5 ms·

If you read the whole article, I don't actually see any complaints about cryptocurrency or that it's the source of the problem. I think they're just stating the

If you read the whole article, I don't actually see any complaints about cryptocurrency or that it's the source of the problem. I think they're just stating the situation as it is and aren't casting any value judgment. I like cryptocurrencies, and I also work in information security and malware analysis. I acknowledge ransomware is a massive problem and that ransomware would be stupid to not use cryptocurrency. Technology isn't inherently good or bad; it just is what it is. I think one of the main sources of the problem here is international law enforcement. The Russian government and security/law enforcement services have a pretty open agreement with cybercriminals: don't target Russian citizens and we won't impact your business. A lot of these organizations are now complementing the ransoms with harassment and blackmail, too, like threatening to release sensitive documents, directly harassing CEOs, etc. And some directly target health care facilities, knowing there'll be more urgency to pay up. So if you're a Russian citizen, you have carte blanche to steal millions from people around the world, in an organizational structure that mostly resembles a kind of standard office job, with almost no anxiety that it'll ever come back to bite you (as long as you never travel outside of the country). It reminds me a little of old-school naval piracy and privateering in many ways. If you're in the US or UK or France or many other places and want to start a lucrative ransomware operation, there's a high chance you'll eventually get caught, so the risk of long-term imprisonment is enough to deter you even if easy millions may tempt you. If you have no moral qualms, great incentives, and nothing to deter you, the possibilities are limitless. I'm not saying that all countries should extradite - just that they should at least make a good faith effort to cooperate with other countries' law enforcement and stop serious cybercrime like ransomware. Though I can understand why an "underdog" nation-state may want to have good relations with some talented criminals within their borders who they may be able to recruit or order around as needed.

ChrisMarshallNY 5y ago
> If you read the whole article That would be lovely, but I don't subscribe to The Economist.
- meowface 5y ago
  Yeah, don't blame you or anyone else for clicking the link, seeing the paywall, and immediately closing the tab. It's what I did, as well. Some commenters posted non-paywalled links below. Not sure of the legality, but I wish HN would/could automatically replace paywalled article links.
  - jaclaz 5y ago
    As well, no idea about the legality, but this particular article is readable with Javascript disabled, JFYI.
mountainb 5y ago
It is exactly analogous to piracy in the 17th and 18th centuries including that pirates operate out of states that are too strong to just outright destroy. When the states were no longer too strong to destroy, they were destroyed as in the 1816 destruction of Algiers by naval bombardment. It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties.
- meowface 5y ago
  Exactly. >It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties. Indeed. It just so happens that the vast majority of these ransomware gangs operate out of Russia and neighboring states. Probably in part due to the confluence of good technical education options, a huge population, and a government that permits the activity. (Not trying to say anything about Russia or Russians but just its government's policy. If it were the US that had this policy, I'm sure the biggest ransomware gangs would operate in the US, instead.) Another thing that reminds me of piracy (and also EVE Online piracy, for anyone who's played that game) is the strict adherence to the basic pirate code of honoring ransoms so that future victims will be willing to pay. They're as ruthless as they can be before payment, but if the victim cooperates and pays, then they'll keep their word - they provide the decryption key, don't release any of their data, and mark them to not be targeted in future ransomware campaigns. It's solely about making as much money as possible.
  - anonymousDan 5y ago
    Hi, I would be super interested in any evidence you could provide that ransomware authors won't target victims in future ransomware campaigns.
    - TedDoesntTalk 5y ago
      Especially since that implies they all work together and maintain lists of forbidden targets.
      - 5y ago
zozbot234 5y ago
> And some directly target health care facilities, knowing there'll be more urgency to pay up. This is a pretty serious allegation, it might be considered terrorist activity depending on how you exactly define that. Same for attacks that intentionally target other critical infrastructure. Putting human lives at risk makes a very real difference here.
- meowface 5y ago
  Absolutely. Not all ransomware gangs do; like pirates of old, some have a strict ethical code. Some also hate that others are doing it because it attracts more negative international attention towards them. Some care purely about money, though, and see hospitals as easy paydays. Here's a September 2020 interview with one operator: https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/481/original/010421_LockBit_Interview.pdf https://talos-intelligence-site.s3.amazonaws.com/production/... >The actor appears to have a contradictory code of ethics, portraying a strong disdain for those who attack health care entities while displaying conflicting evidence about whether he targets them himself. This is probably representative of many adversaries engaged in illicit cyber activity. >Hospitals are considered easy targets, making ransom payments 80 to 90 percent of the time during a ransomware attack. When easy money's in front of you and there are no deterrents, the sole thing holding you back is your ethics, and given a large enough number of people, some are going to have very little in the way of ethics. They're so brazen that many don't even care much about privacy. If there are no possible repercussions, why bother trying to conceal yourself? >During our initial conversations, we shared what we believed to be Aleks’ identity and location based on our own research, which he confirmed.
runawaybottle 5y ago
I’m concerned about this. America has shown since Vietnam that we don’t win in unorthodox wars. The Taliban beat us. The only analogy I can think of is if a smaller power constantly harasses a larger powers trade routes. Eventually America gets exhausted because we only know how to win a direct war. They will exhaust us with this over time and continue building leverage. What are we seriously going to do? Goto war with Russia or China?
- meowface 5y ago
  I don't think anyone wants to go to war over something like this. I definitely don't. There aren't a lot of options, though. You definitely can't do "extraordinary rendition" / kidnapping, for example. One is sanctions against specific individuals, which the US does do. So at least it's harder for them to participate in the international banking system. And from my understanding, US law enforcement will often try to trick these cybercriminals to travel to a seemingly more neutral country (sometimes areas that are common vacation choices for Russians), where they'll get arrested after arriving. Some of them have gotten nabbed this way - notoriously Alexander Vinnik, the owner of BTC-e and launderer behind the Mt. Gox hack [1], though I'm not sure if he was lured there or just happened to be there. But as long as someone is smart enough to never leave the country, I think they're pretty much untouchable. General geopolitical pressure and sanctions is probably the only viable option. Keep collecting evidence of the Russian government's permissive stance and bring it to the negotiating table. If enough pressure is exerted, they might eventually relent and actually start cracking down on the big actors. If they could pressure Russia to permit extradition to the US for serious crimes, that deterrence would probably stop a lot of operations overnight. I doubt that'll ever happen under Putin, though. (And it'd probably be unpopular enough in Russia that I doubt it'll happen under Putin's successors, either.) [1] https://www.justice.gov/usao-ndca/pr/russian-national-and-bitcoin-exchange-charged-21-count-indictment-operating-alleged https://www.justice.gov/usao-ndca/pr/russian-national-and-bi...
  - runawaybottle 5y ago
    I guess the question is, what does Russia want from the leverage gained from facilitating chaos?
DyslexicAtheist 5y ago
agree with all points but this one: > Technology isn't inherently good or bad; it just is what it is. I think we need a new framework for looking at this. All of technology creates different variations of the trolley-problem. So it's like saying: Trolley-company isn't inherently good or bad; it just is what it is. In most cases we don't even know there is a trolley so we get away by framing it like this but it's deeply problematic IMO. Those who write the history books and get to frame things for the future are always the representatives of the trolley company. But just because we have framed it this way throughout human history by using terms such as good, bad or neutral doesn't help either. I'm not saying that tech is bad I'm saying that saying any insinuation of presenting Tech as neutral from a moral (not legal) pov is problematic. Because if we use this by looking into the past then we must also acknowledge all the medical breakthroughs that were created during WWII. (I'm using a flippant point for purpose of illustrating just how problematic this statement is and we're not gonna find a solution by focusing on Technology because it's above all not a technical problem) Especially people in security would be well positioned to think about this because of the bird-eye pov and adversarial thought that's required to analyse it. But perhaps it's not enough and we also need to integrate people from other domains (or at least stop being hostile to the social sciences as an "inferior science" ... because this is exactly the place where we don't see the forest because of the trees)
- meowface 5y ago
  >I'm not saying that tech is bad I'm saying that saying any insinuation of presenting Tech as neutral from a moral (not legal) pov is problematic. Because if we use this by looking into the past then we must also acknowledge all the medical breakthroughs that were created during WWII (I totally understand your point, but my understanding is that actually very little of medical significance happened to be learned from the human experimentation conducted by Nazi Germany and Imperial Japan during WWII, if that's what you're referring to. But for the sake of argument we can assume it did result in medical breakthroughs. Or if you're just referring to all the breakthroughs that occurred due to the pressure of the war, then that works, too.) You're right, it's difficult to consider all technology as objectively neutral. If someone invents a device that lets any random teenager easily and cheaply release an aerosolized neurotoxin into a city center and kill thousands of people, it's hard to steelman the "it's the people, not the technology" argument in that case. Philosophically, my post wasn't too rigorous or accurate. I think in the case of cryptocurrencies, though, there's enough of a balance of positive and negative that it's foolish to discard and vilify the entire concept, even if there are many uses (e.g. scams) that do deserve the critical reaction. If something has some positive utility to it, those always need to be kept in mind. Otherwise, all the politicians arguing in favor of banning encryption would have a much easier time, for example.
paulpauper 5y ago
>If you're in the US or UK or France or many other places and want to start a lucrative ransomware operation, there's a high chance you'll eventually get caught, so the risk of long-term imprisonment is enough to deter you even if easy millions may tempt you. If you have no moral qualms, great incentives, and nothing to deter you, the possibilities are limitless. easy? hardly. you only hear about the successful ransomware. The twitter btc giveaway scam is way more profitable, harder to detect, and easier than trying to code ransomware. People make 1 btc/day undetectable with giveaway scam
- meowface 5y ago
  Yeah, I shouldn't have said easy, but easier to make millions that way than trying to create a legitimate startup or something. And you're right, there are certain kinds of scams that are possibly more lucrative for way less effort. A lot of these ransomware gangs started years ago when such scams weren't quite so lucrative. I wouldn't be surprised if many are pivoting into cryptocurrency-related scams and heists. If you're ignoring effort, though, that one Twitter hack with the BTC-doubling scam made about $100k over a few hours, and that was with access to the top accounts on the platform. According to a random Google search, a ransomware operator makes an average of $300k per company-ransoming. If you're getting 5 companies to pay you an average of that much per week, it's probably more lucrative than any giveaway scam, even if it takes a lot more effort and skill. And if you're getting more than 5 companies per week, it might be more lucrative than almost any kind of scam.
bumbada 5y ago
Let me guess: You are from the US of America. How do I know? Because the Russia is evil mentality. This comes from media in the US and lack of knowledge of History and geopolitics. Let's take some History lessons: Who sank the USS Maine? It was probably a false flag operation or the ship sank itself because of gas leak.We know it was not Spain, but it was used as an excuse to enter a war against Spain for taking Cuba and Philippines from them and committing genocide of at least a million people in the Philippines. Who killed Rasputin? The British Government. Why? Because Rasputin was very influential in making sure Russia did not enter the WWI. Because they wanted Russia to enter they propagated all kinds of lies against him that even today remain and eventually killed him. Who supported the Volsevisk revolution in Russia? The German Govertment so Russia would abandon WWI as they did after the Lenin coup. Governments have always supported crimes when they benefited from those crimes, and that has not stopped in modern times. I asked Reverte, an old war news reported who killed his friends and colleagues: https://en.wikipedia.org/wiki/Arturo_P%C3%A9rez-Reverte https://en.wikipedia.org/wiki/Arturo_P%C3%A9rez-Reverte He told me:"Half Russian secret services, half the US secret services" In today's world, the US Government is behind way more crimes than Russia, because they are 10x or 20x more influential,specially after Berlin Wall's fall. Russia has the GDP of Spain. The second biggest criminal is China, for the same reason. But US media loves China though. Now when African activist that oppose a US multinational because gas or oil gets killed. Who do you believe is behind,Russia? Who do you believe is behind when people is killed protecting the Amazon Jungle against the people that want to plant soy so Chinese pigs(and Chine that eat pigs) could be fed? Who is behind all the chaos that is in north of Africa today. Who supported the war in Libia that made the Libyan army to infiltrate in all the Sahel. Who supported the war in Syria? Afghanistan, Iraq. How is that all those new weapons magically appear out of nothing?
- meowface 5y ago
  This isn't about Russia or the US or politics or anything else you're talking about. It's about the Russian government's particular stance on cybercrime perpetrated against other countries. Unlike most other countries in the world, they explicitly choose to permit it as long as Russian citizens aren't targeted by it. That's the only thing I'm referring to, here; not anything else their current or past governments or any other country's governments have done or are doing.

ChrisMarshallNY 5y ago

> If you read the whole article That would be lovely, but I don't subscribe to The Economist.

meowface 5y ago
Yeah, don't blame you or anyone else for clicking the link, seeing the paywall, and immediately closing the tab. It's what I did, as well. Some commenters posted non-paywalled links below. Not sure of the legality, but I wish HN would/could automatically replace paywalled article links.
- jaclaz 5y ago
  As well, no idea about the legality, but this particular article is readable with Javascript disabled, JFYI.

mountainb 5y ago

It is exactly analogous to piracy in the 17th and 18th centuries including that pirates operate out of states that are too strong to just outright destroy. When the states were no longer too strong to destroy, they were destroyed as in the 1816 destruction of Algiers by naval bombardment. It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties.

meowface 5y ago
Exactly. >It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties. Indeed. It just so happens that the vast majority of these ransomware gangs operate out of Russia and neighboring states. Probably in part due to the confluence of good technical education options, a huge population, and a government that permits the activity. (Not trying to say anything about Russia or Russians but just its government's policy. If it were the US that had this policy, I'm sure the biggest ransomware gangs would operate in the US, instead.) Another thing that reminds me of piracy (and also EVE Online piracy, for anyone who's played that game) is the strict adherence to the basic pirate code of honoring ransoms so that future victims will be willing to pay. They're as ruthless as they can be before payment, but if the victim cooperates and pays, then they'll keep their word - they provide the decryption key, don't release any of their data, and mark them to not be targeted in future ransomware campaigns. It's solely about making as much money as possible.
- anonymousDan 5y ago
  Hi, I would be super interested in any evidence you could provide that ransomware authors won't target victims in future ransomware campaigns.
  - TedDoesntTalk 5y ago
    Especially since that implies they all work together and maintain lists of forbidden targets.
    - 5y ago

zozbot234 5y ago

> And some directly target health care facilities, knowing there'll be more urgency to pay up. This is a pretty serious allegation, it might be considered terrorist activity depending on how you exactly define that. Same for attacks that intentionally target other critical infrastructure. Putting human lives at risk makes a very real difference here.

meowface 5y ago
Absolutely. Not all ransomware gangs do; like pirates of old, some have a strict ethical code. Some also hate that others are doing it because it attracts more negative international attention towards them. Some care purely about money, though, and see hospitals as easy paydays. Here's a September 2020 interview with one operator: https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/481/original/010421_LockBit_Interview.pdf https://talos-intelligence-site.s3.amazonaws.com/production/... >The actor appears to have a contradictory code of ethics, portraying a strong disdain for those who attack health care entities while displaying conflicting evidence about whether he targets them himself. This is probably representative of many adversaries engaged in illicit cyber activity. >Hospitals are considered easy targets, making ransom payments 80 to 90 percent of the time during a ransomware attack. When easy money's in front of you and there are no deterrents, the sole thing holding you back is your ethics, and given a large enough number of people, some are going to have very little in the way of ethics. They're so brazen that many don't even care much about privacy. If there are no possible repercussions, why bother trying to conceal yourself? >During our initial conversations, we shared what we believed to be Aleks’ identity and location based on our own research, which he confirmed.

runawaybottle 5y ago

I’m concerned about this. America has shown since Vietnam that we don’t win in unorthodox wars. The Taliban beat us. The only analogy I can think of is if a smaller power constantly harasses a larger powers trade routes. Eventually America gets exhausted because we only know how to win a direct war. They will exhaust us with this over time and continue building leverage. What are we seriously going to do? Goto war with Russia or China?

meowface 5y ago
I don't think anyone wants to go to war over something like this. I definitely don't. There aren't a lot of options, though. You definitely can't do "extraordinary rendition" / kidnapping, for example. One is sanctions against specific individuals, which the US does do. So at least it's harder for them to participate in the international banking system. And from my understanding, US law enforcement will often try to trick these cybercriminals to travel to a seemingly more neutral country (sometimes areas that are common vacation choices for Russians), where they'll get arrested after arriving. Some of them have gotten nabbed this way - notoriously Alexander Vinnik, the owner of BTC-e and launderer behind the Mt. Gox hack [1], though I'm not sure if he was lured there or just happened to be there. But as long as someone is smart enough to never leave the country, I think they're pretty much untouchable. General geopolitical pressure and sanctions is probably the only viable option. Keep collecting evidence of the Russian government's permissive stance and bring it to the negotiating table. If enough pressure is exerted, they might eventually relent and actually start cracking down on the big actors. If they could pressure Russia to permit extradition to the US for serious crimes, that deterrence would probably stop a lot of operations overnight. I doubt that'll ever happen under Putin, though. (And it'd probably be unpopular enough in Russia that I doubt it'll happen under Putin's successors, either.) [1] https://www.justice.gov/usao-ndca/pr/russian-national-and-bitcoin-exchange-charged-21-count-indictment-operating-alleged https://www.justice.gov/usao-ndca/pr/russian-national-and-bi...
- runawaybottle 5y ago
  I guess the question is, what does Russia want from the leverage gained from facilitating chaos?

DyslexicAtheist 5y ago

agree with all points but this one: > Technology isn't inherently good or bad; it just is what it is. I think we need a new framework for looking at this. All of technology creates different variations of the trolley-problem. So it's like saying: Trolley-company isn't inherently good or bad; it just is what it is. In most cases we don't even know there is a trolley so we get away by framing it like this but it's deeply problematic IMO. Those who write the history books and get to frame things for the future are always the representatives of the trolley company. But just because we have framed it this way throughout human history by using terms such as good, bad or neutral doesn't help either. I'm not saying that tech is bad I'm saying that saying any insinuation of presenting Tech as neutral from a moral (not legal) pov is problematic. Because if we use this by looking into the past then we must also acknowledge all the medical breakthroughs that were created during WWII. (I'm using a flippant point for purpose of illustrating just how problematic this statement is and we're not gonna find a solution by focusing on Technology because it's above all not a technical problem) Especially people in security would be well positioned to think about this because of the bird-eye pov and adversarial thought that's required to analyse it. But perhaps it's not enough and we also need to integrate people from other domains (or at least stop being hostile to the social sciences as an "inferior science" ... because this is exactly the place where we don't see the forest because of the trees)

meowface 5y ago
>I'm not saying that tech is bad I'm saying that saying any insinuation of presenting Tech as neutral from a moral (not legal) pov is problematic. Because if we use this by looking into the past then we must also acknowledge all the medical breakthroughs that were created during WWII (I totally understand your point, but my understanding is that actually very little of medical significance happened to be learned from the human experimentation conducted by Nazi Germany and Imperial Japan during WWII, if that's what you're referring to. But for the sake of argument we can assume it did result in medical breakthroughs. Or if you're just referring to all the breakthroughs that occurred due to the pressure of the war, then that works, too.) You're right, it's difficult to consider all technology as objectively neutral. If someone invents a device that lets any random teenager easily and cheaply release an aerosolized neurotoxin into a city center and kill thousands of people, it's hard to steelman the "it's the people, not the technology" argument in that case. Philosophically, my post wasn't too rigorous or accurate. I think in the case of cryptocurrencies, though, there's enough of a balance of positive and negative that it's foolish to discard and vilify the entire concept, even if there are many uses (e.g. scams) that do deserve the critical reaction. If something has some positive utility to it, those always need to be kept in mind. Otherwise, all the politicians arguing in favor of banning encryption would have a much easier time, for example.

paulpauper 5y ago

>If you're in the US or UK or France or many other places and want to start a lucrative ransomware operation, there's a high chance you'll eventually get caught, so the risk of long-term imprisonment is enough to deter you even if easy millions may tempt you. If you have no moral qualms, great incentives, and nothing to deter you, the possibilities are limitless. easy? hardly. you only hear about the successful ransomware. The twitter btc giveaway scam is way more profitable, harder to detect, and easier than trying to code ransomware. People make 1 btc/day undetectable with giveaway scam

meowface 5y ago
Yeah, I shouldn't have said easy, but easier to make millions that way than trying to create a legitimate startup or something. And you're right, there are certain kinds of scams that are possibly more lucrative for way less effort. A lot of these ransomware gangs started years ago when such scams weren't quite so lucrative. I wouldn't be surprised if many are pivoting into cryptocurrency-related scams and heists. If you're ignoring effort, though, that one Twitter hack with the BTC-doubling scam made about $100k over a few hours, and that was with access to the top accounts on the platform. According to a random Google search, a ransomware operator makes an average of $300k per company-ransoming. If you're getting 5 companies to pay you an average of that much per week, it's probably more lucrative than any giveaway scam, even if it takes a lot more effort and skill. And if you're getting more than 5 companies per week, it might be more lucrative than almost any kind of scam.

bumbada 5y ago

Let me guess: You are from the US of America. How do I know? Because the Russia is evil mentality. This comes from media in the US and lack of knowledge of History and geopolitics. Let's take some History lessons: Who sank the USS Maine? It was probably a false flag operation or the ship sank itself because of gas leak.We know it was not Spain, but it was used as an excuse to enter a war against Spain for taking Cuba and Philippines from them and committing genocide of at least a million people in the Philippines. Who killed Rasputin? The British Government. Why? Because Rasputin was very influential in making sure Russia did not enter the WWI. Because they wanted Russia to enter they propagated all kinds of lies against him that even today remain and eventually killed him. Who supported the Volsevisk revolution in Russia? The German Govertment so Russia would abandon WWI as they did after the Lenin coup. Governments have always supported crimes when they benefited from those crimes, and that has not stopped in modern times. I asked Reverte, an old war news reported who killed his friends and colleagues: https://en.wikipedia.org/wiki/Arturo_P%C3%A9rez-Reverte https://en.wikipedia.org/wiki/Arturo_P%C3%A9rez-Reverte He told me:"Half Russian secret services, half the US secret services" In today's world, the US Government is behind way more crimes than Russia, because they are 10x or 20x more influential,specially after Berlin Wall's fall. Russia has the GDP of Spain. The second biggest criminal is China, for the same reason. But US media loves China though. Now when African activist that oppose a US multinational because gas or oil gets killed. Who do you believe is behind,Russia? Who do you believe is behind when people is killed protecting the Amazon Jungle against the people that want to plant soy so Chinese pigs(and Chine that eat pigs) could be fed? Who is behind all the chaos that is in north of Africa today. Who supported the war in Libia that made the Libyan army to infiltrate in all the Sahel. Who supported the war in Syria? Afghanistan, Iraq. How is that all those new weapons magically appear out of nothing?

meowface 5y ago
This isn't about Russia or the US or politics or anything else you're talking about. It's about the Russian government's particular stance on cybercrime perpetrated against other countries. Unlike most other countries in the world, they explicitly choose to permit it as long as Russian citizens aren't targeted by it. That's the only thing I'm referring to, here; not anything else their current or past governments or any other country's governments have done or are doing.