6 ms·

The wild thing is that the ransomware operations are making so much money that they can afford to buy multi-million dollar zero day vulns that at one point were

The wild thing is that the ransomware operations are making so much money that they can afford to buy multi-million dollar zero day vulns that at one point were only available to nation states or fortune 500 companies. Every successful round of extortion just gives them more ammunition to purchase more of them, hire more engineers, etc. This kind of illicit capital flow totally makes a mockery of AML regulations. All the rules that were created after 9/11 are out the window - this time it's money to pay for zero days, but it's not a huge leap for this kind of illicit capital flow to end up paying for a huge terror op, paramilitary coup, etc. We'll be reading the next blue ribbon commission's retrospective findings for some horrific event in a few years and it'll be obvious what we failed at.

whatshisface 5y ago
It's already obvious where we failed. Companies that don't care about sales won't sell, companies that don't care about R&D won't stay up to date, and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure.
- mcguire 5y ago
  "...and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure..." ...but won't see any particular repercussions until they get hit with a few million dollars ransom and some short-term bad PR.
- qorrect 5y ago
  > and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure. So glad to not be at that job anymore , this is 100% the approach my previous employer took ( who had 99 out of the fortune 100 companies as customers ).
dogman144 5y ago
This is a significantly false generalization about the TTPs for rware operators. Vast majority of these attacks don't work with 0days. They work with malformed IAM policies, social engineering/phishing, and poor asset registries and cloud vis. Keseya being a 0day is an outlier in many ways.
- user-the-name 5y ago
  It is an outlier today. Do you think it will be an outlier in a year? In two years? If a zero-day can gain you millions, tens of millions, maybe a hundred million dollars? Do you think we can keep operating the way we have been up until now?
  - dogman144 5y ago
    I don't think you work in infosec?
  - willcipriano 5y ago
    > Do you think it will be an outlier in a year? In two years? I think it will remain a outlier until that becomes the easier/more economical way for them to do business. Right now there is so much low hanging fruit that I'd see no reason to invest in a bucket truck to get at the stuff further up the tree. I'd say your prediction is at least a few decades away.
- steve_g 5y ago
  I thought this vulnerability had already been reported to Kaseya (privately), and they were working on it. Does that still qualify as a zero-day?
user-the-name 5y ago
It should be pretty obvious that as long as ransomware is this profitable, we are absolutely fucked when it comes to computer security. The economical incentives are so completely and utterly skewed, there is no way for society to function. This is all because of cryptocurrencies. They are the one single factor that enables this economical fiasco. They need to be banned, now, or this will just get worse from here on out.
- xwdv 5y ago
  Banning isn’t enough. They must somehow be destroyed or rendered useless, perhaps through a mass 51% attack or something.
  - anoraca 5y ago
    Couldn't someone DDoS the major mining pools?
- dogman144 5y ago
  This is aggressively myopic. Banning a cryptocurrency is akin to banning HTTP to prevent the attacker's connection for their shell. All ccs are just a protocol which can send verifiably discrete packet w/o a central server verifying the discreteness, and with some fancy branding on the packet type. It's as if people felt very tribal about POP3 vs. IMAP, and the IMAP foundation put out branding and POP3 was a FOSS project. Protocols in that sense can't really be ever banned. It's like banning a math proof. CCs play a role, but they are not the single factor that enables rware, by any means. For instance, it's a lot harder to pop a meat processing plant or coastal pipeline if they didn't hook up IoT to anything and everything OT-related, and ICS was awful at integrating vis b/t IT and OT networks in their plants. Or, for instance, if cyber insurance companies are forbidden from paying ransom, then the economic pot is suddenly dry. And so on...
  - user-the-name 5y ago
    You don't need to ban a protocol. You're free to play around with protocols all day, nobody cares. What is absolutely crucial is to cut the link between that protocol and the financial system. And that is very, very simple. There are a few very centralised points where that happens, and those have to follow laws. They are starting to get cut off already, and these kinds of catastrophes are going to drive the effort to make that happen even quicker.
orhmeh09 5y ago
Just curious, do we have recorded cases where a paramilitary coup or terror operation happened through funds obtained by hacking? Also any evidence that post-9/11 KYC measures have prevented anything bad from happening would be interesting.
- ttyprintk 5y ago
  This is kind of a political question, and another thread got touchy about politics. But with Manafort’s pardon, we might not see Deutsch Bank’s full culpability in failing to kyc. So, if Manafort’s pardon was inevitable, then would you consider the big players in laundering to be sufficiently protected by a political movement/coup inside a major party?
mrtksn 5y ago
AML works against the small time criminals but when the sums get large they have access to much larger infrastructure and good old creative accounting. By infrastructure, I mean states. That said, every once in a while a larger fish is caught. Right now a huge topic in Turkey is about a local businessman laundering about $1B of a US Mormon sect that stole the money from the US by faking business activity and receiving subsidies. In this case, the Americans are in prison and the Turkish guy is in Austria, awaiting extradition. Shortly before things got sour, the guy had access to the highest Turkish officials and was the darling of the media. On the US side of the things, apparently the criminals were partnering with a high ranking CIA official to pull this off. Here is a video on the topic: https://youtu.be/BPZIX5oBrUc https://youtu.be/BPZIX5oBrUc It’s already out of date as more money and connections were revealed since then but if you Google the names, more juicy stuff comes out. Sezgin Baran Korkmaz is the name of the Turkish guy allegedly laundered their money, now under arrest in Austria. Erdogan scrambled to remove his photos with the guy from the internet. It has been revealed that they bought old Turkish companies that were under financial troubles and used these to move the money. Why Turkey? Because Turkey is in economic turmoil and to motivate people bring money in the country they passed a law so the state doesn’t ask the origin of the money and politicians facilitate the bureaucratic process(allegedly for a substantial commission). Pretty straightforward laundromat. Once the money is in the Turkish system, they have access to EU, USA and pretty much everywhere because according to the paperwork the money is coming from legit companies, some a century old. I bet you, Turkey is not the only rough agent here.
iseethroughbs 5y ago
> The wild thing is that the ransomware operations are making so much money that they can afford to buy multi-million dollar zero day vulns that at one point were only available to nation states or fortune 500 companies. Is it a wild thing that if you permit a safe mechanism of extortion a sprawling economy quickly develops around it, dunno.
aksss 5y ago
My favored analogy is piracy and privateering in the 17th, 18th centuries. Sure, the spoils of one attack enable the next. An end to privateering comes with powerful institutional enforcement via the suppression of movement and committed retribution (an eventual monopoly on the exercise of force). I can only imagine what the analogy looks like - it's arguably more difficult than traditional privateers operating on the open seas if the actors in this case are safe on sovereign soil. Perhaps the analogy to the open seas is the Internet itself. If the solution to privateering was denying bad actors the freedom to operate, the same applied solution on the Internet would be dramatic restriction of who can communicate on it. Problem is, the supply chain attacks in this analogy are more akin to sailing under false colors. In this case sailing under false certificates. What do you do when a pirate captures a ship of your fleet, has your flag, your signal flags, and has your latest challenge/response codes? In the age of sail, it would probably mean accepting the loss of the incident, then ruthlessly hunting down the perpetrator directly with the goal of eliminating all actors capable of such sophisticated engagements - basically reducing the talent pool to near zero. If you aren't allowed in this day and age to address the actor directly, you probably have to deny the host nation itself the freedom of movement until they commit to delivering heads on plates. What does that mean? Cutting Russia off the Internet? Is that even doable these days? You could embargo the Internet for your own country like China tries to do - sad that we're having to consider that. I struggle to imagine other half-way realistic options. Kinetic war and assassination seem imprudent/impractical, to say the least. I certainly don't think the answer is to "eliminate crypto", the equivalent to thinking "banish gold coins" in the age of sail would stop piracy. I also don't think the answer is to demand all companies "do better at security". While everyone needs to do security better, it will always be insufficient. A merchant ship in the age of sail was never expected to have the armaments of a national navy. Their solution was to convoy up and if lucky have state actors protect those convoys - a herd defense at worst. The equivalent to "convoying up" in this age would be some sort of massive crowd validation process before updates are released, slowing everything down to an impractical rate. So I struggle to see what's left other than a good offense, as much as I hate to think of what that means for the dream of the open Internet. The merchants demanded their host nation deliver a safe operating environment, at a pretty steep collective cost.
- 5y ago
_the_inflator 5y ago
This is really highly interesting. For me to visualize the problem, I came up with this here: honeypot. In this sense, Kesaya or any other Managed Service Provider is some kind of honeypot. Let 100+ companies gather and share the same problem and exploit it. This comparison did not occur to me for Microsoft and their Zero Day exploits. Because you did not attack Microsoft to spread the damage. You still have to find your victims.
Cyberthal 5y ago
I'd much rather keep FSU hackers in Southeast Asian hookers and blow than leave those vulnerabilities unpatched for Big Brother to pwn all the dissidents. We all gotta do our part.

whatshisface 5y ago

It's already obvious where we failed. Companies that don't care about sales won't sell, companies that don't care about R&D won't stay up to date, and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure.

mcguire 5y ago
"...and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure..." ...but won't see any particular repercussions until they get hit with a few million dollars ransom and some short-term bad PR.
qorrect 5y ago
> and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure. So glad to not be at that job anymore , this is 100% the approach my previous employer took ( who had 99 out of the fortune 100 companies as customers ).

dogman144 5y ago

This is a significantly false generalization about the TTPs for rware operators. Vast majority of these attacks don't work with 0days. They work with malformed IAM policies, social engineering/phishing, and poor asset registries and cloud vis. Keseya being a 0day is an outlier in many ways.

user-the-name 5y ago
It is an outlier today. Do you think it will be an outlier in a year? In two years? If a zero-day can gain you millions, tens of millions, maybe a hundred million dollars? Do you think we can keep operating the way we have been up until now?
- dogman144 5y ago
  I don't think you work in infosec?
- willcipriano 5y ago
  > Do you think it will be an outlier in a year? In two years? I think it will remain a outlier until that becomes the easier/more economical way for them to do business. Right now there is so much low hanging fruit that I'd see no reason to invest in a bucket truck to get at the stuff further up the tree. I'd say your prediction is at least a few decades away.
steve_g 5y ago
I thought this vulnerability had already been reported to Kaseya (privately), and they were working on it. Does that still qualify as a zero-day?

user-the-name 5y ago

It should be pretty obvious that as long as ransomware is this profitable, we are absolutely fucked when it comes to computer security. The economical incentives are so completely and utterly skewed, there is no way for society to function. This is all because of cryptocurrencies. They are the one single factor that enables this economical fiasco. They need to be banned, now, or this will just get worse from here on out.

xwdv 5y ago
Banning isn’t enough. They must somehow be destroyed or rendered useless, perhaps through a mass 51% attack or something.
- anoraca 5y ago
  Couldn't someone DDoS the major mining pools?
dogman144 5y ago
This is aggressively myopic. Banning a cryptocurrency is akin to banning HTTP to prevent the attacker's connection for their shell. All ccs are just a protocol which can send verifiably discrete packet w/o a central server verifying the discreteness, and with some fancy branding on the packet type. It's as if people felt very tribal about POP3 vs. IMAP, and the IMAP foundation put out branding and POP3 was a FOSS project. Protocols in that sense can't really be ever banned. It's like banning a math proof. CCs play a role, but they are not the single factor that enables rware, by any means. For instance, it's a lot harder to pop a meat processing plant or coastal pipeline if they didn't hook up IoT to anything and everything OT-related, and ICS was awful at integrating vis b/t IT and OT networks in their plants. Or, for instance, if cyber insurance companies are forbidden from paying ransom, then the economic pot is suddenly dry. And so on...
- user-the-name 5y ago
  You don't need to ban a protocol. You're free to play around with protocols all day, nobody cares. What is absolutely crucial is to cut the link between that protocol and the financial system. And that is very, very simple. There are a few very centralised points where that happens, and those have to follow laws. They are starting to get cut off already, and these kinds of catastrophes are going to drive the effort to make that happen even quicker.

orhmeh09 5y ago

Just curious, do we have recorded cases where a paramilitary coup or terror operation happened through funds obtained by hacking? Also any evidence that post-9/11 KYC measures have prevented anything bad from happening would be interesting.

ttyprintk 5y ago
This is kind of a political question, and another thread got touchy about politics. But with Manafort’s pardon, we might not see Deutsch Bank’s full culpability in failing to kyc. So, if Manafort’s pardon was inevitable, then would you consider the big players in laundering to be sufficiently protected by a political movement/coup inside a major party?

mrtksn 5y ago

AML works against the small time criminals but when the sums get large they have access to much larger infrastructure and good old creative accounting. By infrastructure, I mean states. That said, every once in a while a larger fish is caught. Right now a huge topic in Turkey is about a local businessman laundering about $1B of a US Mormon sect that stole the money from the US by faking business activity and receiving subsidies. In this case, the Americans are in prison and the Turkish guy is in Austria, awaiting extradition. Shortly before things got sour, the guy had access to the highest Turkish officials and was the darling of the media. On the US side of the things, apparently the criminals were partnering with a high ranking CIA official to pull this off. Here is a video on the topic: https://youtu.be/BPZIX5oBrUc https://youtu.be/BPZIX5oBrUc It’s already out of date as more money and connections were revealed since then but if you Google the names, more juicy stuff comes out. Sezgin Baran Korkmaz is the name of the Turkish guy allegedly laundered their money, now under arrest in Austria. Erdogan scrambled to remove his photos with the guy from the internet. It has been revealed that they bought old Turkish companies that were under financial troubles and used these to move the money. Why Turkey? Because Turkey is in economic turmoil and to motivate people bring money in the country they passed a law so the state doesn’t ask the origin of the money and politicians facilitate the bureaucratic process(allegedly for a substantial commission). Pretty straightforward laundromat. Once the money is in the Turkish system, they have access to EU, USA and pretty much everywhere because according to the paperwork the money is coming from legit companies, some a century old. I bet you, Turkey is not the only rough agent here.

iseethroughbs 5y ago

> The wild thing is that the ransomware operations are making so much money that they can afford to buy multi-million dollar zero day vulns that at one point were only available to nation states or fortune 500 companies. Is it a wild thing that if you permit a safe mechanism of extortion a sprawling economy quickly develops around it, dunno.

aksss 5y ago

My favored analogy is piracy and privateering in the 17th, 18th centuries. Sure, the spoils of one attack enable the next. An end to privateering comes with powerful institutional enforcement via the suppression of movement and committed retribution (an eventual monopoly on the exercise of force). I can only imagine what the analogy looks like - it's arguably more difficult than traditional privateers operating on the open seas if the actors in this case are safe on sovereign soil. Perhaps the analogy to the open seas is the Internet itself. If the solution to privateering was denying bad actors the freedom to operate, the same applied solution on the Internet would be dramatic restriction of who can communicate on it. Problem is, the supply chain attacks in this analogy are more akin to sailing under false colors. In this case sailing under false certificates. What do you do when a pirate captures a ship of your fleet, has your flag, your signal flags, and has your latest challenge/response codes? In the age of sail, it would probably mean accepting the loss of the incident, then ruthlessly hunting down the perpetrator directly with the goal of eliminating all actors capable of such sophisticated engagements - basically reducing the talent pool to near zero. If you aren't allowed in this day and age to address the actor directly, you probably have to deny the host nation itself the freedom of movement until they commit to delivering heads on plates. What does that mean? Cutting Russia off the Internet? Is that even doable these days? You could embargo the Internet for your own country like China tries to do - sad that we're having to consider that. I struggle to imagine other half-way realistic options. Kinetic war and assassination seem imprudent/impractical, to say the least. I certainly don't think the answer is to "eliminate crypto", the equivalent to thinking "banish gold coins" in the age of sail would stop piracy. I also don't think the answer is to demand all companies "do better at security". While everyone needs to do security better, it will always be insufficient. A merchant ship in the age of sail was never expected to have the armaments of a national navy. Their solution was to convoy up and if lucky have state actors protect those convoys - a herd defense at worst. The equivalent to "convoying up" in this age would be some sort of massive crowd validation process before updates are released, slowing everything down to an impractical rate. So I struggle to see what's left other than a good offense, as much as I hate to think of what that means for the dream of the open Internet. The merchants demanded their host nation deliver a safe operating environment, at a pretty steep collective cost.

5y ago

_the_inflator 5y ago

This is really highly interesting. For me to visualize the problem, I came up with this here: honeypot. In this sense, Kesaya or any other Managed Service Provider is some kind of honeypot. Let 100+ companies gather and share the same problem and exploit it. This comparison did not occur to me for Microsoft and their Zero Day exploits. Because you did not attack Microsoft to spread the damage. You still have to find your victims.

Cyberthal 5y ago

I'd much rather keep FSU hackers in Southeast Asian hookers and blow than leave those vulnerabilities unpatched for Big Brother to pwn all the dissidents. We all gotta do our part.