17 ms·
Companies may be punished for paying ransoms to sanctioned hackers
- paulpauper 5y agothen what are companies supposed to do then. in hindsight it is easy to find what went wrong, but hackers are always coming up with new tricks.
- jimbob45 5y agoHave robust and secure backup systems ready to go.
- Scoundreller 5y agobrb, making copies of all my mobo eeprom chips now. Who thought soldering these things to the board would be a good idea.
- moftz 5y agoReplacing hardware is much easier than trying to make backups of embedded systems.
- Scoundreller 5y agoNot if everyone is trying to buy the same parts at the same time.
- zepto 5y agoInvest in better security and resilience. Insure against the losses associated with an unpaid ransom.
- thisisnico 5y agoA lot of times the losses result in the loss of the business entirely.
- zepto 5y agoOnly if you don’t have adequate security and insurance.
- piptastic 5y agoWhich is why they should invest in these things before they happen, rather than respond. Not every business deserves to be in business, either.
- ryan_j_naughton 5y agoNo business "deserves" to be in business. There is no entitlement to being a successful business. Supply and demand should govern this. We should fight the rent seekers who believe they are entitled to their markets and use regulatory capture to maintain their position
- zepto 5y agoDoes this have anything to do with the thread or the OP? I can’t see how.
- bdcravens 5y agoThe article isn't about the companies whose data is held hostage, it's about consultants that sit in the middle and help those companies with paying ransoms. It's more a matter of those consultants being required to register as money transmitters.
- VLM 5y agoResponsible IT operations in the 20s, is optional in the same sense as OSHA compliance was optional in the 70s or SOX compliance was optional in the 00s. Ignore at your own peril.
- bdcravens 5y agoThis isn't about the companies being hacked; it's about the consultants who serve as intermediaries to help pay the ransoms.
- meowface 5y agoI think that's fair. At a previous job from years ago, we took a meeting with one of these ransom payment-facilitator companies. I got the impression they were probably legit and just trying to help companies who knew nothing about cryptocurrency quickly recover from attacks. However, some percentage of these firms definitely are basically part of the ransom racket and essentially act as intermediaries for ransomers. And of course, who knows if my gut feeling of legitimacy in that one particular case was correct or not.
- deleted 5y ago[deleted]
- belatw 5y agoThere’s probably a hell of a market opportunity for stagnant businesses to introduce the malware to themselves, ransom themselves, pay themselves, collect the insurance then launder the cryptocurrency.
- deleted 5y ago[deleted]
- eschneider 5y agoIf you're skilled enough to do that (and not get caught) and that ethically compromised, there are easier (and legal!) ways to make money. Remember kids, the best way to rob a bank is to buy one.
- Threeve303 5y agoIf you’re not able to buy the bank, the second best option is to get a job at one and avoid doing any work.
- vmception 5y agoah insurance fraud.
- kaiju0 5y agoFirst thing that popped in my mind is an employee facilitating an attack and getting a cut. Great way to get a quick payday.
- milkytron 5y agoThis does happen. Here's an article on an attempt made towards Tesla: https://www.wired.com/story/tesla-ransomware-insider-hack-attempt/ https://www.wired.com/story/tesla-ransomware-insider-hack-at...
- bellyfullofbac 5y agoIf the hackers are brave... "Our IT security firm can solve infections of this particular ransomware, but only this one. We charge 20% of what the 'hackers' demand." And the solution would be for this security firm to have Russian (allegedly ;-)) friends that deploy the ransomware and give them the decryption key. See, hacked company, you're not paying the hackers, you're paying IT security experts that are able to recover your data!
- LanceH 5y agoThis is how bribes are paid. You hire a local consultant who will pay the bribes.
- penagwin 5y agoI'm not 100% sure but I'm pretty sure that the sanction laws cover proxies like that.
- amelius 5y agoEspecially if the entire communication goes over the internet via an obscure channel.
- londons_explore 5y agoI think it's pretty difficult to meet the "known or should have known" threshold for that kind of thing. The proxy company can always say they are using their super crypto cracking skills to reverse the encryption. The hacked company would have no way to know they were paying the hackers, nor any way to find out. Obviously the proxy company is breaking the law, but they might be in some untouchable jurisdiction.
- ryan_j_naughton 5y agoRelated article: Could a Ban on Ransom Payments Have Stopped the Colonial Pipeline Attack? https://news.ycombinator.com/item?id=27196299 https://news.ycombinator.com/item?id=27196299 While banning such payments might remove the incentives, that also put a huge burden on the victim and the transition to better cybersecurity should be less disruptive than an outright ban. Another solution that has no harms and only benefit is to require the reporting of every ransom payment. That would give the government the crypto transaction information to conduct taint and attribution analysis. It is currently illegal to knowingly use funds received from kidnapping or ransoms, and this reporting requirement would help the government enforce that.
- Sebb767 5y ago> While banning such payments might remove the incentives, They'd pretty obviously not; companies are already forced to pay a fine (or a ransom, but it's money spent) and it obviously does not incentivize them to properly secure their network. Adding a fine to pay to the government on top (or, more cynically, a tax) will not change much, except that stricken companies now get hit harder, as you said.
- abarringer 5y agoCompanies purchase cyber insurance for a small fee and avoid risk of paying ransoms directly. Make cyber insurance paying ransoms illegal and you'll see boards start funding IT security.
- toomuchtodo 5y agoInsurance companies are likely to disallow ransom payments in their entirety. Too much risk considering the security posture of most organizations. Boards will, generally, still not fund and support effective security culture without steep penalties for breaches (i am in infosec and speak to c suite folks as part of my gig; breach impact, in their current form, are "cost of business"). “Show me the incentive, and I will show you the outcome.” – Charlie Munger https://www.insurancejournal.com/news/international/2021/05/09/613255.htm https://www.insurancejournal.com/news/international/2021/05/... (Insurer AXA to Stop Paying for Ransomware Crime Payments in France)
- vmception 5y agoPeople really out here acting like all of Russia is on the sanction list. Its like the head of Sbersbank and a few companies and a few individuals, and that's it. There is practically no way for this to be a real rebuttal or conversation. Companies can pay ransoms, intermediaries can pay ransoms. There is no legal quagmire. Why would you accept a pseudonymous cryptocurrency in a country you can't even get financial records from the fiat offramps, and use a pseudonym that matched your actual name on the OFAC list? Let alone just not being a person that is on the OFAC list. This is so improbable, the US Treasury can pound sand.
- matheusmoreira 5y agoThe US treasury sanctioned a Monero transaction identifier once. https://www.treasury.gov/ofac/downloads/sdnlist.txt https://www.treasury.gov/ofac/downloads/sdnlist.txt https://localmonero.co/blocks/search/5be5543ff73456ab9f2d207887e2af87322c651ea1a873c5b25b7ffae456c320 https://localmonero.co/blocks/search/5be5543ff73456ab9f2d207... > Digital Currency Address - XMR 5be5543ff73456ab9f2d207887e2af87322c651ea1a873c5b25b7ffae456c320; Kind of embarrassing...
- vmception 5y agolmao, sand is being pounded for anyone passing by: it is impossible to tell from blockchain analysis if anybody sent a payment to a particular Monero address, as neither sender, recipient or amount is stored in transaction data or onchain anywhere. Even client side, the data is limited. Even if the US Treasury seized the recipient's wallet and had it open to look at all transaction history, Monero protocol doesn't tell you what address payments were received from, so the US Treasury would not be able to use their wallet and then compare it to US exchanges or other covered persons to say those people violated sanctions. On the contrary, I do think Monero wallets show what address you sent to, so if they seized an exchange or a covered person's wallet they could see if they sent to that sanctioned address. But of course, the person on the OFAC list has infinite subaddresses to rotate to.
- nitrogen 5y ago
- williesleg 5y agoHey asshole, they're punished by being hacked aren't they? I guess the leaders want to get in on the shakedown.
- dehrmann 5y agoInteresting use of an auto-antonym in a headline.
- tomrod 5y agoThis seems like punishing people for being mugged.
- milkytron 5y agoNot really. And this is why analogies can be bad. A better analogy would be that this is like someone's business getting robbed, and being punished for paying the robber who flew overseas to ship it back to you. But still, this is different, more complex, and more nuanced.
- tomrod 5y agoHow?
- trashtester 5y agoImagine the city you live en being bombed daily by an enemy airforce. Then you discover (after losing your house) that the neighbour paid the attacking airforce to avoid his house.
- Barrin92 5y agoWhich is way more reasonable than it sounds. Put differently, it incentivizes companies to get their security in order. Keep in mind the arguably larger victim of these attacks is the public who may lose their own data or security which they have entrusted to these businesses. We have an expectation of due diligence from firms. If you're a company that rents storage space and you keep your property unlocked and you lose all your customers stuff it's not just the thieves who are in trouble.
- rectang 5y agoThis is a national security issue — malicious actors based in other nation-states are raiding American companies. It seems that US defense forces are not up to the task of repelling these invaders — yet we're expecting individual companies to go up against them?? It will be a long, long time before the marketplace evolves sufficient technological measures to guard against state-sanctioned/possibly-state-sponsored malicious actors operating with impunity in a lawless environment.
- wearywanderer 5y agoThe military can't stop it, the police can't stop it, companies can't stop it, and the marketplace can't stop it.... so what are you proposing? Surrender? Escalating to a hot war?
- leecarraher 5y agoI agree, this is a classic do as I say not as I do situation. Punish businesses for paying out ransomware ransomes meanwhile the government(mainly local, but sometimes larger) pay out routinely when their systems are compromised.
- Ottolay 5y agoMuch of the proposed legislation applies to local governments too. E.G. http://pulse.ncpolicywatch.org/2021/05/12/as-nc-lawmakers-fast-track-legislation-prohibiting-ransomware-payments-federal-officials-focus-on-pipeline-shutdown-future-attacks/ http://pulse.ncpolicywatch.org/2021/05/12/as-nc-lawmakers-fa...
- cortesoft 5y ago“Government” is not a monolith.... the group trying to punish for paying ransoms is not the same group paying out ransoms
- happymellon 5y agoI guess that they could always have backups. Then they also don't need to pay the ransoms.
- yubiox 5y agoCompanies should be punished for choosing windows for mission critical applications. Everyone knows by now that windows is just for games and malware.
- philjohn 5y agoRansomware will target whichever is the dominant platform. If more companies switch to Linux it's not like there haven't been 0 days there before that could have been exploited. IMHO, reducing it to "stop using windows!" is a crude reduction of the forces behind this.
- whydoyoucare 5y agoThe inherent difference in design philosophies of both operating systems will make it arguably difficult to target Linux in the same manner Windows is being targeted today.
- notorandit 5y agoWhat about unsanctioned hackers?
- ttt0 5y agoThey just need to be taxed, probably.
- xwdv 5y agoI wonder, if you could insure your business against ransomware attacks so that instead of paying out you just file a claim for whatever losses, then maybe you could concoct a scheme for insurance fraud by having hackers ransomware your business out and collecting the insurance money. Basically a 21st century version of burning down your business for insurance money.
- BiteCode_dev 5y agoMaybe this new wave of ransomwares and the attention it's getting will finally force IT on a more quality driven path. Right now I see a lot of projects with small budgets sent to fast lane to finish asap, security be damn. Or project with big budget wasted on middle men paying scraps to interns sold as experts.
- Tempest1981 5y agoSure, but it's like asking a gambler to stop gambling. Or a driver to obey the speed limit. They've gambled, "successfully", for a long time. They embrace the risk.
- kuratkull 5y agoSecurity almost always gets attention only after the fact.
- ttt0 5y agoSo they now have to pay the ransom twice?
- meepmorp 5y agoAnd since you don't really know for sure if a hacker is sanctioned or not, you're at risk if you pay any ransom. Not quite a ban, but a disincentive to make a deal, for sure.
- jrochkind1 5y agoThere's pretty much no way to know if a bitcoin address belongs to someone from a sanctioned country or otherwise sanctioned, right? So this effectively makes paying ransomware an activity with very high legal risk. It will be interesting to see how that all plays out. It's hard to imagine the regulators didn't think of this... I wonder what they are thinking exactly.
- gnopgnip 5y agoThe government doesn't need to prove a bitcoin address belongs to someone on the sanctioned list, the specific intermediaries used aren't important. Proving that you know you are paying someone on the sanction list is enough.
- jrochkind1 5y agoYou misread my point. In fact, the article suggests they don't even need to prove that you know you are paying someone on the sanction list. > In a pair of advisories, the Treasury’s Office of Foreign Assets Control and its Financial Crimes Enforcement Network warned that facilitators could be prosecuted even if they or the victims did not know that the hackers demanding the ransom were subject to U.S. sanctions. Indeed, that means it is legally dangerous to pay anyone whose identity you don't know. That is what I'm saying, yes.
- CivBase 5y agoCompanies would just add the cost of the punishment into the cost of the ransom, re-evaluate the risk, and probably decide to just keep doing what they're doing. The problem is not that companies are paying ransoms. The problem is that companies who operate infrastructures of national importance and who collect sensitive data about us are loosing control of said infrastructures and data. If paying ransoms is part of the discussion, we're already in a very sorry state. Legal action should be focused first-and-foremost on preventing that loss of control. First we need to decide what is important enough that we should legally require companies to protect it. Certain data or services may require special licenses, depending on scale and importance. Then we need to decide on how to evaluate whether or not the company has provided sufficient protection and what the punishment should be for failing to provide sufficient protection. Then we need to establish an government organization of white-hat hackers who are charged with evaluating the protection measures implemented by companies - much like how a health inspector goes around evaluating the conditions of food service companies.
- throwawinsider 5y agoGovernments want to keep the monopoly of ransomware (aka taxes)
- Trias11 5y agoCompanies should be punished harder for outsourcing or lowballing security specialists
- robbrown451 5y agoI still like my idea of keeping it legal to pay the ransom, but you have to pay an equal amount as a fine/fee to the government. Deter the bad guys by driving the market price up (so in effect, the bad guys will collect less money because they can't ask for as much), and incentivize prevention (i.e. making systems more secure) by making it more costly to address after the fact. https://news.ycombinator.com/item?id=23659729 https://news.ycombinator.com/item?id=23659729
- baybal2 5y agoA very good way to put it: FUD in action. We may put you in jail for paying sanctioned criminals, but we will not tell you explicitly what constitutes a sanctioned crime, who those criminals are, or we can pull it right out of thin air This way they evade the need to go to the legislature to institute a new class of ban list for them to run. As an any "pull out of thin air" type privilege, it's a bad thing
- slver 5y agoSo a hacker has your data, and demands money. The government's proposal: 1. If you pay the hacker, we want money because you paid a hacker. 2. If you don't pay the hacker, we want money because you leaked your users' data. The bottom-line is that if you're a victim of ransomware, the government joins the hacker, both of them kicking you while you're down and demanding money.
- californical 5y agoOr, you can think of it as increasing the incentive to take security seriously. And it seems like they’d have to pay the fine for (2) regardless of if they pay to get the data back in this case.
- slver 5y agoIt's also an incentive to pay immediately, and tell no one about it.
- adrianN 5y agoThe government should fine the company either way for not properly securing their user's data. Security is serious business, it's time companies took it more seriously.
- HPsquared 5y agoThe ransomers seem to perform this function rather effectively.
- fpoling 5y agoNo necessary so as the company may just pay for insurance from future attacks. Granted insurance companies then will demand some compliance with security check lists, but this feedback loop is very slow.
- ozim 5y agoNot anymore because latest business was, if you don't pay they will leak the data: https://www.forbes.com/sites/thomasbrewster/2021/05/13/ransomware-hackers-claim-to-leak-250gb-of-washington-dc-police-data-after-cops-dont-pay-4-million-ransom/ https://www.forbes.com/sites/thomasbrewster/2021/05/13/ranso...
- bosswipe 5y agoBan cryptocurrencies. Cryptocurrencies are all negative externalities with few societal benefits.
- roughly 5y agoIt would be nice if the NSA had spent the last decade or two helping shore up cybersecurity, instead of creating, stockpiling, and accidentally leaking zero days to later get used in ransomware attacks.
- kingsuper20 5y agoI've thought exactly this thing for years. I'm afraid that you'd have to build a completely separate organization with a separate management line up to the top of the chart. and even then you'd spend most of your time protecting yourself from the NSA and it's brethren.
- ameminator 5y agoI have some issue with the headline - the article discusses "facilitating" so it may in fact target money-transfer firms and banks. That said, if these laws can target the victims of ransomware, this sounds self-defeating. Not only will companies continue to get hacked (as nowhere do I see any meaningful help in preventing "cybercrimes" or shoring up cybersecurity), but now there will be incentive to not report that a crime took place at all. Put another way, if I have been a victim of ransomware and the only way to recover the data is to pay the ransom - should I : A) report the crime and hope I can recover the data some other way? B) pay the ransom, and report the crime and then suffer more fines C) pay the ransom and tell nobody, allowing the crime to go unreported, but forgoing the risk of further punishment from the government There is probably a way to help companies and maybe a national cybersecurity initiative may be of use here, but blaming/punishing then victim is not the way. Maybe preventing the payments is reasonable, but even then, it seems that prevention of the crime itself is the best medicine (as it is in most cases).
- axegon_ 5y agoI'm kind of on the fence here. I see the logic behind it but in many cases incidents will simply be swept under the rug and users will never find out that their data has been compromised.
- dcdc123 5y agoGood. Paying off a ransomware hacker should be illegal.
- davidgh 5y agoSo, basically when a company pays a ransom they’ll also have to pay a tax. Lovely.
- kingsuper20 5y agoor they simply keep it secret.
- jollybean 5y agoAnother idea would be to require breaches to be made public. And of course, the government coordinating with good companies a series of best practices and models, and working with MS, even Linux versions to help get the message out and implement good policy. Like a 'tiered strategy' for home, small biz., mid biz. and 'high touch enterprise'. Basically some kind of 'board' that exist to help train, coordinate and communicate the things that need to be done.
- jl6 5y agoIt’s like Spectre all over again. Just as many of the CPU performance gains of the last 25 years turned out to be based on taking insecure shortcuts, perhaps we will find many of the economic gains of the information economy are founded on similarly insecure practices. Maybe handling data at scale is unaffordable for most businesses, who rely on those shortcuts, and wouldn’t be profitable if they had to hire competent infosec staff.
- oeiiooeieo 5y agoCan we all take a moment to appreciate the ridiculous picture of the "hackers" without desks at the top of the article?
- mhh__ 5y agoDaft Punk successor?
- read_if_gay_ 5y agoThe masks too. For maximum anonymity online.
- ttt0 5y agoI think it's the picture of that famous hacker known as 4chan.
- maxrev17 5y agoThis looks like it could work, however what about the cases where people decide to pay, and end up in cahoots with the gang in order to keep them both out of trouble?
- heroHACK17 5y agoI've had a stance on this for awhile that paying ransoms to hackers is no different than cooperating with terrorists. Like others have mentioned here, this is a national security issue. CMV.
- deleted 5y ago[deleted]
- 6510 5y agoI think things should be more basic. Just make HACCP laws. No need to wait until people die from food poisoning. [000] - https://en.wikipedia.org/wiki/Hazard_analysis_and_critical_control_points https://en.wikipedia.org/wiki/Hazard_analysis_and_critical_c...
- auiya 5y agoIf the USG isn't able to provide protection against ransomware attacks, what other choice is there? This is going to be a hard sell - especially when the USG continues to pay ransoms themselves. Oh they may call it other nonsense like "humanitarian aid" to try and save face, but they're ransoms. I'm not in favor of kicking the victim when they're down.
- ajkdhcb2 5y agoMonero is often accepted (such as in the pipeline situation). It is an interesting usecase that the company could try to pay privately to avoid legal action themselves.
- thayne 5y agoIf a sanctioned individual holds you up at gunpoint and asks for your money, is it illegal to give it to them?
- jl2718 5y agoThe miners can easily stop this, and they will if the users suggest even a tiny bit of infungible preference. I’m not sure that government can control this, although I’m sure they will try, but some authority may be needed to coordinate information sharing between victims and validators. Not even the most die-hard freedom fighters will side with the dishonest and violent. Cryptocurrency will be the worst thing that ever happened to them.
- Proziam 5y ago> Not even the most die-hard freedom fighters will side with the dishonest and violent. Cryptocurrency will be the worst thing that ever happened to them. The history of many nations has proven this to be untrue.
- jl2718 5y agoYou’re probably right. But it seems in everybody’s interest not to force that alliance. For instance, look at Monero booming today after the treasury news. That’s a sign of who ordinary people are most afraid of. It would be nice for modern government to at least aspire to be more loved than feared.
- jacquesm 5y agoApologies to people from China, Russia, Ukraine and so on on HN ahead of everything else: It would not be a bad idea to get countries that routinely shield bad actors and/or active engage in electronic warfare across the net to be blackholed as long as they don't cooperate in bringing the perps in these cases to justice. People will get killed because of these actions, if it hasn't already happened. Of course that works both ways: the countries on the other side of that divide would have to stop doing the same thing, to each other and to countries on the other side of the divide. It's sort of an 'electronic curtain', the iron curtain of cold. China already erected one half of such a barrier, the GFW definitely reduces the chances of foreign hackers attacking Chinese infrastructure, it doesn't seem to do anything to keep attacks from China out of the rest of the world though. So regardless of the origin of these hackers, I'm all for a bit more isolation until we've figured out how to deal with this problem, cross border digital crime is going to be (and already is) a real headache.
- srswtf123 5y agoPersonally, I believe we're living through the events that will lead to the permanent fracturing of the Internet as we know it, along state or bloc lines. I'm torn as to this being a pro or con for humanity.
- nexuist 5y agoI don't think this will happen. American conglomerates are too dependent on both Western and non-Western markets to push for a fracturing. It would mean a lot of work and duplicated effort to offer the same services across multiple Internets on top of destroying lots of supply chains (what do if vendor X only has an API on the American Internet but vendor Y operates off the Chinese Internet?). A lot of money lost for something that could be fixed by just investing in cybersecurity.
- wearywanderer 5y agoI just don't think this could work. If the money is good enough, I think hackers in blackholed countries would find ways to connect with the outside world, particularly if their government was inclined to help them do it.
- bern4444 5y agoI'm surprised companies don't buy insurance against this. I could very easily see insurance companies offering a new product. Pay us $25,000 a year, for a 5 million liability. Or 50,000 a year for a 10 million dollar liability shield etc. Insurance companies can then develop their own methods to better determine premiums for companies based on measures they take. Companies can then decide how much risk to take in choosing not to invest in cyber security for their operations based on the cost of their premiums. If this is an insurance option that currently exists, perhaps more companies will begin paying for it.
- ben509 5y agoSometimes it can be covered by business owner's policy[1], but there are specifc policies covering cyber extortion, e.g. [2] [3]. As you suggested, they are generally paired with risk management. [1]: https://www.investopedia.com/terms/business-owners-policy.asp https://www.investopedia.com/terms/business-owners-policy.as... [2]: https://www.thebalancesmb.com/insuring-against-ransomware-and-other-cyber-extortion-4060470 https://www.thebalancesmb.com/insuring-against-ransomware-an... [3]: https://www.robertsonryan.com/2021/05/18/ransomware-insurance/ https://www.robertsonryan.com/2021/05/18/ransomware-insuranc...
- nexuist 5y agoCyber insurance is a real field but it's still very new so not a lot of executives know about it. I think in the future it will become a very popular industry. I could even see it becoming an option for private citizens, paying $x/mo so that when you get doxxed your insurance company will sue a bunch of websites on your behalf to get your data taken down. Right now this is an awfully tedious and high-effort process, but it's especially necessary when you have e.g. revenge porn or private messages threatened to be revealed by blackmailers.
- toast0 5y agoI didn't see this discussed, so here goes. Why is that sanctioned sometimes means allowed and sometimes means disallowed. You can say, an action was sanctioned, meaning it was approved by someone in power. You can say an action was sanctioned, meaning it was punished, presumably because it wasn't approved. And you can say unsanctioned to mean it wasn't approved, or to say it wasn't punished. What the hell, English?
- davchana 5y agoEnglish is my 2nd (or 3rd?) language, so pardon my understanding, but I think when its a noun, it can be aprooval or denial; but as a verb its always aprooval. Right?
- toast0 5y agoI don't think that's right. The UN is sanctioning X could be approval or disapproval. Maybe they're sanctioning vaccine sharing. Maybe they're sanctioning nuclear weapons testing. Now if we say 'applying sanctions' it definitely means disapproval.
- nexuist 5y agoMy understanding is that it always means "approved." When someone says "sanctioning Russia" they're referring to the set of rules or punishments that have been approved by the US government. These rules or punishments didn't exist before, but now they do, hence they are "sanctioned."