4 ms·

Netsec Twitter's theory is that the attacker(s) had a VPS operating in the US that the FBI was able to access and which contained the key to the wallet where th

Netsec Twitter's theory is that the attacker(s) had a VPS operating in the US that the FBI was able to access and which contained the key to the wallet where the final payment ended up.

TaupeRanger 5y ago
Really? That seems like something fairly obvious to attempt to prevent from an attacker's viewpoint.
hammock 5y ago
How? A keylogger? Cache somewhere?
walrus01 5y ago
I am by far no ransomware expert, but it really seems like amateur hour if they were running a Linux based Bitcoin full node using the mainline CLI daemon and client, with a wallet, on some hosting company geographically within the United States. Why would it need to be in the US?
- partyboy 5y ago
  Don't underestimate the stupidity/incompetence of these ransomware devs. Many cybercriminals have been caught for unbelievably dumb reasons.
- staticassertion 5y ago
  I only know a few criminal hackers, but within that sample their skillset is really niche. They know what they know well, but otherwise they're just trying to solve problems like any engineer. Kinda like data scientists - they can be masters with a couple of libraries and concepts, but if you have a data science team you also are more or less guaranteed to have a jupyter notebook open to the world, or something along those lines.
gruez 5y ago
So many questions. Why are they running a bitcoin node on a vps? do they need to make automated payments or something? it's very easy to run a bitcoin node locally, or even airgap the signing keys.
vmception 5y ago
The FBI doesn't need the VPS to be in the United States for that The FBI specifically has had expanded Congressional authority for like 10 years to operate extraterritorially on cyber matters FBI agents will show up physically in any country and request cooperation from local municipal police (maybe) to seize electronic property as well as affect arrests in a way compliant with both jurisdictions. Given that private key crypto seizure is consequence free and irrevocable, if the FBI had access to the memory at a foreign data center they could have just taken it without worrying about local procedural nuances. Using crypto the proper way already shield against this, because you have to assume that you can't trust your own security or the data center operators, let alone the state. The server should only have the Master Public Key[1] for giving a one-time use address and rotating down the index in one of the address trees immediately after any input is received (rotate to a new account upon receipt of funds, new accounts are from an infinite tree of arrays at each node). The mnemonic for the master public key would have been generated offline and never on any device. Moving the funds, whenever one feels like it, can be signed offline and physically handed to a node that will append the signed transaction to the blockchain. [1]Bitcoin Improvement Protocols - BIP 44 (2014), BIP 39 (2013), BIP 32 (2012) but anyway I'm leaning towards it being a private key on Coinbase that they got a warrant to check for, and it was correct, and they seized those assets
- justAnIdea 5y ago
  I want to see hoe "FBI agents will show up" in Russia. Or China. I giggled.
- Scoundreller 5y ago
  The legal requirements to search a US-hosted VPS might be higher than an extraterritorial one. US servers have rights, and those largely end once they're off US soil. That's why there's any warrant at all.
TZubiri 5y ago
The connections need to pass through the US just once in order to give the US a chance to attack it. Since they created the internet, they have field advantage. It's almost impossible not to use a US based provider, it goes as deep as ipv4 distribution.
- dragonwriter 5y ago
  > The connections need to pass through the US just once in order to give the US a chance to attack it. Less than once if the US were, purely hypothetically, to have a well-funded foreign sigint operation that might cooperate with domestic law enforcement on priority issues.
  - TZubiri 5y ago
    True, but it would be far less common I reckon.

Netsec Twitter's theory is that the attacker(s) had a VPS operating in the US that the FBI was able to access and which contained the key to the wallet where the final payment ended up.

TaupeRanger 5y ago

Really? That seems like something fairly obvious to attempt to prevent from an attacker's viewpoint.

hammock 5y ago

How? A keylogger? Cache somewhere?

walrus01 5y ago

I am by far no ransomware expert, but it really seems like amateur hour if they were running a Linux based Bitcoin full node using the mainline CLI daemon and client, with a wallet, on some hosting company geographically within the United States. Why would it need to be in the US?

partyboy 5y ago
Don't underestimate the stupidity/incompetence of these ransomware devs. Many cybercriminals have been caught for unbelievably dumb reasons.
staticassertion 5y ago
I only know a few criminal hackers, but within that sample their skillset is really niche. They know what they know well, but otherwise they're just trying to solve problems like any engineer. Kinda like data scientists - they can be masters with a couple of libraries and concepts, but if you have a data science team you also are more or less guaranteed to have a jupyter notebook open to the world, or something along those lines.

gruez 5y ago

So many questions. Why are they running a bitcoin node on a vps? do they need to make automated payments or something? it's very easy to run a bitcoin node locally, or even airgap the signing keys.

vmception 5y ago

The FBI doesn't need the VPS to be in the United States for that The FBI specifically has had expanded Congressional authority for like 10 years to operate extraterritorially on cyber matters FBI agents will show up physically in any country and request cooperation from local municipal police (maybe) to seize electronic property as well as affect arrests in a way compliant with both jurisdictions. Given that private key crypto seizure is consequence free and irrevocable, if the FBI had access to the memory at a foreign data center they could have just taken it without worrying about local procedural nuances. Using crypto the proper way already shield against this, because you have to assume that you can't trust your own security or the data center operators, let alone the state. The server should only have the Master Public Key[1] for giving a one-time use address and rotating down the index in one of the address trees immediately after any input is received (rotate to a new account upon receipt of funds, new accounts are from an infinite tree of arrays at each node). The mnemonic for the master public key would have been generated offline and never on any device. Moving the funds, whenever one feels like it, can be signed offline and physically handed to a node that will append the signed transaction to the blockchain. [1]Bitcoin Improvement Protocols - BIP 44 (2014), BIP 39 (2013), BIP 32 (2012) but anyway I'm leaning towards it being a private key on Coinbase that they got a warrant to check for, and it was correct, and they seized those assets

justAnIdea 5y ago
I want to see hoe "FBI agents will show up" in Russia. Or China. I giggled.
Scoundreller 5y ago
The legal requirements to search a US-hosted VPS might be higher than an extraterritorial one. US servers have rights, and those largely end once they're off US soil. That's why there's any warrant at all.

TZubiri 5y ago

The connections need to pass through the US just once in order to give the US a chance to attack it. Since they created the internet, they have field advantage. It's almost impossible not to use a US based provider, it goes as deep as ipv4 distribution.

dragonwriter 5y ago
> The connections need to pass through the US just once in order to give the US a chance to attack it. Less than once if the US were, purely hypothetically, to have a well-funded foreign sigint operation that might cooperate with domestic law enforcement on priority issues.
- TZubiri 5y ago
  True, but it would be far less common I reckon.