6 ms·

Just like the mob there are some targets that just aren't worth it because they bring too much heat. They are learning this is bad for business all around so th

Just like the mob there are some targets that just aren't worth it because they bring too much heat. They are learning this is bad for business all around so they are stepping back and encouraging others to do the same.

deleted 5y ago
[deleted]
ggggtez 5y ago
This is it. Governments have cyber abilities that far outstrip individual organizations. And when cyber fails, there are still other diplomatic and less diplomatic tools. I wouldn't be surprised if the US Government here reached out to foreign governments for assistance in dismantling their infrastructure (it almost certainly was not on US soil). An individual hospital probably couldn't garner that kind of backing, but oil pipelines? The US would probably be willing to use military strikes to keep the oil flowing. A small country would be very willing to help out to maintain good will.
- 3GuardLineups 5y ago
  yup. In popular parlance, "fucked around, found out"
- bluGill 5y ago
  Small countries routinely help out for cases like this. I expect the US has reached out to whatever ones were involved long ago - it is just that until now things were still in the evidence gathering stage. While the police are sometimes willing to make an example of the wrong guy - that is the exception - most of the time they try to be right which means long investigations over many attacks.
- jtchang 5y ago
  Exactly. Also not sure why everyone says Bitcoin is anonymous. It's as anonymous as how deep someone is willing to spend to uncover your address. If we are talking multiple nation states who are interested in tracking you down you are pretty much screwed.
  - meowface 5y ago
    The problem is the US doesn't have any jurisdiction over Russia, and the Russian government turns a blind eye to these activities (and sometimes works with certain cybercriminals) as long as Russian citizens aren't victimized. Not only will they not extradite, they won't do anything at all to address it. So another government would have to resort to extralegal methods like what ostensibly happened in this case, if it isn't a smokescreen. (I think either scenario is plausible.) (This isn't some anti-Russian screed or anything; this is just one particular point where the Russian government is IMO behaving improperly. I could elaborate if needed.)
    - mr_toad 5y ago
      > Russian government turns a blind eye to these activities Presumably in return for some sort of gratuity. Perhaps they decided they weren’t getting a big enough cut.
mywittyname 5y ago
One thing that impressed me about this situation was the speed at which this was dealt with. A few hours after the attack, an executive order was signed reducing regulations around truck transport of fuel. But the next day, service was being restored. And by the end of the week, the attackers were disbanded and their assets seized. There's a pretty clear message here that the US isn't fucking around.
- wang_li 5y ago
  If I'd just collected enough ransom to retire and never work again, I'd also put out a press release announcing I was out of business and someone seized all my shit and etc.
  - hooande 5y ago
    Darkside was a legit business. They routinely collected ransoms ten or twenty times larger than what they got from Colonial. if they were going to retire, they would have done it a long time ago
    - snypher 5y ago
      Didn't Colonial pay $5m? I don't think Darkside ever received a $50m-$100m ransom. Do you have any more details?
      - hooande 5y ago
        They don't have financial reports and insurance companies don't routinely disclose ransom amounts. Darkside has opened negotiations in the tens of millions in the past [0], with an average demand in the millions [1] [0] https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ https://krebsonsecurity.com/2021/05/a-closer-look-at-the-dar... [1] https://www.areteir.com/darkside-ransomware-caviar-taste-on-your-big-game-budget/ https://www.areteir.com/darkside-ransomware-caviar-taste-on-...
    - fuzzylightbulb 5y ago

deleted 5y ago

[deleted]

ggggtez 5y ago

This is it. Governments have cyber abilities that far outstrip individual organizations. And when cyber fails, there are still other diplomatic and less diplomatic tools. I wouldn't be surprised if the US Government here reached out to foreign governments for assistance in dismantling their infrastructure (it almost certainly was not on US soil). An individual hospital probably couldn't garner that kind of backing, but oil pipelines? The US would probably be willing to use military strikes to keep the oil flowing. A small country would be very willing to help out to maintain good will.

3GuardLineups 5y ago
yup. In popular parlance, "fucked around, found out"
bluGill 5y ago
Small countries routinely help out for cases like this. I expect the US has reached out to whatever ones were involved long ago - it is just that until now things were still in the evidence gathering stage. While the police are sometimes willing to make an example of the wrong guy - that is the exception - most of the time they try to be right which means long investigations over many attacks.
jtchang 5y ago
Exactly. Also not sure why everyone says Bitcoin is anonymous. It's as anonymous as how deep someone is willing to spend to uncover your address. If we are talking multiple nation states who are interested in tracking you down you are pretty much screwed.
- meowface 5y ago
  The problem is the US doesn't have any jurisdiction over Russia, and the Russian government turns a blind eye to these activities (and sometimes works with certain cybercriminals) as long as Russian citizens aren't victimized. Not only will they not extradite, they won't do anything at all to address it. So another government would have to resort to extralegal methods like what ostensibly happened in this case, if it isn't a smokescreen. (I think either scenario is plausible.) (This isn't some anti-Russian screed or anything; this is just one particular point where the Russian government is IMO behaving improperly. I could elaborate if needed.)
  - mr_toad 5y ago
    > Russian government turns a blind eye to these activities Presumably in return for some sort of gratuity. Perhaps they decided they weren’t getting a big enough cut.

mywittyname 5y ago

One thing that impressed me about this situation was the speed at which this was dealt with. A few hours after the attack, an executive order was signed reducing regulations around truck transport of fuel. But the next day, service was being restored. And by the end of the week, the attackers were disbanded and their assets seized. There's a pretty clear message here that the US isn't fucking around.

wang_li 5y ago
If I'd just collected enough ransom to retire and never work again, I'd also put out a press release announcing I was out of business and someone seized all my shit and etc.
- hooande 5y ago
  Darkside was a legit business. They routinely collected ransoms ten or twenty times larger than what they got from Colonial. if they were going to retire, they would have done it a long time ago
  - snypher 5y ago
    Didn't Colonial pay $5m? I don't think Darkside ever received a $50m-$100m ransom. Do you have any more details?
    - hooande 5y ago
      They don't have financial reports and insurance companies don't routinely disclose ransom amounts. Darkside has opened negotiations in the tens of millions in the past [0], with an average demand in the millions [1] [0] https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ https://krebsonsecurity.com/2021/05/a-closer-look-at-the-dar... [1] https://www.areteir.com/darkside-ransomware-caviar-taste-on-your-big-game-budget/ https://www.areteir.com/darkside-ransomware-caviar-taste-on-...
  - fuzzylightbulb 5y ago