4 ms·

Monero transactions are extremely difficult to trace. Bitcoin transactions are traceable and can often lead you to a real person or organization, but if you're

Monero transactions are extremely difficult to trace. Bitcoin transactions are traceable and can often lead you to a real person or organization, but if you're the FBI and you're tracing some Russian resident cashing out some extortion payments at a Russian exchange and transferring that money to their Russian bank account, there's nothing you can do about it. The vast majority of these ransomware gangs are in Russia and/or neighboring states, so that means you can't really do anything about any of them, besides trying to periodically go after some of their infrastructure in a whack-a-mole manner. You can't actually do anything about the criminals themselves. (I wrote more about this here: https://news.ycombinator.com/item?id=27096715 https://news.ycombinator.com/item?id=27096715. Not saying about Russia or its people, of course, and I know there's a lot of anti-Russia writing in the West, but this particular issue of ransomware can definitely be largely blamed on the Russian government's stance of not addressing it as long as Russian citizens aren't targeted.)

tromp 5y ago
They're mostly untraceable, but not completely. That's why Monero devs keep trying to increase the ring size.
- meowface 5y ago
  Thanks, I've clarified my post.
- matheusmoreira 5y ago
  > That's why Monero devs keep trying to increase the ring size. Is there anything stopping them? It is my understanding that larger signature rings are always better. Currently it seems to be fixed at 11 signatures. Why not a larger number? https://www.getmonero.org/resources/moneropedia/ring-size.html https://www.getmonero.org/resources/moneropedia/ring-size.ht...
  - tromp 5y ago
    Larger transaction size (and hence chain size growth) and verification times.
    - matheusmoreira 5y ago
      Is there any data on the strength of the current ring size of 11? Is it sufficient to prevent tracking?
paulpauper 5y ago
but cross chain tx of millions of dollars of btc to xmr is not exacly trivial, unles there is someitng i am missing
- meowface 5y ago
  Indeed; it's their country's law enforcement being okay with the crimes that's the core of the problem, here.
mindslight 5y ago
It's almost like the FBI's activities on this matter are futile and should be replaced with continual public service announcements telling people to not give money to the telephone.
- meowface 5y ago
  This isn't scamming but rather ransomware extortion. If you're the CEO of a company and a ransomware gang targets you, encrypts the disks of every single server, including backups - leaving you completely inoperable - and messages you with screenshots of all the sensitive documents and PII they'll release if you don't pay, it's hard to just release a PSA telling people to ignore it. The threat is absolutely real, and the total cost might end up being much more than the ransom payment. This happens on a daily basis. You might as well inform people to not pay when a cartel kidnaps their child and holds them for ransom. A better PSA would be to keep off-site cold-storage backups, secure hot backups as much as you can, abide by the principle of least privilege, keep sensitive materials in as few and secure of places as possible, general network and application security advice, etc. But no matter how much you try to inform people, there'll still be thousands of companies that won't win against organized crime gangs filled with sophisticated, dedicated attackers who are constantly scouring for potential new victims and who know they have no risk of being hampered by any law enforcement organization in the world.
  - mindslight 5y ago
    The public article just mentions phone scams, but now having read the Outline link I see the private version goes into much more. Obviously PSAs aren't an approach to ransomware, but talking about the need to take software security seriously isn't as directly actionable.
  - richwater 5y ago
    > If you're the CEO of a company and a ransomware gang targets you, encrypts the disks of every single server, including backups - leaving you completely inoperable - and messages you with screenshots of all the sensitive documents and PII they'll release if you don't pay, it's hard to just release a PSA telling people to ignore it. If a company is this incompetent once, it will happen again. Paying a ransom is just giving the company the opportunity to cover it up and collect more PII without punishment or oversight.
csomar 5y ago
They get arrested as soon as they land on US-friendly soils. (ie: https://en.wikipedia.org/wiki/Alexander_Vinnik https://en.wikipedia.org/wiki/Alexander_Vinnik ) But, yeah, otherwise the US can't do much if they are currently in Russia or China.
- meowface 5y ago
  Indeed; I mentioned that, with Vinnik as an example, in https://news.ycombinator.com/item?id=27097212 https://news.ycombinator.com/item?id=27097212

tromp 5y ago

They're mostly untraceable, but not completely. That's why Monero devs keep trying to increase the ring size.

meowface 5y ago
Thanks, I've clarified my post.
matheusmoreira 5y ago
> That's why Monero devs keep trying to increase the ring size. Is there anything stopping them? It is my understanding that larger signature rings are always better. Currently it seems to be fixed at 11 signatures. Why not a larger number? https://www.getmonero.org/resources/moneropedia/ring-size.html https://www.getmonero.org/resources/moneropedia/ring-size.ht...
- tromp 5y ago
  Larger transaction size (and hence chain size growth) and verification times.
  - matheusmoreira 5y ago
    Is there any data on the strength of the current ring size of 11? Is it sufficient to prevent tracking?

paulpauper 5y ago

but cross chain tx of millions of dollars of btc to xmr is not exacly trivial, unles there is someitng i am missing

meowface 5y ago
Indeed; it's their country's law enforcement being okay with the crimes that's the core of the problem, here.

mindslight 5y ago

It's almost like the FBI's activities on this matter are futile and should be replaced with continual public service announcements telling people to not give money to the telephone.

meowface 5y ago
This isn't scamming but rather ransomware extortion. If you're the CEO of a company and a ransomware gang targets you, encrypts the disks of every single server, including backups - leaving you completely inoperable - and messages you with screenshots of all the sensitive documents and PII they'll release if you don't pay, it's hard to just release a PSA telling people to ignore it. The threat is absolutely real, and the total cost might end up being much more than the ransom payment. This happens on a daily basis. You might as well inform people to not pay when a cartel kidnaps their child and holds them for ransom. A better PSA would be to keep off-site cold-storage backups, secure hot backups as much as you can, abide by the principle of least privilege, keep sensitive materials in as few and secure of places as possible, general network and application security advice, etc. But no matter how much you try to inform people, there'll still be thousands of companies that won't win against organized crime gangs filled with sophisticated, dedicated attackers who are constantly scouring for potential new victims and who know they have no risk of being hampered by any law enforcement organization in the world.
- mindslight 5y ago
  The public article just mentions phone scams, but now having read the Outline link I see the private version goes into much more. Obviously PSAs aren't an approach to ransomware, but talking about the need to take software security seriously isn't as directly actionable.
- richwater 5y ago
  > If you're the CEO of a company and a ransomware gang targets you, encrypts the disks of every single server, including backups - leaving you completely inoperable - and messages you with screenshots of all the sensitive documents and PII they'll release if you don't pay, it's hard to just release a PSA telling people to ignore it. If a company is this incompetent once, it will happen again. Paying a ransom is just giving the company the opportunity to cover it up and collect more PII without punishment or oversight.

csomar 5y ago

They get arrested as soon as they land on US-friendly soils. (ie: https://en.wikipedia.org/wiki/Alexander_Vinnik https://en.wikipedia.org/wiki/Alexander_Vinnik ) But, yeah, otherwise the US can't do much if they are currently in Russia or China.

meowface 5y ago
Indeed; I mentioned that, with Vinnik as an example, in https://news.ycombinator.com/item?id=27097212 https://news.ycombinator.com/item?id=27097212