4 ms·

There are more technical details in the linked affidavit (page 6 and 7): https://www.justice.gov/opa/press-release/file/1402056/download https://www.justice.gov

There are more technical details in the linked affidavit (page 6 and 7): https://www.justice.gov/opa/press-release/file/1402056/download https://www.justice.gov/opa/press-release/file/1402056/downl... They kept following transactions on the blockchain, but it's not clear how the private key became in the posession of the FBI.

qeternity 5y ago
The wetware is always the weakest link.
ianhawes 5y ago
Netsec Twitter's theory is that the attacker(s) had a VPS operating in the US that the FBI was able to access and which contained the key to the wallet where the final payment ended up.
- TaupeRanger 5y ago
  Really? That seems like something fairly obvious to attempt to prevent from an attacker's viewpoint.
- hammock 5y ago
  How? A keylogger? Cache somewhere?
- walrus01 5y ago
  I am by far no ransomware expert, but it really seems like amateur hour if they were running a Linux based Bitcoin full node using the mainline CLI daemon and client, with a wallet, on some hosting company geographically within the United States. Why would it need to be in the US?
  - partyboy 5y ago
    Don't underestimate the stupidity/incompetence of these ransomware devs. Many cybercriminals have been caught for unbelievably dumb reasons.
  - staticassertion 5y ago
    I only know a few criminal hackers, but within that sample their skillset is really niche. They know what they know well, but otherwise they're just trying to solve problems like any engineer. Kinda like data scientists - they can be masters with a couple of libraries and concepts, but if you have a data science team you also are more or less guaranteed to have a jupyter notebook open to the world, or something along those lines.
- gruez 5y ago
  So many questions. Why are they running a bitcoin node on a vps? do they need to make automated payments or something? it's very easy to run a bitcoin node locally, or even airgap the signing keys.
- vmception 5y ago
  The FBI doesn't need the VPS to be in the United States for that The FBI specifically has had expanded Congressional authority for like 10 years to operate extraterritorially on cyber matters FBI agents will show up physically in any country and request cooperation from local municipal police (maybe) to seize electronic property as well as affect arrests in a way compliant with both jurisdictions. Given that private key crypto seizure is consequence free and irrevocable, if the FBI had access to the memory at a foreign data center they could have just taken it without worrying about local procedural nuances. Using crypto the proper way already shield against this, because you have to assume that you can't trust your own security or the data center operators, let alone the state. The server should only have the Master Public Key[1] for giving a one-time use address and rotating down the index in one of the address trees immediately after any input is received (rotate to a new account upon receipt of funds, new accounts are from an infinite tree of arrays at each node). The mnemonic for the master public key would have been generated offline and never on any device. Moving the funds, whenever one feels like it, can be signed offline and physically handed to a node that will append the signed transaction to the blockchain. [1]Bitcoin Improvement Protocols - BIP 44 (2014), BIP 39 (2013), BIP 32 (2012) but anyway I'm leaning towards it being a private key on Coinbase that they got a warrant to check for, and it was correct, and they seized those assets
  - justAnIdea 5y ago
    I want to see hoe "FBI agents will show up" in Russia. Or China. I giggled.
  - Scoundreller 5y ago
    The legal requirements to search a US-hosted VPS might be higher than an extraterritorial one. US servers have rights, and those largely end once they're off US soil. That's why there's any warrant at all.
- TZubiri 5y ago
  The connections need to pass through the US just once in order to give the US a chance to attack it. Since they created the internet, they have field advantage. It's almost impossible not to use a US based provider, it goes as deep as ipv4 distribution.
  - dragonwriter 5y ago
    > The connections need to pass through the US just once in order to give the US a chance to attack it. Less than once if the US were, purely hypothetically, to have a well-funded foreign sigint operation that might cooperate with domestic law enforcement on priority issues.
    - TZubiri 5y ago
      True, but it would be far less common I reckon.
remarkEon 5y ago
>Based on ... I have probable cause to believe that the aforementioned property may be seized... Forgive me if this is a dumb question; I have not used a blockchain explorer for anything consequential. Isn't that wallet just the last place it ended up? So, you have chain of custody but does that prove that the owner of that wallet is the "target"?
- koheripbal 5y ago
  Nope, but the recipient is welcome to come to the US, show up at the FBI and ask for it back.
- ytpete 5y ago
  I think generally speaking, someone in possession of stolen property isn't entitled to keep that property even if they had nothing to do with the theft and had no reason to believe it was stolen. That prevents them from being guilty of a crime - but authorities can still come seize the property without compensating them at all for their loss. In a way it's similar to getting stuck with counterfeit money. You didn't do anything wrong, but no one is going to just hand you the replacement real money you "deserve" - you just got unlucky.
koheripbal 5y ago
This is why all these gangs will now switch to Monero the moment they get BTC paid.
hellbannedguy 5y ago
The Laywer did a great job explaining Bitcoin. Can anyone here (hn) add anything? It seems like steps in the investigation, or process to identifying the bad guys were left out.

qeternity 5y ago

The wetware is always the weakest link.

ianhawes 5y ago

Netsec Twitter's theory is that the attacker(s) had a VPS operating in the US that the FBI was able to access and which contained the key to the wallet where the final payment ended up.

TaupeRanger 5y ago
Really? That seems like something fairly obvious to attempt to prevent from an attacker's viewpoint.
hammock 5y ago
How? A keylogger? Cache somewhere?
walrus01 5y ago
I am by far no ransomware expert, but it really seems like amateur hour if they were running a Linux based Bitcoin full node using the mainline CLI daemon and client, with a wallet, on some hosting company geographically within the United States. Why would it need to be in the US?
- partyboy 5y ago
  Don't underestimate the stupidity/incompetence of these ransomware devs. Many cybercriminals have been caught for unbelievably dumb reasons.
- staticassertion 5y ago
  I only know a few criminal hackers, but within that sample their skillset is really niche. They know what they know well, but otherwise they're just trying to solve problems like any engineer. Kinda like data scientists - they can be masters with a couple of libraries and concepts, but if you have a data science team you also are more or less guaranteed to have a jupyter notebook open to the world, or something along those lines.
gruez 5y ago
So many questions. Why are they running a bitcoin node on a vps? do they need to make automated payments or something? it's very easy to run a bitcoin node locally, or even airgap the signing keys.
vmception 5y ago
The FBI doesn't need the VPS to be in the United States for that The FBI specifically has had expanded Congressional authority for like 10 years to operate extraterritorially on cyber matters FBI agents will show up physically in any country and request cooperation from local municipal police (maybe) to seize electronic property as well as affect arrests in a way compliant with both jurisdictions. Given that private key crypto seizure is consequence free and irrevocable, if the FBI had access to the memory at a foreign data center they could have just taken it without worrying about local procedural nuances. Using crypto the proper way already shield against this, because you have to assume that you can't trust your own security or the data center operators, let alone the state. The server should only have the Master Public Key[1] for giving a one-time use address and rotating down the index in one of the address trees immediately after any input is received (rotate to a new account upon receipt of funds, new accounts are from an infinite tree of arrays at each node). The mnemonic for the master public key would have been generated offline and never on any device. Moving the funds, whenever one feels like it, can be signed offline and physically handed to a node that will append the signed transaction to the blockchain. [1]Bitcoin Improvement Protocols - BIP 44 (2014), BIP 39 (2013), BIP 32 (2012) but anyway I'm leaning towards it being a private key on Coinbase that they got a warrant to check for, and it was correct, and they seized those assets
- justAnIdea 5y ago
  I want to see hoe "FBI agents will show up" in Russia. Or China. I giggled.
- Scoundreller 5y ago
  The legal requirements to search a US-hosted VPS might be higher than an extraterritorial one. US servers have rights, and those largely end once they're off US soil. That's why there's any warrant at all.
TZubiri 5y ago
The connections need to pass through the US just once in order to give the US a chance to attack it. Since they created the internet, they have field advantage. It's almost impossible not to use a US based provider, it goes as deep as ipv4 distribution.
- dragonwriter 5y ago
  > The connections need to pass through the US just once in order to give the US a chance to attack it. Less than once if the US were, purely hypothetically, to have a well-funded foreign sigint operation that might cooperate with domestic law enforcement on priority issues.
  - TZubiri 5y ago
    True, but it would be far less common I reckon.

remarkEon 5y ago

>Based on ... I have probable cause to believe that the aforementioned property may be seized... Forgive me if this is a dumb question; I have not used a blockchain explorer for anything consequential. Isn't that wallet just the last place it ended up? So, you have chain of custody but does that prove that the owner of that wallet is the "target"?

koheripbal 5y ago
Nope, but the recipient is welcome to come to the US, show up at the FBI and ask for it back.
ytpete 5y ago
I think generally speaking, someone in possession of stolen property isn't entitled to keep that property even if they had nothing to do with the theft and had no reason to believe it was stolen. That prevents them from being guilty of a crime - but authorities can still come seize the property without compensating them at all for their loss. In a way it's similar to getting stuck with counterfeit money. You didn't do anything wrong, but no one is going to just hand you the replacement real money you "deserve" - you just got unlucky.

koheripbal 5y ago

This is why all these gangs will now switch to Monero the moment they get BTC paid.

hellbannedguy 5y ago

The Laywer did a great job explaining Bitcoin. Can anyone here (hn) add anything? It seems like steps in the investigation, or process to identifying the bad guys were left out.