23 ms·

The Oncoming Ransomware Storm

103 points by tenslisi 5y ago

boringg 5y ago
Things enabled by BTC/crypto: ransomewear, climate change, overnight speculation millionaires! Also article is a bit dystopian and blaming capitalism (per usual these days).
- sebastien_bois 5y ago
  But not entirely inaccurate. I mean, 20 years, maybe even just 10 years ago we would've shrugged off the type of attacks happening now as "pure science fiction".
  - TheBill 5y ago
    30 years ago there was ransomware in the wild: 1989 -Popp/ AIDS trojan 2005 - GPCoder trojan 2017 - notpetya (AKA the moller maersk hack) https://actzero.ai/resources/white-paper/the-rise-of-ransomware-as-a-service/ https://actzero.ai/resources/white-paper/the-rise-of-ransomw...
    - tharne 5y ago
      Amazing how quickly people forget the past.
    - sebastien_bois 5y ago
      I was referring more to general attacks, the type that would have seemed too far-fetched decade(s) ago.
      - candiodari 5y ago
        The first ever computer virus (arguably) was “brain”, arguably ransomware: https://us.norton.com/internetsecurity-malware-when-were-computer-viruses-first-written-and-what-were-their-original-purposes.html https://us.norton.com/internetsecurity-malware-when-were-com... Needless to say, it predated cryptocurrency by decades and it’s creators are at the very least millionaires.
seafoam 5y ago
"A future in which ransomware and mass data theft are so ubiquitous they’ve worked their way into our daily lives" >>> True "The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency" >>> False
- SteveNuts 5y ago
  Right, it's definitely a contributing factor as to why it's profitable, but the attacks themselves could be done entirely out of malice if they wanted to.
  - riccardomc 5y ago
    Sure it can be done entirely out of malice, but it is now clear that cryptocurrencies enable the incentive of doing it for money. It is becoming more and more evident that ransomware attacks are the killer app of crypto.
    - akiselev 5y ago
      > It is becoming more and more evident that ransomware attacks are the killer app of crypto. Illegal activities were always the killer app. I doubt bitcoin would be where it is today without the silk road sites.
    - tharne 5y ago
      Because there was no such thing as cyber crime prior to the invention of cryptocurrency.
      - VectorLock 5y ago
        Not on the scale we're seeing now.
        tharne 5y ago
        There are also a lot more computers and things running software now.
alrs 5y ago
Ransomware is great. 1. Creates a huge financial incentive to try and break PGP encryption. 2. Pushes aside all of the lame corporate compliance "infosec" people whose job it is get lied to about PCI compliance and bitch about version numbers that they don't understand. 3. Proves useless all of the "ex-special-forces" "red team" "master safecracker" Defcon LARPers. 4. Gives the insurance companies enough room to attribute attacks to nation-state actors, making them "acts of war," and thus uninsurable. If companies can't half-ass this stuff and let their insurer clean up the mess, they're going to stop half-assing this stuff. 5. Put an end to the "I dunno, I pulled it off Dockerhub" madness.
- megameter 5y ago
  Also the most likely tonic to platform churn, reinvented wheels, codebase growth. The culture will flip towards lambasting anything that hasn't been put through the wringer as "untrustworthy".
- alrs 5y ago
  6. You used to need to wonder: Have I been hacked? How bad? Now you get an invoice day-of.
- api 5y ago
  Items 2 and 3 will increase massively as people who don't know what they're doing attempt to cover their butts.
  - alrs 5y ago
    a steep climb in the short term that falls off a cliff in the not-so-short-term as those employers cease to exist.
    - api 5y ago
      That's not how the world works my friend.
      - 5y ago
yabones 5y ago
As somebody who's not that familiar with how financial institutions handle fraud/money laundering detection, is it possible for ransomware to have become so prevalent without cryptocurrencies? I know HSBC was in the news a few years ago for turning a blind eye towards a drug cartel, but would this type of attack at scale be tolerated by the major banks/credit unions?
- dragontamer 5y ago
  I don't think cryptocurrencies are the only solution. Before the rise of cryptocoins, you'd just shuttle physical gift cards around. But cryptocoins are definitely more efficient than traditional forms of money laundering.
  - celestialcheese 5y ago
    The big corporate targets and the >1m ransoms aren't doable with gift cards. A large hospital chain in San Diego[1] last week was hit with a $100m[2] ransomware attack that shut down the hospital. Can't pay that with gift cards. [1] - https://www.sandiegouniontribune.com/news/health/story/2021-05-10/nine-days-in-cyber-attack-continues-at-scripps-health https://www.sandiegouniontribune.com/news/health/story/2021-... [2] - Source internal said that was the ransom amount
    - dragontamer 5y ago
      You'd ask for cash. A middleman would pick it up, convert it to gift cards or Tide laundry detergent (so that the traced cash would go cold) and then pass it forward through the criminal network. The middleman needs to be paid because it's high risk (cops would trace the cash to the middleman... but no further). So cryptocoin are way cheaper. But still, there's plenty of ways to do things using old school techniques.
      - VectorLock 5y ago
        You also need to trust that your criminal middleman with $100M doesn't just abscond with your money. With cryptocurrency when its in your wallet, its yours, and the risk of relying on a 3rd party to transport your ill gotten gains is much lower.
DrPhish 5y ago
"Imagine a world in which every other month you’re forced to bid for your personal data back from hackers who continuously rob you. And a world where all of this is is so commonplace there are automated darknet marketplaces where others can bid on your data, and every detail of your personal life is up for sale to the highest bidder. Every private text, photo, email, and password is just a digital commodity to be traded on the market. Because that’s what the market demands and that’s what capitalism left unchecked will provide." Maybe I'm in a minority, but I think I'd air-gap my personal data if this world ever came to pass...I'm considering it already to be perfectly honest. Would the general population just give up if things got that bad? As per TFA, I imagine state level actors will step in if things get much worse, lest people start unhooking en masse due to the risk/reward ratio flipping.
- NateEag 5y ago
  > Would the general population just give up if things got that bad? I suspect the general population is already mostly- immune to this. I think most people keep their pictures and all other important data in Google or Apple's services. Movies from Netflix, music with Spotify. Those companies have backups. If your phone or laptop gets hacked, you just wipe it and reinstall Chrome. Access to email is what most normals need to protect. Ransomware is really better shaped for attacking organizations than individuals, IMO. ...I still burn our family photos to write-once M-Discs, mind.
f38zf5vdt 5y ago
Banning cryptocurrency only fixes one side of the global-internet-being-security-broken problem. If you're a nation-state actor and you can still break into computer systems throughout the world, you can still: - Manipulate and profit in foreign stock markets by short/long selling based on insider information - Choose who gets elected by making dirty laundry public - See military planning by the enemy, live, as it happens - Trick critical foreign infrastructure into self-destruction - Discover and cultivate corporate espionage assets based on what you know about their personality from emails/SMS/metadata/etc - Plant incriminating evidence against political or corporate adversaries, for example by using their home internet connection for something nefarious The future hell described in the article is not a future hell. It is the present hell. Ransomware is just one small part of it.
- alrs 5y ago
  ^ ^ ^ If there's any Keanu-pill to swallow, it's this. Intelligence agencies don't "make us safe," they drive financial gain for insiders. I'd bet the ratio of effort spent on "market manipulation" versus "find the evil doers" to be 10:1.
  - IQunder130 5y ago
    Intelligence agencies exist to gather intelligence about the adversaries of state actors, not "find the evil doers". And being the bloated government agencies that they are I very much doubt they're the hyper-competent market manipulators you imagine them to be.
- obviouslynotme 5y ago
  But that only applies to targets who are "in the game." If you are a government entity or listed company or act as their agents, then you know that security is an issue and are paid well enough to make a decent effort. Whether you do or not is a different issue. Grandma doesn't have security audits, wouldn't know how to do one, and couldn't afford it if she did. She is the victim here. She might call the police but they will file a report and forget it. The only chance of getting caught is some larger agency like the FBI picking it up and going after you. This is highly unlikely. The only thing stopping Grandma from getting ransomed is making it difficult to pay. If your ransom depends on walking Grandma through the 15 step process of paying you, then it's unlikely to happen or be profitable.
tracedddd 5y ago
Why are arguments of this form so pervasive? Cryptocurrency is bad and must be banned because ransomware. Encryption is bad because pedos, let’s ban Tor and Signal. We need a permanent surveillance state and forfeit most of our rights to privacy because terrorists bad, what do you have to hide? Is it an appeal to emotion? Fear?
- jodrellblank 5y ago
  Why are comments in the form of putting words into someone's mouth which they didn't say, so pervasive? The blog says "reign in and regulate", not "ban". But, to address your point, because they're good arguments. "We need to regulate $thing" has saved lots of lives. No longer can you sell plain river water to drink, dump sewage directly back into rivers, dump industrial waste into rivers, build houses which collapse, build hotels with no fire consideration, build using asbestos, make buildings with electric wiring without circuit breakers, adulterate food with sawdust and plaster, sell products with lead paint, burn leaded gasoline in places where people breathe, and on and on and on. That's progress; try things, filter out the things which are badder than they are good.
  - robot_no_419 5y ago
    The author has multiple articles calling for an outright blanket ban on all cryptocurrencies. So in the author's own words, he is calling for a ban on all cryptocurrency.
    - jodrellblank 5y ago
      In this article being discussed the author's own words are: "'legislation and intervention in the financial system at only the level nation states can act. The free flow of money from US banks to cryptocurrency exchanges is the root cause and needs to halt'" Which is a call for regulating, not banning. If you want to use something different which the author said somewhere else, to back some other point and say that it outweighs what the author says here, then actually do all those things. What are the author's own words elsewhere, where, and what point are you trying to make by vaguely gesticulating towards them?
mousepilot 5y ago
I remember reading about malware like this some time back. I tried everything I could to prepare but got vetoed at every turn by management. My idea was to do "pull" backups to a server, instead of "push" backups to shares, instead my boss's boss bought some commercial backup package that while ok, when it bombed a t-log chain, they blamed microsoft's implementation of native sql server backups, and of course was nowhere near my dream "pull" server thing, heck, I don't know if my idea was even valid, I'm not that smart a guy honestly, you gotta know your limits. I wanted flash removed from my desktop, because being the intellectual slug I am, I google everything, like how to get the correct date and time. My previous job was as a convenience store clerk, and as I'm in the process of getting fired right this very week, I suspect it'll be my next job too. I was told by my boss's boss and his cousin the gaming guy who built servers that "our firewall blocks everything". Of course, I got a text message one morning from my boss, while I don't remember the exact text, I remember it included the word "armagghedon". I came in to work carrying my uninfected laptop, and heck, my pc looked pretty normal except the icons had changed and sort of "doubled up", each second version contained the same message, you know the drill. I'm an sql guy, I know I'm not all CS smart like everyone here but I gotta say it was obvious even to me what was coming, its like an enemy doing bombing raids in the next city over and people are still out there watering their lawns like nothing is happening. Friggin malware, I guess it pays well tho.
- JackFr 5y ago
  GPT-3
  - mousepilot 5y ago
    heh interestingly enough, I've learned that machine learning is a trend in malware protection nowadays and rather than being signature based, it watches for malware like behavior. after the attack, we installed something like that, and it removed some of the very small vb programs I had put my heart and soul into.
  - tnzm 5y ago
    This guy, and not the amygdala-hijacked no-theory-of-minders that rolled in the other day?
theshadowknows 5y ago
I don't really have any answers. I don't think cryptocurrency really makes the 'ransomware storm' possible. Maybe it makes it easier or easier to get away with the cash. I do know that I work at a company with very tight controls on what we can and can't do with our computers. But we're free to install Chrome extensions as we please. Which doesn't strike me as a great idea, but maybe that's not really even the problem. A lot of what I see in big corp environments comes down to finger pointing. I'm on a weeks old thread this very day where different groups are saying 'this isnt X's fault it's Y's fault' and it is going nowhere. At the end of the day we need to stop assigning blame and work together to fix problems. But that means we have to be able to actually admit 'maybe this system isnt as fool proof as we thought' which, of course, opens the company up to legal liability. It's a tough and complex problem, I think. Because no one wants to 'admit fault' for fear of being sued, but not admitting fault ends up obscuring root cause. And round and round we go.
daaang 5y ago
> The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency. And is entirely enabled by this one technology, it could not exist otherwise. Huh, cryptocurrency existed in 1989, when the first ransomware was active? Did the author even google the word "ransomware?" Wire transfers and all types of pre-paid voucher services were used well before cryptocurrencies were even created.
- mytherin 5y ago
  The article directly addresses your point in the paragraph surrounding the sentence you cherry picked. > Now this is not a new phenomenon by any means. But what is new is that the level of these attacks has gone parabolic in the last few years because of one simple fact. With the addition of bitcoin to the problem it’s insanely profitable, low-risk, and almost the perfect crime. It’s also a very real economic tool that nation states can use to disrupt each other’s infrastructure. > The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency. Consider the same situation on top of the existing international banking system. Go to your local bank branch and try to wire transfer $200,000 to an anonymous stranger in Russia and see how that works out. Modern ransomware could not exist without Bitcoin, it has poured gasoline on a fire we may not be able to put out.
  - daaang 5y ago
    I agree, the author contradicts themselves immediately. Cryptocurrency is not the "singular" reason, and it is not why these attacks are even "possible." The hypothetical they picked might not work. The methods that ransomware was using for decades to extort hundreds of thousands of dollars did, and will continue to work.
    - mytherin 5y ago
      You are still taking words out of context. Clearly the author agrees that cryptocurrency is not the singular reason behind *all* ransomware, considering he states it is not a new phenomenon. The sentence you took out of context relates to *modern* ransomware: > The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency.... Modern ransomware could not exist without Bitcoin, it has poured gasoline on a fire we may not be able to put out. The question is not if ransomware would still exist without cryptocurrency (obviously it would, it existed before then). The question is if it would still be as pervasive as it has become in the last few years without cryptocurrency.
amelius 5y ago
Governments should make it illegal to pay ransom. Only the government should be allowed to pay (in the name of victims) but under very strict conditions. EDIT: slightly different but I wasn't the only one with an idea in this direction: https://www.reuters.com/article/us-treasury-cyber-idUSKBN26M77U https://www.reuters.com/article/us-treasury-cyber-idUSKBN26M...
- api 5y ago
  This is the only good answer. Making it illegal to pay any form of ransom under any circumstance would hobble a ton of different extortion activities. Ransom only encourages more crime. It's a form of aiding and abetting.
- bena 5y ago
  That's not exactly going to do what you think it does. It potentially makes the victims criminals. That's just not what the law should be doing. It is decidedly unjust. It also drives the whole thing further from the public eye as no one will admit they're being held up for ransom because paying is now illegal. If making something illegal was a perfect solution, ransomware wouldn't be a thing in the first place.
- momothereal 5y ago
  What's the punishment for paying? A fine? Then you might as well add that to the ransom and pay... Snark aside, there's just no simple, hand-waving solution to this. Even if you held the company owners criminally liable for paying a ransom, pretty much any small company will shut down for not being able to afford top-notch security. It also opens the door to blackmail: > We've encrypted your files. Pay us $AMOUNT BTC by tomorrow, or your files are gone. And with a recurring payment of $AMOUNT BTC per month, I promise not to report you to the FBI for paying!
- djrogers 5y ago
  > Governments should make it illegal to pay ransom. That won't really change anything, other than add 'break a law' to 'lose tons of $$' and 'lose data/time' to the list of bad things a company will deal with to recover from a ransomware attack.
deleted 5y ago
[deleted]
bradleyjg 5y ago
Make coins paid in ransom subject to seizure wherever they may be found. It’s not a silver bullet but it would help and it’s an easy change to make.
- randomhodler84 5y ago
  Already the case/law. The US had seized and sold many BTC over the years. The Silk Road seized coins were sold to the highest bidder.
api 5y ago
This histrionic piece really reduces this author's credibility in my mind. I say this as someone fairly skeptical of cryptocurrency, or at least of the value of present-day cryptocurrency.
duckfang 5y ago
My big question, and I would love an answer: Why is it that an organization can topple to malware and ransomware by some L1 tech clicking on a "bad email"? People are going to click on shit. That's a 100% guaranteed fact - be it intentional or not. But WHY is our computing and communications paradigm so brittle that any Jack or Jane can click a link and pwn the infrastructure?
- CountDrewku 5y ago
  https://www.cisecurity.org/resources/advisory/?type=advisory https://www.cisecurity.org/resources/advisory/?type=advisory Take a quick look at all the vulnerabilities out there. Google has been releasing 1-2 fixes a week for the last month or so. It's a constant battle keeping this stuff patched.
- bena 5y ago
  As I've told someone today, we're shooting lightning through sand and somehow it all works. There are network effects of network effects at work inside computer systems. We can harden a path. Two paths, sure. Three, why not. 4 billion? No way to be sure. It's also a matter of it being an aggressor's game. The defense has to be perfect every single time. The offense just has to win once. And they get infinite tries. And they suffer no penalty for failure.
- muttled 5y ago
  You're completely right in your thinking that it's largely ridiculous and avoidable. The answer is generally lack of separation of duties and least privilege. That L1 tech in a smaller organization might be a member of the domain admins group. And to avoid UAC prompts, might sign into his computer as domain admin account. If something runs as him, it runs as admin. Large file shares where every user has edit permissions are also extremely prevalent. Every user has the ability to destroy the shared drive. I've seen a lot of small organizations where the owner insisted on being an admin, despite having no technical knowledge. He clicks something wrong and the malware's got carte blanche. Old line of business applications will often require exact versions of Flash/Java/whatever which are riddled with security holes. Outside that, there's the 0 days and exploits. But a lot of what I see are setups that grew from small, insecure setups where it didn't matter to big, insecure setups where it did. Combine that with the ROI on security not being immediately tangible, and it's hard to get approval for projects to fix it. Even if you design the most secure systems, unless you've got a seat at the executive table someone will probably overrule you and make exceptions.
robin_reala 5y ago
Are there any active non-Windows ransomware infections going on? I don’t recall seeing any macOS / Linux / Android / iOS attacks.
- wepple 5y ago
  I’m willing to bet SaaS ransomware will be up next. Imagine a user is tricked into adding a browser addon (common), and the malicious addon encrypts all the data in a salesforce, Dropbox, and online mail account
  - tnzm 5y ago
    And then users are going to be thankful that their data is not encrypted at rest. Classic pincer maneuver
  - muttled 5y ago
    One of the reasons why it's so important to disable the ability for users to consent on behalf of the organization for applications in suites such as 365 where the default is to allow the user to do so.
robot_no_419 5y ago
FYI, the author has a huge conflict of interest whenever he writes about cryptocurrency, seeing as he's the founder of Adjoint, Inc, a company which digitizes cash and settlement processes for multinational corporates. So it's easy to see why he hates a technology that renders his entire company useless.
- TheBill 5y ago
  Something that would be relevant. Would love to know who's downvoting you.
  - deleted 5y ago
    [deleted]
- wespiser_2018 5y ago
  Or, he founded a blockchain company only to realize that blockchain, and byzantine consensus, is a terrible way to do things.
  - daaang 5y ago
    You seem to share an anti-crytpo outlook and a history of musings on Haskell with the OP. Are you related in some way? You even have another comment [0] defending him. Crying foul. https://news.ycombinator.com/item?id=27125133 https://news.ycombinator.com/item?id=27125133
scg 5y ago
The same shortsighted argument could've been done at various times against cryptography, against torrents, against remote access, against the internet, and against using computers (inherently hackable). Now it's crypto payments, and tomorrow it's going to be something else because criminals use technology to scale as much as everyone else. Crypto networks are especially good at cross-border payments, and they are hard to censor by a state actor. Indeed, these were among the design constraints of Bitcoin. If one wishes to argue that such a technology shouldn't exist, good luck with that; it exists, has legitimate use cases, and banning outright it is shortsighted in the same way opposing cryptography is shortsighted.
edem 5y ago
> Cryptocurrencies are almost entirely used for illicit activity and investment frauds This made clear that this guy has __no knowledge__ about cryptocurrencies. The article is just bogus.
_wldu 5y ago
The article failed to mention tor. IMPO, tor and cryptocurrency combined are the reason for the explosion of ransomware. Payment websites running as tor location hidden services combined with anon payments (XMR) is hard to beat (when done correctly).
Sevii 5y ago
Today is the beginning 'wild west' stage of the information technology industry. Software ate the world and now security is starting to matter to the bottom line. GDPR and privacy are another big factor which I think will push the professionalization of the industry. I do think the worst case scenario outlined in this article is unlikely. We can build systems that are not that vulnerable to ransomware. You can have backups that are safely stored off network. It is just that old industries have slowly computerized without updating their processes and view of themselves. Every company is a tech company now.
rini17 5y ago
Since stolen credit cards are used in the same illicit way as cryptocurrency, they should be banned too :)
1vuio0pswjnm7 5y ago
"The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency." So-called crytocurrency may not be the sine qua non, but it is arguably a substantial factor in what is causing these campaigns of automated attacks. Without an easy way to launder the "ransom" payments, could these attacks be systematically executed on a large scale with a level of success (receiving the payments without getting caught) necessary to justify the risk.
meowface 5y ago
I'm not an unequivocal fan of cryptocurrencies or any particular cryptocurrency by any means, but it appears this author really hates cryptocurrency and this is just an opportunity for them to argue that governments should ban cryptocurrency. Which is completely understandable and obviously in good faith given ransomware is bad and they think cryptocurrencies are bad, but I just wanted to point out their stance and that this is an anti-cryptocurrency blog rather than a security/tech blog. Every blog post they've ever published is about why they think cryptocurrency is awful: https://www.stephendiehl.com/blog.html https://www.stephendiehl.com/blog.html >The Oncoming Ransomware Storm - May 11, 2021 >Et tu, Signal? - April 7, 2021 >The Political Case for a Blanket Cryptocurrency Ban - March 30, 2021 >Bitcoin: The Postmodern Ponzi - February 27, 2021 >The Crypto Chernobyl - February 10, 2021 >Gamestop, Bitcoin and the Commoditization of Populist Rage - February 3, 2021 >Facebook Libra is Architecturally Unsound - November 2, 2019 I think they make many valid criticisms, but they remind me of the inverse of the standard Bitcoin maximalist. It seems there are a lot of people who think Bitcoin or Ethereum or something else should become the universal currency of the world and is the best and most innovative thing ever, and a lot of other people who think they should all be made illegal and are the worst thing ever. Also somewhat reminiscent of pg's fanboy/hater dichotomy: http://www.paulgraham.com/fh.html http://www.paulgraham.com/fh.html
- pja 5y ago
  This is just an ad hominem response to Stephen's argument.
  - meowface 5y ago
    It 100% is an ad hominem response. I'm not trying to address his arguments whatsoever and am very low on Graham's hierarchy of disagreement. And again, I do agree with many of his points. I just personally don't think banning cryptocurrencies (or pretty much anything) is the answer, and the very "ban-happy" attitude colors my impression of all of this and makes it less likely that I'd want to attempt to address their arguments, because I know they've very likely already made up their mind that they think the only solution is a government crackdown.
zabzonk 5y ago
> we’ve seen the entire NHS hospital service shutdown We have? As an NHS user, how did I miss this this?
randomhodler84 5y ago
More blaming money for crime. Cryptocurrency is money. Crime will always exist as long as there are laws. Laws will exist as long as there is society. Money will exist as long as there is trade. Society<=>Trade. Stephen once again shouts at the inanimate money or tech to blame it for societies ills. This is a dangerous attitude can lead to cryptography restrictions, like banning of e2e or tor.
- IQunder130 5y ago
  It's money that is more difficult to regulate, and easier to conduct illicit transactions with. Rather than debate abstract principles the point of the article is very clearly that fewer practical hurdles to clear -> more people engaging in an activity, given the same incentive.

103 points by tenslisi 5y ago

Things enabled by BTC/crypto: ransomewear, climate change, overnight speculation millionaires! Also article is a bit dystopian and blaming capitalism (per usual these days).

sebastien_bois 5y ago
But not entirely inaccurate. I mean, 20 years, maybe even just 10 years ago we would've shrugged off the type of attacks happening now as "pure science fiction".
- TheBill 5y ago
  30 years ago there was ransomware in the wild: 1989 -Popp/ AIDS trojan 2005 - GPCoder trojan 2017 - notpetya (AKA the moller maersk hack) https://actzero.ai/resources/white-paper/the-rise-of-ransomware-as-a-service/ https://actzero.ai/resources/white-paper/the-rise-of-ransomw...
  - tharne 5y ago
    Amazing how quickly people forget the past.
  - sebastien_bois 5y ago
    I was referring more to general attacks, the type that would have seemed too far-fetched decade(s) ago.
    - candiodari 5y ago
      The first ever computer virus (arguably) was “brain”, arguably ransomware: https://us.norton.com/internetsecurity-malware-when-were-computer-viruses-first-written-and-what-were-their-original-purposes.html https://us.norton.com/internetsecurity-malware-when-were-com... Needless to say, it predated cryptocurrency by decades and it’s creators are at the very least millionaires.

seafoam 5y ago

"A future in which ransomware and mass data theft are so ubiquitous they’ve worked their way into our daily lives" >>> True "The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency" >>> False

SteveNuts 5y ago
Right, it's definitely a contributing factor as to why it's profitable, but the attacks themselves could be done entirely out of malice if they wanted to.
- riccardomc 5y ago
  Sure it can be done entirely out of malice, but it is now clear that cryptocurrencies enable the incentive of doing it for money. It is becoming more and more evident that ransomware attacks are the killer app of crypto.
  - akiselev 5y ago
    > It is becoming more and more evident that ransomware attacks are the killer app of crypto. Illegal activities were always the killer app. I doubt bitcoin would be where it is today without the silk road sites.
  - tharne 5y ago
    Because there was no such thing as cyber crime prior to the invention of cryptocurrency.
    - VectorLock 5y ago
      Not on the scale we're seeing now.
      - tharne 5y ago
        There are also a lot more computers and things running software now.

alrs 5y ago

Ransomware is great. 1. Creates a huge financial incentive to try and break PGP encryption. 2. Pushes aside all of the lame corporate compliance "infosec" people whose job it is get lied to about PCI compliance and bitch about version numbers that they don't understand. 3. Proves useless all of the "ex-special-forces" "red team" "master safecracker" Defcon LARPers. 4. Gives the insurance companies enough room to attribute attacks to nation-state actors, making them "acts of war," and thus uninsurable. If companies can't half-ass this stuff and let their insurer clean up the mess, they're going to stop half-assing this stuff. 5. Put an end to the "I dunno, I pulled it off Dockerhub" madness.

megameter 5y ago
Also the most likely tonic to platform churn, reinvented wheels, codebase growth. The culture will flip towards lambasting anything that hasn't been put through the wringer as "untrustworthy".
alrs 5y ago
6. You used to need to wonder: Have I been hacked? How bad? Now you get an invoice day-of.
api 5y ago
Items 2 and 3 will increase massively as people who don't know what they're doing attempt to cover their butts.
- alrs 5y ago
  a steep climb in the short term that falls off a cliff in the not-so-short-term as those employers cease to exist.
  - api 5y ago
    That's not how the world works my friend.
    - 5y ago

yabones 5y ago

As somebody who's not that familiar with how financial institutions handle fraud/money laundering detection, is it possible for ransomware to have become so prevalent without cryptocurrencies? I know HSBC was in the news a few years ago for turning a blind eye towards a drug cartel, but would this type of attack at scale be tolerated by the major banks/credit unions?

dragontamer 5y ago
I don't think cryptocurrencies are the only solution. Before the rise of cryptocoins, you'd just shuttle physical gift cards around. But cryptocoins are definitely more efficient than traditional forms of money laundering.
- celestialcheese 5y ago
  The big corporate targets and the >1m ransoms aren't doable with gift cards. A large hospital chain in San Diego[1] last week was hit with a $100m[2] ransomware attack that shut down the hospital. Can't pay that with gift cards. [1] - https://www.sandiegouniontribune.com/news/health/story/2021-05-10/nine-days-in-cyber-attack-continues-at-scripps-health https://www.sandiegouniontribune.com/news/health/story/2021-... [2] - Source internal said that was the ransom amount
  - dragontamer 5y ago
    You'd ask for cash. A middleman would pick it up, convert it to gift cards or Tide laundry detergent (so that the traced cash would go cold) and then pass it forward through the criminal network. The middleman needs to be paid because it's high risk (cops would trace the cash to the middleman... but no further). So cryptocoin are way cheaper. But still, there's plenty of ways to do things using old school techniques.
    - VectorLock 5y ago
      You also need to trust that your criminal middleman with $100M doesn't just abscond with your money. With cryptocurrency when its in your wallet, its yours, and the risk of relying on a 3rd party to transport your ill gotten gains is much lower.

DrPhish 5y ago

"Imagine a world in which every other month you’re forced to bid for your personal data back from hackers who continuously rob you. And a world where all of this is is so commonplace there are automated darknet marketplaces where others can bid on your data, and every detail of your personal life is up for sale to the highest bidder. Every private text, photo, email, and password is just a digital commodity to be traded on the market. Because that’s what the market demands and that’s what capitalism left unchecked will provide." Maybe I'm in a minority, but I think I'd air-gap my personal data if this world ever came to pass...I'm considering it already to be perfectly honest. Would the general population just give up if things got that bad? As per TFA, I imagine state level actors will step in if things get much worse, lest people start unhooking en masse due to the risk/reward ratio flipping.

NateEag 5y ago
> Would the general population just give up if things got that bad? I suspect the general population is already mostly- immune to this. I think most people keep their pictures and all other important data in Google or Apple's services. Movies from Netflix, music with Spotify. Those companies have backups. If your phone or laptop gets hacked, you just wipe it and reinstall Chrome. Access to email is what most normals need to protect. Ransomware is really better shaped for attacking organizations than individuals, IMO. ...I still burn our family photos to write-once M-Discs, mind.

f38zf5vdt 5y ago

Banning cryptocurrency only fixes one side of the global-internet-being-security-broken problem. If you're a nation-state actor and you can still break into computer systems throughout the world, you can still: - Manipulate and profit in foreign stock markets by short/long selling based on insider information - Choose who gets elected by making dirty laundry public - See military planning by the enemy, live, as it happens - Trick critical foreign infrastructure into self-destruction - Discover and cultivate corporate espionage assets based on what you know about their personality from emails/SMS/metadata/etc - Plant incriminating evidence against political or corporate adversaries, for example by using their home internet connection for something nefarious The future hell described in the article is not a future hell. It is the present hell. Ransomware is just one small part of it.

alrs 5y ago
^ ^ ^ If there's any Keanu-pill to swallow, it's this. Intelligence agencies don't "make us safe," they drive financial gain for insiders. I'd bet the ratio of effort spent on "market manipulation" versus "find the evil doers" to be 10:1.
- IQunder130 5y ago
  Intelligence agencies exist to gather intelligence about the adversaries of state actors, not "find the evil doers". And being the bloated government agencies that they are I very much doubt they're the hyper-competent market manipulators you imagine them to be.
obviouslynotme 5y ago
But that only applies to targets who are "in the game." If you are a government entity or listed company or act as their agents, then you know that security is an issue and are paid well enough to make a decent effort. Whether you do or not is a different issue. Grandma doesn't have security audits, wouldn't know how to do one, and couldn't afford it if she did. She is the victim here. She might call the police but they will file a report and forget it. The only chance of getting caught is some larger agency like the FBI picking it up and going after you. This is highly unlikely. The only thing stopping Grandma from getting ransomed is making it difficult to pay. If your ransom depends on walking Grandma through the 15 step process of paying you, then it's unlikely to happen or be profitable.

tracedddd 5y ago

Why are arguments of this form so pervasive? Cryptocurrency is bad and must be banned because ransomware. Encryption is bad because pedos, let’s ban Tor and Signal. We need a permanent surveillance state and forfeit most of our rights to privacy because terrorists bad, what do you have to hide? Is it an appeal to emotion? Fear?

jodrellblank 5y ago
Why are comments in the form of putting words into someone's mouth which they didn't say, so pervasive? The blog says "reign in and regulate", not "ban". But, to address your point, because they're good arguments. "We need to regulate $thing" has saved lots of lives. No longer can you sell plain river water to drink, dump sewage directly back into rivers, dump industrial waste into rivers, build houses which collapse, build hotels with no fire consideration, build using asbestos, make buildings with electric wiring without circuit breakers, adulterate food with sawdust and plaster, sell products with lead paint, burn leaded gasoline in places where people breathe, and on and on and on. That's progress; try things, filter out the things which are badder than they are good.
- robot_no_419 5y ago
  The author has multiple articles calling for an outright blanket ban on all cryptocurrencies. So in the author's own words, he is calling for a ban on all cryptocurrency.
  - jodrellblank 5y ago
    In this article being discussed the author's own words are: "'legislation and intervention in the financial system at only the level nation states can act. The free flow of money from US banks to cryptocurrency exchanges is the root cause and needs to halt'" Which is a call for regulating, not banning. If you want to use something different which the author said somewhere else, to back some other point and say that it outweighs what the author says here, then actually do all those things. What are the author's own words elsewhere, where, and what point are you trying to make by vaguely gesticulating towards them?

mousepilot 5y ago

I remember reading about malware like this some time back. I tried everything I could to prepare but got vetoed at every turn by management. My idea was to do "pull" backups to a server, instead of "push" backups to shares, instead my boss's boss bought some commercial backup package that while ok, when it bombed a t-log chain, they blamed microsoft's implementation of native sql server backups, and of course was nowhere near my dream "pull" server thing, heck, I don't know if my idea was even valid, I'm not that smart a guy honestly, you gotta know your limits. I wanted flash removed from my desktop, because being the intellectual slug I am, I google everything, like how to get the correct date and time. My previous job was as a convenience store clerk, and as I'm in the process of getting fired right this very week, I suspect it'll be my next job too. I was told by my boss's boss and his cousin the gaming guy who built servers that "our firewall blocks everything". Of course, I got a text message one morning from my boss, while I don't remember the exact text, I remember it included the word "armagghedon". I came in to work carrying my uninfected laptop, and heck, my pc looked pretty normal except the icons had changed and sort of "doubled up", each second version contained the same message, you know the drill. I'm an sql guy, I know I'm not all CS smart like everyone here but I gotta say it was obvious even to me what was coming, its like an enemy doing bombing raids in the next city over and people are still out there watering their lawns like nothing is happening. Friggin malware, I guess it pays well tho.

JackFr 5y ago
GPT-3
- mousepilot 5y ago
  heh interestingly enough, I've learned that machine learning is a trend in malware protection nowadays and rather than being signature based, it watches for malware like behavior. after the attack, we installed something like that, and it removed some of the very small vb programs I had put my heart and soul into.
- tnzm 5y ago
  This guy, and not the amygdala-hijacked no-theory-of-minders that rolled in the other day?

theshadowknows 5y ago

I don't really have any answers. I don't think cryptocurrency really makes the 'ransomware storm' possible. Maybe it makes it easier or easier to get away with the cash. I do know that I work at a company with very tight controls on what we can and can't do with our computers. But we're free to install Chrome extensions as we please. Which doesn't strike me as a great idea, but maybe that's not really even the problem. A lot of what I see in big corp environments comes down to finger pointing. I'm on a weeks old thread this very day where different groups are saying 'this isnt X's fault it's Y's fault' and it is going nowhere. At the end of the day we need to stop assigning blame and work together to fix problems. But that means we have to be able to actually admit 'maybe this system isnt as fool proof as we thought' which, of course, opens the company up to legal liability. It's a tough and complex problem, I think. Because no one wants to 'admit fault' for fear of being sued, but not admitting fault ends up obscuring root cause. And round and round we go.

daaang 5y ago

> The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency. And is entirely enabled by this one technology, it could not exist otherwise. Huh, cryptocurrency existed in 1989, when the first ransomware was active? Did the author even google the word "ransomware?" Wire transfers and all types of pre-paid voucher services were used well before cryptocurrencies were even created.

mytherin 5y ago
The article directly addresses your point in the paragraph surrounding the sentence you cherry picked. > Now this is not a new phenomenon by any means. But what is new is that the level of these attacks has gone parabolic in the last few years because of one simple fact. With the addition of bitcoin to the problem it’s insanely profitable, low-risk, and almost the perfect crime. It’s also a very real economic tool that nation states can use to disrupt each other’s infrastructure. > The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency. Consider the same situation on top of the existing international banking system. Go to your local bank branch and try to wire transfer $200,000 to an anonymous stranger in Russia and see how that works out. Modern ransomware could not exist without Bitcoin, it has poured gasoline on a fire we may not be able to put out.
- daaang 5y ago
  I agree, the author contradicts themselves immediately. Cryptocurrency is not the "singular" reason, and it is not why these attacks are even "possible." The hypothetical they picked might not work. The methods that ransomware was using for decades to extort hundreds of thousands of dollars did, and will continue to work.
  - mytherin 5y ago
    You are still taking words out of context. Clearly the author agrees that cryptocurrency is not the singular reason behind *all* ransomware, considering he states it is not a new phenomenon. The sentence you took out of context relates to *modern* ransomware: > The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency.... Modern ransomware could not exist without Bitcoin, it has poured gasoline on a fire we may not be able to put out. The question is not if ransomware would still exist without cryptocurrency (obviously it would, it existed before then). The question is if it would still be as pervasive as it has become in the last few years without cryptocurrency.

amelius 5y ago

Governments should make it illegal to pay ransom. Only the government should be allowed to pay (in the name of victims) but under very strict conditions. EDIT: slightly different but I wasn't the only one with an idea in this direction: https://www.reuters.com/article/us-treasury-cyber-idUSKBN26M77U https://www.reuters.com/article/us-treasury-cyber-idUSKBN26M...

api 5y ago
This is the only good answer. Making it illegal to pay any form of ransom under any circumstance would hobble a ton of different extortion activities. Ransom only encourages more crime. It's a form of aiding and abetting.
bena 5y ago
That's not exactly going to do what you think it does. It potentially makes the victims criminals. That's just not what the law should be doing. It is decidedly unjust. It also drives the whole thing further from the public eye as no one will admit they're being held up for ransom because paying is now illegal. If making something illegal was a perfect solution, ransomware wouldn't be a thing in the first place.
momothereal 5y ago
What's the punishment for paying? A fine? Then you might as well add that to the ransom and pay... Snark aside, there's just no simple, hand-waving solution to this. Even if you held the company owners criminally liable for paying a ransom, pretty much any small company will shut down for not being able to afford top-notch security. It also opens the door to blackmail: > We've encrypted your files. Pay us $AMOUNT BTC by tomorrow, or your files are gone. And with a recurring payment of $AMOUNT BTC per month, I promise not to report you to the FBI for paying!
djrogers 5y ago
> Governments should make it illegal to pay ransom. That won't really change anything, other than add 'break a law' to 'lose tons of $$' and 'lose data/time' to the list of bad things a company will deal with to recover from a ransomware attack.

deleted 5y ago

[deleted]

bradleyjg 5y ago

Make coins paid in ransom subject to seizure wherever they may be found. It’s not a silver bullet but it would help and it’s an easy change to make.

randomhodler84 5y ago
Already the case/law. The US had seized and sold many BTC over the years. The Silk Road seized coins were sold to the highest bidder.

api 5y ago

This histrionic piece really reduces this author's credibility in my mind. I say this as someone fairly skeptical of cryptocurrency, or at least of the value of present-day cryptocurrency.

duckfang 5y ago

My big question, and I would love an answer: Why is it that an organization can topple to malware and ransomware by some L1 tech clicking on a "bad email"? People are going to click on shit. That's a 100% guaranteed fact - be it intentional or not. But WHY is our computing and communications paradigm so brittle that any Jack or Jane can click a link and pwn the infrastructure?

CountDrewku 5y ago
https://www.cisecurity.org/resources/advisory/?type=advisory https://www.cisecurity.org/resources/advisory/?type=advisory Take a quick look at all the vulnerabilities out there. Google has been releasing 1-2 fixes a week for the last month or so. It's a constant battle keeping this stuff patched.
bena 5y ago
As I've told someone today, we're shooting lightning through sand and somehow it all works. There are network effects of network effects at work inside computer systems. We can harden a path. Two paths, sure. Three, why not. 4 billion? No way to be sure. It's also a matter of it being an aggressor's game. The defense has to be perfect every single time. The offense just has to win once. And they get infinite tries. And they suffer no penalty for failure.
muttled 5y ago
You're completely right in your thinking that it's largely ridiculous and avoidable. The answer is generally lack of separation of duties and least privilege. That L1 tech in a smaller organization might be a member of the domain admins group. And to avoid UAC prompts, might sign into his computer as domain admin account. If something runs as him, it runs as admin. Large file shares where every user has edit permissions are also extremely prevalent. Every user has the ability to destroy the shared drive. I've seen a lot of small organizations where the owner insisted on being an admin, despite having no technical knowledge. He clicks something wrong and the malware's got carte blanche. Old line of business applications will often require exact versions of Flash/Java/whatever which are riddled with security holes. Outside that, there's the 0 days and exploits. But a lot of what I see are setups that grew from small, insecure setups where it didn't matter to big, insecure setups where it did. Combine that with the ROI on security not being immediately tangible, and it's hard to get approval for projects to fix it. Even if you design the most secure systems, unless you've got a seat at the executive table someone will probably overrule you and make exceptions.

robin_reala 5y ago

Are there any active non-Windows ransomware infections going on? I don’t recall seeing any macOS / Linux / Android / iOS attacks.

wepple 5y ago
I’m willing to bet SaaS ransomware will be up next. Imagine a user is tricked into adding a browser addon (common), and the malicious addon encrypts all the data in a salesforce, Dropbox, and online mail account
- tnzm 5y ago
  And then users are going to be thankful that their data is not encrypted at rest. Classic pincer maneuver
- muttled 5y ago
  One of the reasons why it's so important to disable the ability for users to consent on behalf of the organization for applications in suites such as 365 where the default is to allow the user to do so.

robot_no_419 5y ago

FYI, the author has a huge conflict of interest whenever he writes about cryptocurrency, seeing as he's the founder of Adjoint, Inc, a company which digitizes cash and settlement processes for multinational corporates. So it's easy to see why he hates a technology that renders his entire company useless.

TheBill 5y ago
Something that would be relevant. Would love to know who's downvoting you.
- deleted 5y ago
  [deleted]
wespiser_2018 5y ago
Or, he founded a blockchain company only to realize that blockchain, and byzantine consensus, is a terrible way to do things.
- daaang 5y ago
  You seem to share an anti-crytpo outlook and a history of musings on Haskell with the OP. Are you related in some way? You even have another comment [0] defending him. Crying foul. https://news.ycombinator.com/item?id=27125133 https://news.ycombinator.com/item?id=27125133

scg 5y ago

The same shortsighted argument could've been done at various times against cryptography, against torrents, against remote access, against the internet, and against using computers (inherently hackable). Now it's crypto payments, and tomorrow it's going to be something else because criminals use technology to scale as much as everyone else. Crypto networks are especially good at cross-border payments, and they are hard to censor by a state actor. Indeed, these were among the design constraints of Bitcoin. If one wishes to argue that such a technology shouldn't exist, good luck with that; it exists, has legitimate use cases, and banning outright it is shortsighted in the same way opposing cryptography is shortsighted.

edem 5y ago

> Cryptocurrencies are almost entirely used for illicit activity and investment frauds This made clear that this guy has __no knowledge__ about cryptocurrencies. The article is just bogus.

_wldu 5y ago

The article failed to mention tor. IMPO, tor and cryptocurrency combined are the reason for the explosion of ransomware. Payment websites running as tor location hidden services combined with anon payments (XMR) is hard to beat (when done correctly).

Sevii 5y ago

Today is the beginning 'wild west' stage of the information technology industry. Software ate the world and now security is starting to matter to the bottom line. GDPR and privacy are another big factor which I think will push the professionalization of the industry. I do think the worst case scenario outlined in this article is unlikely. We can build systems that are not that vulnerable to ransomware. You can have backups that are safely stored off network. It is just that old industries have slowly computerized without updating their processes and view of themselves. Every company is a tech company now.

rini17 5y ago

Since stolen credit cards are used in the same illicit way as cryptocurrency, they should be banned too :)

1vuio0pswjnm7 5y ago

"The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency." So-called crytocurrency may not be the sine qua non, but it is arguably a substantial factor in what is causing these campaigns of automated attacks. Without an easy way to launder the "ransom" payments, could these attacks be systematically executed on a large scale with a level of success (receiving the payments without getting caught) necessary to justify the risk.

meowface 5y ago

I'm not an unequivocal fan of cryptocurrencies or any particular cryptocurrency by any means, but it appears this author really hates cryptocurrency and this is just an opportunity for them to argue that governments should ban cryptocurrency. Which is completely understandable and obviously in good faith given ransomware is bad and they think cryptocurrencies are bad, but I just wanted to point out their stance and that this is an anti-cryptocurrency blog rather than a security/tech blog. Every blog post they've ever published is about why they think cryptocurrency is awful: https://www.stephendiehl.com/blog.html https://www.stephendiehl.com/blog.html >The Oncoming Ransomware Storm - May 11, 2021 >Et tu, Signal? - April 7, 2021 >The Political Case for a Blanket Cryptocurrency Ban - March 30, 2021 >Bitcoin: The Postmodern Ponzi - February 27, 2021 >The Crypto Chernobyl - February 10, 2021 >Gamestop, Bitcoin and the Commoditization of Populist Rage - February 3, 2021 >Facebook Libra is Architecturally Unsound - November 2, 2019 I think they make many valid criticisms, but they remind me of the inverse of the standard Bitcoin maximalist. It seems there are a lot of people who think Bitcoin or Ethereum or something else should become the universal currency of the world and is the best and most innovative thing ever, and a lot of other people who think they should all be made illegal and are the worst thing ever. Also somewhat reminiscent of pg's fanboy/hater dichotomy: http://www.paulgraham.com/fh.html http://www.paulgraham.com/fh.html

pja 5y ago
This is just an ad hominem response to Stephen's argument.
- meowface 5y ago
  It 100% is an ad hominem response. I'm not trying to address his arguments whatsoever and am very low on Graham's hierarchy of disagreement. And again, I do agree with many of his points. I just personally don't think banning cryptocurrencies (or pretty much anything) is the answer, and the very "ban-happy" attitude colors my impression of all of this and makes it less likely that I'd want to attempt to address their arguments, because I know they've very likely already made up their mind that they think the only solution is a government crackdown.

zabzonk 5y ago

> we’ve seen the entire NHS hospital service shutdown We have? As an NHS user, how did I miss this this?

randomhodler84 5y ago

More blaming money for crime. Cryptocurrency is money. Crime will always exist as long as there are laws. Laws will exist as long as there is society. Money will exist as long as there is trade. Society<=>Trade. Stephen once again shouts at the inanimate money or tech to blame it for societies ills. This is a dangerous attitude can lead to cryptography restrictions, like banning of e2e or tor.

IQunder130 5y ago
It's money that is more difficult to regulate, and easier to conduct illicit transactions with. Rather than debate abstract principles the point of the article is very clearly that fewer practical hurdles to clear -> more people engaging in an activity, given the same incentive.