51 ms·
DarkSide ransomware gang quits after servers, Bitcoin stash seized
- null_object 6y agoSo taking down hospitals and healthcare facilities was fair game. But messing with Big Oil was just a step too far.
- unethical_ban 6y agoIt's an interesting point. I think there is a big difference between hitting decentralized targets and disabling fuel transport for the entire east coast, BUT if it was this possible before, why wait until now? Or, if it isn't true - perhaps they're deflecting attention.
- balls187 6y agoThat shouldn't be a much of a surprise; the US has always aligned itself with protecting it's oil supply.
- ctdonath 6y agoCrude insult. Akin to criticizing someone for "aligning with protecting his oxygen supply".
- WarOnPrivacy 6y agoCage match. Me with no gas vs. you with no oxygen
- ctdonath 6y agoSure. You with oxygen, me with gas ... and the striker omnipresent on my keychain. You're goin' down in flames. :-)
- elevaet 6y agoI believe you mean a Light Sweet Crude insult.
- telmo 6y ago> Crude insult. Kudos if that was a deliberate joke.
- dwheeler 6y agoEvery country protects its food, water, and energy supply. Exceptions stop being countries.
- russellbeattie 6y agoWhy are you being down voted? Every major war and international crisis in my lifetime has been directly or indirectly related to US prioritizing oil above pretty much all else. From the Iranian revolution to the Gulf wars, to the terrorism our involvement in the middle east has caused, to the climate crisis and our lack of efforts to reduce consumption. Whoever called this an insult isn't paying attention.
- Edman274 6y agoEveryone freaks out about oil. Japan attacked the United States in World War 2 because the United States stopped exporting oil to Japan. It was the primary motivator behind Pearl Harbor.
- sriram_sun 6y agoOil shortages and long lines make for good/bad TV. Fear of bad media coverage energized the Govt. to act.
- rattray 6y agoPerhaps part of the difference was that it took longer for the victim to pay this time. Presumably Hospitals cave before the impacts make the headlines.
- lostlogin 6y agoI’ve got colleagues who have had radiology hardware that got locked - CT scanners specifically. The NHS paid and they were back to work in a couple of hours.
- PeterisP 6y agoI'd guess that it's entirely the other way around - govt wanted to act, so they drummed up the bad media coverage to justify removing any restrictions they had to (re)act quickly, instead of through the usual law enforcement process which takes months or years.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- dboreham 6y agoThe pipeline thing was just a pretext to open the can of whupass. It could have been an electrical grid, chemical plant, whatever. The hospitals the the past few months would have been the catalyst for the dept. of whatever TLA that pulled off this operation. It takes a while to get authorization, staff up the team etc.
- icecap12 6y agoFeels like a nation-state response. US Cyber Command? Either way, a chilling warning to organized hacking groups.
- jtbayly 6y agoFeels like an inside job. “Oops. We lost all the money of our affiliates. Our money is gone too. No we didn’t take it.” Sure you didn’t.
- deleted 6y ago[deleted]
- ggggtez 6y agoThat doesn't make a lot of sense. If they thought that they could take a golden exit, they wouldn't be continuing to setup the business again under new rules to avoid government scrutiny. They'd just take the money and disappear. The fact that they are continuing means that they want to continue the business. And if they are doing that, then why would they suddenly break all existing contracts? Surely that would ruin a lot of their reputation, and hurt their ability to get clients. Can you imagine what kind of amazing free PR they would be getting if they continued the attack? Surely other criminals would be amazed at their ability to resist counter hacks. That would mean more clients and more money. No, no. While I'm sure there is theft in the ransomware world, I don't think you make this kind of play from a position of strength.
- jtbayly 6y agoIf they are scared but want to continue the "business" then they are stuck between a rock and a hard place. Getting hacked is a nice "out" from their contracts without losing money to reimbursements. Remember, they won't be accepting as wide a clientele anymore, so presumably a fair bit of that money they wouldn't get back from re-signups. On the flip side, they now have extra money they can use for incentives to the clients they really want to sign back up. So, I think there's a good case to be made that this is the best course of action, given they are scared but don't want to quit entirely (which seems clear). It isn't nearly as bad a hit to their reputation as just taking the money and running, so they don't have to hide their identities and rebuild new ones to start over in crime, and they don't lose nearly as much money, and they probably won't lose the clients they actually care about.
- MattGaiser 6y agoWhy does a gang have a blog/Telegram channel?
- cableclasper 6y agoModern Warfare.
- dredmorbius 6y agos/Modern/Ancient/ https://suntzusaid.com/book/13 https://suntzusaid.com/book/13
- whymauri 6y agowhy are ransomware groups transacting in BTC, which can be easily traced?
- spand 6y agoI would expect only Bitcoin markets to have the liquidity and depth where one can easily buy 5 million worth of coins. Similarly when the hackers want to sell the coins again.
- Taek 6y agoNah there are dozens of options where you could easily move 5 million a day. They are probably using bitcoin because it's easiest for the victim to pay in. I assume they would rotate it through zcash/monero before they spend it
- willvarfar 6y agoJust curious, what alternatives are there, and how would they work?
- lallysingh 6y agoMonero for transactions, then change back to BTC for value storage.
- angio 6y agoThey can also ask for ETH and use Tornado cash to launder it.
- chitowneats 6y agoCheck out Monero. I'm a lay person when it comes to cryptography and cryptocurrency, but supposedly an innovation in that currency, known as ring signatures, keeps the blockchain private.
- smoldesu 6y agoBecause even though the transactions can be traced, the accounts holding them are arbitrary. You can observe a Bitcoin transaction propagate through the blockchain, but you'll never really see any personal identifiers besides the address.
- SavantIdiot 6y agoWhy should I believe this? They can shut down their servers, move their crypto to different wallets, and pop up again in a few weeks, right?
- specialp 6y agoThey know that they can and will be found, and are running scared. In general ransomware works because it takes a lot of resources to find the criminals behind it. And generally there's not enough resources to do this. But once it hits a level where it creates a widespread national problem, it becomes more of an act of war. Then you get people involved that aren't just law enforcement and have tools that aren't available to law enforcement with large budgets.
- ttul 6y agoNot to mention diplomatic channels to apply pressure on local governments that may have previously lacked the impetus to do anything about these groups.
- jl2718 6y agoI don’t understand how ransom ware works at all. The address is known well in advance, so a miner knows they might face sanction of their own coins for including it in their block. Not worth it.
- snypher 6y agoRunning scared though? I see this as the dash from 2nd plate to 3rd. If you're going to ditch your servers and wash your coins you might as well make it seem like you were compromised. I don't think there's any fear here as they surely must have anticipated the consequences.
- sfotm 6y agoI’m skeptical as well. They know they built up a little too much notoriety and want to exit the game, is my guess. A core set of people can live pretty comfortably off of the ransom here, though they’ll have a hard time laundering it.
- justapassenger 6y agoSeems like they should invest more into cybersecurity, if someone was able to “steal” their Bitcoin and take over their infrastructure ;). But honestly, this only shows that IT systems are nowadays so complex that you cannot get them right and be able to truly protect you, no matter if you’re good or bad guy.
- stadium 6y agoIt just takes one agent or informant on the inside to bring the whole house down.
- intrasight 6y ago> takes one agent or informant Only if that agent has the master keys. Strong security is about making sure that there is no master key.
- stadium 6y agoI was thinking more about the soft targets and people based parts of the system, but you raise an interesting point. Zero trust systems might be solvable from a tech perspective, but zero trust organizations from a social perspective are a whole lot harder to design and enforce, maybe impossible. In accounting systems, which are targets of fraud and malfeasance (e.g. Enron), there is a "4 eyes" principle. It takes at least 2 people to change something that impacts the financials. But that can't stop 2 people from colluding. Back to the topic, if one agent or informant builds trust with one actor in the target group, and they collude or if one slip is made, it could be game over. Once the org is compromised, how do you know who to trust?
- intrasight 6y agoI was thinking something along these lines. Any admin access to any critical/secure system can only be made thought a channel that will record the session. Perhaps such things exist.
- 6y ago
- kossTKR 6y agoCan crypto actually be non-traceable? I remember currencies like Monero or ZCash advertising privacy from the last crypto craze. I mean if you have 100M in some account, can you actually run it trough "private" currencies to remove traces? BTC, ETH etc. all seems super traceable, even more so than in regular banking. Also how are criminals getting their money out with no one noticing, does Panama/Malta etc. have Kraken/Bittrex equivalents with no questions asked?
- generalizations 6y agoI think it's still just pseudo-anonymity, even for monero. Which means, practically, that I don't think it would have done more for these guys than just delay the seizure.
- tryptophan 6y agoNope. Monero is actually private and untraceable.
- jackson1442 6y agoUntil someone cracks it, that is. If it becomes the crypto of choice for some of the bigger fish, you can bet the government will find a way to trace it.
- ryanlol 6y ago>Until someone cracks it This is certainly not a given. The government isn’t going to be cracking signal messages within any reasonable timeframe either.
- bluGill 6y agoThere are ways to crack encryption that have nothing to do with math. It doesn't matter how good your crypto is. You could probably get by plain text as far as the FBI's effort to crack your crypto are concerned as they won't waste their time checking if you are that stupid.
- lawnchair_larry 6y agoI think this is what you say when the heat is on you too badly. They’re trying to shed the target on their back.
- throwawaysea 6y agoIf this is the US taking action, they should go after distributed denial of secrets next (https://en.m.wikipedia.org/wiki/Distributed_Denial_of_Secrets https://en.m.wikipedia.org/wiki/Distributed_Denial_of_Secret...). This group is doxxing people for their donations, which isn’t “hacktivism” - it’s just a criminal breach of privacy. Crime doesn’t become a non-crime just because it is left-biased. Enough with the unchecked rise of cyber crimes.
- kall 6y agoSo they have a public representative living in the US and are associated with Harvard University. I don‘t think there‘s much shadowy cybercrime to investigate there. How do you feel about Wikileaks and the prosecution of Julian Assange?
- throwawaysea 6y agoHaving a "Harvard affiliation" doesn't legitimize illegal activities. Leaking private messages, passwords, and so on from social networks is an unacceptable breach of privacy. Exposing people's private donations is also unacceptable. This is a group looking to create a chilling effect on others' speech, particularly moderates and conservatives, through illegal cyber crimes. I am not sure how you can possibly see that as anything other than "shadowy cyberycrime" given their identities are anonymous and they're committing cyber crimes.
- jtchang 6y agoJust like the mob there are some targets that just aren't worth it because they bring too much heat. They are learning this is bad for business all around so they are stepping back and encouraging others to do the same.
- deleted 6y ago[deleted]
- ggggtez 6y agoThis is it. Governments have cyber abilities that far outstrip individual organizations. And when cyber fails, there are still other diplomatic and less diplomatic tools. I wouldn't be surprised if the US Government here reached out to foreign governments for assistance in dismantling their infrastructure (it almost certainly was not on US soil). An individual hospital probably couldn't garner that kind of backing, but oil pipelines? The US would probably be willing to use military strikes to keep the oil flowing. A small country would be very willing to help out to maintain good will.
- 3GuardLineups 6y agoyup. In popular parlance, "fucked around, found out"
- bluGill 6y agoSmall countries routinely help out for cases like this. I expect the US has reached out to whatever ones were involved long ago - it is just that until now things were still in the evidence gathering stage. While the police are sometimes willing to make an example of the wrong guy - that is the exception - most of the time they try to be right which means long investigations over many attacks.
- jtchang 6y agoExactly. Also not sure why everyone says Bitcoin is anonymous. It's as anonymous as how deep someone is willing to spend to uncover your address. If we are talking multiple nation states who are interested in tracking you down you are pretty much screwed.
- notjes 6y agoNice story bro.
- paulpauper 6y agoIt would be ironic if they were victims of someone else's ransomware
- deleted 6y ago[deleted]
- purple_ferret 6y agoWhat exactly is a 'payment server' in terms of a crypto wallet? Surely, they're not storing their bitcoin keys on some aws linux box are they?
- doomroot 6y agoWith bitcoin you can produce infinitely many public keys/addresses without your private keys ever touching an internet device.
- g_p 6y ago> The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that henceforth it would be forbidden to attack those in the “social sector” (defined as healthcare and educational institutions) and organizations in the “gov-sector” (state) of any country. Affiliates also will be required to get approval before infecting victims. Statements like this seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. I do wonder if ransomware is (in a strange way) a(n illegal) free-market response to what is perceived to be an under-valuation of tech skills - aggrieved people who can carry out attacks and gain access to deploy ransomware are likely to be able to earn more through this route, even factoring in their "risk of being caught". If a market correction occurs (ransomware becomes a real fear, organisations rapidly start to value security skills more and pay "megabucks" for the skills and hire them at-scale), the risk/reward of being caught starts to mean access brokers reduce in number, and the compensation reaches a free market equilibrium (accounting for the "getting caught" risk of criminal activity). A lot of the time I still see people trying to hire entry-level people into live/ operational security roles, without the experience they'd need. I wonder if this is partly due to a desire to cut costs, rather than accept the need to pay rock-star compensation?
- yebyen 6y agoWhen I heard that this pipeline company started advertising a job opening for CyberSecurity Advisor in the last few days, and heard today the ransom of about $5 million was paid, my first reaction was to say "I bet the salary for that position is a lot less than $5 million, and I bet the budget for that department will be less, too..."
- rebuilder 6y agoWell, if it's more expensive to prevent the attack than to pay the ransom, what's the point? ;)
- g_p 6y agoI think you're right - as I said on a sibling comment, if beans are all you count, and bean-counters rule the roost, you can write this off as a one-off, and point out you had 30 years without a ransomware, and therefore we don't need to do anything...
- bredren 6y agoIt was a mistake to attack the business side of the oil company, because it created what could be sold as reasonable doubt to shut down the pipeline. As a result, the ransom had the optics of an attack on infrastructure. As evidenced by the coverage of Americans desperately filling up containers. This created the impetus for the US to treat this as an incident far and above the ambient ransomware activities leading up to this. It also gave the US an opportunity to show how effective it could be when it had the political cover to do so.
- geofft 6y agoI think the question is, how come an attack on a hospital does not have the optics of an attack on infrastructure? (It almost seems oil does not require infrastructure - you can, theoretically, prep for an oil infrastructure outage by storing it containers, same as you do with water and food. But you can't really prep for a medical infrastructure outage. Is it just that, as a result, there were no photos of people hoarding medical care and so there was less political will?)
- Denvercoder9 6y agoOil does require infrastructure. What you put in your car is several steps removed from what is pumped out of the ground.
- jkubicek 6y agoI think the parent's point was that if oil infrastructure is completely disrupted, consumers won't even be affected for a few days and the short-term consequences will be somewhat minor (some percentage of drivers won't be able to drive, deliveries may be delayed). If a hospital is shut down, then people will start dying immediately. The consequences are much more direct and severe.
- dbt00 6y agoI think this is simplistic and overlooks logistics and flexibility. If a hospital closes, patients can be moved. If there's no gas, patients can't get to any hospital.
- strict9 6y agoLots of opining about motives and reasoning for the shutdown, but this seems like the most likely scenario: >“However, a strong caveat should be applied to these developments: it’s likely that these ransomware operators are trying to retreat from the spotlight more than suddenly discovering the error of their ways”
- rebelde 6y agoDarkSide's English is incredibly good for some supposed Russians. It even has the correct use of the apostrophe in "clients'". I know nothing, but my hunch is that this was written by a well-educated person who grew up in the US or Canada.
- whatshisface 6y agoThe lack of thick accents, hammer and sickle symbols, and hardbass leaves me seriously questioning the plausibility of this "Russian" theory.
- baobabKoodaa 6y agoI also took note of the apparent lack of tracksuits, vodka, AK-47s, and bears.
- culturestate 6y agoI can’t decide if it’s worse to imply that Russians can’t learn English or to think that the anglosphere only exists in North America.
- rebelde 6y agoI am just saying that it is idiomatic North American English. I, for instance, could not write in idiomatic British English if I tried. For instance, your use of "state" in your username and "anglosphere" in your one sentence strongly hints to me that your English is not purely North American. (I see your profile, too.) The vast majority of Americans would use different terms.
- deleted 6y ago[deleted]
- culturestate 6y agoLooking only at the parts quoted in krebs’s post, it doesn’t really stick out to me as either American or British English. They use double quotation marks, for example - American - but leave the trailing comma outside, which is British. Other than that, there are no giveaway spellings or idioms. It could just as easily be someone whose exposure to English is dominated by technical documentation, which tends to use mostly American style.
- cirowrc 6y agowouldn't be surprised if that's their version of "lost all my crypto in a boating accident"
- renewiltord 6y agoIt actually sounds like what someone does when the mob boss is coming after you. Your car catches fire and there’s a charred body inside with your watch on it. The money you took from him is gone. It probably caught fire.
- coldcode 6y agoWhen I was doing anti-cheat stuff for a game company I was able to leverage their attempts at avoiding being hacked by a third party who kept stealing their cheats and reselling them. Even criminals have criminals trying to steal from them.
- ggggtez 6y agoI think this roughly answers a question that I've been wondering about: Why don't cyber criminals hack into the energy grid, water, or other utilities? Surely their cyber security is outdated right? Well, their cyber security may not be the most advanced, but traditional security (i.e. military strength) likely dissuades criminals from choosing those targets that are likely to put them on the short list.
- Verdex 6y agoFor some reason, this comment immediately made me think of an alternate history where ransomware groups hack infrastructure and then improve and monitor their security for them. "Look guys, yeah, it's really easy to hack the power plants that supply electricity to the white house, but then we'll all have military ninjas showing up in our bedrooms at 3 in the morning. So if you try that little stunt again, then we're going to get our own ninjas to give you a visit. Go hack a cereal company or something."
- aerostable_slug 6y agoI think DarkSide addressed this. They don't want to be viewed as a threat to society. They are thieves, they go after soft targets with deep pockets and ideally insurance, and they don't want to have the public or nation-states interested in them. The game changed when the valves to the pipeline were closed as a precaution. They just went from thief to threat.
- code-munkee 6y agoCritical Infrastructure Sectors as defined by CISA https://www.cisa.gov/critical-infrastructure-sectors https://www.cisa.gov/critical-infrastructure-sectors Pretty easy to identify what is Critical Infrastructure. The bigger reason for more coverage is optics. People take money out of their wallet on a regular basis to pay for gas. Gas gets them to their job, where they can then make more money to pay for gas, food, and so on. If Gas is affected, their job, their routine and their wallet is affected.
- ur-whale 6y ago> Bitcoin stash seized Just goes to show how unsophisticated they are and how low ransomware game barrier of entry really is.
- deleted 6y ago[deleted]
- dqpb 6y agoGoing after oil companies strikes me as no different than going after the mafia. It’s the kind of thing you do if you want to end up with your head in a box.
- billytetrud 6y agoThe way the article talks about these cybercrime gangs makes them sound like a benevolent government or non profit. They're putting up restrictions? Gang representatives are talking to the press? What kind of world is this?
- adventured 6y agoThe idea is to narrow who's going to chase after you, based on how you're perceived in terms of being a threat. They want a certain type of police/authority chasing them for financial crimes, not special forces cutting their throats in the middle of the night because they're perceived to be terrorists attacking a superpower's critical infrastructure and trying to harm large numbers of people.
- ThinkBeat 6y agoA far fetched scenario: If I were these guys (I am glad I am not), You have just brought down far more interest and heat from now just law enforcement but probably at least a couple of intelligence services. Arranging your own death would seem like a reasonable thing to do. All our money is gone, stolen. All our servers are gone, grabbed by law enforcement. We have nothing left. Bye. It would be interesting to follow the Bitcoins traversal around the network.
- adventured 6y agoHaving done something so idiotic as inadvertently taking down critical infrastructure for a superpower with global military & espionage capabilities (that nearly all nations will cooperate with) - the problem is, the people chasing you do not give a shit about your money and whether it's gone, and they do not care about your servers. Bye won't work, and faking your death won't be believable. If you're these people, you're going to be hunted to the ends of the planet and most likely they're royally screwed with no way out (unless they're under the direct protection of eg China or Russia).
- goshx 6y agoSo is everyone accepting this as truth? No suspicion of smokes and mirrors?
- normac2 6y agoI'm interested to understand the psychology of ransomware types who go after these enormous and important targets. That includes the pipeline, which obviously claimed at least a few lives of its own via people not being able to drive to get medical care, etc. Are they armchair criminal masterminds who don't really have a visceral understanding of how much damage they're doing? Or just straight up psychopaths? I can't think of any other options.
- Miner49er 6y agoThey've learned from this, from the article: "The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that henceforth it would be forbidden to attack those in the “social sector” (defined as healthcare and educational institutions) and organizations in the “gov-sector” (state) of any country. Affiliates also will be required to get approval before infecting victims." They aren't trying to cause this kind of harm. Additionally: "DarkSide organizers also said they were releasing decryption tools for all of the companies that have been ransomed but which haven’t yet paid." This people have more morals then most rich businessman, IMO.
- normac2 6y agoWell, maybe they learned they did the wrong thing. Other reasons seem plausible: maybe they just thought it would make them look better if they're caught. Maybe they wanted to look better to their clients/allies who are currently like "whoa Nelly, these guys are basically Gus Fring. Maybe we'll work with someone a little less evil." I don't know nearly enough to guess, but it doesn't seem cut-and-dried to me that this is a case of them realizing what they did was wrong. In any case, the same question still applies for what happened before: why were they in a psychological state that made them try this in the first place? Even if we grant that they've changed their tune for moral reasons, that would rule out straight psychopaths, but would include people who had severe antisocial traits but still started to have some feelings about it once they saw the real-life consequences. We see this with repentant murderers. As far as rich businessmen who do evil stuff, there's a literature on that, and it seems to be a complicated mix. There's "just filling my role" (for those not at the very top of their organizations), thinking you'd be replaced by someone else doing the same thing, dissociation/denial about what you're doing, and -- yeah -- straight up antisocial/psychopath types. And more. It's a fascinating topic.
- ______- 6y agoRe-posted comment from a previous thread[0] Still relevant [0] https://news.ycombinator.com/item?id=27097966 https://news.ycombinator.com/item?id=27097966 ___________________ There is a theory floating about that some ransomware attacks were done purely to damage a country's infra and making money was a bonus, but not the main aim. So the perpetrators used ransomware as a front and the real goal is to destroy and disrupt a country's computer infra. But then we could argue ransomware is just going to bolster and make our systems antifragile and resilient against such attacks in the future, so the ransomware attacks could backfire since in the future it would be much harder to attack the US for example with other types of malware. It also means people are going to be storing mission critical and crown-jewels type data in airgapped systems and making filesystems read-only. The data would also be encrypted and compartmented into separate containers so attacks can't affect the whole filesystem if the airgap was breached.
- vmception 6y agoIdiots. They have every arm-chair analyst saying “cryptocureency is the cause of ransomware!” and they don't even use multisig to leverage the cryptocurrency technology preventing that prevents its unilateral seizure? Looking forward to the day when someone proves there is nothing the state can do. But for now we have to watch these lackadaisical shit shows.
- 3pt14159 6y agoStatements like "money of advertisers and founders was transferred to an unknown account" don't make sense to me. Why is the money held on a server at all? Surely it's more secure to keep wallets receiving money locally on a laptop or in a paper wallet, no? Why would they put the gold in the munitions depot if they don't have to?
- timdellinger 6y agoI'm seeing statements about the payments server and the money associated with the payments server, but (at the risk of using an analogy) it seems like they've lost their "petty cash" box, not their main account. Surely they were wise enough to only put a small amount of money in the payments server. The bulk of their cash would be in a separate account (which wasn't lost).
- 3pt14159 6y agoOh well then I take it these guys will be back in some form or another in the coming weeks. With enough cash and time they can replace their seized infrastructure without too much effort. Probably with a non-American target next time. I don't understand why so many hackers target America when the USA has the strongest offensive cyber capabilities of any nation on earth. Surely there is less blowback from hacking an Argentinian pipeline.
- KONAir 6y agoI still can't wrap my head around how can such a critical infrastructre is not air gapped. This is just so... basic. You will never be secure enough, this is not what internet is for.
- TameAntelope 6y agoIt probably is, their billing systems aren’t though. I believe they shut down the pipeline because they were unable to bill.
- didericis 6y agoThis is an extremely important detail which seems overlooked. The pipeline did not need to be shutdown because of a danger to infrastructure, it was a corporate management decision to protect the company’s interests. Colonial used a ransomeware attack on their company to do their own form of retaliatory blackmail on the entire southeast US to get a state level response and avoid the payout. The above is not a defense of ransomeware, and I understand why Colonial acted as they did/it seems to have worked. They likely would not have gotten state level help had they not shut down the pipeline. But they have a larger level of responsibility for the damage caused by the pipeline shutdown than is being portrayed.
- inputError 6y agoive supported some major oil drilling companies in the midwest and they are the biggest cheapskates I have ever dealt with, and that's including credit unions.
- AtlasBarfed 6y agoThis just seems like the group is just closing the storefront and will spin up another at some other point. Almost like it's a show seizure of drugs to show "something was done" but really nothing was done. How do you "seize" bitcoin?
- thysultan 6y agoA good old "i lost the electronic coins in a boating accident". If nothing comes of this after this, this serves as a good proof of concept.
- aazaa 6y ago> The crime gang announced it was closing up shop after its servers were seized and someone drained the cryptocurrency from an account the group uses to pay affiliates. If so, this is either: 1. one heckuva Mickey Mouse operation 2. a smokescreen The statement never mentions Bitcoin, but let's assume that this is the "cryptocurrency" being referred to. That Bitcoin private keys were being stored on a "server" strains credulity. There's very little reason to do so, and every reason not to. Payments can be received and orders fulfilled by a server - without private keys. Multiple addresses can be watched in read-only mode. The only reason for a server to hold private keys is if that server is capable of making automated payments, and that capability is a crucial part of the operation. Bitcoin's history is littered with the corpses of people who messed up the management of their own cryptographic keys. Any reasonably competent operator would know about them and would never, under any circumstances hold private keys on a server. Which leaves Option 2. Smokescreen. Make it look like all the loot was lost, try to throw investigators off the trail. If so, it's a lame attempt. One other possibility comes to mind. The ransom itself was the smokescreen. The amount of the ransom was nothing for a company the size of Colonial. And it's about 1/10 of the annual salary of some developers. Why risk the prospect of life in prison for such as small payoff? The reason is, of course, to make this operation look like something it's not. A Mickey Mouse band of idiots who can't manage their own private keys or servers. Lots of reasons to do this, starting with the notion that the attackers are trying to conceal their identities. And maybe that this was a test operation. Throw in the trinkets of ransom to make it look believable to the public.
- vmception 6y agoIronically, it plays off of ignorance in either option. The DOJ could bolster credibility of itself to the ignorant by saying “thats right criminals you cant hide” even if the DOJ never got anything.
- KZZ 6y ago$5 million is 1/10 the annual salary of some developers?
- deleted 6y ago[deleted]
- lamontcg 6y ago> “There’s too much publicity,” the XSS administrator explained. “Ransomware has gathered a critical mass of nonsense, bullshit, hype, and fuss around it. The word ‘ransomware’ has been put on a par with a number of unpleasant phenomena, such as geopolitical tensions, extortion, and government-backed hacks. This word has become dangerous and toxic.” You've finally figured out that extortion is bad, well done.
- InfiniteRand 6y agoAnyone curious about who were the advertisers of a ransom ware gang? Am I missing something?
- plank_time 6y agoEither the founder stole the money himself, or the NSA showed the world just how powerful they are when they flex. If it’s the latter, I’m really impressed by their skills.
- manquer 6y agoThe guys developing the ransomware are not necessarily the guys behind this group. Even if the developers were in-house, they may not be managing the money. So hack may be not be as difficult as we might think. It is kind of ironic actually, the ransomware targeted billing systems of colonial, however they didn't really secure their own money.
- klyrs 6y ago> “There’s too much publicity,” the XSS administrator explained. “Ransomware has gathered a critical mass of nonsense, bullshit, hype, and fuss around it. The word ‘ransomware’ has been put on a par with a number of unpleasant phenomena, such as geopolitical tensions, extortion, and government-backed hacks. This word has become dangerous and toxic.” I am... flabbergasted. What? Ransomware has always been a brand of extortion; it's right there in the name. Extortion has become dangerous and toxic? You have got to be kidding me. I wonder what's next for these folks. A life of simple, honest, pleasant and non-toxic crime?
- eganist 6y agoI'm interpreting the statement to mean that ransomware very rapidly lost its reputation as a nuisance-crime this week. Misplaced ransomware runs a far more substantial risk of triggering enforcement action now. Or at least that's the perception I'm deriving from the quote.
- klyrs 6y agoOthers seem to suspect that this is a ploy. It does kinda fit the melodrama on display... Otoh, as a kid I was into small-time mischief (pilfering candy from teacher's desk kinda stuff). I had a good sense of what would go unnoticed, but I was a bit too trusting of my friends. They'd go overboard, get caught, and I'd take the blame. So, I can sympathise with this a bit Without external proof, I wouldn't hazard a guess as to which it is
- jmkni 6y agoI actually laughed out loud reading this, These guys are giving ransomware a bad name, ahahaha, what?!
- knolan 6y agoI read it as more of a “they’ve ruined it for the rest of us” whinge.
- 6y ago
- ipaddr 6y agoHow do we know they haven't pulled another exit scam, Mt Gox style?
- Havoc 6y agoI'd love to know the behind the scenes on this. Guessing the US leaned on some other country hard to confiscate servers asap... Loads of "bulletproof" hosting locations but don't think any can withstand that kind of focused above national law type pressure
- gzer0 6y ago"So Sergey has pulled the inevitable exit scam, proving yet again, that there really is no honour amongst thieves. I sincerely hope that no companies had paid the Tsar’s ransom before Sergey headed off for his dacha in the Urals. Forking out millions and still having your network out would be a bitter pill indeed to swallow."
- kordlessagain 6y agoLike I said, unethical and unskilled losers.
- 2wired 6y agoLets not forget a lot of the images they were showing of plastic bags in car trunks were stock photos from Mexican fuel smugglers etc, media was used to fuel panic to protect the oil company, and justify retaliation.
- deleted 6y ago[deleted]
- tyingq 6y ago"drained the cryptocurrency from an account the group uses to pay affiliates" Some pretty good karma/irony there. They left wallet keys laying around on a server.
- johnvaluk 6y agoI'm having a hard time accepting the premise of this article. Does it contain any verifiable facts?
- hnnnnnnng 6y agoIt's about time the NSA uses it's surveillance capabilities to stop a ransomware attack.
- ASalazarMX 6y agoOnce I had the fortune of seeing the three cups and a ball scam live, on the street. One guy does the trick, another encourages the victim, and a third one watches the crowd disguised as a random onlooker. If something makes the onlooker nervous, he will signal the others and they will grab their things and disappear in less seconds than your hand has fingers. This sudden quit seems similar, specially with the withdrawal of funds to an "unknown address", as if they closed shop and disappeared.
- mathgenius 6y agoHow does the scam work ? You got me curious...
- damontal 6y agoBall gets placed under one of three cups. Cups get mixed around and people guess where the ball is for money. The ball isn’t under any of them though. The scammer palmed it.
- jmkni 6y agoI guess people let their guards down when the plant in the audience gets it right and win some money, they pay less attention to the scammer's sleight of hand.
- deleted 6y ago[deleted]
- ASalazarMX 6y agoEach round is double or nothing. The victim wins the first few rounds, but he starts losing after the scammer starts hiding the ball instead of putting it under a cup. The victim keeps doubling on, thinking they will eventually win, but it never happens.
- treme 6y agohttps://www.youtube.com/watch?v=hGAfimeeCD8 https://www.youtube.com/watch?v=hGAfimeeCD8
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- keymone 6y agoThis is good for Bitcoin.
- SpinsInCircles 6y agoIt's easy to quit went your a bunch of cunts and find our that you have poked the big dog and now are scared, fuck them, and anyone like them. As I said earlier insurers should put a bounty on these pricks, lets put an open bounty on them and theirs.
- jtdev 6y agoI would wager a foolish sum that Colonial had a complete shit security posture and had many opportunities to improve but chose to accept this risk at the executive level. I have zero sympathy for Colonial.
- jtdev 6y agoLOL: “Tech audit of Colonial Pipeline found ‘glaring’ problems” https://apnews.com/article/va-state-wire-technology-business-1f06c091c492c1630471d29a9cf6529d https://apnews.com/article/va-state-wire-technology-business...
- karmasimida 6y agoThey learned the hard lesson who is the boss. Fighting government with military power is never a good idea, even if you are fully prepared. The consequences would surely follow.
- slt2021 6y agodont mess with american oil, period. never ever
- cromka 6y ago“Ransomware has gathered a critical mass of nonsense, bullshit, hype, and fuss around it. The word ‘ransomware’ has been put on a par with a number of unpleasant phenomena, such as geopolitical tensions, extortion, and government-backed hacks. This word has become dangerous and toxic.” Imagine feeling hurt that your low-key mob activities are equalled to high-stakes mob activities, so much that your consider it "dangerous" and "toxic". Really love the irony here.
- arbuge 6y ago* claims to have quit, after it claims servers, Bitcoin stash seized.
- alex_young 6y agoWhy should anyone believe them? This sounds like a cover to take the money and change a fake name. "Don't look over here, all the money and servers are gone!"
- briantakita 6y agoSeems just as likely that domestic industrial sabotage and/or members of a 3 letter agency were behind this. Much more que bono for corporations/3 letter agency than the Russians. For example, train freight will be the logical alternative to the pipeline. "Dark Side" is a silly name & I know of many silly security folk. Seems like a cultural fit somewhere...
- dools 6y agoSo now would probably be a good time to sell Bitcoin ...
- Taniwha 6y agoOK - how does one "sieze a bitcoin stash" - presumably one backs up one's stash and promptly transfers the bitcoin from there when the coppers come
- rishabhd 6y agoToo much attention and too brazen attack tactics. XSS shut down ransomware discussion and ransomware groups are having a market correction moment as of now. Shutting funds was easier, probably Kremlin asked gents at whitebit to hand off things before anyone loses fingers. Ultimately, this would simply mean that the targets would be carefully chosen, affiliates screened and new ransomware would be announced in coming months (or weeks even) which would target enterprise/ businesses. Key lesson as summed up beautifully by an old timer in our team "You don't mess with big oil."
- rbrbr 6y agoHackers got hacked, does get better than that.
- helsinkiandrew 6y agoTom Levine of Bloomberg said it well: "So for instance if you run a ransomware business and shut down, like, a marketing agency or a dating app or a cryptocurrency exchange until it pays you a ransom in Bitcoin, that’s great, that’s good money. A crime, sure, but good money. But if you shut down the biggest oil pipeline in the U.S. for days, that’s dangerous, that’s a U.S. national security issue, that gets you too much attention and runs the risk of blowing up your whole business" https://www.bloomberg.com/opinion/articles/2021-05-11/crypto-markets-are-where-the-fun-is https://www.bloomberg.com/opinion/articles/2021-05-11/crypto...
- wanyehood 6y agothank God for dr Moses Buba for helping me with pills for penis enlargement and cure my friends diabetes, he has been putting smile on my face, and on the faces of my loved ones, I got his email address via facebook platform on a penis size forum on facebook so I decided to contact him directly on his email address, and my encounter with this herbal doctor is a lifetime mind blowing testimony, so to all the other men out there about little penis , and other people that are sick of all other deadly diseases such as kidney problems, diabetes, leukemia, herpes and those that needs pills or creams for erectile dysfunction, premature ejaculation, kindly contact him directly on his email address via: buba.herbalmiraclemedicine@gmail.com or WhatsApp him on +2349060529305 or call me for more details +15019914802 He is the best herbal doctor I have ever came across during my search for a cure, Good luck to all the sick people out there, I love you all
- vfclists 6y agoThis is more like the situation when US companies restructure, collapse or seek Chapter 11 bankruptcy when they are hit with huge fines they don't want to pay. It was probably planned all along.