20 ms·

This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Rus

• floatingatoll 5y ago
  No, they’re not elite, they’re just script kiddies with a payout mechanism.
  • SavantIdiot 5y ago
    "Script kiddies" got their name because 20 years ago any kid could download some code and create a DDoS attack by running a pre-written script. Ransomware hacks seem a bit more sophisticated, even with today's highly modular malware. I think it is an interesting proposal: a fake attack as shown by the disparity in savvy between the attack and the payment, or a really dumb screw up. EDIT: as "koheripbal" says below, maybe their tumbler is a boob (paraphrased).
    • AJ007 5y ago
      How much sophistication does it take to attack a computer system running software that hasn’t been patched in years?
      • rhodozelia 5y ago
        ./nestea.o
      • icedchai 5y ago
        Many so called "professionals" are still running operations with 5+ year old distributions that haven't been patched in almost as many years, and servers that people are afraid to reboot. I was once contracted by a company that was literally afraid to have any employees reboot a server because they had no idea how it worked, if it would come back up, and what to do if something didn't restart. They wanted an outside guy to take the blame.
        • rm_-rf_slash 5y ago
          Would’ve been a decent opportunity to contract a job paid half up front.
          • icedchai 5y ago
            I took the job on the side. It was literally the equivalent of "set up a couple of static web servers with FTP accounts, and move everything over." It was about 8 hours of work and 100 hours of meetings.
    • majormajor 5y ago
      There's been some reporting of basically a new version of that for the modern "as a service" times, like here https://www.zdnet.com/article/darkside-the-ransomware-group-responsible-for-colonial-pipeline-cyberattack-explained/ https://www.zdnet.com/article/darkside-the-ransomware-group-... > According to FireEye, affiliates are required to pay up to 25% of ransom payments under $500,000, and 10% of any successful extortion attempts over $5 million. So the ransomware authors might not always be the people collecting the initial payments. Although according to the press release here, it was siezed from the DarkSide group itself? So it's still a bit confusing.
      • Ekaros 5y ago
        Question really becomes where did that group get the software from? It could be multiple levels of indirection such as people hired to develop the stuff aren't really connected to activities. They might just as well be contractors not so well paid...
    • vmception 5y ago
      > "Script kiddies" got their name because 20 years ago any kid could download some code and create a DDoS attack by running a pre-written script. Ransomware hacks seem a bit more sophisticated, even with today's highly modular malware. They're downloadable and leased out. This allows people to focus on choosing targets instead of the entire vertical integration and liability at each step.
• vmception 5y ago
  "Russians did it!" - the modern Bugs Bunny
• osrec 5y ago
  I was reading the article in utter confusion too. I personally think it's the authorities trying to save face, as I don't think even a computer-literate high school kid would make these mistakes.
  • kibwen 5y ago
    "Save face" for whom? It wasn't the US gov who got hacked or paid the ransom, it was the Colonial Pipeline Company.
    • shiftpgdn 5y ago
      The US Judicial system which tries to flex its "unlimited" reach.
      • qeternity 5y ago
        Do we have reason to believe they don’t have that capability? There are very few who have escaped the long arm of the DOJ.
        • russian-hacker 5y ago
          That you know of.
      • edgyquant 5y ago
        I don’t think it’s an understatement to say that their reach kind of is. If sanctioned the US government could almost certainly 51% attack any given crypto and redirect funds to whoever they want. This isn’t what happened but it’s laughable to think the US government isn’t capable of tracking down the account and seizing coins.
        • tracedddd 5y ago
          I doubt they could 51% Bitcoin with any sort of haste. Perhaps with a few year plan. Simply put it’s a procurement issue. There are limited ASICS and they are distributed among many operators, mostly foreign. There aren’t massive ASIC stockpiles in the US just waiting to be purchased. A government 51% attack would probably involve doing a private chip run.
• sneak 5y ago
  It always struck me as improbable that all these high profile (and notoriously hard/impossible to attribute) attacks on “critical infrastructure” or whatever are always instantly and authoritatively pinned (by US authorities) on groups operating in the US’s geopolitical enemies. “Russian hackers” once again, eh?
  • staticassertion 5y ago
    You find it improbable that geopolitical enemies tend to be the ones that attack us? Feels like saying "I find it weird that people I insult disproportionately punch me in the face".
    • sneak 5y ago
      I think you are assigning too much “us vs them” to the ransomware marketplace. With ransomware criminals, “us” is the attacker, and “them” is everyone with a computer who might pay. Political boundaries don’t factor in to it at all. It is by nature an anonymous attack, hence the term “ransom”. It is strange to me that almost all high-profile ransomware attacks that have been publicized in the US are claimed by the FBI to be Russian or Chinese. There are plenty of other countries with greedy criminals that know software, too.
      • staticassertion 5y ago
        When your government greenlights criminal activities against their enemies it helps a lot. Many* cyber criminals act as mercs for hire, and are in fact hired for official government operations against the US. It's simply not true that political boundaries don't factor in. They're a massive part - most obviously, consider extradition or whether the attacker's government will cooperate with the US. * I say many, but it's more like "it happens", but it feels important to point out.
        • sneak 5y ago
          It is absolutely trivial for an attacker in the US or anywhere to make their ransomware attack appear to come from Russia (to someone who doesn’t know that).
• nodesocket 5y ago
  Also completely baffled how the feds got access to the private key and why an elite Russian hacking group would store their crypto on a US based server. At the same time, the obvious tin foil hat answer of it was the feds who concocked the entire scheme also doesn't add up. If the NSA/CIA was behind it, they would be smart enough to not use a US based server / wallet. That makes the story inconsistent, and brings up the questions I am asking here. Instead, they would just use a clean wallet (preferably out of Russia). I.E. the misdirection and misinformation does not add up if it was an "inside job" by the US government.
  • bob1029 5y ago
    The implausibility of all these scenarios is making me increasingly nervous regarding the other possible ones. If SHA256 and asymmetric crypto are compromised to this extent, we have a far bigger problem to worry about.
• 2OEH8eoCRo0 5y ago
  Who says they're elite? I know that ironically many hackers have poor security practices themselves.
  • koheripbal 5y ago
    While I suspect the DOJ is leaving out critical information, it is true that these gangs are not nearly as elite as some people imagine. They just happen to be in an untouchable legal jurisdiction.
    • 71a54xd 5y ago
      It's even more ironic (and troubling) that seeming amateurs managed to shutdown an entire pipeline :) Can't wait to read this report!
  • ChuckMcM 5y ago
    I think this is accurate. If you imagine the extremely unlikely scenario where the DOJ put out a statement that anyone in the US who happened to extract money out of persons or companies in Russia would not be prosecuted or hindered by US law enforcement, what sort of people would jump in to try their hand at that. It seems to me it would certainly be an attractive idea for script kiddies to jump on to if they felt it was low/no risk.
  • ad8e 5y ago
    I encountered this myself. I was hit by a browse-and-get-owned zero day. I found out one day later from a blog post, where an anonymous person had hacked the command and control server and wiped the hacker's database in a remarkably brief time. Clearly, their skills were not on par. The responsible vulnerability was in Java applets, which I had disabled for security reasons. But Java secretly re-enabled itself after updating. I kept Java uninstalled for a long time after that.
• mortehu 5y ago
  This could have been far downstream from the hackers themselves. They might just have been monitoring the bitcoins and waiting for some to land in one of many addresses for which they have the private key. Presumably FBI is continuously scooping up whatever private keys they can.
  • vmception 5y ago
    Yeah Elliptic and Chainanalysis make all their money by convincing people that all transfers are of the same Ultimate Beneficial Owner until it hits an exchange As long as the ignorance stays high, they get government contracts
    • mnouquet 5y ago
      That's utter bs, exchanges generates unique BIP32 addresses for deposit. There isn't a master exchanges key used among all customers.
      • vmception 5y ago
        Which is not something I commented on at all Genuinely curious why you think your response was related or even mutually exclusive
        • mnouquet 5y ago
          I actually probably commented on the wrong comment :-/
• gremloni 5y ago
  They can’t be very elite if even I know the following would absolutely work. Run bitcoin through tumbler -> convert to Monero -> run through tumbler again -> convert to eth -> cash out
• lettergram 5y ago
  Indeed was just discussing the same thing. Perhaps they simply are tracking if the money goes anywhere or using this as a way to hide their incompetence? Just saying they can do something they really can’t or put a legal hold on that wallet so if any exchange receives it they get fined?
• kerng 5y ago
  Agreed, there is something that is not being told here. Maybe the US struck a deal with whoever did this to safe face or something.
• tiahura 5y ago
  “I'm supposed to believe some elite Russian hacking group keeps …” Why not. Remember Elite Russian GRU hackers identified because they all registered their cars with the DMV at the same address? https://www.bellingcat.com/news/uk-and-europe/2020/10/22/russian-vehicle-registration-leak-reveals-additional-gru-hackers/ https://www.bellingcat.com/news/uk-and-europe/2020/10/22/rus... Smart people do dumb things.
  • camjohnson26 5y ago
    If they were elite they would have asked for more than $2 million
  • Animats 5y ago
    The Mossad did something dumb like that once. Neckties are not widely worn in Israel, so the photo office that made fake passports had some neckties on hand when taking pictures. But only three different neckties. After a while, some other countries caught on.
• colechristensen 5y ago
  People overestimate criminals. The ones that get caught, especially. What would you do if you were a foreign intelligence service? Participate in attacks yourself? No! You would drop hints and supply tools sideways to sloppy groups of idiots enabling them to be destructive, maybe acquiring some funds, and keeping your hands as clean as possible. Then when it comes out that "elite russian hackers" were incompetent idiots, it makes people think the claims of your connection to the crimes are even less likely. Tricks and disinformation are the name of the game. If you actually were elite, you would hide and practice and save your actual actions for critical moments and not show your hand for a few million dollars. Or you'd go into security consulting which is a far safer, more profitable, and overall smarter thing to do.
  • chii 5y ago
    > If you actually were elite exactly. Look at stuxnet - nobody knew it was an attack until it was over!
  • snypher 5y ago
    I think it was the RSA hack where the second (and presumed more elite) team had gained access to the first group of hackers and just followed their APTs. Noone really found out about the second group when the story was reported on.
  • paulpauper 5y ago
    hacker gangs can make tens of millions dollars. No security consultant makes that much.
    • smoldesu 5y ago
      Hacker gangs also apparently lose 2.4 million dollars at the drop of a hat, which is something that no security consultant ever has to worry about.
      • DaiPlusPlus 5y ago
        > which is something that no security consultant ever has to worry about There's enough self-styled cypherpunk infosec experts that might insist on being paid only in BTC and then lose their decrypted wallet...
• dheera 5y ago
  Also, how exactly do you "seize" cryptocurrency without hard forking it?
  • icedchai 5y ago
    They send it to another wallet/account that they control. Not hard to understand.
    • dheera 5y ago
      And if they don't send? With electronically stored fiat, the feds can just ask the bank to give them the money right out of their account, and I'm sure the banks would cooperate. With paper cash they can just hold their arm while the SWAT team go on a rampage through their bedsheets for the cash. What does one do for Bitcoin, short of a hard fork?
      • kolinko 5y ago
        In crypto „seizing” means getting access to the wallet and sending funds to the one that gov’t has under it’s sole control
        • dheera 5y ago
          How do they get access to the wallet, assuming the dude won't tell them? With fiat they can do it with force, that's the difference. If the dude won't tell them they have no way to get access to it, other than the $5 wrench.
          • jimbob21 5y ago
            If the key is solely located only in the hacker's brain, yes it is out of their reach. Usually, however, if you gain access to the hacker's comp, they'll have it written down somewhere.
          • acdha 5y ago
            > If the dude won't tell them they have no way to get access to it, other than the $5 wrench. This assumes perfect opsec: the guy is unphishable, has a quick-response switch to wipe their computers when their house is raided, etc. They get a lot of people through simple gaps: bust the door down when the target is in the bathroom, grab the unlocked computer in a public setting, etc. The other big assumption is that the only copy of the key belonged to someone in the gang who is a high-value target. If it’s an exchange, they need to make an official request. Someone offering laundering services or a lower-value person in the gang, the offer is likely going to be offered a plea bargain for cooperating to get bigger fish versus a much longer sentence. Even if it is the most culpable member of the gang, the prospect of a very long prison sentence versus something shorter is going to weigh heavily — especially if you know that they’re just going to leave you in jail until you give them the key anyway.
• russian-hacker 5y ago
  Exactly. Until DOJ provides proof, this is pure FUD. Anyone competent enough to extort a foreign company out of millions is not going to attempt to cash out through an exchange.
  • brown9-2 5y ago
    Are you saying the government didn’t actually recover the money that they claim to have recovered?
    • deleted 5y ago
      [deleted]
    • Millenialboomer 5y ago
      I think, at this point, doubting anything the government claims without hard evidence proving their case is the wiser play based on pure pattern recognition.
  • duxup 5y ago
    When the FBI sells the coins won't it be pretty obvious?
• spoonjim 5y ago
  Why are they elite? Ransomware is the new smash and grab.
• deleted 5y ago
  [deleted]
• 3np 5y ago
  > I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? What is it that's so implausible? That's just one possible interpretation. I see many possibilities here. Below are some, where "The FBI" loosely refers to the bureau, collaborating agencies and their partners and contractors: * The FBI has (through active exploitation of hosts/services) gained access to a large number of BTC private keys, which they can utilize if and when they become a point of interest * The FBI has some channel to index and get access to cryptocurrency wallets/private keys from hosts running on cooperating service providers such as GCP, AWS and Azure. * The FBI continuously monitors for BTC addresses/public keys and opportunistically bruteforces them looking for weak keys, keeping a catalogue of broken ones and waiting until they become a point of interest * These coins were sent through some anonymization network/protocol/service and the wallet in question actually has no relationship to the hack at all but just belonged to some clueless user. I have already been assuming all of the above to be going on and this particular instance could be a result of either. There is also the more boring explanation that these 64 something BTC was supposedly "tumbled" but not enough, transferred to a centralized exchange and subsequently frozen. It's also important to remember that it's not a single group/entity responsible for the whole chain here. Darkside provides the software and affiliate program, and maybe some servers. The attacks themselves are performed by "partners" (who just pay for access and could be anyone anywhere). Most likely the wallet here was not under control of Darkside ("The Russan elite hacker group") themselves but some affiliate who could be anything from a "lucky" clueless script kiddie and an actual professional who made one stupid mistake along the way.
• smoldesu 5y ago
  The "elite" hackers are the ones who wrote the ransomware software. You can tell because (apparently) most of them haven't been caught yet.
• t0mbstone 5y ago
  The reason why this story doesn't make sense is because it's most likely a lie. Think about it for a second. If they wanted to discourage copycat criminals, the easiest way to do it would be to claim they seized the crypto, right? But what proof do we have that the feds actually seized anything? Is the bitcoin transaction publicly listed anywhere where we can audit what happened? And even if you see the coins were moved, how do we know it was actually the feds that moved them and not the actual criminals?
  • tacostakohashi 5y ago
    > what proof do we have that the feds actually seized anything? I'm sure the feds will sell the bitcoin in the fullness of time, like this: https://www.usmarshals.gov/assets/2020/febbitcoinauction/ https://www.usmarshals.gov/assets/2020/febbitcoinauction/
    • kristianp 5y ago
      Won't they hand them back to the pipeline owner who paid the ransom?
      • bart_spoon 5y ago
        I don’t know, I can thing of reasons not to. They want to discourage companies both from lax security standards and from paying ransoms when they get attacked. Not paying them back would provide economic incentive that even if the DOJ is working to combat hacking, they won’t be saving you from your own incompetence. Not saying that’s what they will do, just that I think it would make sense to me.
  • lordnacho 5y ago
    > And even if you see the coins were moved, how do we know it was actually the feds that moved them and not the actual criminals? If the feds falsely claimed to have done it, the criminals could embarrass them by moving the coins again.
  • jonnycomputer 5y ago
• audit 5y ago
  The Occam Razor principle [1], likely needs to be completely reversed when dealing with Instutitional Propaganda sources. Meaning that the typical interpretation of the principle that the 'most simple explanation' is probably correct -- needs to be reversed. Meaning that when reading the propaganda agencies -- the view should be, the 'simple most straightforward explanation of highly visible events -- is probably not the right explanation' In this case, you have to decide if the sources you are hearing the info from are the 'Institutional Propaganda' sources or not. With regards to bitcoin, I think its present aquired value -- is in the safety and correctness of the system -- without any human law enforcement and judicial arbitration. If the above premises are broken -- it would loose its value. [1] https://en.wikipedia.org/wiki/Occam%27s_razor https://en.wikipedia.org/wiki/Occam%27s_razor
• dragonwriter 5y ago
  > The errors present by these hackers are so comical it's simply unbelievable. True crime stories abound with comical errors (as do plenty of true not-crime stories). As it turns out, real people fuck up in comical ways all the time. > I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? No, you aren't supposed to believe either (a) that DarkSide are an elite group, or (b) any particular narrative about how the FBI got the private key. AFAICT, no one is selling the first claim, and the only people selling narratives about how the FBI got the private key are doing conspiracy-theory-level creative interpretation of documents.
• mrkramer 5y ago
  >I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host. They host their hacking tools and other software close to the victim because if you see your network infrastructure logs linking back to an IP address in Russia or China for example it would immediately rise alarm and suspicion.
• pharrington 5y ago
  Alot of professional criminals are such because they aren't competent enough to make money legally.
• himinlomax 5y ago
  Computer security is hard. That's why ransomware attacks exist. It's just as hard for ransomware attackers as for their victims. If they were good at computer security, they'd be working a legitimate job. I find your incredulity strange, it's like hearing about the Valentine's day massacre and being shocked that mobsters could be at the receiving end of a Thompson for once.
  • posix_me_less 5y ago
    > If they were good at computer security, they'd be working a legitimate job. Um, what? Did you do a survey of all people who are good at computer security? Furthermore, maybe the attackers _are_ working a legitimate job. Do we know attacker's life details?
• jonnycomputer 5y ago
  I recall seeing on HN lots of descriptions of just how hard it is to maintain strict opsec, or anonymity. Obscurity sometimes is the best security, but these clowns made themselves a big a$$ target for the FBI. Its one thing to be one among hundreds of small-time ransomware attacks, and another to be the one behind shifting the price of oil of the entire southeast US, and to be the subject of thousands of memes about Americans stockpiling gasoline in the backs of their SUVs.