5 ms·

It is exactly analogous to piracy in the 17th and 18th centuries including that pirates operate out of states that are too strong to just outright destroy. When

It is exactly analogous to piracy in the 17th and 18th centuries including that pirates operate out of states that are too strong to just outright destroy. When the states were no longer too strong to destroy, they were destroyed as in the 1816 destruction of Algiers by naval bombardment. It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties.

meowface 5y ago
Exactly. >It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties. Indeed. It just so happens that the vast majority of these ransomware gangs operate out of Russia and neighboring states. Probably in part due to the confluence of good technical education options, a huge population, and a government that permits the activity. (Not trying to say anything about Russia or Russians but just its government's policy. If it were the US that had this policy, I'm sure the biggest ransomware gangs would operate in the US, instead.) Another thing that reminds me of piracy (and also EVE Online piracy, for anyone who's played that game) is the strict adherence to the basic pirate code of honoring ransoms so that future victims will be willing to pay. They're as ruthless as they can be before payment, but if the victim cooperates and pays, then they'll keep their word - they provide the decryption key, don't release any of their data, and mark them to not be targeted in future ransomware campaigns. It's solely about making as much money as possible.
- anonymousDan 5y ago
  Hi, I would be super interested in any evidence you could provide that ransomware authors won't target victims in future ransomware campaigns.
  - TedDoesntTalk 5y ago
    Especially since that implies they all work together and maintain lists of forbidden targets.
    - meowface 5y ago
      I'm specifically referring to a single group/gang/operator. It doesn't mean a different operator - perhaps using the exact same ransomware software as the initial attacker - won't target them. It might exist, but I'm not aware of any list-sharing between unaffiliated operators.
  - meowface 5y ago
    I'm specifically referring to a single group/gang/operator. It doesn't mean a different operator - perhaps using the exact same ransomware software as the initial attacker - won't target them. It might exist, but I'm not aware of any list-sharing between unaffiliated operators. I can't find a source right now and don't know for a fact how many do this, but I know I've read in at least one interview that a ransomware operator at least claimed they did this. And regardless of what actually happens in reality - in my opinion, the most economically rational choice would be for all ransomware operators to do this (and to punish other ransomware operators who don't). In general, many of them seem to try to maintain a reputation of honesty and integrity, despite the obvious juxtaposition with the very immoral behavior. I wrote more about this here: https://news.ycombinator.com/item?id=27102646 https://news.ycombinator.com/item?id=27102646
bloak 5y ago
> It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties. Extradition is not a requirement. France, like Russia, will not extradite its own citizens, but you don't see so many criminal gangs operating out of France.
- meowface 5y ago
  Yeah, it's not merely a matter of Russia not extraditing; they simply don't address the problem at all unless the cybercrime is also affecting other Russian citizens. And in some cases the security services seem to have direct relationships with some cybercriminals. (I'm not sure how friendly or close the relationships are, but there's definitely some tit-for-tat: we let you operate and make all this money, and in return you do us favors when we need them. I believe laundering is one example, like in the BTC-e case.)
  - loa_in_ 5y ago
    It's a very efficient way to operate. This is mostly unrelated, but it reminds me of all those claims of how free market and capitalism promote efficiency wherever they reign.

meowface 5y ago

Exactly. >It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties. Indeed. It just so happens that the vast majority of these ransomware gangs operate out of Russia and neighboring states. Probably in part due to the confluence of good technical education options, a huge population, and a government that permits the activity. (Not trying to say anything about Russia or Russians but just its government's policy. If it were the US that had this policy, I'm sure the biggest ransomware gangs would operate in the US, instead.) Another thing that reminds me of piracy (and also EVE Online piracy, for anyone who's played that game) is the strict adherence to the basic pirate code of honoring ransoms so that future victims will be willing to pay. They're as ruthless as they can be before payment, but if the victim cooperates and pays, then they'll keep their word - they provide the decryption key, don't release any of their data, and mark them to not be targeted in future ransomware campaigns. It's solely about making as much money as possible.

anonymousDan 5y ago
Hi, I would be super interested in any evidence you could provide that ransomware authors won't target victims in future ransomware campaigns.
- TedDoesntTalk 5y ago
  Especially since that implies they all work together and maintain lists of forbidden targets.
  - meowface 5y ago
    I'm specifically referring to a single group/gang/operator. It doesn't mean a different operator - perhaps using the exact same ransomware software as the initial attacker - won't target them. It might exist, but I'm not aware of any list-sharing between unaffiliated operators.
- meowface 5y ago
  I'm specifically referring to a single group/gang/operator. It doesn't mean a different operator - perhaps using the exact same ransomware software as the initial attacker - won't target them. It might exist, but I'm not aware of any list-sharing between unaffiliated operators. I can't find a source right now and don't know for a fact how many do this, but I know I've read in at least one interview that a ransomware operator at least claimed they did this. And regardless of what actually happens in reality - in my opinion, the most economically rational choice would be for all ransomware operators to do this (and to punish other ransomware operators who don't). In general, many of them seem to try to maintain a reputation of honesty and integrity, despite the obvious juxtaposition with the very immoral behavior. I wrote more about this here: https://news.ycombinator.com/item?id=27102646 https://news.ycombinator.com/item?id=27102646

bloak 5y ago

> It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties. Extradition is not a requirement. France, like Russia, will not extradite its own citizens, but you don't see so many criminal gangs operating out of France.

meowface 5y ago
Yeah, it's not merely a matter of Russia not extraditing; they simply don't address the problem at all unless the cybercrime is also affecting other Russian citizens. And in some cases the security services seem to have direct relationships with some cybercriminals. (I'm not sure how friendly or close the relationships are, but there's definitely some tit-for-tat: we let you operate and make all this money, and in return you do us favors when we need them. I believe laundering is one example, like in the BTC-e case.)
- loa_in_ 5y ago
  It's a very efficient way to operate. This is mostly unrelated, but it reminds me of all those claims of how free market and capitalism promote efficiency wherever they reign.