7 ms·

> The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that hence

by g_p 5y ago

> The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that henceforth it would be forbidden to attack those in the “social sector” (defined as healthcare and educational institutions) and organizations in the “gov-sector” (state) of any country. Affiliates also will be required to get approval before infecting victims. Statements like this seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. I do wonder if ransomware is (in a strange way) a(n illegal) free-market response to what is perceived to be an under-valuation of tech skills - aggrieved people who can carry out attacks and gain access to deploy ransomware are likely to be able to earn more through this route, even factoring in their "risk of being caught". If a market correction occurs (ransomware becomes a real fear, organisations rapidly start to value security skills more and pay "megabucks" for the skills and hire them at-scale), the risk/reward of being caught starts to mean access brokers reduce in number, and the compensation reaches a free market equilibrium (accounting for the "getting caught" risk of criminal activity). A lot of the time I still see people trying to hire entry-level people into live/ operational security roles, without the experience they'd need. I wonder if this is partly due to a desire to cut costs, rather than accept the need to pay rock-star compensation?

yebyen 5y ago
When I heard that this pipeline company started advertising a job opening for CyberSecurity Advisor in the last few days, and heard today the ransom of about $5 million was paid, my first reaction was to say "I bet the salary for that position is a lot less than $5 million, and I bet the budget for that department will be less, too..."
- rebuilder 5y ago
  Well, if it's more expensive to prevent the attack than to pay the ransom, what's the point? ;)
  - g_p 5y ago
    I think you're right - as I said on a sibling comment, if beans are all you count, and bean-counters rule the roost, you can write this off as a one-off, and point out you had 30 years without a ransomware, and therefore we don't need to do anything...
    - deleted 5y ago
      [deleted]
    - deleted 5y ago
      [deleted]
    - Jeff_Brown 5y ago
      That's surely how it would be represented in order to retroactively justify negligence. But a more precise calculus would take into account that (1) the proliferation in ransomware is recent and explosive, and (2) getting hit by one ransomware group doesn't mean a second group won't strike soon. (Although I'm guessing the second wouldn't be allowed to use the same ransomware-as-a-service platform, as that would harm the platform's reputation.)
  - bluGill 5y ago
    Until the attacks get more expensive. Some companies never settle law suits even when it is obvious they will lose in court. As a result they only have to deal with courts in cases where it is obvious they will lose since no lawyer will bother a with a case that isn't obvious. (the end result is about the same lost overall - when they lose they tend to be punished in court for not settling)
  - mywittyname 5y ago
    I know you're saying this in jest, but that's the calculus. The outcome here shows that executives made the right call. The $5MM fee was easily paid, less than the costs of security, and the insurance company will probably cover it anyway. And the government/people were so outraged that the attackers were met with fucking swift justice. The company will probably get some grants or something to cover the cost of "securing their infrastructure." Never let a good crisis go to waste.
- g_p 5y ago
  I think you're spot-on here - the ransom is seen as a "cost of doing business", and until recently security was seen as "a problem that happens to other people". Sadly my experience is that organisations like this will take their $5m ransom (or other remediation cost), assume it's a one-off, then divide it by their number of ransom-free years, and proclaim it was better value for money than hiring 2 or 3 senior security gurus on $300k /yr with 60 vacation days, and letting them bring in a team to deliver meaningful security. Beyond taking security out of the hands of bean-counters though, I'm not sure how you address this. Pursuing organisations that pay ransoms and prosecuting senior CEO/CFO-type executives for conspiracy to commit money laundering (and pushing for criminal convictions) could discourage paying ransoms. If it's left to businesses as something they can write down as a "cost", I don't see it getting better - there has to be a risk to the liberty of the CEO/CFO before they'll take security seriously in my experience. 90 days in federal prison would certainly sharpen their focus in future.
  - briffle 5y ago
    Even better, they will take the cost of their Insurance Deductible, and then do those calculations. Most businesses have insurance for this stuff.
    - g_p 5y ago
      Interestingly, it looks like (some) insurers may be responding to this. > In an apparent industry first, the global insurance company AXA said Thursday it will stop writing cyber-insurance policies in France that reimburse customers for extortion payments made to ransomware criminals. https://www.insurancejournal.com/news/international/2021/05/09/613255.htm https://www.insurancejournal.com/news/international/2021/05/...
    - aerostable_slug 5y ago
      And DarkSide has stated they target businesses with that insurance. It's smart. They were hosed the moment Colonial's infosec (or whomever) recommended closing the valves on the pipelines. Until that moment they'd been doing reasonably well (for criminal scum).
    - deleted 5y ago
- mgfist 5y ago
  TBH I was shocked $5 million was all it cost.
  - yebyen 5y ago
    I imagine it went something like this "OK, now that you have our attention, and the eyes of the entire international media apparatus are on us, here's how we're going to do this. We're going to send some integer number of million money dollars down this pipe, and you're going to turn that gas pipe back on like you said you would. Then here's what happens next... we're going to give you an integer number of minutes running head start before the drone strikes start raining down on these 12 sites we've identified as likely candidates for your location, ... now how many millions was it that you were asking for from us again?" Doesn't really matter how much it was, either, if it has really been seized already in less than 24 hours. Was it enough to convince the boss guy or gal to take the bait and risk revealing themselves? (Probably not, but IMHO that wasn't likely to happen anyway, at least not since the heat started getting turned up on them all.)
    - sudosysgen 5y ago
      There is basically a zero percent chance that the US knew where they were physically. The servers that were claimed to be seized were on cloud platforms. And even then, we don't know if this is true or if it's just an exit strategy.
      - yebyen 5y ago
        It's easy to say "basically zero chance" when we're armchair quarterbacks and not the ones in the hot seat. I'm inclined to agree that our cyber-security apparatus is not up to the task, but it's also true that nobody has perfect OpSec, (and I'd guess there are few out there have deeper pockets to track down and make sure the perpetrators regret this, than the combination of US government + oil companies.)
        throwawayboise 5y ago
- deleted 5y ago
  [deleted]
- grumple 5y ago
  The cost of shutting down this pipeline for a week is a lot more than 5 million. At 3 million barrels per day going through it, in 6 days that's 18 million barrels. At $65/barrel that's 195 million worth of oil that didn't transit and it probably has huge knock-on effects throughout the affected regions (things that didn't ship, trips not taken, etc).
  - inasio 5y ago
    I believe it was a gasoline pipeline, so the price per barrel is a lot more than that.
marsven_422 5y ago
The free market fundamentally rests on the respect for property rights. Ransom-ware is a violation of said property right and thus an act of aggression therefore allowing for self defense. Violation of property rights is always morally wrong.
cjblomqvist 5y ago
That's not really reasonable - what about replacing hacking with murder? It's illegal for a reason - and not because it's too costly to do.
- johncessna 5y ago
  I was thinking replacing hacker with scammer. After all, Scammers scamming old folks are just showing a gap in online education and regulations. Ransomware gangs aren't the vigilante heroes/embodiment of the undervalued IT security worker. They're a group of people looking to make a quick buck and don't give a damn about the harm they cause or who they cause it to.
- dannyw 5y ago
  Money can always be replaced. Lives can't be. Most ransomware hackers are not so amoral enough to go around murdering people or calling hits. Some are, but most ain't.
WrtCdEvrydy 5y ago
> seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. This is a business that actually provides better support than a regular business. From conversations with friends in the Infragard side of this, and the agencies that collaborate, they have 24/7 English support available before and after payment, as well as decryption remote support if you can't get your files decrypted... there are also instances of refunds if they can't decrypt your files due to technical issues. Unlike regular businesses, support is a sales channel since it's the way to ensure you get paid so a lot of resources go to support activities in these "organizations".
- mason55 5y ago
  Yeah apparently in addition to their white label ransomware software, if you licensed their software you could also have DarkSide handle negotiations for you. 10%-25% of the ransom and in exchange you get people who have real experience handling the negotiations and have the infra in place already to remain anonymous while supporting 24/7 English language service.
  - rsj_hn 5y ago
    Ransomware-As-A-Platform. I wonder if they got the criminal-underground equivalent of VC-funding, or if they have something like Y-combinator to fund innovative criminal approaches and promote networking -- like evil-Kirk from the mirror universe, there could be a Saul Graham with a mustache writing essays about unlocking value and what you are not allowed to say in the ransomware community.
    - vmception 5y ago
      There is investment infrastructure. Mostly informal and enforced via smart contract and multisignature transactions. Organized on forums and chat rooms. Not much capital is needed though and the affiliate and licensing model is better, which also just means an address is hardcoded that splits payment, or a server controls the private key (or master private key for infinite unique address creation) to addresses and automatically splits received payments to the RaaS service I get that was supposed to be a joke, its exactly the same or even more streamlined than the licit economy. There is no major distinction except the kinds of “risk factors” one might list.
omoikane 5y ago
> business-like Reminds me of this negotiation: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W https://www.reuters.com/article/us-cyber-cwt-ransom/payment-... Previously discussed here: https://news.ycombinator.com/item?id=24032779 https://news.ycombinator.com/item?id=24032779
JackFr 5y ago
> I do wonder if ransomware is (in a strange way) a(n illegal) free-market response to what is perceived to be an under-valuation of tech skills - aggrieved people who can carry out attacks and gain access to deploy ransomware are likely to be able to earn more through this route, even factoring in their "risk of being caught". Sure. In the same way the mugging people is a response to undervaluing “beating the crap out of people and taking their money” skills.
- at-fates-hands 5y ago
  Its been said before: "When the system fails you, you create your own system." Which relates to what you're saying. When clever, intelligent people are ostracized and marginalized, they then use those skills to get illegally what society has prevented them from getting legally. At some point, the idea of getting caught doesn't even register anymore.
  - JKCalhoun 5y ago
    Were these people ostracized and marginalized? If we just paid engineers more would this type of crime disappear? Or is greed, ego, arrogance also a part of their actions?
    - at-fates-hands 5y ago
      >> Were these people ostracized and marginalized? We probably will never know. A lot of hackers turn to hacking because of various reasons - some ideological, others because they felt they didn't fit in anywhere else. >> If we just paid engineers more would this type of crime disappear? Probably not. You cannot get rid of one type of crime by simply paying people NOT to do it. It is what is - at no time in human history has any civilization had zero crime. That's regardless of punishments and financial incentives. >> Or is greed, ego, arrogance also a part of their actions? I think its different things at different times. When I was hacking, it was arrogance, thinking I was smarter than others and trying to prove it. That leads to thinking you are beyond law enforcement when you get away with it (ego). If you're into it solely for financial gain, then the other two feed your greed. Get one nice payout for your ransomware and now you think its easy to do and you'll never be caught - increasing your greed to get more. They all kind of play into each other: arrogance: "I'll never get caught." ego: "They'll never catch me, my ops sec is too good for law enforcement." greed: "This was too easy, next time I'll target a bigger company for a bigger payout."
johncessna 5y ago
> “We are apolitical, we do not participate in geopolitics, do not need to tie us with a defined government and look for other our motives [sic],” reads an update to the DarkSide Leaks blog. “Our goal is to make money, and not creating problems for society. From today we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.”[1] [1] https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ https://krebsonsecurity.com/2021/05/a-closer-look-at-the-dar... Yeah, just dirtbags making money.
- Miner49er 5y ago
  This is better then most rich businessman, actually. Many don't care if they create problems for society, if it means more money for them.
  - colechristensen 5y ago
    They are, of course, lying. They don’t want the extra attention that comes from attacking public infrastructure or affecting large numbers of people. Nobody cares if you sabotage a random small business. Lots of people care when you attack a fuel pipeline. Attention is bad for this business.
- at-fates-hands 5y ago
  Sounds like they're about to get rolled up by law enforcement as well. As someone who's had the full force of a three letter agency come down on me, this is not something you want to deal with on any level. I was lucky. I was young and dumb and got a slap on the wrist. Times have changed and when govt agencies see this as an attack on critical infrastructure, you're looking at some serious jail time. I would say its only a matter of time until they're tracked down. When you're being hunted like that, the govt works 24/7 and never stops. People on the run don't have that luxury.
  - johncessna 5y ago
    Thanks for sharing your experience. Not to dig too deep into details, but what would you say your primary motivation was in your 'young and dumb' days? Were you curious about it, was it a statement, was there an allure?
arrosenberg 5y ago
> Statements like this seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. It's just digital Privateering - Francis Drake with a laptop. > If a market correction occurs... The English solved it by expanding their Navy and enlisting those who would otherwise pirate. Seems like as good a solution as any here.
- goodlinks 5y ago
  I thought privateers were state sponsored (i thought that was the distinction from piracy?). Which sort of makes the comparison to ransom ware potentially more apt/thought provoking? In anycase disparity of oppourtunity is what breaks trust and therefor collaboration. The world needs to universally operate in the ballpark of fairness or we are all at risk in the long term. (This comment is also influenced by the under valued tech resources thought). Edit (sorry some more thought while fixing typos): When the disparity of oppourtunity is at state level there are privateers and wars, when at a personal level there are muggings and burglaries etc. *this is all probably stupidly obvious.. but as its against uncontrolled capitalism or classist segregation we dont seem to want to say it too much maybe?
throwawayboise 5y ago
> ransomware activities being far more coordinated and "business-like" than they often get credit for. This is the "organized" in organized crime. It's not lone bored teenagers doing this stuff.
nyghtly 5y ago
I think you're on to something in the context of globalization. There are many incredibly talented tech workers globally who can't get paid what they're worth because they lack access to employment with the wealthiest employers (because of strict border policies and the lack of visa sponsorship). If they had the freedom to migrate, then they might choose to seek employment in another country with a supply shortage, rather than enter the black market.
newsclues 5y ago
Cybercrime is the market response to under utilized/paid tech workers.
nemothekid 5y ago
>I do wonder if ransomware is (in a strange way) a(n illegal) free-market response to what is perceived to be an under-valuation of tech skills - aggrieved people who can carry out attacks and gain access to deploy ransomware are likely to be able to earn more through this route, even factoring in their "risk of being caught". Almost all crime syndicates work this way. There is a balancing point where the crime you do does enough damage to make you money, but not so much money that the government dedicates elites to come knocking on your door. What DarkSide did was veer too far in the wrong direction.
djrogers 5y ago
> Statements like this seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. They only don’t get credit for that in mainstream media. In the Cyber Security world, Ransomware as a Service (and various other malware-aaS) groups have been discussed as well organized, customer-focused entities for quite some time. I swear this is the first time it seems the world is hearing about RaaS, which feels weird since it’s a pretty dominant model today.

by g_p 5y ago

yebyen 5y ago

When I heard that this pipeline company started advertising a job opening for CyberSecurity Advisor in the last few days, and heard today the ransom of about $5 million was paid, my first reaction was to say "I bet the salary for that position is a lot less than $5 million, and I bet the budget for that department will be less, too..."

rebuilder 5y ago
Well, if it's more expensive to prevent the attack than to pay the ransom, what's the point? ;)
- g_p 5y ago
  I think you're right - as I said on a sibling comment, if beans are all you count, and bean-counters rule the roost, you can write this off as a one-off, and point out you had 30 years without a ransomware, and therefore we don't need to do anything...
  - deleted 5y ago
    [deleted]
  - deleted 5y ago
    [deleted]
  - Jeff_Brown 5y ago
    That's surely how it would be represented in order to retroactively justify negligence. But a more precise calculus would take into account that (1) the proliferation in ransomware is recent and explosive, and (2) getting hit by one ransomware group doesn't mean a second group won't strike soon. (Although I'm guessing the second wouldn't be allowed to use the same ransomware-as-a-service platform, as that would harm the platform's reputation.)
- bluGill 5y ago
  Until the attacks get more expensive. Some companies never settle law suits even when it is obvious they will lose in court. As a result they only have to deal with courts in cases where it is obvious they will lose since no lawyer will bother a with a case that isn't obvious. (the end result is about the same lost overall - when they lose they tend to be punished in court for not settling)
- mywittyname 5y ago
  I know you're saying this in jest, but that's the calculus. The outcome here shows that executives made the right call. The $5MM fee was easily paid, less than the costs of security, and the insurance company will probably cover it anyway. And the government/people were so outraged that the attackers were met with fucking swift justice. The company will probably get some grants or something to cover the cost of "securing their infrastructure." Never let a good crisis go to waste.
g_p 5y ago
I think you're spot-on here - the ransom is seen as a "cost of doing business", and until recently security was seen as "a problem that happens to other people". Sadly my experience is that organisations like this will take their $5m ransom (or other remediation cost), assume it's a one-off, then divide it by their number of ransom-free years, and proclaim it was better value for money than hiring 2 or 3 senior security gurus on $300k /yr with 60 vacation days, and letting them bring in a team to deliver meaningful security. Beyond taking security out of the hands of bean-counters though, I'm not sure how you address this. Pursuing organisations that pay ransoms and prosecuting senior CEO/CFO-type executives for conspiracy to commit money laundering (and pushing for criminal convictions) could discourage paying ransoms. If it's left to businesses as something they can write down as a "cost", I don't see it getting better - there has to be a risk to the liberty of the CEO/CFO before they'll take security seriously in my experience. 90 days in federal prison would certainly sharpen their focus in future.
- briffle 5y ago
  Even better, they will take the cost of their Insurance Deductible, and then do those calculations. Most businesses have insurance for this stuff.
  - g_p 5y ago
    Interestingly, it looks like (some) insurers may be responding to this. > In an apparent industry first, the global insurance company AXA said Thursday it will stop writing cyber-insurance policies in France that reimburse customers for extortion payments made to ransomware criminals. https://www.insurancejournal.com/news/international/2021/05/09/613255.htm https://www.insurancejournal.com/news/international/2021/05/...
  - aerostable_slug 5y ago
    And DarkSide has stated they target businesses with that insurance. It's smart. They were hosed the moment Colonial's infosec (or whomever) recommended closing the valves on the pipelines. Until that moment they'd been doing reasonably well (for criminal scum).
  - deleted 5y ago
mgfist 5y ago
TBH I was shocked $5 million was all it cost.
- yebyen 5y ago
  I imagine it went something like this "OK, now that you have our attention, and the eyes of the entire international media apparatus are on us, here's how we're going to do this. We're going to send some integer number of million money dollars down this pipe, and you're going to turn that gas pipe back on like you said you would. Then here's what happens next... we're going to give you an integer number of minutes running head start before the drone strikes start raining down on these 12 sites we've identified as likely candidates for your location, ... now how many millions was it that you were asking for from us again?" Doesn't really matter how much it was, either, if it has really been seized already in less than 24 hours. Was it enough to convince the boss guy or gal to take the bait and risk revealing themselves? (Probably not, but IMHO that wasn't likely to happen anyway, at least not since the heat started getting turned up on them all.)
  - sudosysgen 5y ago
    There is basically a zero percent chance that the US knew where they were physically. The servers that were claimed to be seized were on cloud platforms. And even then, we don't know if this is true or if it's just an exit strategy.
    - yebyen 5y ago
      It's easy to say "basically zero chance" when we're armchair quarterbacks and not the ones in the hot seat. I'm inclined to agree that our cyber-security apparatus is not up to the task, but it's also true that nobody has perfect OpSec, (and I'd guess there are few out there have deeper pockets to track down and make sure the perpetrators regret this, than the combination of US government + oil companies.)
      - throwawayboise 5y ago
deleted 5y ago
[deleted]
grumple 5y ago
The cost of shutting down this pipeline for a week is a lot more than 5 million. At 3 million barrels per day going through it, in 6 days that's 18 million barrels. At $65/barrel that's 195 million worth of oil that didn't transit and it probably has huge knock-on effects throughout the affected regions (things that didn't ship, trips not taken, etc).
- inasio 5y ago
  I believe it was a gasoline pipeline, so the price per barrel is a lot more than that.

marsven_422 5y ago

The free market fundamentally rests on the respect for property rights. Ransom-ware is a violation of said property right and thus an act of aggression therefore allowing for self defense. Violation of property rights is always morally wrong.

cjblomqvist 5y ago

That's not really reasonable - what about replacing hacking with murder? It's illegal for a reason - and not because it's too costly to do.

johncessna 5y ago
I was thinking replacing hacker with scammer. After all, Scammers scamming old folks are just showing a gap in online education and regulations. Ransomware gangs aren't the vigilante heroes/embodiment of the undervalued IT security worker. They're a group of people looking to make a quick buck and don't give a damn about the harm they cause or who they cause it to.
dannyw 5y ago
Money can always be replaced. Lives can't be. Most ransomware hackers are not so amoral enough to go around murdering people or calling hits. Some are, but most ain't.

WrtCdEvrydy 5y ago

> seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. This is a business that actually provides better support than a regular business. From conversations with friends in the Infragard side of this, and the agencies that collaborate, they have 24/7 English support available before and after payment, as well as decryption remote support if you can't get your files decrypted... there are also instances of refunds if they can't decrypt your files due to technical issues. Unlike regular businesses, support is a sales channel since it's the way to ensure you get paid so a lot of resources go to support activities in these "organizations".

mason55 5y ago
Yeah apparently in addition to their white label ransomware software, if you licensed their software you could also have DarkSide handle negotiations for you. 10%-25% of the ransom and in exchange you get people who have real experience handling the negotiations and have the infra in place already to remain anonymous while supporting 24/7 English language service.
- rsj_hn 5y ago
  Ransomware-As-A-Platform. I wonder if they got the criminal-underground equivalent of VC-funding, or if they have something like Y-combinator to fund innovative criminal approaches and promote networking -- like evil-Kirk from the mirror universe, there could be a Saul Graham with a mustache writing essays about unlocking value and what you are not allowed to say in the ransomware community.
  - vmception 5y ago
    There is investment infrastructure. Mostly informal and enforced via smart contract and multisignature transactions. Organized on forums and chat rooms. Not much capital is needed though and the affiliate and licensing model is better, which also just means an address is hardcoded that splits payment, or a server controls the private key (or master private key for infinite unique address creation) to addresses and automatically splits received payments to the RaaS service I get that was supposed to be a joke, its exactly the same or even more streamlined than the licit economy. There is no major distinction except the kinds of “risk factors” one might list.

omoikane 5y ago

> business-like Reminds me of this negotiation: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W https://www.reuters.com/article/us-cyber-cwt-ransom/payment-... Previously discussed here: https://news.ycombinator.com/item?id=24032779 https://news.ycombinator.com/item?id=24032779

JackFr 5y ago

> I do wonder if ransomware is (in a strange way) a(n illegal) free-market response to what is perceived to be an under-valuation of tech skills - aggrieved people who can carry out attacks and gain access to deploy ransomware are likely to be able to earn more through this route, even factoring in their "risk of being caught". Sure. In the same way the mugging people is a response to undervaluing “beating the crap out of people and taking their money” skills.

at-fates-hands 5y ago
Its been said before: "When the system fails you, you create your own system." Which relates to what you're saying. When clever, intelligent people are ostracized and marginalized, they then use those skills to get illegally what society has prevented them from getting legally. At some point, the idea of getting caught doesn't even register anymore.
- JKCalhoun 5y ago
  Were these people ostracized and marginalized? If we just paid engineers more would this type of crime disappear? Or is greed, ego, arrogance also a part of their actions?
  - at-fates-hands 5y ago
    >> Were these people ostracized and marginalized? We probably will never know. A lot of hackers turn to hacking because of various reasons - some ideological, others because they felt they didn't fit in anywhere else. >> If we just paid engineers more would this type of crime disappear? Probably not. You cannot get rid of one type of crime by simply paying people NOT to do it. It is what is - at no time in human history has any civilization had zero crime. That's regardless of punishments and financial incentives. >> Or is greed, ego, arrogance also a part of their actions? I think its different things at different times. When I was hacking, it was arrogance, thinking I was smarter than others and trying to prove it. That leads to thinking you are beyond law enforcement when you get away with it (ego). If you're into it solely for financial gain, then the other two feed your greed. Get one nice payout for your ransomware and now you think its easy to do and you'll never be caught - increasing your greed to get more. They all kind of play into each other: arrogance: "I'll never get caught." ego: "They'll never catch me, my ops sec is too good for law enforcement." greed: "This was too easy, next time I'll target a bigger company for a bigger payout."

johncessna 5y ago

> “We are apolitical, we do not participate in geopolitics, do not need to tie us with a defined government and look for other our motives [sic],” reads an update to the DarkSide Leaks blog. “Our goal is to make money, and not creating problems for society. From today we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.”[1] [1] https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ https://krebsonsecurity.com/2021/05/a-closer-look-at-the-dar... Yeah, just dirtbags making money.

Miner49er 5y ago
This is better then most rich businessman, actually. Many don't care if they create problems for society, if it means more money for them.
- colechristensen 5y ago
  They are, of course, lying. They don’t want the extra attention that comes from attacking public infrastructure or affecting large numbers of people. Nobody cares if you sabotage a random small business. Lots of people care when you attack a fuel pipeline. Attention is bad for this business.
at-fates-hands 5y ago
Sounds like they're about to get rolled up by law enforcement as well. As someone who's had the full force of a three letter agency come down on me, this is not something you want to deal with on any level. I was lucky. I was young and dumb and got a slap on the wrist. Times have changed and when govt agencies see this as an attack on critical infrastructure, you're looking at some serious jail time. I would say its only a matter of time until they're tracked down. When you're being hunted like that, the govt works 24/7 and never stops. People on the run don't have that luxury.
- johncessna 5y ago
  Thanks for sharing your experience. Not to dig too deep into details, but what would you say your primary motivation was in your 'young and dumb' days? Were you curious about it, was it a statement, was there an allure?

arrosenberg 5y ago

> Statements like this seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. It's just digital Privateering - Francis Drake with a laptop. > If a market correction occurs... The English solved it by expanding their Navy and enlisting those who would otherwise pirate. Seems like as good a solution as any here.

goodlinks 5y ago
I thought privateers were state sponsored (i thought that was the distinction from piracy?). Which sort of makes the comparison to ransom ware potentially more apt/thought provoking? In anycase disparity of oppourtunity is what breaks trust and therefor collaboration. The world needs to universally operate in the ballpark of fairness or we are all at risk in the long term. (This comment is also influenced by the under valued tech resources thought). Edit (sorry some more thought while fixing typos): When the disparity of oppourtunity is at state level there are privateers and wars, when at a personal level there are muggings and burglaries etc. *this is all probably stupidly obvious.. but as its against uncontrolled capitalism or classist segregation we dont seem to want to say it too much maybe?

throwawayboise 5y ago

> ransomware activities being far more coordinated and "business-like" than they often get credit for. This is the "organized" in organized crime. It's not lone bored teenagers doing this stuff.

nyghtly 5y ago

I think you're on to something in the context of globalization. There are many incredibly talented tech workers globally who can't get paid what they're worth because they lack access to employment with the wealthiest employers (because of strict border policies and the lack of visa sponsorship). If they had the freedom to migrate, then they might choose to seek employment in another country with a supply shortage, rather than enter the black market.

newsclues 5y ago

Cybercrime is the market response to under utilized/paid tech workers.

nemothekid 5y ago

>I do wonder if ransomware is (in a strange way) a(n illegal) free-market response to what is perceived to be an under-valuation of tech skills - aggrieved people who can carry out attacks and gain access to deploy ransomware are likely to be able to earn more through this route, even factoring in their "risk of being caught". Almost all crime syndicates work this way. There is a balancing point where the crime you do does enough damage to make you money, but not so much money that the government dedicates elites to come knocking on your door. What DarkSide did was veer too far in the wrong direction.

djrogers 5y ago

> Statements like this seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. They only don’t get credit for that in mainstream media. In the Cyber Security world, Ransomware as a Service (and various other malware-aaS) groups have been discussed as well organized, customer-focused entities for quite some time. I swear this is the first time it seems the world is hearing about RaaS, which feels weird since it’s a pretty dominant model today.