20 ms·

The ransomware surge

132 points by arkadiyt 6y ago

paulpauper 6y ago
the irony is if any of the early victims kept their excess BTC they came out ahead
sneak 6y ago
This is going to be the rationale given for the heavy-handed cryptocurrency regulation they're going to bring down on all the exchanges that US persons can access. Pretty soon all you'll be able to legally access as a USian is "Bitcoin!(tm)"[1] (like what PayPal is doing), not the actual uncut blockchain bitcoin that you can send and receive at will. [1]: https://www.epsilontheory.com/in-praise-of-bitcoin/ https://www.epsilontheory.com/in-praise-of-bitcoin/
- pydry 6y ago
  They'll hold off on regulating Bitcoin until it starts being used to get dirty money out of America. When that happens they will suddenly remember that its use value is strictly limited to illegal transactions and speculation. Might be too late by that point tho.
  - oh_sigh 6y ago
    Isn't that what happens when extortion gangs from Asia and Europe extort American businesses?
- amelius 6y ago
  Personally, I don't see the problem. 1. Bitcoin drives up GPU costs. 2. Bitcoin makes it ridiculously easy to commit certain forms of crime. 3. And Bitcoin's energy footprint hurts the planet.
  - danuker 6y ago
    4. It snuffs those pesky troublemakers and brings them back in line through monetary inflation across generations.
    - amelius 6y ago
      Monetary inflation can also be a good thing as it reduces wealth inequality and income inequality.
      - bastiantower 6y ago
        It doesn't, quite the contrary. Poor and middle class people hold much more of their wealth as cash than rich people.
      - danuker 6y ago
        Only if the newly-created money is distributed, and doesn't just belong to the Federal Reserve. As the system works now, the Federal Reserve prints the money and gets to spend it, and I can't imagine a more unequal income.
      - rawtxapp 6y ago
        More like increases inequality [1][2]. If you're rich, you have access to rock-bottom interest rates which you can then invest. If you're an average citizen, you watch all asset values (real estate to start with) soar while your income stays relatively stable. 1: https://www.clasp.org/blog/how-inflation-reinforces-economic-disparities https://www.clasp.org/blog/how-inflation-reinforces-economic... 2: https://www.theatlantic.com/ideas/archive/2019/11/income-inequality-getting-worse/601414/ https://www.theatlantic.com/ideas/archive/2019/11/income-ine...
    - dghlsakjg 6y ago
      Bitcoin has been around for less than twenty years. Since then it has seen massive deflationary periods (when the relative value rises, like up until a month ago), and massive inflationary periods (when the value drops) In 2018 bitcoin had an "inflation" rate of roughly 500% (meaning that at the beginning of 2018 you could buy a basket of goods with an equivalent value of $13.5k USD, at the end of the year you had to spend 500% more bitcoin to get the exact same basket of goods. Meanwhile you only had to spend 2-3% more USD to get those same goods) The fact that there aren't bitcoin loans is proof that it is not a viable store of value.
  - sneak 6y ago
    Putting an entire society under ubiquitous surveillance to catch a tiny minority of criminals isn't a good bargain. Fact is, though, that's not even why they do it. Eventually you get to the point where you see that the information and ultimate large scale control permitted by the collection of that information is itself the end goal, and that it has nothing to do with detecting or preventing crime.
    - amelius 6y ago
      It's easier to trace Bitcoin than cash.
      - uncletammy 6y ago
        Which to me sounds like a better argument to NOT make it illegal. From the perspective of government that is.
- tootahe45 6y ago
  Already happening with 'unhosted' wallets being blocked or heavily scrutinized. My personal experience is as follows: Sent over 20 transactions from US exchange -> US exchange and no problems. Sent a single transaction from my unhosted software wallet -> US exchange, and got my account locked. Questioned on everything including my employer's information, had do re-do advanced KYC, source of funds etc. (The unhosted wallet was funded from an exchange which makes it stupid, and i didn't use any coinjoins or anything).
  - londons_explore 6y ago
    I wonder how exchanges know each other's addresses? Don't they tend to use a new address for every incoming and outgoing payment? Do they have private API's to verify addresses?
    - uncletammy 6y ago
      They are fairly easy to pick out simply based on the way money flows in and out of the addresses. Also, they become known over time as customers share them then they are eventually labeled by companies (exchanges included) performing blockchain analytics. Many of the public blockchain explorers show labels for popular addresses. I've seen labels on big exchanges, Satoshi's coins, seized silk road coins, coins from hacks, etc.
  - sneak 6y ago
    Which exchange were you withdrawing from?
    - tootahe45 6y ago
      To be fair it was a regulated stable-coin issuer based in NY where i was redeeming stable-coins for USD, so the strictest of all AML was to be expected. I was just surprised the tech is already in place for a travel rule for crypto. If i would guess it would've been a company like chainanalysis aggregating the exchange data to enable this.
- seibelj 6y ago
  Will increase the utility of decentralized exchanges like Uniswap and DeFi in general. The more CEX gets regulated the less people will want / need to use them.
  - rawtxapp 6y ago
    Yep, that's what people don't understand, you can ban centralized entities as much as you want, but you can't stop people from running arbitrary code on their devices which means it's impossible to shutdown a properly decentralized network.
    - Nursie 6y ago
      If you can’t convert back to a national currency, nobody will care.
      - ipaddr 6y ago
        If you can use it as a currency some will care.
  - cinquemb 6y ago
    Yup, and its only a matter of time before a uncollateralized + decentralized stable coin takes over from USDT/USDC…
davethedevguy 6y ago
The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetrators know this. They don't need to be more sophisticated than the InfoSec people at a given organisation, they just need to trick one user in that organisation in to letting them on to the network.
- g_p 6y ago
  Absolutely this - most ransomware attacks are pretty unsophisticated. You don't need privilege escalation, or an exploit. You can carry out the attack using just basic user permissions. You are exploiting a basic "problem" of most modern OSs (that apps run "as" the user executing them) - the user/group permission model ceases to work in 2021 with non-expert users. Portal-based access to individual files via secure OS-provided portals (i.e. like on Android/iOS/flatpak) help to prevent apps needing access to every file on the filesystem, but until those are widely adopted, it will be increasingly difficult for "normal" organisations to prevent ransomware attacks. You can prevent ransomware fairly simply by following best practice, and taking some steps that most companies will feel are excessive (but effective), such as whitelisting binaries, preventing running of any binaries not on that whitelist, and keeping that whitelist up to date on a regular real-time basis. Nobody wants to spend the time doing this, so they leave it a "free-for-all". Exploiting user-level access is just the natural escalation now that getting good exploits is more costly and difficult. Now attackers will "make do" wiht what they have. IT can win the battle, but with inconvenience, friction, and increased costs in IT. There's important businesses that are "critical infrastructure" still using Windows 7 on their corporate day-to-day let-me-check-my-emails-and-browse-the-web laptops, without extended support. Organisational inertia and a lack of recognition that they need to pay for the technology that enablers their business leads them to this position.
  - londons_explore 6y ago
    I would like to see rate-limiting built into OS's. Eg. an application is only allowed to touch 100 files per second or 1000 files per hour. When it reaches those limits, it gets paused and a popup asks the user if this application really should be doing X. Then at least ransomware can't run through stuff too quickly.
paulpauper 6y ago
Exchanges are good at blacklisting BTC ,so this means it will be hard for hackers to cash out. Just converting BTC into XMR is not a trivial process, as it needs to go through an exchange. Trustless cross chain transactions are still in infancy .
- danuker 6y ago
  > Trustless cross chain transactions are still in infancy . They can technically exist?
  - seibelj 6y ago
    Yes and are being actively developed by multiple teams https://eprint.iacr.org/2020/1126.pdf https://eprint.iacr.org/2020/1126.pdf
  - jMyles 6y ago
    > They can technically exist? Do you mean in the specific case of ring signatures? Or at all? There are already threshold-signature-based schemes for doing this with ECDSA (though they're very gas heavy at the moment). But none has emerged for ring signatures yet beyond the paper stage.
  - a1369209993 6y ago
    > They can technically exist? Yes, assuming sufficiently (not very) expressive transaction signing on said chains. Assume Alice wishes to exchange 1 ABC for Dan's 1 DEF. Alice publishes a transaction for 1 ABC with a UTXO that must be signed by both Alice and Dan. She then provides a zero-knowledge proof that her private key for that signature hashes to XXX. Dan then publishes a transaction for 1 DEF with a UTXO that requires a signature from Alice[0] and a hash preimage of XXX. Alice then pulishes a transaction moving that 1 DEF to her own whereever, which (since second-preimage attacks are hard) contains the private key Dan needs to claim the 1 ABC UTXO. So this requires that chain ABC supports 2-of-2 (or k-of-n) signature requirements, and that chain DEF supports signature-and-hash-preimage requirements. This simple protocol is vulnerable to losing money entirely if one party abandons it partway though, but that can mitigated by exchanging eg 0.1 ABC/DEF at a time, or by a more sophisticated exchange protocol. Edit: 0: using a different key than the XXX preimage.
jude- 6y ago
Ransomware wouldn't be a problem if the software industry took quality assurance seriously (or was regulated to do so), like every other engineering industry. There's little difference to me between an insecure program that allows hackers to hold your data for ransom, and a defective home appliance that occasionally starts electric fires.
- thatguy0900 6y ago
  Well every home appliance could easily start a fire if random malicious actors got to fuck with it while it was plugged in. You'll note that other engineering disciplines would also fall apart if hostile actors were constantly throwing explosives at the things they make 24/7.
  - akiselev 6y ago
    Yeah but software engineers know that hostile actors come with the territory any time they expose a networked device or service. It's no different than corrosion or any number of other inevitabilities that engineers have to deal with. When's the last time a civil engineer designed a bridge without accounting for corrosion or the fact that people will be driving over it?
    - thatguy0900 6y ago
      How is wear and tear equivalent to hostile humans purposefully trying to fuck it up? Even military installations needs armed guards to stop people from just cutting through the fence. Wear and tear is more equivalent to keeping your site from going down to high traffic. Show me a road that's still safe when three guys with guns are standing in the middle of it shooting at passing drivers.
      - akiselev 6y ago
        How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them? Engineers design stuff to withstand adversaries all the time, when it's required. Designing with adversaries in mind is always required for connected systems in our field. The computer equivalent to "three guys with guns are standing in the middle of [a road] shooting at passing drivers" would be three gunmen gaining physical access to a datacenter - game over. We don't try to protect against that attack vector any more than civil engineers protect against terrorists when designing some intersection, except maybe we encrypt some data at rest and they put up some bollards and CCTV. You're getting hung up on the agency aspect when the most important thing is the attack by attrition. It doesn't matter whether it is a force of nature like corrosion or all the bad actors in human civilization, the point is that it is a known quantity that will eventually degrade and break every nontrivial system. We don't know which future zero day exploit will break our systems any more than civil engineers know which wave or car will cause the ultimate collapse, but we know that it is inevitable. That's why we have defense in depth. It is the nature of the beast. [1] https://en.wikipedia.org/wiki/33_Thomas_Street https://en.wikipedia.org/wiki/33_Thomas_Street
louwrentius 6y ago
> "The hackers were the Ryuk ransomware gang and they demanded we pay them 45 Bitcoin, which was about half a million dollars. Make no mistake: this ransomware surge is 100% enabled / facilitated by Bitcoin and possibly other cryptocurrencies. This would not have been so bad if cryptocurrencies would actually provide anything of really significant value to our societies, but no. Aside from a mixture of Ponzi scheme, Pyramid scheme, and MLM + the energy waste, this ransomware is yet another terrible effect on our world. It is time we effectively ban cryptocurrencies. Let’s end this madness. Please. I am dead serious. I think cryptocurrencies and blockchain technology is the asbestos of the software world.
- seibelj 6y ago
  Crypto also risks the ability of central banks to print infinite amounts of money
  - user-the-name 6y ago
    Cryptocurrencies are being printed in massive amounts all the time.
    - matheusmoreira 6y ago
      He said infinite amounts. Cryptocurrencies usually have a fixed supply.
      - user-the-name 6y ago
        So you're saying he is wrong in the weirdest way possible, by literally implying that central banks print infinite money, in a finite universe?
        matheusmoreira 6y ago
        By infinite supply people mean the bank's ability to create any amount of money at will. Most cryptocurrencies have limits on the money supply.
tootahe45 6y ago
I don't get why everybody cares so much about the ransomware/cryptominer part, but not the data being exfiltrated and sold/used for criminal activity part..
- g_p 6y ago
  My cynical suspicion is because exfiltration/sale doesn't prevent the business from continuing to operate, pretending nothing is wrong, and gaslighting their users via reassuring language if anyone finds out or is approached. When the data is encrypted and locked up, the company itself cries foul (not out of care for people's data) as it can't keep doing whatever mundane things it was doing day-to-day.
  - Craighead 6y ago
    Mundane... like providing health care?
- deleted 6y ago
  [deleted]
- johnvaluk 6y ago
  This attack is most effective against victims without backups who are desperate to get back their data. If you have backups, you basically shrug it off, restore your data, (re)train your users and use forensics to mitigate any obvious weaknesses. In most cases, it takes less effort for the attackers to move on to the next victim instead of trying to extract value from any data they may have exfiltrated (probably none in a lot of cases).
- bluGill 6y ago
  Most data just isn't that useful. Sure there are exceptions, but most isn't very useful. If you offered my company our competitors source code for free, we wouldn't take it - we have some ethics. I think most of you are in the same boat - even if you don't have strong company ethics are quick check would discover that you already know how to do everything they are doing, so time looking at their code is time you aren't adding those features to yours. (the one exception would be their file format which are valuable) Even if the data is valuable, can they use it? I know the database admins in my company are registered with the SEC as not able to trade some things because we have insider information from our customers. Even if someone got that data though, they would have to figure out the database, what it means, AND be lucky enough to do that when there is something non-public that can be traded. Most of the time the expected supply is the same as actual supply, so that fact that we have insider information on the actual supply isn't actually useful. (the above is a different department from mine so I don't know the details very well) Thus the example of a police department is an outlier as the data is sensitive for a long time.
danuker 6y ago
March 31st was World Backup Day. Hope you guys have backups.
- megous 6y ago
  April 31st is the world backup day for most people.
djoldman 6y ago
Can someone tell me where I'm wrong here: The solution to ransomware is to daily mirror every system to an append only backup and then just flash everything back if you get hit. You lose a few days...
- edflsafoiewq 6y ago
  Your data has still been leaked. A few days ago there was a story about a ransomware gang threatening to expose police informants if they didn't get paid.
  - djoldman 6y ago
    Yes, definitely that. But I think a lot of businesses really have a problem with the mechanics of just getting their business running again, like the one in the article. This seems fairly straightforward to defend against.
  - walshemj 6y ago
    Seems a bit risky attacking other criminals - you never know if they might have contacts in the hard to extradite countries they work in.
  - bluGill 6y ago
    But my data isn't that sensitive. I'd prefer to keep it secret, but the value decays fast.
- deleted 6y ago
  [deleted]
- toss1 6y ago
  The threat to that is a silent encryptiion on that goes on for weeks before the alert/ransom is demanded. Your mirrors are now full of encrypted trash, or you need to go back a month or more. This could be managed with a backup that maintains 'fingerprint' hashes of all the files, tracks the changes and alerts if there are too many, or alternatively, the user/admin litters the system with a set of canary files of the same type that should never change, and the backup system halts and alerts if any of them do. I'd like to see a utility to just check a set of canary files for changes. Anyone know of one?
RcouF1uZ4gsC 6y ago
I think it is likely that there will be a real world kidnapping where the kidnappers demand a Bitcoin ransom. Once this happens, Bitcoin will get rapidly regulated out of existence by governments. Imagine if it follows the usual stereotypical news coverage. An attractive, photogenic American woman goes to a foreign country and gets kidnapped. Later the kidnappers send ransom demands with a Bitcoin address. This would be wall-to-wall 24/7 news coverage on all the major channels. After that, the public would likely support almost any type of regulation on crypto-currency.
- billytetrud 6y ago
  Kidnappers can also demand dollars for ransom. Are governments going to regulate dollars out of existence? Or are you saying they'll just use it as an excuse to harass bitcoin?
  - RcouF1uZ4gsC 6y ago
    Dollars are a little different in that transferring large amounts anonymously is hard. Collecting the ransom is probably the point of highest vulnerability and that is something law enforcement agencies like the FBI have used to catch kidnappers. However, with cryptocurrency, that vulnerability is mitigated a lot, and that completely changes the dynamics. There is a reason, the ransomware attackers aren't demanding suitcases of cash at pre-ordained meeting sites.
    - jude- 6y ago
      Good thing, then, that Bitcoin is anything but anonymous.
      - hi5eyes 6y ago
        https://techcrunch.com/2021/03/26/chainalysis-raises-100m-doubles-valuation-to-over-2b/ https://techcrunch.com/2021/03/26/chainalysis-raises-100m-do... 2b for a company cexs use to filter out dirty crypto
- 6y ago
rapjr9 6y ago
Are not the organizations that signed this report the ones who should be doing something about ransomware?
roody15 6y ago
“ increase regulation of cryptocurrency services” Hmmm.
- user-the-name 6y ago
  Cryptocurrencies are the one sole reason that there is a ransomware epidemic today. Without them, ransomware would be nowhere near as profitable or easy. Kill cryptocurrencies, kill ransomware. Plus, kill a massive source of carbon emissions. It's a massive win on multiple fronts.
  - swiley 6y ago
    I don't think you can just "kill cryptocurrencies." China tried that and most of the mining happens there now. Plus not all cryptocurrencies waste power the way bitcoin does. And before crypto was big there was malware that asked for money via mailed checks and bank transfers (and there are plenty of scams that just call people and ask for money with no software at all.) In addition banks make an incredible profit laundering money for drug/human trafficking. I'm sure they could be convinced to put that to use doing other things if crypto wasn't there.
    - user-the-name 6y ago
      Of course we can. There just hasn't been much political will to do so yet, because they have been an irrelevant distraction. That is no longer the case now that they are actively making climate change worse, and disrupting business through ransomware.
darkhorn 6y ago
Interestingly they target mostly Windows users. If you are Linux or BSD user you are less likely to be targeted.
- bluGill 6y ago
  Perhaps, but don't take comfort in that: protect yourself with good backups so you can keep the reputation of it not being worth it to attack linux/BSD users as they won't pay up. So long as there is no money in attacking they won't find our bugs.
operator-name 6y ago
Since nobody has linked it, here is the primary source, the report mentioned in the article: https://securityandtechnology.org/ransomwaretaskforce/report/ https://securityandtechnology.org/ransomwaretaskforce/report... As an aside does anyone know (with citations) the history and why reputable news publications like the BBC or reuters never cite their sources? It's always seemed odd that even quacks and conspiracy cites (mis)use sources whilst well respected publishers don't.
korethr 6y ago
Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed on a Friday night that the web front-ends are acting weird, and they can't get in to troubleshoot, and then 10 minutes later come to discover that the latest strain of Ryuk has laid waste to 2/3s of the servers and workstations across the company. And then all of a sudden, those VM snapshots you'd been copying off to another file share with a shell script have become your salvation. Yeah, containing Ryuk and the rest of incident response mode are going to suck, but at least now you don't have to write an apology to your customers that the data they entrusted to you has been irrevocably lost. In case you're wondering, no, that did not literally happen to me. But it is a mild fictionalization of someone I know. Keep backups, and test your restores regularly, people.
- kemonocode 6y ago
  Modern ransomware gangs focus more on data exfiltration rather than actually locking down data, and it lets them remain undetected for longer too. That said, yes, correct, having good and reliable backups is vital.
  - beermonster 5y ago
    In combination with techniques to minimise easy/unrestricted exfiltration of data. Such as egress filtering, software access policies/controls, minimum privilege, network segregation/isolation, good user access and network access controls, decent patching policy, good and tested backups and incident response plan…yada yada. Make sure if they do get in, the damage is limited.
- likecarter 6y ago
  A crucial point you missed: Ransomware gangs often destroy your backup infrastructure. So it's important to create pull-only backups or backups that cannot be deleted / overwritten.
Traster 6y ago
There's this point in Civilization (1) where you get Knights and your attack is 4 and mostly you're going against Phalanxes who are defense 2, and even with various advantages you still have a massive edge. That's where I feel we are with a lot of computer systems. It's far easier to attack than defend, and with Bitcoin it's easier than ever to transfer wealth anonymously. In the case of the knights eventually the defence got the edge again with the advent of firearms, but that could be a long time coming.
jll29 6y ago
Timely topic, the current Communications of the ACM has a more detailed article on this topic: https://dl.acm.org/doi/10.1145/3449054 https://dl.acm.org/doi/10.1145/3449054
ericalexander0 6y ago
Surprised at how much focus there is on backups as the solution. You'll never fully recover from those backups. Backups won't help you avoid fines, lawsuits, lost customers, and lost time. I run an open data set on data breaches. The vast majority of ransomware incidents start with a phishing email, to beach head, to find domain admin, to game over. The root problem is domain admin population size. Reduce it to zero with privileged access management to avoid ransomware. https://ericalexander.org/SecurityBreach/#/ https://ericalexander.org/SecurityBreach/#/
- networkimprov 6y ago
  A second root problem is the insanity of public SMTP on today's Internet: allowing anyone, claiming any identity, to send you any content without limits. I started the "mnm" open source project to enable a new email network, on a new protocol. More: https://mnmnotmail.org/ https://mnmnotmail.org/ Follow: https://twitter.com/mnmnotmail https://twitter.com/mnmnotmail
  - bouncycastle 6y ago
    It looks very similar to Slack / Discord. However, if an org needs email, why can't they just configure their filters to move everything from outside the org in a special folder, and email server could further filter any link and put it through a warning page before redirecting to the link. We already have DKIM and SPF to verify if the domains of the sender. Just setting up these can work.
    - networkimprov 6y ago
      Have you looked through the FAQ and protocol draft? https://mnmnotmail.org/faq.html https://mnmnotmail.org/faq.html https://github.com/networkimprov/mnm/blob/master/Protocol.md https://github.com/networkimprov/mnm/blob/master/Protocol.md The mnm client app isn't chat-oriented like Slack & Discord, altho it does provide presence status for contacts who've opted into that.
  - corinroyal 6y ago
Thorentis 6y ago
Just because lives aren't being directly targeted, how isn't this a form of terrorism? If your and your employee's livelihoods depends on your IT systems, and somebody intentionally destroys them, that is terrifying! Unless there is some serious teeth to any response to this, it will keep hapening. The FBI and the UK CCC can put out as many recommendations as they like about backups and updates, but criminals will just keep finding targets, or upping the damage. It is time to consider these attacks as terrorism, and respond to state sponsored terror attacks accordingly.
- deleted 6y ago
  [deleted]
cloudking 6y ago
There's an argument to be made here for using hosted cloud providers instead of rolling your own servers, keeping your data off premise and relying on their security practices. The problem with managing your own servers and services is that you're constantly playing the security game, and responsible for keeping your systems secure and up to date. People hate on providers like Google, but the reality is they have _thousands_ of top tier engineers and security experts managing and monitoring their cloud services. Using their managed database and VM services are far more likely to provide better security than your in house IT team. When was the last time you heard of a Google Cloud customer falling victim to a ransomware attack? (I'm using Google as an example, can say the same for Microsoft, Amazon etc)
- deleted 6y ago
  [deleted]
nikanj 6y ago
Ransomware got way more viable thanks to crypto. No more need for money mules and shady shell companies, just take moneys in crypto and you’re golden
- greenn 6y ago
  That crypto has to become real money at some point. If the ransom is in something like bitcoin (very common) then identification is just a waiting game for that conversion
  - bostik 6y ago
    Funny that you should mention that. It looks like there is an emerging interest to go after the money outlets: https://krebsonsecurity.com/2021/04/task-force-seeks-to-disrupt-ransomware-payments/ https://krebsonsecurity.com/2021/04/task-force-seeks-to-disr...
  - leifg 6y ago
    I doubt that any of the ransomware people will use any crypto exchange. I suspect there is whole network of people that will sell crypto for cash to people who want to buy drugs/other things on the darknet. Maybe there is a handful of corrupt exchanges but the bigger ones already check where your crypto is coming from.
55555 6y ago
> "Not only that but, really distressingly, the funds that come in from paid ransoms fund other forms of organised crime, like human trafficking and child exploitation." Not really. Those things either fund themselves or their divisions get shut down within the criminal organization. Paid ransoms mostly fund luxury sports cars and vacation homes. Source: I'm a Russian mob boss and ransomware is highly segmented from the rest of my rackets.
A_No_Name_Mouse 6y ago
Can anyone elaborate on what a company wide restore operation looks like in a big company? I worry about this because IT support teams tend to test restores per system. But what if it's thousands of systems going down at the same time? If this happens I even wonder how long it would take to restore productivity if the ransom is being paid. Also, what percentage of systems would typically be infected?
CynicusRex 6y ago
Criminalize crypto pyramid Ponzi schemes because it's good for nothing but things that makes humanity worse: gambling, ransomware, wastefulness, greed, etc. https://www.cynicusrex.com/file/cryptocultscience.html https://www.cynicusrex.com/file/cryptocultscience.html https://www.stephendiehl.com/blog/banbitcoin.html https://www.stephendiehl.com/blog/banbitcoin.html

132 points by arkadiyt 6y ago

the irony is if any of the early victims kept their excess BTC they came out ahead

This is going to be the rationale given for the heavy-handed cryptocurrency regulation they're going to bring down on all the exchanges that US persons can access. Pretty soon all you'll be able to legally access as a USian is "Bitcoin!(tm)"[1] (like what PayPal is doing), not the actual uncut blockchain bitcoin that you can send and receive at will. [1]: https://www.epsilontheory.com/in-praise-of-bitcoin/ https://www.epsilontheory.com/in-praise-of-bitcoin/

pydry 6y ago
They'll hold off on regulating Bitcoin until it starts being used to get dirty money out of America. When that happens they will suddenly remember that its use value is strictly limited to illegal transactions and speculation. Might be too late by that point tho.
- oh_sigh 6y ago
  Isn't that what happens when extortion gangs from Asia and Europe extort American businesses?
amelius 6y ago
Personally, I don't see the problem. 1. Bitcoin drives up GPU costs. 2. Bitcoin makes it ridiculously easy to commit certain forms of crime. 3. And Bitcoin's energy footprint hurts the planet.
- danuker 6y ago
  4. It snuffs those pesky troublemakers and brings them back in line through monetary inflation across generations.
  - amelius 6y ago
    Monetary inflation can also be a good thing as it reduces wealth inequality and income inequality.
    - bastiantower 6y ago
      It doesn't, quite the contrary. Poor and middle class people hold much more of their wealth as cash than rich people.
    - danuker 6y ago
      Only if the newly-created money is distributed, and doesn't just belong to the Federal Reserve. As the system works now, the Federal Reserve prints the money and gets to spend it, and I can't imagine a more unequal income.
    - rawtxapp 6y ago
      More like increases inequality [1][2]. If you're rich, you have access to rock-bottom interest rates which you can then invest. If you're an average citizen, you watch all asset values (real estate to start with) soar while your income stays relatively stable. 1: https://www.clasp.org/blog/how-inflation-reinforces-economic-disparities https://www.clasp.org/blog/how-inflation-reinforces-economic... 2: https://www.theatlantic.com/ideas/archive/2019/11/income-inequality-getting-worse/601414/ https://www.theatlantic.com/ideas/archive/2019/11/income-ine...
  - dghlsakjg 6y ago
    Bitcoin has been around for less than twenty years. Since then it has seen massive deflationary periods (when the relative value rises, like up until a month ago), and massive inflationary periods (when the value drops) In 2018 bitcoin had an "inflation" rate of roughly 500% (meaning that at the beginning of 2018 you could buy a basket of goods with an equivalent value of $13.5k USD, at the end of the year you had to spend 500% more bitcoin to get the exact same basket of goods. Meanwhile you only had to spend 2-3% more USD to get those same goods) The fact that there aren't bitcoin loans is proof that it is not a viable store of value.
- sneak 6y ago
  Putting an entire society under ubiquitous surveillance to catch a tiny minority of criminals isn't a good bargain. Fact is, though, that's not even why they do it. Eventually you get to the point where you see that the information and ultimate large scale control permitted by the collection of that information is itself the end goal, and that it has nothing to do with detecting or preventing crime.
  - amelius 6y ago
    It's easier to trace Bitcoin than cash.
    - uncletammy 6y ago
      Which to me sounds like a better argument to NOT make it illegal. From the perspective of government that is.
tootahe45 6y ago
Already happening with 'unhosted' wallets being blocked or heavily scrutinized. My personal experience is as follows: Sent over 20 transactions from US exchange -> US exchange and no problems. Sent a single transaction from my unhosted software wallet -> US exchange, and got my account locked. Questioned on everything including my employer's information, had do re-do advanced KYC, source of funds etc. (The unhosted wallet was funded from an exchange which makes it stupid, and i didn't use any coinjoins or anything).
- londons_explore 6y ago
  I wonder how exchanges know each other's addresses? Don't they tend to use a new address for every incoming and outgoing payment? Do they have private API's to verify addresses?
  - uncletammy 6y ago
    They are fairly easy to pick out simply based on the way money flows in and out of the addresses. Also, they become known over time as customers share them then they are eventually labeled by companies (exchanges included) performing blockchain analytics. Many of the public blockchain explorers show labels for popular addresses. I've seen labels on big exchanges, Satoshi's coins, seized silk road coins, coins from hacks, etc.
- sneak 6y ago
  Which exchange were you withdrawing from?
  - tootahe45 6y ago
    To be fair it was a regulated stable-coin issuer based in NY where i was redeeming stable-coins for USD, so the strictest of all AML was to be expected. I was just surprised the tech is already in place for a travel rule for crypto. If i would guess it would've been a company like chainanalysis aggregating the exchange data to enable this.
seibelj 6y ago
Will increase the utility of decentralized exchanges like Uniswap and DeFi in general. The more CEX gets regulated the less people will want / need to use them.
- rawtxapp 6y ago
  Yep, that's what people don't understand, you can ban centralized entities as much as you want, but you can't stop people from running arbitrary code on their devices which means it's impossible to shutdown a properly decentralized network.
  - Nursie 6y ago
    If you can’t convert back to a national currency, nobody will care.
    - ipaddr 6y ago
      If you can use it as a currency some will care.
- cinquemb 6y ago
  Yup, and its only a matter of time before a uncollateralized + decentralized stable coin takes over from USDT/USDC…

davethedevguy 6y ago

The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetrators know this. They don't need to be more sophisticated than the InfoSec people at a given organisation, they just need to trick one user in that organisation in to letting them on to the network.

g_p 6y ago
Absolutely this - most ransomware attacks are pretty unsophisticated. You don't need privilege escalation, or an exploit. You can carry out the attack using just basic user permissions. You are exploiting a basic "problem" of most modern OSs (that apps run "as" the user executing them) - the user/group permission model ceases to work in 2021 with non-expert users. Portal-based access to individual files via secure OS-provided portals (i.e. like on Android/iOS/flatpak) help to prevent apps needing access to every file on the filesystem, but until those are widely adopted, it will be increasingly difficult for "normal" organisations to prevent ransomware attacks. You can prevent ransomware fairly simply by following best practice, and taking some steps that most companies will feel are excessive (but effective), such as whitelisting binaries, preventing running of any binaries not on that whitelist, and keeping that whitelist up to date on a regular real-time basis. Nobody wants to spend the time doing this, so they leave it a "free-for-all". Exploiting user-level access is just the natural escalation now that getting good exploits is more costly and difficult. Now attackers will "make do" wiht what they have. IT can win the battle, but with inconvenience, friction, and increased costs in IT. There's important businesses that are "critical infrastructure" still using Windows 7 on their corporate day-to-day let-me-check-my-emails-and-browse-the-web laptops, without extended support. Organisational inertia and a lack of recognition that they need to pay for the technology that enablers their business leads them to this position.
- londons_explore 6y ago
  I would like to see rate-limiting built into OS's. Eg. an application is only allowed to touch 100 files per second or 1000 files per hour. When it reaches those limits, it gets paused and a popup asks the user if this application really should be doing X. Then at least ransomware can't run through stuff too quickly.

paulpauper 6y ago

Exchanges are good at blacklisting BTC ,so this means it will be hard for hackers to cash out. Just converting BTC into XMR is not a trivial process, as it needs to go through an exchange. Trustless cross chain transactions are still in infancy .

danuker 6y ago
> Trustless cross chain transactions are still in infancy . They can technically exist?
- seibelj 6y ago
  Yes and are being actively developed by multiple teams https://eprint.iacr.org/2020/1126.pdf https://eprint.iacr.org/2020/1126.pdf
- jMyles 6y ago
  > They can technically exist? Do you mean in the specific case of ring signatures? Or at all? There are already threshold-signature-based schemes for doing this with ECDSA (though they're very gas heavy at the moment). But none has emerged for ring signatures yet beyond the paper stage.
- a1369209993 6y ago
  > They can technically exist? Yes, assuming sufficiently (not very) expressive transaction signing on said chains. Assume Alice wishes to exchange 1 ABC for Dan's 1 DEF. Alice publishes a transaction for 1 ABC with a UTXO that must be signed by both Alice and Dan. She then provides a zero-knowledge proof that her private key for that signature hashes to XXX. Dan then publishes a transaction for 1 DEF with a UTXO that requires a signature from Alice[0] and a hash preimage of XXX. Alice then pulishes a transaction moving that 1 DEF to her own whereever, which (since second-preimage attacks are hard) contains the private key Dan needs to claim the 1 ABC UTXO. So this requires that chain ABC supports 2-of-2 (or k-of-n) signature requirements, and that chain DEF supports signature-and-hash-preimage requirements. This simple protocol is vulnerable to losing money entirely if one party abandons it partway though, but that can mitigated by exchanging eg 0.1 ABC/DEF at a time, or by a more sophisticated exchange protocol. Edit: 0: using a different key than the XXX preimage.

jude- 6y ago

Ransomware wouldn't be a problem if the software industry took quality assurance seriously (or was regulated to do so), like every other engineering industry. There's little difference to me between an insecure program that allows hackers to hold your data for ransom, and a defective home appliance that occasionally starts electric fires.

thatguy0900 6y ago
Well every home appliance could easily start a fire if random malicious actors got to fuck with it while it was plugged in. You'll note that other engineering disciplines would also fall apart if hostile actors were constantly throwing explosives at the things they make 24/7.
- akiselev 6y ago
  Yeah but software engineers know that hostile actors come with the territory any time they expose a networked device or service. It's no different than corrosion or any number of other inevitabilities that engineers have to deal with. When's the last time a civil engineer designed a bridge without accounting for corrosion or the fact that people will be driving over it?
  - thatguy0900 6y ago
    How is wear and tear equivalent to hostile humans purposefully trying to fuck it up? Even military installations needs armed guards to stop people from just cutting through the fence. Wear and tear is more equivalent to keeping your site from going down to high traffic. Show me a road that's still safe when three guys with guns are standing in the middle of it shooting at passing drivers.
    - akiselev 6y ago
      How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them? Engineers design stuff to withstand adversaries all the time, when it's required. Designing with adversaries in mind is always required for connected systems in our field. The computer equivalent to "three guys with guns are standing in the middle of [a road] shooting at passing drivers" would be three gunmen gaining physical access to a datacenter - game over. We don't try to protect against that attack vector any more than civil engineers protect against terrorists when designing some intersection, except maybe we encrypt some data at rest and they put up some bollards and CCTV. You're getting hung up on the agency aspect when the most important thing is the attack by attrition. It doesn't matter whether it is a force of nature like corrosion or all the bad actors in human civilization, the point is that it is a known quantity that will eventually degrade and break every nontrivial system. We don't know which future zero day exploit will break our systems any more than civil engineers know which wave or car will cause the ultimate collapse, but we know that it is inevitable. That's why we have defense in depth. It is the nature of the beast. [1] https://en.wikipedia.org/wiki/33_Thomas_Street https://en.wikipedia.org/wiki/33_Thomas_Street

louwrentius 6y ago

> "The hackers were the Ryuk ransomware gang and they demanded we pay them 45 Bitcoin, which was about half a million dollars. Make no mistake: this ransomware surge is 100% enabled / facilitated by Bitcoin and possibly other cryptocurrencies. This would not have been so bad if cryptocurrencies would actually provide anything of really significant value to our societies, but no. Aside from a mixture of Ponzi scheme, Pyramid scheme, and MLM + the energy waste, this ransomware is yet another terrible effect on our world. It is time we effectively ban cryptocurrencies. Let’s end this madness. Please. I am dead serious. I think cryptocurrencies and blockchain technology is the asbestos of the software world.

seibelj 6y ago
Crypto also risks the ability of central banks to print infinite amounts of money
- user-the-name 6y ago
  Cryptocurrencies are being printed in massive amounts all the time.
  - matheusmoreira 6y ago
    He said infinite amounts. Cryptocurrencies usually have a fixed supply.
    - user-the-name 6y ago
      So you're saying he is wrong in the weirdest way possible, by literally implying that central banks print infinite money, in a finite universe?
      - matheusmoreira 6y ago
        By infinite supply people mean the bank's ability to create any amount of money at will. Most cryptocurrencies have limits on the money supply.

tootahe45 6y ago

I don't get why everybody cares so much about the ransomware/cryptominer part, but not the data being exfiltrated and sold/used for criminal activity part..

g_p 6y ago
My cynical suspicion is because exfiltration/sale doesn't prevent the business from continuing to operate, pretending nothing is wrong, and gaslighting their users via reassuring language if anyone finds out or is approached. When the data is encrypted and locked up, the company itself cries foul (not out of care for people's data) as it can't keep doing whatever mundane things it was doing day-to-day.
- Craighead 6y ago
  Mundane... like providing health care?
deleted 6y ago
[deleted]
johnvaluk 6y ago
This attack is most effective against victims without backups who are desperate to get back their data. If you have backups, you basically shrug it off, restore your data, (re)train your users and use forensics to mitigate any obvious weaknesses. In most cases, it takes less effort for the attackers to move on to the next victim instead of trying to extract value from any data they may have exfiltrated (probably none in a lot of cases).
bluGill 6y ago
Most data just isn't that useful. Sure there are exceptions, but most isn't very useful. If you offered my company our competitors source code for free, we wouldn't take it - we have some ethics. I think most of you are in the same boat - even if you don't have strong company ethics are quick check would discover that you already know how to do everything they are doing, so time looking at their code is time you aren't adding those features to yours. (the one exception would be their file format which are valuable) Even if the data is valuable, can they use it? I know the database admins in my company are registered with the SEC as not able to trade some things because we have insider information from our customers. Even if someone got that data though, they would have to figure out the database, what it means, AND be lucky enough to do that when there is something non-public that can be traded. Most of the time the expected supply is the same as actual supply, so that fact that we have insider information on the actual supply isn't actually useful. (the above is a different department from mine so I don't know the details very well) Thus the example of a police department is an outlier as the data is sensitive for a long time.

danuker 6y ago

March 31st was World Backup Day. Hope you guys have backups.

megous 6y ago
April 31st is the world backup day for most people.

djoldman 6y ago

Can someone tell me where I'm wrong here: The solution to ransomware is to daily mirror every system to an append only backup and then just flash everything back if you get hit. You lose a few days...

edflsafoiewq 6y ago
Your data has still been leaked. A few days ago there was a story about a ransomware gang threatening to expose police informants if they didn't get paid.
- djoldman 6y ago
  Yes, definitely that. But I think a lot of businesses really have a problem with the mechanics of just getting their business running again, like the one in the article. This seems fairly straightforward to defend against.
- walshemj 6y ago
  Seems a bit risky attacking other criminals - you never know if they might have contacts in the hard to extradite countries they work in.
- bluGill 6y ago
  But my data isn't that sensitive. I'd prefer to keep it secret, but the value decays fast.
deleted 6y ago
[deleted]
toss1 6y ago
The threat to that is a silent encryptiion on that goes on for weeks before the alert/ransom is demanded. Your mirrors are now full of encrypted trash, or you need to go back a month or more. This could be managed with a backup that maintains 'fingerprint' hashes of all the files, tracks the changes and alerts if there are too many, or alternatively, the user/admin litters the system with a set of canary files of the same type that should never change, and the backup system halts and alerts if any of them do. I'd like to see a utility to just check a set of canary files for changes. Anyone know of one?

RcouF1uZ4gsC 6y ago

I think it is likely that there will be a real world kidnapping where the kidnappers demand a Bitcoin ransom. Once this happens, Bitcoin will get rapidly regulated out of existence by governments. Imagine if it follows the usual stereotypical news coverage. An attractive, photogenic American woman goes to a foreign country and gets kidnapped. Later the kidnappers send ransom demands with a Bitcoin address. This would be wall-to-wall 24/7 news coverage on all the major channels. After that, the public would likely support almost any type of regulation on crypto-currency.

billytetrud 6y ago
Kidnappers can also demand dollars for ransom. Are governments going to regulate dollars out of existence? Or are you saying they'll just use it as an excuse to harass bitcoin?
- RcouF1uZ4gsC 6y ago
  Dollars are a little different in that transferring large amounts anonymously is hard. Collecting the ransom is probably the point of highest vulnerability and that is something law enforcement agencies like the FBI have used to catch kidnappers. However, with cryptocurrency, that vulnerability is mitigated a lot, and that completely changes the dynamics. There is a reason, the ransomware attackers aren't demanding suitcases of cash at pre-ordained meeting sites.
  - jude- 6y ago
    Good thing, then, that Bitcoin is anything but anonymous.
    - hi5eyes 6y ago
      https://techcrunch.com/2021/03/26/chainalysis-raises-100m-doubles-valuation-to-over-2b/ https://techcrunch.com/2021/03/26/chainalysis-raises-100m-do... 2b for a company cexs use to filter out dirty crypto
6y ago

rapjr9 6y ago

Are not the organizations that signed this report the ones who should be doing something about ransomware?

roody15 6y ago

“ increase regulation of cryptocurrency services” Hmmm.

user-the-name 6y ago
Cryptocurrencies are the one sole reason that there is a ransomware epidemic today. Without them, ransomware would be nowhere near as profitable or easy. Kill cryptocurrencies, kill ransomware. Plus, kill a massive source of carbon emissions. It's a massive win on multiple fronts.
- swiley 6y ago
  I don't think you can just "kill cryptocurrencies." China tried that and most of the mining happens there now. Plus not all cryptocurrencies waste power the way bitcoin does. And before crypto was big there was malware that asked for money via mailed checks and bank transfers (and there are plenty of scams that just call people and ask for money with no software at all.) In addition banks make an incredible profit laundering money for drug/human trafficking. I'm sure they could be convinced to put that to use doing other things if crypto wasn't there.
  - user-the-name 6y ago
    Of course we can. There just hasn't been much political will to do so yet, because they have been an irrelevant distraction. That is no longer the case now that they are actively making climate change worse, and disrupting business through ransomware.

darkhorn 6y ago

Interestingly they target mostly Windows users. If you are Linux or BSD user you are less likely to be targeted.

bluGill 6y ago
Perhaps, but don't take comfort in that: protect yourself with good backups so you can keep the reputation of it not being worth it to attack linux/BSD users as they won't pay up. So long as there is no money in attacking they won't find our bugs.

operator-name 6y ago

Since nobody has linked it, here is the primary source, the report mentioned in the article: https://securityandtechnology.org/ransomwaretaskforce/report/ https://securityandtechnology.org/ransomwaretaskforce/report... As an aside does anyone know (with citations) the history and why reputable news publications like the BBC or reuters never cite their sources? It's always seemed odd that even quacks and conspiracy cites (mis)use sources whilst well respected publishers don't.

korethr 6y ago

Backups. I cannot emphasize enough the importance of backups. Take backups, verify your ability to restore from them, and keep them segregated from the rest of your infrastructure. It doesn't matter how inelegant and hacky your backup solution is, so long as you can restore from it. Any backup you can restore from is better than no backup. You might get a call from one of your application engineers shortly before bed on a Friday night that the web front-ends are acting weird, and they can't get in to troubleshoot, and then 10 minutes later come to discover that the latest strain of Ryuk has laid waste to 2/3s of the servers and workstations across the company. And then all of a sudden, those VM snapshots you'd been copying off to another file share with a shell script have become your salvation. Yeah, containing Ryuk and the rest of incident response mode are going to suck, but at least now you don't have to write an apology to your customers that the data they entrusted to you has been irrevocably lost. In case you're wondering, no, that did not literally happen to me. But it is a mild fictionalization of someone I know. Keep backups, and test your restores regularly, people.

kemonocode 6y ago
Modern ransomware gangs focus more on data exfiltration rather than actually locking down data, and it lets them remain undetected for longer too. That said, yes, correct, having good and reliable backups is vital.
- beermonster 5y ago
  In combination with techniques to minimise easy/unrestricted exfiltration of data. Such as egress filtering, software access policies/controls, minimum privilege, network segregation/isolation, good user access and network access controls, decent patching policy, good and tested backups and incident response plan…yada yada. Make sure if they do get in, the damage is limited.
likecarter 6y ago
A crucial point you missed: Ransomware gangs often destroy your backup infrastructure. So it's important to create pull-only backups or backups that cannot be deleted / overwritten.

Traster 6y ago

There's this point in Civilization (1) where you get Knights and your attack is 4 and mostly you're going against Phalanxes who are defense 2, and even with various advantages you still have a massive edge. That's where I feel we are with a lot of computer systems. It's far easier to attack than defend, and with Bitcoin it's easier than ever to transfer wealth anonymously. In the case of the knights eventually the defence got the edge again with the advent of firearms, but that could be a long time coming.

jll29 6y ago

Timely topic, the current Communications of the ACM has a more detailed article on this topic: https://dl.acm.org/doi/10.1145/3449054 https://dl.acm.org/doi/10.1145/3449054

ericalexander0 6y ago

Surprised at how much focus there is on backups as the solution. You'll never fully recover from those backups. Backups won't help you avoid fines, lawsuits, lost customers, and lost time. I run an open data set on data breaches. The vast majority of ransomware incidents start with a phishing email, to beach head, to find domain admin, to game over. The root problem is domain admin population size. Reduce it to zero with privileged access management to avoid ransomware. https://ericalexander.org/SecurityBreach/#/ https://ericalexander.org/SecurityBreach/#/

networkimprov 6y ago
A second root problem is the insanity of public SMTP on today's Internet: allowing anyone, claiming any identity, to send you any content without limits. I started the "mnm" open source project to enable a new email network, on a new protocol. More: https://mnmnotmail.org/ https://mnmnotmail.org/ Follow: https://twitter.com/mnmnotmail https://twitter.com/mnmnotmail
- bouncycastle 6y ago
  It looks very similar to Slack / Discord. However, if an org needs email, why can't they just configure their filters to move everything from outside the org in a special folder, and email server could further filter any link and put it through a warning page before redirecting to the link. We already have DKIM and SPF to verify if the domains of the sender. Just setting up these can work.
  - networkimprov 6y ago
    Have you looked through the FAQ and protocol draft? https://mnmnotmail.org/faq.html https://mnmnotmail.org/faq.html https://github.com/networkimprov/mnm/blob/master/Protocol.md https://github.com/networkimprov/mnm/blob/master/Protocol.md The mnm client app isn't chat-oriented like Slack & Discord, altho it does provide presence status for contacts who've opted into that.
- corinroyal 6y ago

Thorentis 6y ago

Just because lives aren't being directly targeted, how isn't this a form of terrorism? If your and your employee's livelihoods depends on your IT systems, and somebody intentionally destroys them, that is terrifying! Unless there is some serious teeth to any response to this, it will keep hapening. The FBI and the UK CCC can put out as many recommendations as they like about backups and updates, but criminals will just keep finding targets, or upping the damage. It is time to consider these attacks as terrorism, and respond to state sponsored terror attacks accordingly.

deleted 6y ago
[deleted]

cloudking 6y ago

There's an argument to be made here for using hosted cloud providers instead of rolling your own servers, keeping your data off premise and relying on their security practices. The problem with managing your own servers and services is that you're constantly playing the security game, and responsible for keeping your systems secure and up to date. People hate on providers like Google, but the reality is they have _thousands_ of top tier engineers and security experts managing and monitoring their cloud services. Using their managed database and VM services are far more likely to provide better security than your in house IT team. When was the last time you heard of a Google Cloud customer falling victim to a ransomware attack? (I'm using Google as an example, can say the same for Microsoft, Amazon etc)

deleted 6y ago
[deleted]

nikanj 6y ago

Ransomware got way more viable thanks to crypto. No more need for money mules and shady shell companies, just take moneys in crypto and you’re golden

greenn 6y ago
That crypto has to become real money at some point. If the ransom is in something like bitcoin (very common) then identification is just a waiting game for that conversion
- bostik 6y ago
  Funny that you should mention that. It looks like there is an emerging interest to go after the money outlets: https://krebsonsecurity.com/2021/04/task-force-seeks-to-disrupt-ransomware-payments/ https://krebsonsecurity.com/2021/04/task-force-seeks-to-disr...
- leifg 6y ago
  I doubt that any of the ransomware people will use any crypto exchange. I suspect there is whole network of people that will sell crypto for cash to people who want to buy drugs/other things on the darknet. Maybe there is a handful of corrupt exchanges but the bigger ones already check where your crypto is coming from.

55555 6y ago

> "Not only that but, really distressingly, the funds that come in from paid ransoms fund other forms of organised crime, like human trafficking and child exploitation." Not really. Those things either fund themselves or their divisions get shut down within the criminal organization. Paid ransoms mostly fund luxury sports cars and vacation homes. Source: I'm a Russian mob boss and ransomware is highly segmented from the rest of my rackets.

A_No_Name_Mouse 6y ago

Can anyone elaborate on what a company wide restore operation looks like in a big company? I worry about this because IT support teams tend to test restores per system. But what if it's thousands of systems going down at the same time? If this happens I even wonder how long it would take to restore productivity if the ransom is being paid. Also, what percentage of systems would typically be infected?

CynicusRex 6y ago

Criminalize crypto pyramid Ponzi schemes because it's good for nothing but things that makes humanity worse: gambling, ransomware, wastefulness, greed, etc. https://www.cynicusrex.com/file/cryptocultscience.html https://www.cynicusrex.com/file/cryptocultscience.html https://www.stephendiehl.com/blog/banbitcoin.html https://www.stephendiehl.com/blog/banbitcoin.html