23 ms·
New technology has enabled cyber-crime on an industrial scale
- djoldman 6y agohttps://outline.com/jpaTRm https://outline.com/jpaTRm
- lucasyvas 6y agoI'm about done with articles that complain about cryptocurrency as a source of this "brand new problem" Also why don't we talk about tax havens while we're at it?
- henvic 6y agoBecause tax havens really doesn't exist. What exists are tax hells! The fact that some countries have lower taxes means that society can produce more without having parasites in the state robbing everyone as easily! If anything, we need more tax havens.
- throwaway3699 6y agoTax havens keep other countries accountable from overspending, because they know people will move away from an overzealous jurisdiction. Just look at CA. I would move my money to one if I could reap the benefits and I suspect people hate them only because they're not able to also do the same thing.
- linspace 6y agoBut why not move yourself?
- henvic 6y agoAsking him to move because of this is pure fascism ideology. You should reconsider that. There are many reasons why someone might want to live in a place, despite the state there. The state and the country/state/city/whatever are different things.
- linspace 6y agoI don't know what happened to me, lately I'm becoming more and more fascist. I thought you should pay where you live but I apologize. Clearly not paying taxes was with the best intentions, for a better world.
- henvic 6y agoIt is. Taxes are slavery. Not paying them is better for everyone.
- arcticbull 6y agoI didn't realize public schools, fire departments, police stations, roads, highways, bridges, army, water, a regulated EM spectrum, a managed airspace, a managed border and NASA, was slavery. It's gonna be tough to explain to my kids how the Mars Helicopter was slavery. Boy was I mistaken!
- dang 6y agoPlease don't respond to a bad comment by breaking the site guidelines yourself. That only makes things worse. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- dang 6y agoPlease don't post flamebait to HN, and please don't use HN for ideological battle. Those things are tedious and lead to predictable, nasty discussion. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sort=byDate&type=comment&query=generic%20ideolog%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...
- throwaway3699 6y agoMy government spent the better part of two decades bombing children in the Middle East. Why should I support that if I can choose not to? Also, can you say I'm not being swindled if I'm spending nearly half my income on taxes?
- 55555 6y agoThey generally tax their own populace at a relatively standard rate (20-40%+) while taxing the offshore corps based there at 0% (or more). Hong Kong, for example. In a sense it's economic subterfuge/sabotage. This is a response to one possible reading of your comment.
- hhs 6y agoDidn’t feel like a complaint about cryptocurrency, but more of an update on empirical points. And agree, both tax havens and cryptocurrency seem important to consider.
- lucasyvas 6y agoYou're perspective is not wrong - these write-ups are just getting tiring because they almost sound like propaganda pandering to an audience that doesn't know any better and needs to be protected. The world's problems are well-documented and fighting technological progress is a waste of time. We need capable law makers and regulatory bodies. None seem fit to the task.
- ethanbond 6y agoWhich is why need broader dialogue on these problems. So people who are not already deeply invested in those problems (or underlying technologies) can start thinking about how to manage them effectively.
- shillforhumanty 6y agoI couldn't reach the article from some error, I assumed from the title they were talking about IoT. I am surprised you mentioned it's about cryptocurrency. Yikes
- fcantournet 6y agoThey're not unrelated subjects. A lot of crypto operates much in the same way dark pool finance operates. It's unregulated & opaque. This is prime territory for both scams and other criminal activities.
- lucasyvas 6y agoYou're not wrong - but considering we failed to stop p2p file sharing how does anyone expect us to stop this? The music industry railed against stuff like Napster and got literally nowhere in the grand scheme of things. We are watching a repeat of history and apparently nobody learned a thing the first time.
- ethanbond 6y agoI don’t think I know anyone who frequently pirates music anymore… Mostly due to superior products coming out (Rdio, Spotify) but given that a founder of Spotify was involved in the torrent community, don’t think it’s a crazy theory to say the legal pressure created product pressure.
- lucasyvas 6y agoYou hit the nail on the head for this particular example. It took YEARS for the industry to suck it up and make it as convenient as it needed to be, though. The difference here is that TSLA is already accepting Bitcoin, and the financial sector is already building on Ethereum. So is it really going to be illegal or are there just going to be smoother experiences layered on top that the average user will flock to? Because I'm guessing, based on where we are, that it has to be the latter at this point. Illegal use will be minimized by a new breed of middleman. It's not ideal, but it's right for the majority of people I think.
- pyrale 6y agoWhat happens the day Tesla or the platform that processes payments for them gets subpoenaed for accepting coins from a ransomware attack? I suspect they will quietly drop their coins and stop accepting new ones, especially since that's unlikely to be a common payment method.
- crumbshot 6y agoThe article isn't wrong though. The main uses of cryptocurrencies, other than as speculative assets, are online drug dealing and ransomware payments. For almost every other application, real money is more useable, convenient and reliable.
- meowface 6y agoFor Monero, yes, that's by far the predominant use. For a time, that was the predominant use for Bitcoin, but I'm pretty sure it isn't anymore as of like ~7 years ago, probably. (The article mentions Bitcoin - probably because ransomware operators know ransomware victims can more easily acquire Bitcoin than Monero - but for other kinds of serious black market activity it's almost always Monero.) For others, I think it's totally untrue even from the start. It's actually usually a lot easier to launder USD than it is to launder something like Bitcoin or Ethereum, given every transaction is completely public and traceable.
- ethanbond 6y agoThe important feature of traditional accounts is that they’re all individually tied to some real-world entity. It’s hard to understand what money ultimately went where in a chain of 10,000 purposely convoluted transactions even if you can see the entire transaction record. Good luck creating 10k bank accounts to shuffle money around.
- 6y ago
- meowface 6y agoIf you read the whole article, I don't actually see any complaints about cryptocurrency or that it's the source of the problem. I think they're just stating the situation as it is and aren't casting any value judgment. I like cryptocurrencies, and I also work in information security and malware analysis. I acknowledge ransomware is a massive problem and that ransomware would be stupid to not use cryptocurrency. Technology isn't inherently good or bad; it just is what it is. I think one of the main sources of the problem here is international law enforcement. The Russian government and security/law enforcement services have a pretty open agreement with cybercriminals: don't target Russian citizens and we won't impact your business. A lot of these organizations are now complementing the ransoms with harassment and blackmail, too, like threatening to release sensitive documents, directly harassing CEOs, etc. And some directly target health care facilities, knowing there'll be more urgency to pay up. So if you're a Russian citizen, you have carte blanche to steal millions from people around the world, in an organizational structure that mostly resembles a kind of standard office job, with almost no anxiety that it'll ever come back to bite you (as long as you never travel outside of the country). It reminds me a little of old-school naval piracy and privateering in many ways. If you're in the US or UK or France or many other places and want to start a lucrative ransomware operation, there's a high chance you'll eventually get caught, so the risk of long-term imprisonment is enough to deter you even if easy millions may tempt you. If you have no moral qualms, great incentives, and nothing to deter you, the possibilities are limitless. I'm not saying that all countries should extradite - just that they should at least make a good faith effort to cooperate with other countries' law enforcement and stop serious cybercrime like ransomware. Though I can understand why an "underdog" nation-state may want to have good relations with some talented criminals within their borders who they may be able to recruit or order around as needed.
- ChrisMarshallNY 6y ago> If you read the whole article That would be lovely, but I don't subscribe to The Economist.
- meowface 6y agoYeah, don't blame you or anyone else for clicking the link, seeing the paywall, and immediately closing the tab. It's what I did, as well. Some commenters posted non-paywalled links below. Not sure of the legality, but I wish HN would/could automatically replace paywalled article links.
- api 6y ago"New technology enables the unwashed masses to engage in financial crime at an industrial scale. That's supposed to be reserved only for oligarchs and politicians." This new technology also enables a degree of financial privacy that's a fundamental threat to civilization. It's... uhh... significantly less private than cash and (depending on the cryptocurrency used) often less private than bank wire. Never mind. FTFY Financial crime is one of those things that becomes less criminal as the scale gets larger or as one approaches influential political circles. Launder a hundred grand for a street drug dealer? Go directly to prison. Launder billions for drug cartels through major banks? You might get a fine and have to apologize. https://www.buzzfeednews.com/article/anthonycormier/hsbc-money-laundering-drug-cartels https://www.buzzfeednews.com/article/anthonycormier/hsbc-mon... Yes this last part is part whataboutism, but not without reason. 2008 proved that meaningful financial reform is virtually impossible. A riot is the last resort of the powerless.
- seaourfreed 6y ago$32 Trillion is stored in Tax Havens, for tax evasion by the wealthy. SOURCE: Routers. https://www.reuters.com/article/us-offshore-wealth/super-rich-hold-32-trillion-in-offshore-havens-idUSBRE86L03U20120722 https://www.reuters.com/article/us-offshore-wealth/super-ric... BBC: https://www.bbc.com/news/business-40442595 https://www.bbc.com/news/business-40442595 Forbes: https://www.forbes.com/sites/kenrapoza/2017/09/15/tax-haven-cash-rising-now-equal-to-at-least-10-of-world-gdp/?sh=e2ff1a870d6a https://www.forbes.com/sites/kenrapoza/2017/09/15/tax-haven-...
- arcticbull 6y ago> Also why don't we talk about tax havens while we're at it? Tax havens aren't a party to ransomware. This is just whataboutism. We can talk about tax havens too, but that's a different conversation for a different time.
- NotEvil 6y agoWithout crypto they were the things to go to. And also many criminals make use of them
- arcticbull 6y agoI sincerely doubt most people who are today carrying out ransomware scams were wealthy enough 10 years ago to benefit materially from tax havens haha. If they were, they wouldn't be committing crime today.
- loa_in_ 6y agoYou shouldn't claim to know who does and who doesn't commit crime based on how wealthy are or were they.
- arcticbull 6y agoIt's more about rational self-interest. Do the wealthy regularly steal bread from the grocery store? Probably not. The risk-reward profile is all wrong - they have many much easier ways to make money. I suppose you're right that I don't know this for a fact, I'm saying the incentives are wrong.
- loa_in_ 6y agoThe way I see it, wealthy people have: more ability to evade being caught and they can operate on a scale that exceeds capacity of ordinary police. Their risks are also somewhat diminished because they have some way to persevere and something to fall on, even with a hefty fine. I imagine that there are people parking in illegal places every time because the fine is marginal to them. All I'm saying is that the way I see it, there's no correlation between wealth and affinity to crime.
- Spooky23 6y agoCryptocurrency enables it. Tell me how you, the CFO of a small US city, would send $1M to Russia in 2006?
- ur-whale 6y agohttps://archive.is/qWIxr https://archive.is/qWIxr
- DangitBobby 6y agoI wonder why pages on archive.is never seem to present the Reader Mode option when opened in Firefox or Chrome. I wish there were a force reader mode option so I could at least try to improve my situation in the case that the archive.is renders some lines of text as 100% overlapping.
- paulpauper 6y agoWhy cant arrests be made during the cash out process. surely it cannot be that hard to trace some of the money
- throwaway3699 6y agoMoney laundering online is quite seamless. Just launch an online store or something.
- meowface 6y agoMonero transactions are extremely difficult to trace. Bitcoin transactions are traceable and can often lead you to a real person or organization, but if you're the FBI and you're tracing some Russian resident cashing out some extortion payments at a Russian exchange and transferring that money to their Russian bank account, there's nothing you can do about it. The vast majority of these ransomware gangs are in Russia and/or neighboring states, so that means you can't really do anything about any of them, besides trying to periodically go after some of their infrastructure in a whack-a-mole manner. You can't actually do anything about the criminals themselves. (I wrote more about this here: https://news.ycombinator.com/item?id=27096715 https://news.ycombinator.com/item?id=27096715. Not saying about Russia or its people, of course, and I know there's a lot of anti-Russia writing in the West, but this particular issue of ransomware can definitely be largely blamed on the Russian government's stance of not addressing it as long as Russian citizens aren't targeted.)
- tromp 6y agoThey're mostly untraceable, but not completely. That's why Monero devs keep trying to increase the ring size.
- meowface 6y agoThanks, I've clarified my post.
- matheusmoreira 6y ago> That's why Monero devs keep trying to increase the ring size. Is there anything stopping them? It is my understanding that larger signature rings are always better. Currently it seems to be fixed at 11 signatures. Why not a larger number? https://www.getmonero.org/resources/moneropedia/ring-size.html https://www.getmonero.org/resources/moneropedia/ring-size.ht...
- woah 6y agoIsn’t ransomware trivially preventable by backing up files, and having a completely different security procedure and credentials for modifying backups than doing anything else in the system?
- benjohnson 6y agoUsed to be. Now they grab a copy of the data and threaten you with divulging it. That can be a huge problem.
- arp242 6y agoAlso an outage in itself can be a major issue. A health care provider with no working computers is kind of dead in the water these days, and fixing all of this can take days or weeks.
- pyrale 6y agoThe issue is that getting a competent workforce to maintain your systems is not always easy, especially if you're not in an industry with a connection to tech. Ransomware also targets individuals, which typically don't have the knowhow to sanitize their computers. Since our industry is kind of not caring about security wrt consumer goods, they're left to fend for themselves.
- koheripbal 6y agoNewer variants search and destroy backups first, and poison systems for a couple weeks before cryptolocking everything first.
- anonymousDan 6y agoWould be really interested to see a write-up of those poisoning variants. Presuming cold backups are tamperproof, it seems to me poisoning really only make sense when fresh data is significantly more valuable than historical (pre infection) data? If you had a hypothetically secure recovery testing procedure, then it should pick up the data is corrupted right? In which case you could tune the frequency of when you run it to reduce the amount of potential fresh data loss.
- TheGigaChad 6y agoNo Coiners, charge into the breach!
- deleted 6y ago[deleted]
- ______- 6y agoThere is a theory floating about that some ransomware attacks were done purely to damage a country's infra and making money was a bonus, but not the main aim. So the perpetrators used ransomware as a front and the real goal is to destroy and disrupt a country's computer infra. But then we could argue ransomware is just going to bolster and make our systems antifragile and resilient against such attacks in the future, so the ransomware attacks could backfire since in the future it would be much harder to attack the US for example with other types of malware. It also means people are going to be storing mission critical and crown-jewels type data in airgapped systems and making filesystems read-only. The data would also be encrypted and compartmented into separate containers so attacks can't affect the whole filesystem if the airgap was breached. Thank you ransomware authors for forcing people to have better security!
- anigbrowl 6y agoFunny, I've been hearing that argument since the 1990s yet here we are. This concept isn't new, military aircraft were been hardened against electronic attack for years by limiting them to very simple software loaded from tape. There's a kind of product life cycle where people build tough robust systems with state-of-the-art technology, then those become dominant to the point where it seems superfluous, and people see opportunity in reducing inefficiency, overengineering etc., and adding new and genuinely beneficial features instead.
- petra 6y ago>> then those become dominant to the point where it seems superfluous Interesting. Can you give an example that happening over the large scale in some non-military field?
- neonate 6y agohttps://archive.is/qWIxr https://archive.is/qWIxr
- pdkl95 6y agoIt is always a temptation for a rich and lazy nation, To puff and look important and to say: -- "Though we know we should defeat you, we have not the time to meet you. We will therefore pay you cash to go away." And that is called paying the Dane-geld; But we've proved it again and again, That if once you have paid him the Dane-geld You never get rid of the Dane. It is wrong to put temptation in the path of any nation, For fear they should succumb and go astray; So when you are requested to pay up or be molested, You will find it better policy to say: -- "We never pay any-one Dane-geld, No matter how trifling the cost; For the end of that game is oppression and shame, And the nation that pays it is lost!" https://www.poetryloverspage.com/poets/kipling/dane_geld.html https://www.poetryloverspage.com/poets/kipling/dane_geld.htm... We've known for hundreds (thousands?) of years that paying ransom only encourages more demands for ransom in the future. The solution to this is backups and improved security. I know that's expensive. Pay that cost now or continue paying more dane-geld proving over and over again that you are a mark that will pay. > or, increasingly, to prevent them from being leaked Why did high-risk data exist in the first place? Maybe stop gathering so much risky data.
- arcticbull 6y agoThis sounds a lot like a victim blaming to justify the existence of a technology which intentionally seeks to make transactions like these easier.
- loa_in_ 6y agoThe victims' only mistake was the way they underfunded their IT security. It's not a small mistake though, and the financial losses of the victim itself can in certain cases easily be dwarfed by losses of people who got their data exposed.
- meowface 6y agoIt's more than that, though. Many of the modern ransomware gangs are filled with talented, dedicated attackers who specifically target certain companies. You could invest a ton into security, have a competent security team, follow best practices, set up lots of security appliances and software, have lots of analysts monitoring and responding to alerts and actively hunting for threats and writing custom SIEM rules etc., and there could still be one small mistake that lets a sophisticated attacker in. As the adage goes, the defenders have to win every time and the attackers only have to win once. A group of sufficiently motivated, dedicated, resourceful, and talented attackers who face zero risk of any sort of repercussions will very likely get in if they put enough time and effort into it. This isn't just old-school ransomware that merely tries to infect as many computers as possible in general and just happens to land on a corporate machine and automatically spreads from there. These are trained, experienced red teams manually targeting companies and everyone who works at them. In many cases the victims do indeed have poor security, but a company doesn't necessarily need to have poor security to fall victim to ransomware.
- deleted 6y ago[deleted]
- ExtraE 6y ago> The phones were seemingly designed to hide criminal activity, with end-to-end encryption, disappearing messages and no gps data. Subscriptions were paid in Bitcoin. Some of this is unusual (no gps) but the rest is standard, no? iMessage is e2e encrypted and lots of platforms have disappearing messages.
- Merrill 6y agoThe problem is that politicians, being lawyers, believe that cybercrime can be controlled by after the fact detection, apprehension, and punishment. This does not work for cybercrime. Cyber systems must be designed so that crime cannot happen. But a large part of the government does not want that level of security built into systems.
- fungiblecog 6y agoNew technology has enabled everything to be scaled up so why would crime be any different...
- sunstone 6y agoA nicely prescient article given the pipeline shutdown on the East Coast.