19 ms·
Ransomware gangs are complaining that other crooks are stealing their ransoms
- staticassertion 5y agoThis happens with scammers a lot from what I've seen. I watch Jim Browning and it's interesting to see how often a scammer will say "No, that other person was trying to scam you, do not talk to them, only talk to us" when they see evidence of a previous scam.
- matheusmoreira 5y ago> Cyber criminals using a ransomware-as-a-service scheme have been spotted complaining that the group they rent the malware from could be using a hidden backdoor to grab ransom payments for themselves. That's hilarious. You'd think they'd know better than to trust code they did not write...
- bryanrasmussen 5y agohow many of these people actually write their own code though? I mean if there is ransomware as a service, it would imply not a lot.
- Waterluvian 5y agoYeah. I’ve always assumed most of these people are low-skilled thugs. The Russian equivalent of tax or tech support call scammers in India.
- deleted 5y ago[deleted]
- lilSebastian 5y ago>That's hilarious. You'd think they'd know better than to trust code they did not write... Most humans trust code they didn't write
- matheusmoreira 5y agoYeah, but these people are in the business of exploiting that trust. I thought they'd be smart enough not to have their own trust exploited...
- anyfactor 5y agoAlways going to be a bigger fish. But it is scary to hear that there is an entire supply chain dedicated to this sort of activity.
- deleted 5y ago[deleted]
- junon 5y agoSo they're basically publicly admitting they're script kiddies. Hilarious.
- rocqua 5y agousually these affiliates do the actual hacking themselves. They simply outsource the payload development. They aren't necessarily script kiddies. Outsourcing your non-core work is just efficient. It's good business. That this model is breaking is good news! It means that the efficiencies that trust allows are eroding in the ecosystem.
- jokethrowaway 5y agoThey could just be buying exploits. I can't imagine professionals capable of hacking useful targets having problems writing a script that encrypts some files with a public key and needs a private key to be unlocked.
- ninjanomnom 5y agoLike with most things it's not as simple as it looks from the outside. Malware payloads need to exist undetected by whatever system they've been deployed to which by itself is an ever changing cat and mouse game that requires a different knowledge set than simply gaining access to said system. If you have a second computer you're willing to accidentally mess up and require a wipe + reinstall, I recommend you experiment a bit and try writing your own malware or playing with some open source variations floating around. It can teach a lot to see from the attacker's perspective.
- alisonkisk 5y ago"script kiddie" is just a slur for "outsourcing".
- mdeck_ 5y agoNo honor among thieves? Color me shocked.
- rocqua 5y agoI thiink I can see why Revil added the backdoor. It's not to steal ransoms. It's to prevent too juicy a target. There have been reports of crews stating "we won't hit hospitals in covid". With this backdoor, if your customers hit a hospital, you can hold your promise. Even worse than hospitals (from their perspective) is agitating the American intelligence services. Hit too many pipelines, or similar high-news high-impact targets and 'national security threat' is your new name. Worse than that still, imagine one of your affiliates is stupid enough to target inside Russia. You need to keep the Russians happy or all of a sudden trial or extradition become likely outcomes. At the same time, once you have the opportunity, why not use back door for some more money. Glad to see that they still aren't fully cooperating like legal businesses yet.
- schleck8 5y agoThe Duesseldorf hospital was hit by ransomware and a patient died during the outage. I'm not saying that all ransom gangs are coldhearted, but let's not frame them to have morals
- 4gotunameagain 5y agoI don't think it is about morals, but more about avoiding trouble. And I also wouldn't find it too hard to believe that there must be at least some ransomware groups with morals. Not the same as yours, sure
- miohtama 5y agoWhen you hit a national security target, you get NSA and CIA after you. They have vast resources to make your life difficult wherever you are.
- deleted 5y ago[deleted]
- netrus 5y agoOn the other hand, why shouldn't NSA and CIA be invested 100% in pushing back on these attacks already? The potential harm from this vector is obviously gigantic, so why wait for a really significant attack to happen?
- quickthrower2 5y agoWho do they complain to? Is there an ombudsman?
- gigatexal 5y agoFuck all of them. Criminals stealing from criminals, cry me a river.
- deleted 5y ago[deleted]
- ivrrimum 5y agolol
- anonymousDan 5y agoSo where is the back door I wonder. In the actual payload that gets deployed to the victim's device? Or in some backend part of the ransomware software?
- rocqua 5y agoI would put it in the key generation algorithm used for the encryption. If that algorithm was somehow backdoored (like the dual-ec curve, or just by (assymertically) encrypting the key and putting it in the identifier. Then the RaaS could just use the backdoor to recover the key.
- ur-whale 5y ago> other crooks are stealing their ransoms The hallmark of an ecosystem.
- kappuchino 5y agoRe: Thieves stealing from thieves ... I worked(*) with a credit-card scammer who brought in a software for creating "yes-cards": Cloned Creditcards that had corrupted chip and pin settings(See https://www.zeit.de/2016/05/kreditkarten-banken-betrug-sicherheit-kriminalitaet https://www.zeit.de/2016/05/kreditkarten-banken-betrug-siche..., sorry its only in german). It was unheard of at the time that you could do this. So we set up a test to clone a credit card of ours. The kicker was, the software didn't work when you disconnected the computer it ran on from the internet. Security mechanism from the creator? Nope, it turns out after tracing/dissassembly it sent the data from the cards to a third party to sell it. Our informant was first confused, then outraged. No honor amongs thieves! (*) journalistically!
- TheJoeMan 5y agoSo to encourage merchants using Dip and Tap instead of swipe, brick and mortar cc processor companies said they no longer would cover fraud from cloned swipes. Sounds fine right? Except their own payment terminals after 2 or 3 dips/taps not working just go “fine just use swipe” -_-
- Nursie 5y agoThat very much depends on the terminal settings and the merchant agreement with the acquirer…
- lelanthran 5y agoThat's part of the EMV standards; the terminal parameters set by the bank or the merchant are combined with the card parameters set by the issuer to determine threshold for risk. A merchant or bank in a 3rd world country may decide on thresholds that effectively never do a fallback transaction.
- fsckboy 5y ago> cc processor companies said they no longer would cover fraud from cloned swipes. Sounds fine right? yes, and it makes sense that it would encourage adoption of the new dip-tap machines. That they can also swipe does not decrease the incented appeal of the new safer system
- Waterluvian 5y agoThere’s no evidence to suggest it’s happening here, but I wonder how effective it is to disrupt ransomware activity by making the community distrust each other.
- iJohnDoe 5y agoVery good point. Any type of disruption is beneficial. Especially when you start screwing over your affiliates. It’s has been proven that affiliates are the main reason ransomware has been so successful. Piss off your affiliates and now you no longer have incoming victims/targets.
- billpg 5y agoOh-Dear-How-Sad-Never-Mind.gif
- beermonster 5y agoWould be a shame if someone else used that same back door to assist in capturing the perps.
- otikik 5y agoTiny violin louthiers are rejoicing thanks to this new market opportunity.
- trulyme 5y agoWhat is the best defence against this? Is there some software on hdd/sdd level that can detect file being encrypted?
- marcosdumay 5y ago> What is the best defence against this? Backups.
- ericbarrett 5y agoStored offline or at least immutable, e.g. via S3 bucket lifetime policy. Lots of cases of casual backup servers being infected & encrypted as well.
- marcosdumay 5y agoYeah, for protecting against ransomware, the computers you are backing-up must not have permission to write in your backups, and the place you are writing your backups on must not have the same security flaws as them. Both offline media and well configured S3 can do. Although, I'd personally bet much more on my capacity of configuring a server than S3. Anyway, you can't go wrong with offline. The one thing you can't have is a NAS where your computers directly write the data.
- ericbarrett 5y agoI favor cloud storage here since you can configure write-only storage pools (without delete, or at least with versioning). Whereas "offline" backups must come online for new copies, and that's a window for infection of the hosting file system, barring well-configured snapshots or the like. Also it can be your second location for the "three copies, two locations" rule of thumb, especially if you are an SMB with only one physical space. (The opposite plays here, too. If everything you have is in the cloud, you should keep local backups.)
- normaler 5y agoWe are using borg to backup our Servers and each Server has its own user in the backupsystem, that allows to execute only the backup command in append mode, so an infected server can not destroy its backups.
- elzbardico 5y agoWell. They should go to the police!
- kosasbest 5y agoGood. Share the (stolen) wealth.
- dylan604 5y agoRobin Hood as a service?
- peter_retief 5y agoI just upvoted for the headline, clickbaited by the article complaining about crooks complaining about other crooks. I wonder if there is a name for this?
- BTCOG 5y agoSee right through your C2, seize it, so you see how we move. also I don't watch TV - I sit back - and watch cowrie hijack a box - patch the hole - like howdy - its me - ya new best friend show me the way that you planned to get these ends Snakes in the grass stay on my toes credentials contained within all these SQL rows no time for these hoes So what you gotta say to me? I need new information, f** all your old queries I'm planted like raspberries, Pycharm's filled with adversaries, static build, f** your external libraries.
- drummer 5y agoI can't get the humancetipede image out of my head with these gangs chainfucking eachother with revil being the last link in the chain
- nostrademons 5y agoNote that REvil is the group behind the Colonial Pipeline hack that took down gas supplies down the eastern seaboard earlier this year. They were taken offline by (presumably) the U.S. intelligence services shortly after that hack. It's interesting that a.) they're back and b.) a secret backdoor that allows REvil to override their affiliates and restore access themselves is found shortly afterwards. Particularly since REvil, in the immediate aftermath of Colonial Pipeline, before they were shut down, sent out a message to their affiliates forbidding any attacks on governments or critical infrastructure. An alternative explanation is that they cut a deal with the CIA where they are allowed to continue to operate in exchange for instituting a backdoor and handing over the keys to major Western governments, such that if they hit any "politically embarrassing" targets, the government can override the affiliate and restore operations. Keep your friends close and your enemies closer. It's often smarter to co-opt an adversary than it is to shut them down entirely.
- aradox66 5y agoLove this take
- syshum 5y ago>> An alternative explanation is that they cut a deal with the CIA where they are allowed to continue to operate in exchange for instituting a backdoor CIA would demand a cut of the revenue as well. It should be appalling that anyone would think this is a possibility but sadly I do not put anything past US Federal Agencies anymore