6 ms·

Cybercrime REvil gang asks for $70M to decrypt systems locked in Kaseya attack

32 points by spenvo 5y ago

stevespang 5y ago
The straw that broke that camel's back ? It appears that Western Gov't will unite on this one and through proxies send out covert assassination teams to seek out and eliminate all parties involved in this REvil gang. Israel does similar with Iranian nuke scientists in Iran. Mercenaries can be had a lot cheaper than $70 million - - guaranteed. REvil just put a price on their heads.
nosmokewhereiam 5y ago
2016: https://www.aspeninstitute.org/wp-content/uploads/2016/05/Cyber_Financial_Wars.pdf https://www.aspeninstitute.org/wp-content/uploads/2016/05/Cy... 2018: Morgan doctine "cyber privateering" 2021: Geek Squad offers MSP?
Black101 5y ago
finally someone asks for a proper ransom
- zimpenfish 5y ago
  Technically they're asking for a $45bn ransom if it's $45k per system and their claim of 1M infected systems is correct. $70m is just the "buy it now" price.
SheinhardtWigCo 5y ago
It's going to get interesting when someone is able to construct a smart contract that is guaranteed to release the decryption key once enough money has been paid in.
- DangitBobby 5y ago
  What guarantees that the released key is actually the decryption key?
  - aaron695 5y ago
    This part is solvable. They encrypt the data using 100,000 keys in 100,000 parts. You pay 1/100,000 the ransom and pick a key. You test. You get a random 1/100,000 of your data back. Repeat. There would be better ways I'm sure.
- dandanua 5y ago
  That's meaningless, you can just simulate the execution of a contract locally and get the key without spending anything. The power of smart contracts is very limited. The hype around them is based on a lot of lie, from the people that are not very different from those criminal hackers.
  - Kbelicius 5y ago
    > The power of smart contracts is very limited. The hype around them is based on a lot of lie, from the people that are not very different from those criminal hackers. Can you recommend any further readin on this?
    - dandanua 5y ago
      In essence, a smart contract is just a server script that controls your wallet. It's public, i.e. the code is visible to everyone and you can't change it after publishing to the blockchain. The execution of this script also has some memory state on the blockchain, which is also public and controlled only by the script. That's all. Yes, you can use it to write crypto-kitties or some fair casinos (although it's very hard, since you have to implement fair unpredictable randomness). You can use your imagination to write some other interesting stuff. But you can't rebuild the entire financial system based on that. Here I commented about some specific problems https://news.ycombinator.com/item?id=27651377 https://news.ycombinator.com/item?id=27651377
moneywoes 5y ago
With the scale of the attack, could it be cheaper to pay this than recover? What if they get the money and don’t provide the keys?
- arcticbull 5y ago
  They're building a brand. If they don't release the keys they won't get paid next time they hack someone. My understanding is ransomware groups have decent customer service too - some even have numbers you can call for help. Better than the majority of tech companies ;) There's one way to end this for US businesses: criminalize paying ransomware ransoms, and end the ability to convert fiat to crypto. Kill the fiat gateways, kill the scammers.
  - capableweb 5y ago
    > There's one way to end this for US businesses: criminalize paying ransomware ransoms, and end the ability to convert fiat to crypto. Would be enough with just the first, and the second wouldn't even do anything, I don't think ransomware people are interested in converting fiat to cryptocurrencies, they are interested in the reverse. But criminalizing would A) legitimize cryptocurrency and probably B) build more hype around it. Use existing laws and tools for stopping existing breakage of those laws, makes sense. Come up with new bans that affect more than the action you want to affect, not much sense.
    - arcticbull 5y ago
      Build all the hype you want around it, the price would pancake if the only way to buy was via localbitcoins, and that's really the only thing most people care about.
  - axiosgunnar 5y ago
    Then we should destroy their brand. Fake a few high profile ransomware attacks in their name. Make the companies complain loudly that they „paid“ you but you didn't provide the keys and they had to recover the data manually. What are they gonna do, sue you? :-)
noamsky 5y ago
Microsoft Windows strikes again :]
Yuioup 5y ago
I think we need to talk about Bitcoin. How much longer do we need to put up with it being the enabler of serious and dangerous cyber crime? Add to that the serious damage it is causing to the environment (I don't want to hear about the 'green energy' nonsense, it's not true and you know it). It's time to eradicate bitcoin.
- ryanlol 5y ago
  This crime would work with cash or wire transfers. Eradicating cryptocurrency would achieve nothing at this point. These same gangs have extensive infrastructure for stealing millions from US bank accounts, BEC actors are still making more money than ransomware crowd. If a company really wants to pay, they won’t have a problem bringing suitcases full of cash on a private jet to russia. Especially since most of these payments are not made directly by the victims, but third parties who earn their living by facilitating these payments.
  - MikeDelta 5y ago
    It is possible, but it is much much harder to make 70 mio USD disappear through the regular financial system. It is much easier with BTC. It is hard to get away with suitcases of cash without getting arrested.
    - ryanlol 5y ago
      > It is hard to get away with suitcases of cash without getting arrested. It is not. The suitcases just need to be delivered in a friendly country such as Russia. Many of the most prolific ransomware criminals have been identified, but they simply live beyond the reach of Western law enforcement. > It is possible, but it is much much harder to make 70 mio USD disappear through the regular financial system. BEC gangs and even regular craigslist scammers manage to do this every day. There’s absurdly extensive infrastructure in the US and abroad to facilitate this.
  - ASalazarMX 5y ago
    > If a company really wants to pay, they won’t have a problem bringing suitcases full of cash on a private jet to russia Gentlemen, get your ransoms ready! the Russian Ransomware Jet arrives next Sunday! We used to fly a jet per ransom, but it became so unprofitable we pool them now.
Kamren 5y ago
Hey thanks a lot.. https://www.mybalancenow.kim/ https://www.mybalancenow.kim/
ukoki 5y ago
Someone needs to start a ransomware operation were decryption keys are never released even after the ransom is paid. This will poison the well of ransomware and hopefully make it untenable as a business as no victim could reasonably trust their ransoms to buy anything. Funds could be donated to charity, or returned to the victims after - say - five years.
- waste_monk 5y ago
  Seems like malware with extra steps. Good idea if you want to save on rent (because you'll probably end up in prison), but not really anything else to recommend it, and I doubt the authorities would be convinced you're doing it for the greater good. Besides which, there are plenty of "legitimate" ransomware businesses who would gladly have your legs broken or worse if you threatened their business model. Just because it's digital doesn't mean it's not serious organised crime. Please leave this sort of thing to law enforcement professionals.
- coolspot 5y ago
  Well, that’s basically destroying someone’s data with extra steps, charity won’t make it less evil. Ransomware operators likely can prove they have keys by decrypting random file/block selected by the victim.
  - typon 5y ago
    Or you can work with the victim to secretly provide the decryption keys, completely hidden from media coverage.
- ASalazarMX 5y ago
  Donate 10,000 USD to UNICEF if you want to recover your data.
bellyfullofbac 5y ago
News websites with URLs and names that look like they come out of an "SEO words" bin make me wary. What is "The Record" (By Recorded Future)? Is it a legit news organization? Edit: Wikipedia says: "Recorded Future is a privately held cybersecurity company founded in 2009 with headquarters in Somerville, Massachusetts. The company specializes in the collection, processing, analysis, and dissemination of threat intelligence." OK, a company that's been around 12 years is I guess legitimate.
aaron695 5y ago
> We will publish publicly decryptor that decrypts files of all victims, so everyone will be able to recover from attack in less than an hour. It is possible to use a unique key for each client and one key that decrypts them all [1] I wonder if they did, or if they made a mistake and only used one key. They would have to be more professional than that I guess. [1] https://stackoverflow.com/questions/597188/encryption-decryption-with-multiple-keys https://stackoverflow.com/questions/597188/encryption-decryp... If they used this implementation then each clients data has a unique symmetric key encrypting it and attached to their data is that symmetric key encrypted in multiple instances using different keys. One key Revil uses everywhere and another unique key for each client. So Revil can hand over a global key or personal key to recover the original symmetric key which is then used to decrypt the data.
- majewsky 5y ago
  > They would have to be more professional than that I guess. There are news all the time of big companies making rookie mistakes of that magnitude. I don't see why it should be different for big companies of the organized-crime variant.

32 points by spenvo 5y ago

The straw that broke that camel's back ? It appears that Western Gov't will unite on this one and through proxies send out covert assassination teams to seek out and eliminate all parties involved in this REvil gang. Israel does similar with Iranian nuke scientists in Iran. Mercenaries can be had a lot cheaper than $70 million - - guaranteed. REvil just put a price on their heads.

nosmokewhereiam 5y ago

2016: https://www.aspeninstitute.org/wp-content/uploads/2016/05/Cyber_Financial_Wars.pdf https://www.aspeninstitute.org/wp-content/uploads/2016/05/Cy... 2018: Morgan doctine "cyber privateering" 2021: Geek Squad offers MSP?

Black101 5y ago

finally someone asks for a proper ransom

zimpenfish 5y ago
Technically they're asking for a $45bn ransom if it's $45k per system and their claim of 1M infected systems is correct. $70m is just the "buy it now" price.

SheinhardtWigCo 5y ago

It's going to get interesting when someone is able to construct a smart contract that is guaranteed to release the decryption key once enough money has been paid in.

DangitBobby 5y ago
What guarantees that the released key is actually the decryption key?
- aaron695 5y ago
  This part is solvable. They encrypt the data using 100,000 keys in 100,000 parts. You pay 1/100,000 the ransom and pick a key. You test. You get a random 1/100,000 of your data back. Repeat. There would be better ways I'm sure.
dandanua 5y ago
That's meaningless, you can just simulate the execution of a contract locally and get the key without spending anything. The power of smart contracts is very limited. The hype around them is based on a lot of lie, from the people that are not very different from those criminal hackers.
- Kbelicius 5y ago
  > The power of smart contracts is very limited. The hype around them is based on a lot of lie, from the people that are not very different from those criminal hackers. Can you recommend any further readin on this?
  - dandanua 5y ago
    In essence, a smart contract is just a server script that controls your wallet. It's public, i.e. the code is visible to everyone and you can't change it after publishing to the blockchain. The execution of this script also has some memory state on the blockchain, which is also public and controlled only by the script. That's all. Yes, you can use it to write crypto-kitties or some fair casinos (although it's very hard, since you have to implement fair unpredictable randomness). You can use your imagination to write some other interesting stuff. But you can't rebuild the entire financial system based on that. Here I commented about some specific problems https://news.ycombinator.com/item?id=27651377 https://news.ycombinator.com/item?id=27651377

moneywoes 5y ago

With the scale of the attack, could it be cheaper to pay this than recover? What if they get the money and don’t provide the keys?

arcticbull 5y ago
They're building a brand. If they don't release the keys they won't get paid next time they hack someone. My understanding is ransomware groups have decent customer service too - some even have numbers you can call for help. Better than the majority of tech companies ;) There's one way to end this for US businesses: criminalize paying ransomware ransoms, and end the ability to convert fiat to crypto. Kill the fiat gateways, kill the scammers.
- capableweb 5y ago
  > There's one way to end this for US businesses: criminalize paying ransomware ransoms, and end the ability to convert fiat to crypto. Would be enough with just the first, and the second wouldn't even do anything, I don't think ransomware people are interested in converting fiat to cryptocurrencies, they are interested in the reverse. But criminalizing would A) legitimize cryptocurrency and probably B) build more hype around it. Use existing laws and tools for stopping existing breakage of those laws, makes sense. Come up with new bans that affect more than the action you want to affect, not much sense.
  - arcticbull 5y ago
    Build all the hype you want around it, the price would pancake if the only way to buy was via localbitcoins, and that's really the only thing most people care about.
- axiosgunnar 5y ago
  Then we should destroy their brand. Fake a few high profile ransomware attacks in their name. Make the companies complain loudly that they „paid“ you but you didn't provide the keys and they had to recover the data manually. What are they gonna do, sue you? :-)

noamsky 5y ago

Microsoft Windows strikes again :]

Yuioup 5y ago

I think we need to talk about Bitcoin. How much longer do we need to put up with it being the enabler of serious and dangerous cyber crime? Add to that the serious damage it is causing to the environment (I don't want to hear about the 'green energy' nonsense, it's not true and you know it). It's time to eradicate bitcoin.

ryanlol 5y ago
This crime would work with cash or wire transfers. Eradicating cryptocurrency would achieve nothing at this point. These same gangs have extensive infrastructure for stealing millions from US bank accounts, BEC actors are still making more money than ransomware crowd. If a company really wants to pay, they won’t have a problem bringing suitcases full of cash on a private jet to russia. Especially since most of these payments are not made directly by the victims, but third parties who earn their living by facilitating these payments.
- MikeDelta 5y ago
  It is possible, but it is much much harder to make 70 mio USD disappear through the regular financial system. It is much easier with BTC. It is hard to get away with suitcases of cash without getting arrested.
  - ryanlol 5y ago
    > It is hard to get away with suitcases of cash without getting arrested. It is not. The suitcases just need to be delivered in a friendly country such as Russia. Many of the most prolific ransomware criminals have been identified, but they simply live beyond the reach of Western law enforcement. > It is possible, but it is much much harder to make 70 mio USD disappear through the regular financial system. BEC gangs and even regular craigslist scammers manage to do this every day. There’s absurdly extensive infrastructure in the US and abroad to facilitate this.
- ASalazarMX 5y ago
  > If a company really wants to pay, they won’t have a problem bringing suitcases full of cash on a private jet to russia Gentlemen, get your ransoms ready! the Russian Ransomware Jet arrives next Sunday! We used to fly a jet per ransom, but it became so unprofitable we pool them now.

Kamren 5y ago

Hey thanks a lot.. https://www.mybalancenow.kim/ https://www.mybalancenow.kim/

ukoki 5y ago

Someone needs to start a ransomware operation were decryption keys are never released even after the ransom is paid. This will poison the well of ransomware and hopefully make it untenable as a business as no victim could reasonably trust their ransoms to buy anything. Funds could be donated to charity, or returned to the victims after - say - five years.

waste_monk 5y ago
Seems like malware with extra steps. Good idea if you want to save on rent (because you'll probably end up in prison), but not really anything else to recommend it, and I doubt the authorities would be convinced you're doing it for the greater good. Besides which, there are plenty of "legitimate" ransomware businesses who would gladly have your legs broken or worse if you threatened their business model. Just because it's digital doesn't mean it's not serious organised crime. Please leave this sort of thing to law enforcement professionals.
coolspot 5y ago
Well, that’s basically destroying someone’s data with extra steps, charity won’t make it less evil. Ransomware operators likely can prove they have keys by decrypting random file/block selected by the victim.
- typon 5y ago
  Or you can work with the victim to secretly provide the decryption keys, completely hidden from media coverage.
ASalazarMX 5y ago
Donate 10,000 USD to UNICEF if you want to recover your data.

bellyfullofbac 5y ago

News websites with URLs and names that look like they come out of an "SEO words" bin make me wary. What is "The Record" (By Recorded Future)? Is it a legit news organization? Edit: Wikipedia says: "Recorded Future is a privately held cybersecurity company founded in 2009 with headquarters in Somerville, Massachusetts. The company specializes in the collection, processing, analysis, and dissemination of threat intelligence." OK, a company that's been around 12 years is I guess legitimate.

aaron695 5y ago

> We will publish publicly decryptor that decrypts files of all victims, so everyone will be able to recover from attack in less than an hour. It is possible to use a unique key for each client and one key that decrypts them all [1] I wonder if they did, or if they made a mistake and only used one key. They would have to be more professional than that I guess. [1] https://stackoverflow.com/questions/597188/encryption-decryption-with-multiple-keys https://stackoverflow.com/questions/597188/encryption-decryp... If they used this implementation then each clients data has a unique symmetric key encrypting it and attached to their data is that symmetric key encrypted in multiple instances using different keys. One key Revil uses everywhere and another unique key for each client. So Revil can hand over a global key or personal key to recover the original symmetric key which is then used to decrypt the data.

majewsky 5y ago
> They would have to be more professional than that I guess. There are news all the time of big companies making rookie mistakes of that magnitude. I don't see why it should be different for big companies of the organized-crime variant.