7 ms·
> “Our goal is to make money, and not creating problems for society,” the DarkSide criminals wrote last week > In a message posted to its victim shaming blog,
by ______- 5y ago
> “Our goal is to make money, and not creating problems for society,” the DarkSide criminals wrote last week
> In a message posted to its victim shaming blog, DarkSide tried to say it was “apolitical” and that it didn’t wish to participate in geopolitics.
Yes but if destabilizing and disrupting a country's computer infra happens as a side-effect, you are still in the game of politics. Being 'apolitical' is paradoxically still being political, since if you are involved with large groups of people, you can't help but be political.
- btbuildem 5y agoPerhaps they didn't count on their target's profit motive being so strong that the pipeline owners were willing to cause fuel shortages and panic hoarding because they wouldn't be able to add the dollars and cents while sorting out their response.
- OminousWeapons 5y agoOr they didn't understand the degree of consolidation in the industry. Its quite possible they hit the pipeline operators without understanding the level of service outage they would cause.
- khafra 5y agoAntifragility advocates might say the occasional ransomware attack on infrastructure could be a good thing, in the long run, if it promotes a more resilient, less just-in-time based economy. Like Amazon's chaos monkey, but for whole economic sectors.
- bluGill 5y agoJust in time is good for the economy, however like everything else there are downsides that need to be managed.
- ______- 5y agoGood comment about this very thing here: https://news.ycombinator.com/item?id=27099862 https://news.ycombinator.com/item?id=27099862 > It's just a variation of the Normalization of Deviance. See this[1] short talk by Richard Cook for a very good explanation of the mechanism that causes the transition from "robust" to "superfluous". [1] https://www.youtube.com/watch?v=PGLYEDpNu60 https://www.youtube.com/watch?v=PGLYEDpNu60
- 20after4 5y agoThe chaos monkey(1) originated at Netflix. 1. https://netflix.github.io/chaosmonkey/ https://netflix.github.io/chaosmonkey/
- BoiledCabbage 5y agoSupposedly they paid it, but the provided decryption routine was so incredibly slow that they realized it was faster to restore from backup. Not sure how that works, but is what I read.
- not2b 5y agoThat doesn't make much sense; if they had adequate backups and could restore from them without getting the decryption key or code, why would they pay?
- bluGill 5y agoTwo possibilities: They knew restoring from backups is slow, so they wanted a shortcut. They knew there was data (ie from the day of the attack) not in the backups. Take your pick - or not, I have no idea if the claim is even true.
- andrewla 5y ago(Caveat: I know absolutely nothing about this particular situation) Paying would make sense because if there was a vulnerability uncovered by the initial exploit (that is, account information compromised by the initial phishing attempt) then it is perfectly possible that the restored version will be easily exploitable by the same group. I remember this being the case back in SQL Slammer days -- you could restore from backup but your backup would be infected within minutes.
- shalmanese 5y agoModern ransomware teams also threaten to leak your data onto the public internet unless you pay.
- saagarjha 5y agoFree decryption, you mean ;)
- burnished 5y agoI'm not 100% on this, but my understanding is that it was worthwhile due to the vast amount of money involved in the oil industry and the projected time to restore from backup.
- lupire 5y agoFundamentally, DS doesn't want to break anything, they just want to scare people into paying their "tax". They are a thief who just want money from people who can afford it. It's still wrong and side-effect heavy, of course.
- trompetenaccoun 5y agoThat's what they claim, how would we know it's true? It's the word of the extortionists, there is no reason we should just believe them. Governments in certain countries obviously tolerate this sort of hacking, if not outright support it. If you wanted to destabilize the US without directly starting a war, wouldn't that be a good way to go about it?
- edgyquant 5y agoI’m just guessing here but I imagine it’s like how certain groups in South America refrain from kidnapping/violence on large tourist destinations. These groups don’t exist to be evil they exist to make money and bringing the weight of powerful nation states (the US) on you is bad for business.
- hutzlibu 5y ago"In Russia, for example, authorities there generally will not initiate a cybercrime investigation against one of their own unless a company or individual within the country’s borders files an official complaint as a victim. Ensuring that no affiliates can produce victims in their own countries is the easiest way for these criminals to stay off the radar of domestic law enforcement agencies." From the article. So I guess it is the same principle.
- totalZero 5y agoAdditionally, you can presumably make more money by selling drugs to tourists in Cancún than by kidnapping them.
- hutzlibu 5y agoIt is, but ... do you really think, China or Russia really want the US to be destabilized even further? A US falling apart for real, would be bad for Russia as well as China. And vice versa. Because desperate people tend to do desperate actions - not a good thing with so many nukes involved. So I also think, it is likely that at least some russian hacker groups have direct or indirect links to the FSB, and have to work for them occasionally - but most of them probably have indeed their own pocket as the main motivator.
- mormegil 5y ago> Imagine being the chief compliance officer at DarkSide. People constantly come to you with crimes, and you are commercial, you are like “sure go ahead do that crime,” but occasionally you have to stop them and say “no the reputational risk of that crime is too great, we can’t do it,” and the sales reps grumble that you are getting in the way of business. Just like at a bank! https://www.bloomberg.com/opinion/articles/2021-05-11/crypto-markets-are-where-the-fun-is https://www.bloomberg.com/opinion/articles/2021-05-11/crypto...
- shadowgovt 5y agoMy understanding of organized crime in general is that this is more-or-less what it looks like. Sustainable organized crime finds a niche and stays in it. It ends up like any other large, long-lived business; optimized for its niche, vulnerable to niche disruption, and conservative about branching out because of the risk of compromise to its core competencies.
- edgyquant 5y agoDefinitely organize crime is just another business. We have this idea that hackers tend to be loose knit groups of people with more moral objectives. While that may have been true twenty years ago like all criminal markets eventually that stopped being the case.
- indigochill 5y agoI don't at all believe it's stopped being the case. The demographics of the hacker community have certainly changed, with a higher degree of polarization between corporate/fed white hats (e.g. people like Mudge) and criminal black hats, but you still have some grey hat vigilantes in the middle like Janit0r, who wrote BrickerBot that went around bricking open IoT devices so that they wouldn't fall prey to Mirai.
- watwut 5y agoIt was never like that. If you look at those peoples actions, high moral objective was super rare thing. Case in point: I remember people glorifying veev making him sound like good guy and making his detractors sound like liers. Turned out differently.
- shadowgovt 5y agoWhat they mean, of course, is they don't want to poop in the same place they eat. It's not geopolitics if the victim lacks the will or technical firepower to punish the offender, right? ;)
- hourislate 5y agoKaspersky (if you trust them) said this attack could have been a group within the CIA (known as UMBRAGE). My take is why not? With the lack luster response from the current administration and the convenient events that followed, Darkside disbanding, their servers and shitcoin seized, etc, would it be that big of a surprise it was one of our Alphabet Organizations, those same organizations that spy on the American Public.
- ______- 5y ago> My take is why not? Because of the `Russian Razor` principle: It wasn't Russia There's no way it was the Russians It was the Russians
- JustResign 5y agoIt pains me how close this is to a haiku
- naniwaduni 5y ago"There's no way it was Russia" should do it.
- jholman 5y agoNo kireji, no kigo, not even close.
- jsterSC 5y agoyou think a US Federal institution would attack a major US Company and cause suffering to a large swarths of the population, just cause?
- kelnos 5y agoNot the parent, but yes, I do think they would, if they had a good enough reason. And that reason might not be readily apparent to us here. I don't think that was the case here, but... yeah.
- greggman3 5y agoeven if they only cyberlockered private individuals and/or small business they'd still be "creating problems for society".
- NaturalPhallacy 5y ago>“Our goal is to make money, and not creating problems for society,” I think the issue is people read that then add their own meaning to it, and then react to that instead of what was actually said. What they didn't say that people add of their own volition seems to be "and we're not evil", "and we're not criminals", "and we're the good guys". They didn't say those things. Their goal is to make money. That doesn't mean they think they're doing good in the world or innocent. And 'apolitical' just means they're not choosing targets for political reasons, not that they're paragons of virtue or anything. And to be clear, I'm not defending them, just observing the reactions to this. People seem desperate for there to be black and white morality decisions when everything is a shade of grey.
- CRConrad 5y ago> >“Our goal is to make money, and not creating problems for society,” > What they didn't say that people add of their own volition seems to be "and we're not evil", "and we're not criminals", "and we're the good guys". They didn't say those things. Their goal is to make money. That doesn't mean they think they're doing good in the world or innocent. What's funny about their statement is that it's such an obvious lie. They make money by creating problems for society; that's what they demand ransom for, removing the problem they created. Bit funny how people read all kinds of stuff into their statement, but nobody so far has pointed out this discrepancy in what it actually says.
- vmception 5y agoBoth you and this blog seems to be a pedantic unbundling of the choice of word "apolitical". To me, the most important aspect of this article is that you can make people think you are a Russian hacker signed off by Putin himself by adding these Commonwealth of Independent State checks to your code.
- a1369209993 5y ago> you can make people think you are a Russian hacker signed off by Putin himself by adding these Commonwealth of Independent State checks to your code. Reminds me of: > Uncle Milton Industries has been selling ant farms to children since 1956. Some years ago, I remember opening one up with a friend. There were no actual ants included in the box. Instead, there was a card that you filled in with your address, and the company would mail you some ants. My friend expressed surprise that you could get ants sent to you in the mail. I replied: "What's really interesting is that these people will send a tube of live ants to anyone you tell them to." -- https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html https://www.schneier.com/blog/archives/2008/03/the_security_...