14 ms·
Interview with a ransomware group
- 4gotunameagain 5y agoI find myself puzzled by organizations like these. Let's say they do not attack infrastructure or other critical services, and only leech off huge companies. I cannot argue against it?
- jnorthrop 5y agoAre you really intending to condone illegal activity? Just because their targeting "wealthy" companies? That is like condoning a mugger because he is working in a rich neighborhood and not targeting the impoverished.
- everyone 5y agoThe rich people in that neighborhood have acquired their wealth in an unfair injust way.
- typon 5y agoIf I heard news that Jeff Bezos bank account was hacked and $50 million dollars were stolen, I don't think I would even bat an eye. When I hear of ransomware shutting down hospital computers I'm furious and want to see these clowns rot in jail. There's clearly a spectrum here of where it starts becoming a heinous act.
- ohhhhhh 5y agothis is a you problem
- mcguire 5y agoThe global median household wealth is about $7,500. The median income is around $10,000. To much of the world (making some assumptions based on your presence here on HN), you have more in common with Jeff than you do with much of the world; they might take the same attitude to you.
- throwaway672000 5y agoIt's possible the only reason we would disgree if the rest of the world took this attitude is our own greed. To me what's more obviously wrong whether I'm rich or poor is leaking personal info on employees, HR correspondence etc. I don't know whether this group would since they say it hasn't got that far yet but other groups have. Extortion, mugging, burglary etc are worse than the "perfect theft" where you move some numbers from one account to another. I wonder if the people involved believe their own spin that "your boss is the one at fault, would rather you suffer than pay"
- trasz 5y agoBit of an advocatus diaboli, but… Crimes are crimes because they hurt people. Here we’re talking about just lowering company’s profits; same thing happens naturally due to market forces and nobody complains.
- TchoBeer 5y agoUsually lowering a company's profits due to market competition produces value. Just stealing money does not produce value.
- trasz 5y agoThe stolen money don’t have a value to the thief?
- TchoBeer 5y agoThe amount of value it produces for the theif is equal to the amount of value it takes away from the company
- Hjfrf 5y agoGenerally much less, if you're taking into account all the wasted time/energy.
- trasz 5y agoMillion dollars stolen from, say, Bezos, is worth less than that to the thief?
- TchoBeer 5y agoWe can have a discussion about ethics and utility if it's a starving person stealing from Jeff Bezos, but these ransomware firms are large-scale organizations just like the companies they're stealing from.
- 4gotunameagain 5y agoI was looking for a solid argument, since I am not able to provide one. So far there are none presented here either. Are we really going to justify this just by "it is against the law"? So many things are against the law, so many ancient laws demonstrate the inability of humans to create the absolute corpus of ethical behaviours™.
- mcguire 5y agoSince you asked,... The Kantian categorical imperative goes something like, "act as if the basis of your actions would be made universal law." What happens if everyone conducts denial of service and ransom attacks against anyone they perceive as a legitimate target? https://www.aamc.org/news-insights/growing-threat-ransomware-attacks-hospitals https://www.aamc.org/news-insights/growing-threat-ransomware... https://www.wsj.com/articles/the-ruthless-cyber-gang-behind-the-hospital-ransomware-crisis-11623340215 https://www.wsj.com/articles/the-ruthless-cyber-gang-behind-...
- dcow 5y agoWe'd probably have a society that is really good at building safe redundant software services such that this is no longer a threat (;
- pope_meat 5y agoWe'd love in the world that we live in now. Iran's centrifuges have some experience with that. I think it's kind of neat that we're waging war via bit flipping instead of meat flipping, let's call it progress.
- _manifold 5y agoThe fact is that these particular situations are much more complex than a false dichotomy of "good" and "evil" corporations, or "large" and "small" corporations. Take any organization you think is "worthy" of being attacked in this manner, and consider all of the implications of such an attack. Think about the people inside the organization, and those outside of the organization that benefit from that its continued operations. I think it's fair to say the public opinion of oil companies is fairly low; however, arguably the biggest impact of the Colonial Pipeline attack was not on the executives running the company, but on the end customers of gas stations unable to fuel their vehicles due to the shortage (whether truly real or created by panic). I would argue that everyday workers unable to get to work or to the store to buy food is more important than a few executives not getting their bonuses or having their shares lose value. This isn't to say that these corporations are above all reproach and should be allowed to continued operating in whatever way they see fit simply because they have employees and customers are relying on them. But it's also the wrong mindset to think that it's OK to attack corporations in this way just because they "deserve it" in some way.
- danpalmer 5y ago> and only leech off huge companies. I cannot argue against it? Médecins Sans Frontières is a huge company. Their annual budget is around $1.6bn. Are you ok with them being subject to ransomware attacks?
- rory 5y agoAllegedly BlackMatter is not. > It would not extort healthcare, critical infrastructure, oil and gas, defense, non-profit, and government organizations
- danpalmer 5y agoThat's good. I wonder if they'd extort the company that manages the building I live in. If they did the most likely negative outcomes are that I'll receive worse service and pay more for my service charge. That's not too bad for me, but I have vulnerable neighbours for whom that may be a significant problem. There is so much collateral damaged created by this sort of attack against any company of sufficient size. It's easy to wave your hand and say they're a rich company they can afford it, but no company exists in isolation, they're all part of economies, and ultimately it's real people somewhere who take the damage.
- BrianOnHN 5y agoGood luck getting much sympathy. There is still some asshole making off like a bandit even when the lowly employees get hurt at the same company.
- boomlinde 5y agoIn this instance, they claim that they will not attack non-profits, which puts organizations like MSF out of harm's way.
- anthony_r 5y agoLet's inverse the question: please provide a list of companies that would be OK to target, according to you.
- CleverLikeAnOx 5y agoIf a robber steals one grain of rice from each person in a town, was anyone harmed? If you think not, then what if a thousand robbers do the same? Leeching off of companies is kind of like stealing a grain of rice from everyone. The company's costs increase and the price eventually makes its way back to the consumer. Another way to think about it is the total amount of labor needed for the world to operate as it does. In a world that has no ransomware, the labor needed is X. In a world with ransomware it is X + cost of building ransomware + cost of dealing with ransomware.
- CharlesW 5y ago> Leeching off of companies is kind of like stealing a grain of rice from everyone. I'm sure the criminals console themselves by thinking about it that way, but as someone who had to use an emergency room and was denied other services during the month+ Scripps was down (during a global pandemic, no less), it was easy to see how ransomware attacks can directly hurt an enormous number of employees and customers.
- CleverLikeAnOx 5y agoTo clarify my point, even if leeching off companies is like stealing a grain of rice from each person, it is still wrong. My point was that ransomware is wrong even in an idealized abstract scenario where it only targets non-critical companies. Thanks for providing your experience. It drive home that in practice it is much more like beating and robbing many people than it is like stealing just a single grain of rice from them.
- mcguire 5y agoAs a general rule, theft is considered a bad thing. Why do you think it's acceptable?
- danpalmer 5y agoI feel like giving criminals a platform like this is wrong. I'm all for reformed criminals giving interviews in the context of what they did being wrong, but this is an interview about how they're getting better at their crimes. Regardless of how easy it might be given security practices, these are crimes, and they are crimes for a reason: they cause damage. Their impact is felt beyond the ransom money paid, it's felt by employees who may be put in terrible positions as their work is held ransom and who might pay up personally to avoid problems at work, it's felt by customers of these companies who end up with higher prices, it's felt by countries as their output is hit. The fact that this "industry" is getting more "professional" does not change the fact that it's harmful. They don't deserve the publicity and attention that this sort of platforming provides them.
- ailef 5y agoConsidering the huge environmental damage created by e.g. oil companies (and many others), one could say the same about them? The only difference is what these people do is illegal while what the companies do is not: the damage, though, is arguably on the same scale, if not lower for ransomware attacks depending on which infrastructure is attacked.
- eklavya 5y agoAs much as I loathe our response towards global warming. This comment shows why equivalence should not be taken lightly and how absurd the result can be. How about holding people for ransom that is equivalent for sure, how about killing people? Well oil industry eventually ends up killing some people. Let’s put a stop to oil industry before we deal with the kidnappers and killers!!
- ailef 5y ago> Let’s put a stop to oil industry before we deal with the kidnappers and killers!! Nobody said there has to be a priority. Why can't we stop both? Moreover OP comments was not talking about stopping them, but about giving these people a platform. Despite the damage done by oil companies they are still allowed to spend billions of dollars in marketing, lobbying, etc... Resulting in a much bigger, legalized, platform, while still causing way more damage than ransomware "companies".
- imglorp 5y agoAs for repercussions, notice they indicated "fear of the United States and its planning of offensive cyber operations". We don't hear a lot about US offensive operations. Maybe they're ongoing but they don't get a lot of press. If that's the case maybe the need more for deterrence purposes. Does anyone have any visibility? Also, notice they did not mention any concern the FSB would invite them for tea, pay respects to their families, or any other ... imperial entanglements. This says a world about their standing in Russia, whether tolerated, encouraged or some other arrangement.
- the-dude 5y agoStuxnet and Windows are pretty well known I would say.
- wongarsu 5y agoRussia's policy is to leave cybercrime alone as long as they don't attack Russia. A hacker group in Russia declaring to only target companies in the USA and Great Britain is like a US group that only targets Iran and China. US agencies probably wouldn't find time in their busy schedules to go after someone targeting Iran either.
- sudosysgen 5y ago*Russia and it's allies, CIS states are also off-limits. But yes, you are correct.
- nradov 5y agoHence why some malware programs won't activate if they detect the computer's keyboard layout is set to Russian.
- mcguire 5y agoYou might check out Inside Cyber Warfare by Jeffrey Carr from 2011. It's ancient, predating (AFACT) the rise of ransomware, and technically illiterate, but goes into considerable detail about the Russian cyber-crime/-war (they're the same, really) groups and their relationship to the government.
- devnull3 5y ago> it was seeking to recruit partners and claiming that it combined the features of notorious groups like REvil and DarkSide I wonder if they have leetcode style interviews :)
- blankface 5y agoreminds me of the Bin Laden interview(s) before 9/11, specifically the one with Robert Fisk where Bin Laden was saying he was going to start attacking America https://www.bbc.co.uk/programmes/w3csvtth https://www.bbc.co.uk/programmes/w3csvtth https://www.cbsnews.com/pictures/osama-bin-laden-tora-bora/ https://www.cbsnews.com/pictures/osama-bin-laden-tora-bora/
- icemelt8 5y agoThat was strangely fascinating
- btbuildem 5y agoI wonder why they refuse to rip off oil companies? Too well connected & therefore too risky?
- caffeine 5y agoImagine if they shut down every Shell gas station or something similar.
- btbuildem 5y agoI imagined more along the lines of them hitting Shell HQ and extorting the execs for millions and millions. Shutting down a corporate office seems a more likely scenario than hitting a multitude of effectively independent franchises.
- nradov 5y agoRussia depends on oil revenue to survive. They don't want to put any part of that supply chain at risk.
- GuB-42 5y ago> DS: What do you think about the attacks carried out against Colonial Pipeline’s infrastructure or JBS? Does it make sense to attack such large networks? > BM: We think that this was a key factor for the closure of REvil and DarkSide, we have forbidden that type of targeting and we see no sense in attacking them. I think it is your answer, too risky.
- unixhero 5y agoSo basically he interviewed a Romulan.
- unnouinceput 5y agoFrom last phrase: "...but we believe in our motherland..." So yeah, a Russian.
- flerovium 5y agoThis is free advertising for criminals. Correction: this is free advertising for criminals _actively looking to recruit associates to assist them in committing crimes_, and helps them commit crime. Don't upvote "Weapons Smuggling, Inc. (YC21) is hiring a coordination specialist for EMEA operations"
- dcow 5y agoThis is an interesting topic because BM claims to have a moral compass and is only interested in targeting wealth not impacting humans. Let me ask the question: “if companies paid for in-house security professionals competitive with what one might imagine BM pays, would people still choose the grey work?”. I presume in a dichotomy between clearly unethical and ethical, it’s easy for many to choose ethical. But when you add a grey option, it certainly changes things since I imagine most people are ethically grey. Let’s assume what BM is doing is effectively legal in the country where they operate.
- pizza234 5y ago> if companies paid for in-house security professionals competitive with what one might imagine BM pays, would people still choose the grey work? Interestingly, they answer very clearly: > We have not been involved in legal pentesting and we believe that this could not bring the proper material reward. They're in only for the money, so the answer is "yes". Ransomware is not "grey" work though, if this is the implication; it's extortion, which is illegal.
- dcow 5y ago> Let’s assume what BM is doing is effectively legal in the country where they operate.
- pizza234 5y agoThis specific activity has a direct contact with the victims, which makes it considerably different from other gray-area activities, where there is a strong disconnection with the victims (in which case, the concept of victim additionally becomes blurrier, e.g. tobacco industry or, uh, banking). Assuming that one has valid job alternatives (and they definitely have, since they're highly skilled professionals, with an available market), one needs to be have a certain degree of sociopathy in order to be able to do this line of work.
- dcow 5y ago
- sys_64738 5y agoThese people are terrorists so why are they being interviewed?
- CleverLikeAnOx 5y agoIt is not uncommon for journalists to interview terrorists and gangsters. I found it insightful.
- imwillofficial 5y agoTerrorists, cartels, and criminals of all shapes and kinds are often interviewed. As to the bigger question of “why”? It gives us a unique insight into a strata of society most of us are not privy to, opening our minds to new ideas.
- pmoriarty 5y agoKnow your enemy.
- thrwyoilarticle 5y ago>Moreover, LockBit encrypts the first 256 kb of the file (which is pretty bad from the point of view of cryptographic strength). We, on the other hand, encrypt 1 MB. Essentially, that’s the secret to their speed. So I can just pad all my valuable data by 1MB?
- dylan604 5y agowouldn't it just be easier to have duplicate back ups of your "valuables"?
- thrwyoilarticle 5y agoAnd yet the ransomware is successful.
- dylan604 5y agoOf course it is because people don't make backups properly if at all. However, my reply was to someone wanting to pad all of their valuable data with 1MB of fake data so if they were hit with a malware virus it would not actually screw up their data. Nevermind, that 1MB would screw up normal use as the apps would not know how to handle that padded data. But you know, yes, if you totally miss the point of the thread, I could see where thinking the point was the lack of failure of malware.
- jbverschoor 5y agoOr just have 1 padded disk image you mount.. Emm no wait, that's be an fs, so they'd f that up too
- mimixco 5y agoThere's an elephant in this room and its name is ethics. When I was a mainframe programmer at IBM, one of they first things they taught us was how to stop the processor of a System/370 machine. If you can do that, ladies and gentlemen, you can bring down Bank of America, the US Army, the Social Security Administration, etc. So everyone there knew how to be a "black hat" hacker if we wanted to. Was there money to be made in that? Surely. More money than IBM ever paid anyone! But the reason neither I nor any of my colleagues would ever dream of using our skills to hurt people is that last part of the sentence: it hurts people. Yes, IBM did some awful stuff from helping Nazis to keeping apartheid alive in South Africa (over employee objections while I was there), but overall, the "corporation" provided valuable goods and services to real people who had to slog on in real jobs every day to get the world's real work done. Oil companies are in the same boat. The world runs on oil and some ransomware attacks aren't going to change that. The idea that terrorism (and black hat hacking is absolutely a form of terrorism) is a useful way to change corporate behavior is so ill-informed that it's pathetic. When asked about taking a "white hat" approach and selling legal pen testing (or even PTaaS), these developers declined saying they probably couldn't monetize their skills at the same level that way. Well, I say, too effin' bad. If everyone optimizes solely for himself, there will be no one left. It's appalling to me that criminal organizations now recruit, have price lists, and get PR placement. These people and their products (and their communication channels) need to be turned off ASAP for everyone else's sanity and self-preservation.
- draw_down 5y agoSeeing the word “ethics” emphasized, followed by “sure they helped Nazis but...” was really something. Congratulations, I guess.
- fleddr 5y agoWhat elephant in the room? They are self-admitted criminals. They admit to be in a destructive industry to line their own pockets. The only reason they are selective in their targets is because critical targets will increase the chances of them being caught.
- mimixco 5y ago
- cutler 5y agoTotally naive but what would it take to protect a disk from unintentional encryption or maybe make encryption impossible?
- LadyCailin 5y agoGood, offlined backups.
- mod 5y agoMake it read only