10 ms·

While emailing a bunch of employees is probably not going to be too successful, this could actually be a pretty effective strategy if the criminals would follow

While emailing a bunch of employees is probably not going to be too successful, this could actually be a pretty effective strategy if the criminals would follow through on it; basically have an open offer to employees of large companies (or any companies, really) to deploy ransomware internally. Have an installer with a unique ID, a detailed set of instructions for installing the ransomware, communicating anonymously and obtaining the money as anonymously as possible, etc. Nobody needs to know who anybody else is - just "here's our ransomware, any ransom paid that mentions your unique ID, we'll split with you. Have fun" Crowdsourced criminality.

PicassoCTs 5y ago
Make it a fire and forget hidden installer on any usb-port and the world ends today.
- deleted 5y ago
  [deleted]
pbhjpbhj 5y ago
So the criminals can get the ransom, then offer the id of the colluders in return for a further ransom!
- SonicScrub 5y ago
  I don't think so. The success of this would all hinge on an un-easy trust between the organizers and the individuals. Backstabbing your partner would ensure that you would never get anyone else to do this for you again. That would be the end of your operation. You need the world to know that yes people really do this for you, and yes they really do get paid. A similar dynamic is at play between ransomware attackers and their victims. Why would ransomware attackers restore files from a successful attack after the ransom is paid? Easy. The attackers need the world to know that paying the ransom will work, otherwise no one would pay it.
  - hinkley 5y ago
    It is odd watching a bunch of people who effectively deal with rules all day try to predict behavior for a group of people who effectively ignore rules all day. Why is a ransomware company going to follow the rules of common decorum when dealing with a collaborator if the whole point is to defraud a third party? How do I know that they made the payout? Is the collaborator going to come forward and identify themselves? The only way you know that person got paid is if they don't get arrested. There are whole branches of organized crime than live and breathe in the space between 'got paid and lived happily ever after' and 'ended up on the front page of the NYT'. Just off the top of my head you have blackmail, extortion, and hiding the body.
    - SonicScrub 5y ago
      We aren't invoking the ethics of "rule-following" to explain why criminals behave certain ways, rather we are speculating on based on incentive alignments and rational self-interest. The answer to your question is quite simple: because they need third parties to work with them. There are lots of ways as to make past history of payouts known without releasing who the individual collaborators were in each case.
      - hinkley 5y ago
        No. Not even close. This isn't 7-11 trying to con me into buying their scary hot dogs, these are bad people, in all senses of the word. They need third parties to think that working with them is their best option. Their best option is to do something legal, but desperate people can be manipulated. Greedy people can be really manipulated. Maintaining the illusion of safety is just marketing. If the game is extortion, then psychological manipulation is part of the game. I have no assurances that you've given me $1.4 million today and this is the last I will ever hear from you. If I know little about you I can't even turn State's Evidence to save my ass if I get caught but you don't. If I think I know that you or anyone with details of your operation won't come back later and threaten to turn me in unless I pay you money, then I'm a fucking idiot. You could ask for money, or to "deliver a package" for you. In that situation, what you and your associates are counting on me forgetting is that I am mortgaging my future by piling on new crimes with later statute of limitations dates, and establishing a pattern of behavior that makes me look even more complicit. There is no honor among thieves. Stop trying to figure out how to pet a wolf without getting bit.
- praptak 5y ago
  The ransomware group does not need to know the identity of the disgruntled insider.
jaclaz 5y ago
On the other hand, it might provide new opportunities, I would say that an escrow service for this (hypothetical) payment of the (promised) 40% share might represent a new kind of service in demand.
- pitaj 5y ago
  I feel like you could just set it up with a smart contract. No need for anything special, if payment is received, you automatically get your cut.
  - smabie 5y ago
    Exactly. Future of France over here.
  - Sohcahtoa82 5y ago
    I've never understood the nitty gritty details on how that's supposed to work. Certainly you'd still need both parties to tell the contract that the work was done, right? Otherwise, just one party acting fraudulently could release the funds to the wrong person.
    - handrous 5y ago
      I think this would just rely on the ransomers to have the ransom paid to the correct address, which would be tied to a smart contract that'd take care of divvying up any money coming in and forwarding it to other addresses. If money comes in, the work was done, so distribute it, all automatic. Aside from bugs in the contract, or opsec concerns, the main risk (for the saboteur) would be the ransom folks directing the victim to pay some other address that wasn't part of the smart contract, so no money ever comes into it. Really, it's only marginally more reliable than just depending on them to pay you when they get paid.
      - postoak 5y ago
        That is interesting, how would the employee trust that the criminal organization would indicate the correct address (that triggers the smart contract) to the hostage company?
stickfigure 5y ago
The fact that the employee can't publicize the windfall means that the gang has no incentive to pay them, either. The employee can't exactly complain to anyone that they got stiffed. It's a sort of prisoner's dilemma problem - since the game won't be repeated with any single employee, and there's no communication between employees, the gang gets a better outcome in all cases by not paying. I'd bet on the employee getting scammed too.
- SerLava 5y ago
  The only way people would reliably help with the sabotage is if the group had a reputation for paying out. Kind of the same way ransomware works already- if nobody gets their data back, people will be advised never to pay
  - stickfigure 5y ago
    Unless some employees get caught, there's no way for the group to acquire this reputation. Certainly they can't be trusted at their word ("we pay out" - sure you do).
    - dasil003 5y ago
      So pay out, then anonymously rat out their own inside man to the feds? Ugh feels so dirty even saying it, I guess that's why sociopaths win so often.
      - bink 5y ago
        "we paid that guy and he got caught" "we paid this other guy and he got caught" "come join us!"
  - csydas 5y ago
    I strongly disagree based on my experience consulting and the countless articles you can find about this very situation happening prior to the rise of cryptocurrency and ransomware gangs. Disgruntled employees doing shift+delete on a critical directory after missing backups or rotating encryption passwords to gibberish on their last day is very common. (or of course both and more) For me it's not hard to believe at all that someone who is already at a low point and motivated with malicious intent would read up on such an offer and think to themselves "I can screw my boss __and__ get a cool million in etc? Just for 'accidentally' uploading some ssh keys with a misplaced wildcard?" Even before the covid pandemic, stress in IT was high and disgruntled employees doing damage on the way out was making headlines. Search 'Disgruntled employee destroys data' on google and check the date of some of the news articles. Here's one that made US national news in 2014 about how data theft was a trend.[0] Whether or not there's a real payout is of no consequence it seems. I'm only able to immediately find articles about such incidents in the US and the UK, but I am fairly sure it's not limited to such locations, or that outsourced IT isn't just as vulnerable. I've written it before on HN for other reasons, but people like to talk about new laws/standards/etc, but IT doesn't have problems that need legal solutions, as an industry, IT needs to improve discipline across the board and stop letting situations where one person can be so destructive happen. Too many places still run their IT like it's the 80's/90's where one or maybe two with absolutely control over everything. This leads to burnout first of all, which is horrible, but it also creates these bad situations of unregulated control in the first place. [0] https://www.wsj.com/articles/fbi-warns-of-rise-in-disgruntled-employees-stealing-data-1411516389 https://www.wsj.com/articles/fbi-warns-of-rise-in-disgruntle...
xkcd-sucks 5y ago
Even better as sabotage - Make a public offer to your competitor, then watch their org implode in a cloud of suspicion
giomasce 5y ago
Basically affiliate cracking! That's an idea!
mofeien 5y ago
A problem (for the criminal org) might be that if an employee is willing to follow the customization steps for the ransomware and deploy it in order to receive a share of the ransom, it might not be much more difficult or illegal for the employee to just do everything by themselves and receive all of the ransom, cutting out the criminal org completely.
tejtm 5y ago
Sounds like something HR would try
im3w1l 5y ago
I think it's more realistic that baddies pay employees to see some of the juicy data in the company db. Lower(but not 0) risk of detection.
autokad 5y ago
honey pots would make counteracting them very effective

PicassoCTs 5y ago

Make it a fire and forget hidden installer on any usb-port and the world ends today.

deleted 5y ago
[deleted]

pbhjpbhj 5y ago

So the criminals can get the ransom, then offer the id of the colluders in return for a further ransom!

SonicScrub 5y ago
I don't think so. The success of this would all hinge on an un-easy trust between the organizers and the individuals. Backstabbing your partner would ensure that you would never get anyone else to do this for you again. That would be the end of your operation. You need the world to know that yes people really do this for you, and yes they really do get paid. A similar dynamic is at play between ransomware attackers and their victims. Why would ransomware attackers restore files from a successful attack after the ransom is paid? Easy. The attackers need the world to know that paying the ransom will work, otherwise no one would pay it.
- hinkley 5y ago
  It is odd watching a bunch of people who effectively deal with rules all day try to predict behavior for a group of people who effectively ignore rules all day. Why is a ransomware company going to follow the rules of common decorum when dealing with a collaborator if the whole point is to defraud a third party? How do I know that they made the payout? Is the collaborator going to come forward and identify themselves? The only way you know that person got paid is if they don't get arrested. There are whole branches of organized crime than live and breathe in the space between 'got paid and lived happily ever after' and 'ended up on the front page of the NYT'. Just off the top of my head you have blackmail, extortion, and hiding the body.
  - SonicScrub 5y ago
    We aren't invoking the ethics of "rule-following" to explain why criminals behave certain ways, rather we are speculating on based on incentive alignments and rational self-interest. The answer to your question is quite simple: because they need third parties to work with them. There are lots of ways as to make past history of payouts known without releasing who the individual collaborators were in each case.
    - hinkley 5y ago
      No. Not even close. This isn't 7-11 trying to con me into buying their scary hot dogs, these are bad people, in all senses of the word. They need third parties to think that working with them is their best option. Their best option is to do something legal, but desperate people can be manipulated. Greedy people can be really manipulated. Maintaining the illusion of safety is just marketing. If the game is extortion, then psychological manipulation is part of the game. I have no assurances that you've given me $1.4 million today and this is the last I will ever hear from you. If I know little about you I can't even turn State's Evidence to save my ass if I get caught but you don't. If I think I know that you or anyone with details of your operation won't come back later and threaten to turn me in unless I pay you money, then I'm a fucking idiot. You could ask for money, or to "deliver a package" for you. In that situation, what you and your associates are counting on me forgetting is that I am mortgaging my future by piling on new crimes with later statute of limitations dates, and establishing a pattern of behavior that makes me look even more complicit. There is no honor among thieves. Stop trying to figure out how to pet a wolf without getting bit.
praptak 5y ago
The ransomware group does not need to know the identity of the disgruntled insider.

jaclaz 5y ago

On the other hand, it might provide new opportunities, I would say that an escrow service for this (hypothetical) payment of the (promised) 40% share might represent a new kind of service in demand.

pitaj 5y ago
I feel like you could just set it up with a smart contract. No need for anything special, if payment is received, you automatically get your cut.
- smabie 5y ago
  Exactly. Future of France over here.
- Sohcahtoa82 5y ago
  I've never understood the nitty gritty details on how that's supposed to work. Certainly you'd still need both parties to tell the contract that the work was done, right? Otherwise, just one party acting fraudulently could release the funds to the wrong person.
  - handrous 5y ago
    I think this would just rely on the ransomers to have the ransom paid to the correct address, which would be tied to a smart contract that'd take care of divvying up any money coming in and forwarding it to other addresses. If money comes in, the work was done, so distribute it, all automatic. Aside from bugs in the contract, or opsec concerns, the main risk (for the saboteur) would be the ransom folks directing the victim to pay some other address that wasn't part of the smart contract, so no money ever comes into it. Really, it's only marginally more reliable than just depending on them to pay you when they get paid.
    - postoak 5y ago
      That is interesting, how would the employee trust that the criminal organization would indicate the correct address (that triggers the smart contract) to the hostage company?

stickfigure 5y ago

The fact that the employee can't publicize the windfall means that the gang has no incentive to pay them, either. The employee can't exactly complain to anyone that they got stiffed. It's a sort of prisoner's dilemma problem - since the game won't be repeated with any single employee, and there's no communication between employees, the gang gets a better outcome in all cases by not paying. I'd bet on the employee getting scammed too.

SerLava 5y ago
The only way people would reliably help with the sabotage is if the group had a reputation for paying out. Kind of the same way ransomware works already- if nobody gets their data back, people will be advised never to pay
- stickfigure 5y ago
  Unless some employees get caught, there's no way for the group to acquire this reputation. Certainly they can't be trusted at their word ("we pay out" - sure you do).
  - dasil003 5y ago
    So pay out, then anonymously rat out their own inside man to the feds? Ugh feels so dirty even saying it, I guess that's why sociopaths win so often.
    - bink 5y ago
      "we paid that guy and he got caught" "we paid this other guy and he got caught" "come join us!"
- csydas 5y ago
  I strongly disagree based on my experience consulting and the countless articles you can find about this very situation happening prior to the rise of cryptocurrency and ransomware gangs. Disgruntled employees doing shift+delete on a critical directory after missing backups or rotating encryption passwords to gibberish on their last day is very common. (or of course both and more) For me it's not hard to believe at all that someone who is already at a low point and motivated with malicious intent would read up on such an offer and think to themselves "I can screw my boss __and__ get a cool million in etc? Just for 'accidentally' uploading some ssh keys with a misplaced wildcard?" Even before the covid pandemic, stress in IT was high and disgruntled employees doing damage on the way out was making headlines. Search 'Disgruntled employee destroys data' on google and check the date of some of the news articles. Here's one that made US national news in 2014 about how data theft was a trend.[0] Whether or not there's a real payout is of no consequence it seems. I'm only able to immediately find articles about such incidents in the US and the UK, but I am fairly sure it's not limited to such locations, or that outsourced IT isn't just as vulnerable. I've written it before on HN for other reasons, but people like to talk about new laws/standards/etc, but IT doesn't have problems that need legal solutions, as an industry, IT needs to improve discipline across the board and stop letting situations where one person can be so destructive happen. Too many places still run their IT like it's the 80's/90's where one or maybe two with absolutely control over everything. This leads to burnout first of all, which is horrible, but it also creates these bad situations of unregulated control in the first place. [0] https://www.wsj.com/articles/fbi-warns-of-rise-in-disgruntled-employees-stealing-data-1411516389 https://www.wsj.com/articles/fbi-warns-of-rise-in-disgruntle...

xkcd-sucks 5y ago

Even better as sabotage - Make a public offer to your competitor, then watch their org implode in a cloud of suspicion

giomasce 5y ago

Basically affiliate cracking! That's an idea!

mofeien 5y ago

A problem (for the criminal org) might be that if an employee is willing to follow the customization steps for the ransomware and deploy it in order to receive a share of the ransom, it might not be much more difficult or illegal for the employee to just do everything by themselves and receive all of the ransom, cutting out the criminal org completely.

tejtm 5y ago

Sounds like something HR would try

im3w1l 5y ago

I think it's more realistic that baddies pay employees to see some of the juicy data in the company db. Lower(but not 0) risk of detection.

autokad 5y ago

honey pots would make counteracting them very effective