4 ms·

I feel like you could just set it up with a smart contract. No need for anything special, if payment is received, you automatically get your cut.

by pitaj 5y ago

smabie 5y ago
Exactly. Future of France over here.
Sohcahtoa82 5y ago
I've never understood the nitty gritty details on how that's supposed to work. Certainly you'd still need both parties to tell the contract that the work was done, right? Otherwise, just one party acting fraudulently could release the funds to the wrong person.
- handrous 5y ago
  I think this would just rely on the ransomers to have the ransom paid to the correct address, which would be tied to a smart contract that'd take care of divvying up any money coming in and forwarding it to other addresses. If money comes in, the work was done, so distribute it, all automatic. Aside from bugs in the contract, or opsec concerns, the main risk (for the saboteur) would be the ransom folks directing the victim to pay some other address that wasn't part of the smart contract, so no money ever comes into it. Really, it's only marginally more reliable than just depending on them to pay you when they get paid.
  - postoak 5y ago
    That is interesting, how would the employee trust that the criminal organization would indicate the correct address (that triggers the smart contract) to the hostage company?
    - handrous 5y ago
      That's the part that makes it only marginally better than just counting on them to manually forward the money. The only advantage is you skip the part where they already have the money but have not yet betrayed you, and are looking at a huge figure already in their own account and maybe contemplating not sending any of that to you. They can still just have it sent to the wrong place to begin with. Since it'd be easy to fake fulfilled contracts (make sure you own all addresses the contract disburses to) completed contracts, even if publicly visible, aren't even very good for building a reputation for paying out. You might just be paying yourself at multiple addresses, to make it look like you reliably pay out rewards.
- wolfgang42 5y ago
  I wonder if you could use something on the target’s network as an oracle. “This smart contract will pay out when presented with a Kerberos ticket signed by a target.example.com Active Directory server granting Domain Admin privileges.” (This particular formulation has some obvious holes, but you get the idea.)
- postoak 5y ago
  Yes, there in smart contracts there are things called "oracles" which are like 3rd party indicators or sensors that something happened. I don't see how anyone besides the hackers could indicate that.

I feel like you could just set it up with a smart contract. No need for anything special, if payment is received, you automatically get your cut.

by pitaj 5y ago

I feel like you could just set it up with a smart contract. No need for anything special, if payment is received, you automatically get your cut.

smabie 5y ago

Exactly. Future of France over here.

Sohcahtoa82 5y ago

I've never understood the nitty gritty details on how that's supposed to work. Certainly you'd still need both parties to tell the contract that the work was done, right? Otherwise, just one party acting fraudulently could release the funds to the wrong person.

handrous 5y ago
I think this would just rely on the ransomers to have the ransom paid to the correct address, which would be tied to a smart contract that'd take care of divvying up any money coming in and forwarding it to other addresses. If money comes in, the work was done, so distribute it, all automatic. Aside from bugs in the contract, or opsec concerns, the main risk (for the saboteur) would be the ransom folks directing the victim to pay some other address that wasn't part of the smart contract, so no money ever comes into it. Really, it's only marginally more reliable than just depending on them to pay you when they get paid.
- postoak 5y ago
  That is interesting, how would the employee trust that the criminal organization would indicate the correct address (that triggers the smart contract) to the hostage company?
  - handrous 5y ago
    That's the part that makes it only marginally better than just counting on them to manually forward the money. The only advantage is you skip the part where they already have the money but have not yet betrayed you, and are looking at a huge figure already in their own account and maybe contemplating not sending any of that to you. They can still just have it sent to the wrong place to begin with. Since it'd be easy to fake fulfilled contracts (make sure you own all addresses the contract disburses to) completed contracts, even if publicly visible, aren't even very good for building a reputation for paying out. You might just be paying yourself at multiple addresses, to make it look like you reliably pay out rewards.
wolfgang42 5y ago
I wonder if you could use something on the target’s network as an oracle. “This smart contract will pay out when presented with a Kerberos ticket signed by a target.example.com Active Directory server granting Domain Admin privileges.” (This particular formulation has some obvious holes, but you get the idea.)
postoak 5y ago
Yes, there in smart contracts there are things called "oracles" which are like 3rd party indicators or sensors that something happened. I don't see how anyone besides the hackers could indicate that.