11 ms·

The Ransomware Problem Is a Bitcoin Problem

111 points by robseed 5y ago

btilly 5y ago
I understand that this was flagged because there have been many, many articles on the connection between ransomware and bitcoin. However this article is not duplicative. It adds the history of exactly how Viagra spammers got shut down, from the perspective of one of the researchers who did it. And the technique by which that happened is a technique that can shut down bitcoin as well. It is one thing to say, "We have to get rid of cryptocurrency! We're serious!" It is quite another to say, "Here is the method by which a similar past problem was solved." And lay out something that could actually kill the utility of cryptocurrency today. Namely shut down all bank accounts that are willing to exchange large amounts of cash for cryptocurrency. Just as we shut down all bank accounts that were receiving affiliate payments for Viagra spam. So yes, it is possible to do this. We know how to do this. The question is whether the dangers of ransomware are such that we should do this. Cryptocurrencies have legitimate uses. For example they enable a variety of kinds of smart contracts, which NFTs are but one example of. However ransomware is a big and growing problem. What happens when a ransomware attack gone bad winds up killing patients in a hospital? Crashes airplanes? Cuts off people's ability to access credit cards or banks? If we keep seeing random services in a complex world get shut down by ransomware, it is just a question of time until the wrong service gets shut down with disastrous consequences. So far we have had minor inconveniences. But how will people feel after something bigger goes wrong?
arberx 5y ago
"This means that cryptocurrencies are the only tool left for ransomware purveyors. So, if governments take meaningful action against Bitcoin and other cryptocurrencies, they should be able to disrupt this new ransomware plague and then eradicate it, as was seen with the spam Viagra industry." This is the totally incorrect approach. Imagine banning Polaroids because they led to an explosive growth in underage pornography. These exploits are happening not because of crypto but because of insecure systems that public, money making companies haven't invested in making secure.
- hannasanarion 5y ago
  The difference is that polaroids are useful for legitimate purposes. Every conversation I've ever had with a crypto purveyor, even as a person who has worked for crypto companies before, always comes down to "crypto is a good thing because it helps people commit financial crimes". There are no other benefits.
- okareaman 5y ago
  While I mostly agree with you about cryptocurrencies, the idea that companies don't invest in security is a lazy argument. It's not that simple. Companies can't secure themselves against bugs in software that no one knows about (zero days) no matter how much they invest.
  - TingPing 5y ago
    They can audit the projects they use. It will never be perfect but most do nothing.
  - matoro 5y ago
    While this is true, the overwhelming majority of these incidents do not use or require zero-days. The attack vector is nearly always basic phishing/social engineering, or wildly misconfigured/unpatched systems exposed to the internet. Implementing a bare-bones security program, or giving an existing security program the tools & authority to enforce policies, would cut down on ransomware incidents by a factor of 5-10, easily, without touching cryptocurrency in the slightest.
SavantIdiot 5y ago
I'd like to hear how cryptocurrency advocates address this without deploying a fallacy. Cryptocurrency makes ransomware possible, without the former, the latter cannot thrive. The defenses I usually hear come in the form of "current banking facilitates bad stuff, too," which is a fact, but doesn't absolve cryptocurrencies central role in ransomware. As the article states, there is simply no way to pay a ransom without cryptocurrency. Maybe they could do b2b or cash, but that would be sooooo bold (but not impossible?) EDIT: See link from user 'px43' below about the history of ransomware. Good read. Predates cryptocurrency, but I think banking technology would make most payment strategies of the past impossible, like the original article argues (e.g., PO Box in Panama is quoted as a 1989 payment plan, but GP article explains that is harder due to extradition of data and logs).
- J5892 5y ago
  The answer is that sometimes progress comes with a cost. Whether or not you consider cryptocurrencies "progress" is irrelevant, because it's an emerging technology that exists whether you (or I) like it or not. The cold, hard, unavoidable truth is this: Ransomware may be a Bitcoin problem, and it may not be. Either way, tough shit.
  - verdverm 5y ago
    How does this compare to banning ICE vehicles? They are widely adopted and useful, yet their secondary harms warrant laws to be written.
  - emodendroket 5y ago
    > Whether or not you consider cryptocurrencies "progress" is irrelevant I mean not really. If we were to decide, as a country, that it was bad, we could take actions to stop its proliferation. The dollar-BTC transition points are chokepoints we could easily target to get started.
    - devonbleak 5y ago
      Money laundering is also illegal and it's still prolific. Buying weed is also illegal and it's still prolific. Banning things like this just turns them into another laundering opportunity - where there's money to be made there's a way.
alecst 5y ago
Is it possible to ban cryptocurrency traffic in general? How would that even work?
- verdverm 5y ago
  You ban it at the point of interaction with the existing financial system. You don't have to ban or block the technology. A gov't can (has) made it illegal to mine or hold them as well. Most people won't and the value will evaporate if there is no market
- mediaman 5y ago
  You can make it illegal to transact crypto. That would devastate the price and ruin it as a currency. The network would still exist, but it'd be useless as a medium for criminal payments due to the low value.
  - J5892 5y ago
    Bitcoin was wildly popular on darknet markets even when it was worth less than $10. It's still tied to a dollar value, so it can be used for payments without issue.
    - endisneigh 5y ago
      When Bitcoin was worth less than $10 how difficult was it to change your bitcoin into cash?
      - Workaccount2 5y ago
        Way back in the early days before exchanges, you literally bought and sold them on forums using bootleg paypal ripoffs (since paypal didn't recognize virtual money = buyers could refund) I put off my 20,000 BTC purchase because it was so sketchy.
  - fighterpilot 5y ago
    Low value won't change its criminal utility. A criminal looking for a $50k ransomware payment doesn't care if the market cap is $50M or $50B. Outlawing it will make a difference though since it'll make it less likely that victims will pay, meaning the endeavor has a lower success rate.
cgb223 5y ago
Never understood why ransomware didn’t use more anonymous crypto currencies like Monero or ZCash. Doesn’t that better protect the scammers from law enforcement?
- smaryjerry 5y ago
  I thought you can easily wash the money by converting it through an anonymous cryptocurrency and then out again anyways.
  - verdverm 5y ago
    The networks don't interoperate, so you need a "trusted" party to provide this service.
    - lozaning 5y ago
      An atomic exchange fulfills this requirement, assuming your capable of auditing the code that runs the swap smart contract.
- chelmzy 5y ago
  A few crews have started asking for Monero.
- px43 5y ago
  Criminals will keep doing what works until it stops working. There are botnets that still do command and control over IRC.
- kim0 5y ago
  Most dark markets are indeed shifting towards Monero
- tootahe45 5y ago
  - Low liquidity on exchanges for privacy coins, meaning if you order 5m Monero it drastically increases the price - FSPs may question and refuse to facilitate a Monero purchase due to its niche usage - Major exchanges don't list XMR and you want as few hoops as possible to allow the victim to pay, can easily just switch your btc for XMR later, that's fairly simple on a decentralized exchange or a shady offshore one.
Pmop 5y ago
And the cryptocurrency problem is a central banking problem. Therefore, we should eliminate central banks.
deleted 5y ago
[deleted]
blhack 5y ago
I think that what you're seeing is HNers, and techies in general not really understanding that there is a world that exists well outside of their bubble of technology. Bitcoin did not create the concept of ransom. It didn't even create the concept of ransom as a business model for organized crime. See for instance our neighbor to the south: https://www.vox.com/2018/5/11/17276638/mexico-kidnappings-crime-cartels-drug-trade https://www.vox.com/2018/5/11/17276638/mexico-kidnappings-cr... This is such a common thing, that it has been the central plot of several hollywood movies. There are even insurance policies that you can get for it: https://www.mexipass.com/mexico-commercial-insurance/specialty-insurance/kidnap-extorsion-insurance https://www.mexipass.com/mexico-commercial-insurance/special... This is also common in the shipping industry: https://www.reuters.com/article/somalia-piracy/somali-pirates-say-release-syria-ship-after-ransom-idUSLDE74O1JS20110526 https://www.reuters.com/article/somalia-piracy/somali-pirate... And that type of ransoming has had hollywood movies made about it. And again that type of ransoming is common enough to have its own insurance: https://www.marineinsight.com/marine-piracy-marine/marine-insurance-for-piracy-attacks-necessities-and-benefits/ https://www.marineinsight.com/marine-piracy-marine/marine-in... Should we ban shipping? Or ban the internet? Probably not.
- mcphage 5y ago
  > Should we ban shipping? Shipping is pretty useful, though. What are the other major uses for Bitcoin?
  - Mc_Big_G 5y ago
    Ask someone in a country whose currency has been debased.
    - thehappypm 5y ago
      Those people end up hoarding stable currencies like USD today, how is BTC any better?
  - Dah00n 5y ago
    In the long run? Maybe destroying the petro dollar. One can dream.
spoonjim 5y ago
Ransomware is a gift — people are exposing insecure systems only for a few million dollars of payout. A more nefarious actor would do more nefarious things than just collect what is at the nation-state scale a very small amount of money. More ransomware will accelerate security improvements and protect systems from CCP, Five Eyes, etc.
- px43 5y ago
  Agreed, same for crypto miners IMO. These consequences are significantly more benign than if real criminals had gotten into the system. It's essentially a decentralized bug bounty program that every large company who connects to the internet has to opt in to.
- thehappypm 5y ago
  This argument is pretty weird: ransomware is bad, but there's a potentially worse actor out there, so ransomware is good? I'd say that's like someone robbing a bank, but saying "someone else could have robbed you for more".
  - spoonjim 5y ago
    Yes, if someone sticks up your bank for $10 then it likely benefits you in the long run since you implement security measures for when the million dollar stickup man comes by.
  - mixmastamyk 5y ago
    I'd liken it to giving your immune system a work out to better prepare for next year.
yawaworht1978 5y ago
Indeed, it is rather simple, all the founders and idealists of btc have been something like technology supremacist and do not want any government interventions infringing on their business matters. They need to pretend how this is legal and a technology achievement to obfuscate the real purpose. These are, founders getting rich, money laundering(called anonymous transactions), exchange of illegal goods( how many people pay with btc for legal things and how many use it to pay for all kinds of illegal things on the dark web?) . Someone intelligent enough to create Bitcoin is intelligent enough to know this will be used for illicit purposes. No way in hell did a borderline anarchist cypherpunk believe the general population will trust his system more than the banking system. If most governments simply outlaw it, the price will have a rapid trajectory towards zero. Bitcoin and the ecosystem are the only logic tool for ransomware transactions, there is no sugarcoating this.
- easrng 5y ago
  Bitcoin is not anonymous and should not be used for illegal purchases as it is trivial to trace. Use Monero if you care about privacy.
zlynx 5y ago
I believe the benefits of cryptocurrency outweigh problems. I like having options that can be anonymous, don't require banks, immune to government influence, and even completely outside any law. Because laws are not always moral and should be ignored and evaded. That's freedom. Having it is worth the significant amount of problems that come along with it.
- erichocean 5y ago
  > don't require banks, immune to government influence, and even completely outside any law If any of those things were actually true we wouldn’t be having this conversation. Also, since you apparently do think that they are true, why are you at all concerned about what banks or governments or laws might mean for cryptocurrency? I thought cryptocurrencies were immune?
guilhas 5y ago
Bitcoin/cryptocurrency are an amazing technology breakthrough, and they will be the future, companies and govs will not accept anything less than self auditable immutable transactions. Resistance is futile Regarding ransomeware, there is already criminal/scam wallet addresses tracking, so anyone cashing out from these addresses will eventually have to explain it If it wasn't for payment it would be to destroy competition or disrupt enemy country infrastructure Hard cash has also been paying criminals since ever and we still use it. If anything Bitcoin is a step up, due to being more traceable

111 points by robseed 5y ago

I understand that this was flagged because there have been many, many articles on the connection between ransomware and bitcoin. However this article is not duplicative. It adds the history of exactly how Viagra spammers got shut down, from the perspective of one of the researchers who did it. And the technique by which that happened is a technique that can shut down bitcoin as well. It is one thing to say, "We have to get rid of cryptocurrency! We're serious!" It is quite another to say, "Here is the method by which a similar past problem was solved." And lay out something that could actually kill the utility of cryptocurrency today. Namely shut down all bank accounts that are willing to exchange large amounts of cash for cryptocurrency. Just as we shut down all bank accounts that were receiving affiliate payments for Viagra spam. So yes, it is possible to do this. We know how to do this. The question is whether the dangers of ransomware are such that we should do this. Cryptocurrencies have legitimate uses. For example they enable a variety of kinds of smart contracts, which NFTs are but one example of. However ransomware is a big and growing problem. What happens when a ransomware attack gone bad winds up killing patients in a hospital? Crashes airplanes? Cuts off people's ability to access credit cards or banks? If we keep seeing random services in a complex world get shut down by ransomware, it is just a question of time until the wrong service gets shut down with disastrous consequences. So far we have had minor inconveniences. But how will people feel after something bigger goes wrong?

arberx 5y ago

"This means that cryptocurrencies are the only tool left for ransomware purveyors. So, if governments take meaningful action against Bitcoin and other cryptocurrencies, they should be able to disrupt this new ransomware plague and then eradicate it, as was seen with the spam Viagra industry." This is the totally incorrect approach. Imagine banning Polaroids because they led to an explosive growth in underage pornography. These exploits are happening not because of crypto but because of insecure systems that public, money making companies haven't invested in making secure.

hannasanarion 5y ago
The difference is that polaroids are useful for legitimate purposes. Every conversation I've ever had with a crypto purveyor, even as a person who has worked for crypto companies before, always comes down to "crypto is a good thing because it helps people commit financial crimes". There are no other benefits.
okareaman 5y ago
While I mostly agree with you about cryptocurrencies, the idea that companies don't invest in security is a lazy argument. It's not that simple. Companies can't secure themselves against bugs in software that no one knows about (zero days) no matter how much they invest.
- TingPing 5y ago
  They can audit the projects they use. It will never be perfect but most do nothing.
- matoro 5y ago
  While this is true, the overwhelming majority of these incidents do not use or require zero-days. The attack vector is nearly always basic phishing/social engineering, or wildly misconfigured/unpatched systems exposed to the internet. Implementing a bare-bones security program, or giving an existing security program the tools & authority to enforce policies, would cut down on ransomware incidents by a factor of 5-10, easily, without touching cryptocurrency in the slightest.

SavantIdiot 5y ago

I'd like to hear how cryptocurrency advocates address this without deploying a fallacy. Cryptocurrency makes ransomware possible, without the former, the latter cannot thrive. The defenses I usually hear come in the form of "current banking facilitates bad stuff, too," which is a fact, but doesn't absolve cryptocurrencies central role in ransomware. As the article states, there is simply no way to pay a ransom without cryptocurrency. Maybe they could do b2b or cash, but that would be sooooo bold (but not impossible?) EDIT: See link from user 'px43' below about the history of ransomware. Good read. Predates cryptocurrency, but I think banking technology would make most payment strategies of the past impossible, like the original article argues (e.g., PO Box in Panama is quoted as a 1989 payment plan, but GP article explains that is harder due to extradition of data and logs).

J5892 5y ago
The answer is that sometimes progress comes with a cost. Whether or not you consider cryptocurrencies "progress" is irrelevant, because it's an emerging technology that exists whether you (or I) like it or not. The cold, hard, unavoidable truth is this: Ransomware may be a Bitcoin problem, and it may not be. Either way, tough shit.
- verdverm 5y ago
  How does this compare to banning ICE vehicles? They are widely adopted and useful, yet their secondary harms warrant laws to be written.
- emodendroket 5y ago
  > Whether or not you consider cryptocurrencies "progress" is irrelevant I mean not really. If we were to decide, as a country, that it was bad, we could take actions to stop its proliferation. The dollar-BTC transition points are chokepoints we could easily target to get started.
  - devonbleak 5y ago
    Money laundering is also illegal and it's still prolific. Buying weed is also illegal and it's still prolific. Banning things like this just turns them into another laundering opportunity - where there's money to be made there's a way.

alecst 5y ago

Is it possible to ban cryptocurrency traffic in general? How would that even work?

verdverm 5y ago
You ban it at the point of interaction with the existing financial system. You don't have to ban or block the technology. A gov't can (has) made it illegal to mine or hold them as well. Most people won't and the value will evaporate if there is no market
mediaman 5y ago
You can make it illegal to transact crypto. That would devastate the price and ruin it as a currency. The network would still exist, but it'd be useless as a medium for criminal payments due to the low value.
- J5892 5y ago
  Bitcoin was wildly popular on darknet markets even when it was worth less than $10. It's still tied to a dollar value, so it can be used for payments without issue.
  - endisneigh 5y ago
    When Bitcoin was worth less than $10 how difficult was it to change your bitcoin into cash?
    - Workaccount2 5y ago
      Way back in the early days before exchanges, you literally bought and sold them on forums using bootleg paypal ripoffs (since paypal didn't recognize virtual money = buyers could refund) I put off my 20,000 BTC purchase because it was so sketchy.
- fighterpilot 5y ago
  Low value won't change its criminal utility. A criminal looking for a $50k ransomware payment doesn't care if the market cap is $50M or $50B. Outlawing it will make a difference though since it'll make it less likely that victims will pay, meaning the endeavor has a lower success rate.

cgb223 5y ago

Never understood why ransomware didn’t use more anonymous crypto currencies like Monero or ZCash. Doesn’t that better protect the scammers from law enforcement?

smaryjerry 5y ago
I thought you can easily wash the money by converting it through an anonymous cryptocurrency and then out again anyways.
- verdverm 5y ago
  The networks don't interoperate, so you need a "trusted" party to provide this service.
  - lozaning 5y ago
    An atomic exchange fulfills this requirement, assuming your capable of auditing the code that runs the swap smart contract.
chelmzy 5y ago
A few crews have started asking for Monero.
px43 5y ago
Criminals will keep doing what works until it stops working. There are botnets that still do command and control over IRC.
kim0 5y ago
Most dark markets are indeed shifting towards Monero
tootahe45 5y ago
- Low liquidity on exchanges for privacy coins, meaning if you order 5m Monero it drastically increases the price - FSPs may question and refuse to facilitate a Monero purchase due to its niche usage - Major exchanges don't list XMR and you want as few hoops as possible to allow the victim to pay, can easily just switch your btc for XMR later, that's fairly simple on a decentralized exchange or a shady offshore one.

Pmop 5y ago

And the cryptocurrency problem is a central banking problem. Therefore, we should eliminate central banks.

deleted 5y ago

[deleted]

blhack 5y ago

I think that what you're seeing is HNers, and techies in general not really understanding that there is a world that exists well outside of their bubble of technology. Bitcoin did not create the concept of ransom. It didn't even create the concept of ransom as a business model for organized crime. See for instance our neighbor to the south: https://www.vox.com/2018/5/11/17276638/mexico-kidnappings-crime-cartels-drug-trade https://www.vox.com/2018/5/11/17276638/mexico-kidnappings-cr... This is such a common thing, that it has been the central plot of several hollywood movies. There are even insurance policies that you can get for it: https://www.mexipass.com/mexico-commercial-insurance/specialty-insurance/kidnap-extorsion-insurance https://www.mexipass.com/mexico-commercial-insurance/special... This is also common in the shipping industry: https://www.reuters.com/article/somalia-piracy/somali-pirates-say-release-syria-ship-after-ransom-idUSLDE74O1JS20110526 https://www.reuters.com/article/somalia-piracy/somali-pirate... And that type of ransoming has had hollywood movies made about it. And again that type of ransoming is common enough to have its own insurance: https://www.marineinsight.com/marine-piracy-marine/marine-insurance-for-piracy-attacks-necessities-and-benefits/ https://www.marineinsight.com/marine-piracy-marine/marine-in... Should we ban shipping? Or ban the internet? Probably not.

mcphage 5y ago
> Should we ban shipping? Shipping is pretty useful, though. What are the other major uses for Bitcoin?
- Mc_Big_G 5y ago
  Ask someone in a country whose currency has been debased.
  - thehappypm 5y ago
    Those people end up hoarding stable currencies like USD today, how is BTC any better?
- Dah00n 5y ago
  In the long run? Maybe destroying the petro dollar. One can dream.

spoonjim 5y ago

Ransomware is a gift — people are exposing insecure systems only for a few million dollars of payout. A more nefarious actor would do more nefarious things than just collect what is at the nation-state scale a very small amount of money. More ransomware will accelerate security improvements and protect systems from CCP, Five Eyes, etc.

px43 5y ago
Agreed, same for crypto miners IMO. These consequences are significantly more benign than if real criminals had gotten into the system. It's essentially a decentralized bug bounty program that every large company who connects to the internet has to opt in to.
thehappypm 5y ago
This argument is pretty weird: ransomware is bad, but there's a potentially worse actor out there, so ransomware is good? I'd say that's like someone robbing a bank, but saying "someone else could have robbed you for more".
- spoonjim 5y ago
  Yes, if someone sticks up your bank for $10 then it likely benefits you in the long run since you implement security measures for when the million dollar stickup man comes by.
- mixmastamyk 5y ago
  I'd liken it to giving your immune system a work out to better prepare for next year.

yawaworht1978 5y ago

Indeed, it is rather simple, all the founders and idealists of btc have been something like technology supremacist and do not want any government interventions infringing on their business matters. They need to pretend how this is legal and a technology achievement to obfuscate the real purpose. These are, founders getting rich, money laundering(called anonymous transactions), exchange of illegal goods( how many people pay with btc for legal things and how many use it to pay for all kinds of illegal things on the dark web?) . Someone intelligent enough to create Bitcoin is intelligent enough to know this will be used for illicit purposes. No way in hell did a borderline anarchist cypherpunk believe the general population will trust his system more than the banking system. If most governments simply outlaw it, the price will have a rapid trajectory towards zero. Bitcoin and the ecosystem are the only logic tool for ransomware transactions, there is no sugarcoating this.

easrng 5y ago
Bitcoin is not anonymous and should not be used for illegal purchases as it is trivial to trace. Use Monero if you care about privacy.

zlynx 5y ago

I believe the benefits of cryptocurrency outweigh problems. I like having options that can be anonymous, don't require banks, immune to government influence, and even completely outside any law. Because laws are not always moral and should be ignored and evaded. That's freedom. Having it is worth the significant amount of problems that come along with it.

erichocean 5y ago
> don't require banks, immune to government influence, and even completely outside any law If any of those things were actually true we wouldn’t be having this conversation. Also, since you apparently do think that they are true, why are you at all concerned about what banks or governments or laws might mean for cryptocurrency? I thought cryptocurrencies were immune?

guilhas 5y ago

Bitcoin/cryptocurrency are an amazing technology breakthrough, and they will be the future, companies and govs will not accept anything less than self auditable immutable transactions. Resistance is futile Regarding ransomeware, there is already criminal/scam wallet addresses tracking, so anyone cashing out from these addresses will eventually have to explain it If it wasn't for payment it would be to destroy competition or disrupt enemy country infrastructure Hard cash has also been paying criminals since ever and we still use it. If anything Bitcoin is a step up, due to being more traceable