any huge Bellingcat report that is related with non-Russia.
- ricktdotorg 5y agowait, so what is the inference here with Bellingcat? that they are funded by CIA / gov.ru? and that they tell mostly the truth, but willfully withhold certain things detrimental to their financial masters?
- DyslexicAtheist 5y agono. what is insinuated is Bellingcat enjoy connections with GCHQ & MI6. Eliot Higgins is close to the British IC, gives talks at Atlantic Council and trades info with them. Bellingcat (despite the great work they do IMHO) certainly does not get Russian passport details simply by hacking or by asking some "corrupt" Russians working for the state for help. So you can probably trust most of what they say but not how they get their info or that they are simply a "hacktivist / citizen jorno" outfit (they'd be dead since long time if that would be all) At least until I've seen them uncover something as big as Skripal or the MH17 (within the FVEY) I wouldn't believe their claims of being "independent". Which will never happen because you don't bite the hand that feeds. Anyone playing in that league will not survive very long (quite literally) unless they get security benefits needed (which requires affiliation). There doesn't have to be a conspiracy. That protection comes at a cost of bias (it's not required when everyone around you and most importantly yourself believes you're part of the good guys).
- iudqnolq 5y agoI too found the "corrupt officials" hard to believe, but there's a surprising amount of evidence for it. In general the Russian government has a surprisingly middling level of control over society compared to somewhere like China. Other Russian news orgs also buy personal data, try looking at Meduza for example.
- goatsi 5y agoSounds like an issue with what is being surfaced in your social/news bubble. If you go to their site you can certainly find deep dives into many other areas: https://www.bellingcat.com/news/2021/04/01/mahbere-dego-clues-to-a-clifftop-massacre-in-ethiopia/ https://www.bellingcat.com/news/2021/04/01/mahbere-dego-clue... https://www.bellingcat.com/news/africa/2017/02/20/tracking-nigerian-armed-forces-coin-offensive-north-east-nigeria/ https://www.bellingcat.com/news/africa/2017/02/20/tracking-n...
- strictnein 5y ago> imagine Bellingcat being vocal of anything that happens within FVEY Yes, imagine if they covered things in the US: https://www.bellingcat.com/tag/usa/ https://www.bellingcat.com/tag/usa/ Ex: "US Law Enforcement Are Deliberately Targeting Journalists During George Floyd Protests" https://www.bellingcat.com/news/americas/2020/05/31/us-law-enforcement-are-deliberately-targeting-journalists-during-george-floyd-protests/ https://www.bellingcat.com/news/americas/2020/05/31/us-law-e...
- DyslexicAtheist 5y agoall of the reports are pretty tame in comparison with what they could uncover in war zones that involve the US. Taking a swing at US LEA is hardly something to write home about. Until they give me scoops at an equal magnitude say something that shows US black sites still in operation, or another Abu Ghraib or something about Gitmo? Nobody really cares about US racist cops - that's stuff that is anyway covered by WaPo & NYT. Give me something of the same magnitude that got exposed by Manning, Snowden or Assange and I will be happy to believe that they are "neutral". But oh wait - they'd be in exile or dead. So my point stands.
- strictnein 5y agoNah. Not interested in playing your game. You stated X, I showed X was incorrect. Now you're moving the goalposts, which was fully expected. One of the strongest messages the US sends abroad is that the 1st amendment is sacrosanct. Highlighting law enforcement violently suppressing that is extremely damaging to America's reputation.
- DyslexicAtheist 5y agoI'm not playing any game. the goal post is not to compare apples with oranges. if the position is that Bellingcat (which markets itself as a citizen journalist type of outfit) is independent as they claim then they should be measured as such. Nobody is moving any goalposts. Your assertion that they are independent but also are unable to highlight crimes committed by the US then they are simply not independent. FWIW I'm not highlighting any side being bad or good but that the claim of independence needs to be viewed in relation to their alliances.
- 1986 5y agoHere you go: https://www.iqt.org/company-submission/ https://www.iqt.org/company-submission/
- toomuchtodo 5y agoNot OP, but very helpful, I appreciate it.
- RosanaAnaDana 5y agogrants.gov
- deleted 5y ago[deleted]
- vilkkala 5y agoThey seem extremely opaque about it.
- strictnein 5y agoTo clarify: Part of one of their rounds of funding included investment in 2010 by In-Q-Tel, the CIA's investment arm. They are one of numerous investors, which includes Google. They are not receiving ongoing funding. A private equity firm bought them two years ago for $780 million.
- indeedmug 5y agoSo basically at some point they were funded in part by the CIAs fund as well as other tech companies. Now they aren't at all. Seems very misleading to claim they are CIA funded at this point.
- joe_the_user 5y agoThe reason that CIA contact at any point is significant is that, unlike an ordinary investment house, US intelligence agencies as a matter of course act to keep their activity secret. It stands to reason that this implies that any visible CIA involvement would indicate much invisible involvement by The Agency - and various ex-CIA agents who've gone public have basically confirmed this. So getting funding from the CIA really is different from other thing - possibly. But the situation of all this not being known and being officially concealed produces a lot of paradoxes.
- afrcnc 5y agohttps://techcrunch.com/2019/05/30/insight-partners-bags-threat-intel-company-recorded-future-for-780m/ https://techcrunch.com/2019/05/30/insight-partners-bags-thre... >> The deal essentially buys out earlier investors, which included GV (Google’s venture arm), In-Q-Tel (the CIA’s venture arm), IA Ventures, Balderton Capital, Mass Mutual Ventures and others — and gives them a healthy return in the process.
- lupire 5y agoHow do you know? Who is Catalin?
- tyingq 5y agoI'm guessing that screenshot of a "Disciplinary Records" folder is causing some anxiety.
- Invictus0 5y agoIs it possible for organizations to buy ransomware insurance? It is very difficult to avoid paying the ransom when people's lives are in jeopardy. I can imagine hospitals would be interested in purchasing such insurance as well.
- szermer 5y agoYes... and it is a growing part of commercial property insurance: https://www.fmglobal.com/products-and-services/products/cyber-resilience-solutions https://www.fmglobal.com/products-and-services/products/cybe...
- headmelted 5y agoHow would that work though? The group demanding the ransom can freely set their price. Surely if they know an insurance company is on the hook for it then they’ll add a few zeroes accordingly, making it impossible to underwrite.
- Invictus0 5y agoHere's how I imagine it: The policy would insure up to a certain dollar amount, say $20 million, and pay directly to the insured in the event of an attack. If the ransom demand is $50 million, the insured can either pay the remaining $30 million on their own or use the $20 million to begin to repair the damage to their systems.
- jpmoral 5y agoThere was an article or discussion I believe I read on HN that discussed how kidnapping and ransom insurance reduced violent outcomes and made dealing with the kidnappers more predictable.
- bluGill 5y agoTrue, but what has made kidnapping mostly disappear is laws that make it illegal to pay a ransom. That makes it impossible to ask for help (as the police are more likely to find out) raising the ransom, and thus the total paid much less. Nothing is perfect, but when there is no money in the crime there is much less crime. (Don't confuse less with zero!)
- badkitty99 5y agoAnd we thought these gangs were our enemy
- 0xTJ 5y agoYou don't seem to understand what a police informant is. This is a bad thing.
- Pfhreak 5y agoThere's more than just informant data in the leak. Some would argue, for instance, that police disciplinary records being public is in the public good.
- badkitty99 5y agoCorrect
- weltensturm 5y agoIt looks like they switched from .doc to .docx in January, I wonder if the old format was the attack vector
- annoyingnoob 5y ago.doc can contain macros that do bad things .docx cannot contain macros
- londons_explore 5y agoI don't think thats true...
- jaywalk 5y agoIt is true. .docx files cannot contain macros, but .docm files can. The same x/m convention applies to all of the other Office file formats as well.
- blululu 5y agoPlease correct me on this but from what I can gather ransomware is a direct consequence of cryptocurrency. US Federal law enforcement has quite a lot of control over traditional banking and trying to extort the amount of money from a public agency would traditionally call for Federal Intervention. If so it seems like there is a good case to be made for a direct fine placed on the ledger used for payment in order to compensate for the damages.
- tnzm 5y agoWho are you going to fine? Distributed ledgers are not owned by a central entity.
- anothernewdude 5y agoEntities that are caught trading coins that have gone through wallets attached to ransomware. Target big exchanges.
- tartoran 5y agoBut those wallets will be a one time thing and next time a new walled would be used for this type of thing. How could exchanges know that?
- tnzm 5y agoBitcoin is not private. Wallets are ephemeral, however the coins themselves can be tracked. Monero, on the other hand...
- asdfasgasdgasdg 5y agoHere's one possible recipe for fixing this issue: - Ban anonymous cryptocurrencies. - In pseudonymous cryptos, mark any address that has been the destination of a ransomware payment or demand as tainted. Any net positive transaction from a tainted source wallet marks the destination wallet as tainted. (I.e. you are obligated to return tainted monies to tainted wallets if they send money to you.) - Exchanges are forbidden to deal with tainted wallets, or with any exchange that deals with tainted wallets. While you're at it, I guess you could mark any wallet funded at an exchange that doesn't KYC as tainted as well, to limit the use of crypto for money laundering. I'm guessing we're going to figure a lot of this stuff out in the next 10-20 years, if the crypto craze doesn't die off naturally during that timeframe.
- tartoran 5y agoAll this will stop when we start taking security seriously
- schaefer 5y agoYou’re phrasing things in terms of a final solution. I think instead “taking security seriously” will just be an eternal arms race. One that we are already engaged in. And each person that gets extorted is rudely reminded that they are losing.
- steelframe 5y agoThis is my new favorite meme.
- thenoblesunfish 5y agoThese stories often have a part in them that makes me think about how it's somehow surreal that there's some person who goes to work in the morning and does something that looks and feels almost exactly like what most of us here do all day, except that the whole thing is part of an (explicitly) parasitic criminal enterprise.
- wheybags 5y ago> Last week, security firm Emsisoft warned that this feature is often buggy and could lead to situations where the ransomware permanently destroys the victim’s files. The Babuk Locker team responded a few days later in a hacking forum post that they fixed this bug. Basically "thanks for the report, should be fixed now". Such a normal workflow
- btown 5y ago"We take any bug reports related to the integrity of our users' files very seriously."
- tiahura 5y agoAnyone know the forum?
- nvr219 5y agoI thought hacker news was the forum! That's why it's called hacker right?
- walrus01 5y ago"It's not a ransomware service, it's a free surprise off-site backup package!"
- jacquesm 5y agoMost if not all ransomware is 'on site'.
- deleted 5y ago
- deleted 5y ago[deleted]
- mensetmanusman 5y agoI wonder when there is going to be a kinetic response to these types of ransoms.
- sesuximo 5y agoDoes seem a bit nuts that they had a document sitting around containing informant identities. Seems like the kind of thing you’d never store in plain text (or not store at all!)
- CountDrewku 5y agoPossibly breaks CJIS compliance depending on how it was stored and accessed.
- Waterluvian 5y agoWhen your data is encrypted and paying a ransom gets you the key, that makes sense. But when it's extortion, what is to stop from them instantly asking for another ransom?
- arecurrence 5y agobecause if the ransomer does not stick to the deal... then nobody will pay ransoms anymore. Their business model breaks at that point.
- Waterluvian 5y agoI have a feeling a ransomer could get away with it many times before they saw any change in customer behaviour. It's a tragedy of the Commons thing I think?
- iudqnolq 5y agoThat's why they're not anonymous. They have a reputation to protect. Look at how quickly they respond to bug reports.
- pretext 5y agoIt's not a ransomware gang but a blackmail one.
- boomboomsubban 5y ago"Rap Feuds" 7.6 GB "Hate Crimes" 525 KB Though exposing police informants could lead to their death and obviously shouldn't happen, I'm fairly curious why they're tracking the "MOST VIOLENT PERSON MVP."
- deleted 5y ago[deleted]
- whimsicalism 5y agoGlad I'm not the only one who noticed how big the "Rap Feuds" folder is!
- londons_explore 5y agoI assume in "Rap Feuds" there are many hours of rap videos as evidence...
- boomboomsubban 5y agoIf those folders are containing evidence, they are possibly criminally unorganized and you would still expect "hate crimes" to contain a comparable amount of video. Not KB to GB difference.
- not1ofU 5y agoSomebodies secret torrent folder :-D
- ThrowItAway2Day 5y agoOn a serious note, I would expect that street beefs (especially ones that spill over to rap diss tracks) are responsible for the largest percentage of urban homicides.
- boomboomsubban 5y agoThey have a section for street gangs, Latino gangs, gang conflict, and a daily gang report. All combined are smaller than rap feuds.
- m3kw9 5y agoSure but why don’t they go with subscription model because the gangs will always have a copy.
- intrasight 5y agoMakes me angry and sad that this "virus" of ransomware is still so prevalent even thought there is a "vaccine" - in the form of standard cybersecurity practices. But I never hear about anyone getting fired over this, so I guess that it's just not a priority for lots of organizations.
- axaxs 5y agoAgreed. It wouldn't surprise me at all if there were actuaries out there telling companies that it's cheaper to pay ransoms if and when they occur than to hire dedicated security. Which probably is true, at face value.
- intrasight 5y agoI think the insurance industry could quickly put a stop to this by not insuring against incompetent cybersecurity.
- BTCOG 5y agoI support this. Criminals ransoming criminals. Please keep this up and hit the corporate pricks next.
- alsetmusic 5y agoI’m surprised that top-level comments aren’t interested in the escalation of ransomware threats. From holding data of individuals hostage under threat of erasure to corp targets to threatening human life at hospitals and now directly dangling a threat of violence against police informants. This is easily the most vicious threat that I’ve seen.
- 8note 5y agoIt's the police who are really dangling the threat of violence. If we're not ok with those threats becoming public, we should not have police make those threats
- rapjr9 5y agoPerhaps because those involved in computer security don't see any end in sight. It's widely acknowledged that there is no such thing as perfect computer security, if someone wants to get in bad enough they will. Zero-days will always exist. Every single app running on a computer that accesses the internet is an attack route, as are all the companies associated with the computer and software and all the people associated with all of those (via social engineering, bribery, threats). Stopping attackers from getting into computers, especially consumer computers (and many consumers have critical jobs at companies, in governments, etc.) is not possible in total it seems. And once they are in they can steal files, expose them, and encrypt them, or control the computers and data on them (for blackmail or other reasons). So expect it to get worse. It's been on that path for a while and nothing has stopped it yet. Even the CIA has had files outed. Without a solution expect the USA Congress to be blackmailed, chemical plants to explode, all financial dealings to be revealed, unless the ransom is paid. What is there to stop it from happening? I expect it to get much worse before it gets better, mainly because it has only been getting worse and no solutions are in sight. Passing a law that makes paying ransoms illegal is not going to work when the alternative is lots of people dying or big dents in economies. And we can not easily send military strike teams or drones into other countries to attack back, without inviting even bigger conflicts. An offensive cyber posture would also mean you have to find out who attacked you, not always possible. And militaries are set up to fight a single enemy, or a few enemies, not hundreds of thousands of enemies. It has indeed been amazing to watch how little discussion there has been about this as it keeps getting worse. Some people are writing warnings, especially those who are the ones who are supposed to be doing something about it. That seems to be a common tactic these days, if you are responsible for solving a problem print a warning, then when the problem manifests say "I warned you". Many problems have been ignored for decades this way.
- _throwawayaway 5y agothey must have enough confiscated bitcoin to pay any ransom
- steve76 5y agoOur community is sadden to announce the tragic loss of a local computer hobbyist who tripped and fell in front of a municipal dump truck due to untied shoe laces. Contributing factors to the accident are believed to be a loss of focus from recent life stress including a failed rap career, repressed homosexuality, chronic tardiness, and talking back to elders. In unrelated news, we congratulate Sergeant Yang of the Benevolent Retirees Association Metro Police for winning the "face up, face down!" raffle. Also of merit is the National Penalty Battalion, who successful accomplished the release of a genetic bio-weapon targeting the financial profiteers of international narcotics trafficking. We ask for no money. Please simply change your ways. In response to your hardship and efforts, 100 billion dollars has been deposited to your accounts by the federal central bank at 0.0001% interest.
- mjevans 5y agoThey should assume it's all compromised and has all _already_ been shared with their worst enemies, and everyone else. Undercover agents should be extracted or wrap up things where they are under the assumption of being exposed. Informants should be notified, and possibly given witness protection (by a more competent agency) if they are at risk. Training and re-training for everyone involved on proper digital hygiene. Also get qualified staff and create a process that avoids compressible elements where possible. E.G. Text files are so much nicer for security, automation, and long term archive.
- lupire 5y agoInformants go to jail when they stop being useful to the state.
- unexaminedlife 5y agoLet's be honest. Until the government (federal, state, and local) gets deadly serious about cyber crime this will keep happening. There's so much waste in Washington D.C. for them to have no ability to do anything about this stuff makes me think there's way too much corruption in our government. Until that's rooted out and qualified people put into the important decision-making roles, may we simply hope things don't get too bad before they start getting better.
- hilbert42 5y agoCertain critical information should never be stored as digital data, as we've seen repeatedly keeping it secure is essentially impossible. Like it or not, there's now overwhelming evidence to prove that statement true. We've seen far too many supposedly very secure sites broken into have any faith in keeping very sensitive data secure—the huge SolarWinds attack, the NSA break-in and the loss of British National Health records to name just a few at the tip of a huge iceberg. Now here's yet another instance, and we're seeing them at this high level almost every day. Tragically, this leak could have very serious consequences in that people are likely to be killed as the consequence: It's time we citizens demanded that such critical records be stored on paper files and in locked cabinets in secured buildings as they once were. Simply, we've no other option. Smart governments such as Russia have gone back to keeping critical documents on paper as they once did. In essence, no matter how hard one tries to secure digital data it's still dead easy for a determined adversary to access it—but it's much, much harder - in fact almost impossible - for the same adversary to break into a building and then into locked repositories and steal the same files in their paper form. Let's do some very basic sums to prove my point: 1. The amount of data stolen in this case is 250GB. (This is an absolutely huge amount of data.) 2. If we commit text to paper we get about 2K bytes per page (a long accepted round figure) 3. Therefore, a standard ream of paper, 500 pages, stores 1,000,000 bytes (1MB) of data. 4. 250GB is actually 250,000 megabytes 5. Now, a ream of paper weighs conservatively 2Kg (it's likely more). Thus, each 1MB in paper storage will weigh ≈2 kg 6. Extrapolating this out, we therefore need ≈500,000 kg ==> ≈500 tons of paper. 7. Thus, I'd strongly assert that whilst thieves (smart hackers) have amply demonstrated that they can easily steal 250GB of data from right under the noses of highly secured sites such as the NSA, Police etc, that it would be nigh on impossible for them to do so if the records were STILL stored in paper form, as they: (a) would have to breach the physical security of a guarded building and break in; (b) once inside, they'd then have to breach records security by breaking into secure records rooms thence secured filing cabinets; and, (c) then remove 500 tons of paper records, this would require a huge logistical operation involving much manpower and many, many trucks—and they'd have to do all this without being caught! The only way this could ever happen in practice would be for a country to be invaded by another (like the Nazis did in WWII). In short, digital security has long proved that it's nowhere near being ready for prime-time. QED!
- amelius 5y agoThis crime was made possible by Bitcoin™.
- why_Mr_Anderson 5y agoI can imagine that sooner or later reply to threats like this would be a Tomahawk or two.
- slim 5y agoIt is strange that they keep files on police informants. In my country it certainly does not work this way. Every police officer has his own informants and nobody knows who they are apart from him.
- lupire 5y agoI don't understand why the US military isn't handling this as terrorist/guerrilla attack in national security.
- NotSammyHagar 5y agoI continue to be amazed that the people writing ransom aren't brought to justice. I'm not talking about the small time ones that want a few thousand. There have any multi-million dollar payments. Can thse be taking in payments (even bitcoin) that with enormous legal effort can't be tracked down? Even if they are in Russia or some place that won't prosecute them, they can make life hard by putting out international warrants for their arrest. So big companies just don't care enough to try to get them prosecuted? Also it should be considered an illegal payment, extortion at least. This feels like an actual real job for international crime fighting.
- freebuju 5y agoTaking f*ck the p0lice to another level quite literally. That said. It's ironic that law enforcement can't even protect your identity or PII should you risk your life to become an informant. Private corps when faced with a data breach under GDPR laws are made to pay for their slip ups. LE under the same circumstances have a special pass under the guise of national security. And the cost is your life in the worst case scenario