7 ms·

I thiink I can see why Revil added the backdoor. It's not to steal ransoms. It's to prevent too juicy a target. There have been reports of crews stating "we wo

by rocqua 5y ago

I thiink I can see why Revil added the backdoor. It's not to steal ransoms. It's to prevent too juicy a target. There have been reports of crews stating "we won't hit hospitals in covid". With this backdoor, if your customers hit a hospital, you can hold your promise. Even worse than hospitals (from their perspective) is agitating the American intelligence services. Hit too many pipelines, or similar high-news high-impact targets and 'national security threat' is your new name. Worse than that still, imagine one of your affiliates is stupid enough to target inside Russia. You need to keep the Russians happy or all of a sudden trial or extradition become likely outcomes. At the same time, once you have the opportunity, why not use back door for some more money. Glad to see that they still aren't fully cooperating like legal businesses yet.

schleck8 5y ago
The Duesseldorf hospital was hit by ransomware and a patient died during the outage. I'm not saying that all ransom gangs are coldhearted, but let's not frame them to have morals
- 4gotunameagain 5y ago
  I don't think it is about morals, but more about avoiding trouble. And I also wouldn't find it too hard to believe that there must be at least some ransomware groups with morals. Not the same as yours, sure
  - miohtama 5y ago
    When you hit a national security target, you get NSA and CIA after you. They have vast resources to make your life difficult wherever you are.
    - deleted 5y ago
      [deleted]
    - netrus 5y ago
      On the other hand, why shouldn't NSA and CIA be invested 100% in pushing back on these attacks already? The potential harm from this vector is obviously gigantic, so why wait for a really significant attack to happen?
      - aborsy 5y ago
        Ransomware make private sector aware of security issues and resilient against attacks. It’s like developing antibodies to viruses. NSA rather not to interfere, unless infrastructure is involved. Interference from public sector may actually not be successful in the long run, as companies simply adjust to that, and keep ignoring security at a new equilibrium level.
        CryptoPunk 5y ago
        Not suggesting you're doing this, but their existence should still not be framed as positive. They are malicious and sophisticated, and should be pursued accordingly. If they're willing to extort others by holding their data ransom, there's no telling what else they may be willing to do. But yes, ransomware does lead to a hardening of network infrastructure, and reduces the likelihood of successful espionage operations, by alerting parties - via the ransomware attack - to security vulnerabilities.
      - vkou 5y ago
        > On the other hand, why shouldn't NSA and CIA be invested 100% in pushing back on these attacks already? For the same reason that neither them, nor the Army doesn't serve drug warrants, or investigate tax evasion. Because policing is not their mandate. That's the job of either your local police department, or the FBI, or any one of a number of the other federal police forces.
        shkkmo 5y ago
        If ransomware gangs are seen as a potential threat to national security, wouldn't preemptive action against these groups fall under the claimed remit of the NSA or CIA?
- GravitasFailure 5y ago
  The target was a different university, and when the scammers realized their mistake they handed over the encryption keys. I wouldn't say morals play no role, since someone that is perfectly fine robbing a wealthy institution isn't automatically going to be OK with causing someone's death, but there absolutely is risk management at play since the hunt for someone that stole a few hundred thousand dollars is going to be much lower priority than a hunt for a killer.
- rocqua 5y ago
  Not at all suggesting they have morals. I'm suggesting it makes business sense to avoid targeting hospitals. Because people will come after you much harder if you do that too often. If the NSA starts deploying the TAO against ransomware crews, the crews are going to have a much MUCH harder time actually making money.
- loopback_device 5y ago
  An investgation later revealed that the patient's death was not caused by the ransomware attack, and the patient would've died regardless.
- Sosh101 5y ago
  Surely any ransomware attack is coldhearted? It's only effective if you are threatening something the target really cares about.
  - asddubs 5y ago
    Was robin hood coldhearted? I certainly don't mean to suggest any ransomware group has motivations that noble, but I don't think you can generally say that
    - DFHippie 5y ago
      A better question: was Robin Hood a real person whose behavior could serve as evidence?
      - asddubs 5y ago
        does it matter if it's just used as a counterexample to make a point while speaking in general terms?
    - jokethrowaway 5y ago
      Absolutely. Theft is violence and it's morally wrong no matter the circumstances. It doesn't matter if you're stealing a piece of bread not to starve, if you're stealing the money to save the lives of orphans, to help the homeless or pay for hospitals. It doesn't matter if you're an individual, a dictator's army or a democratically elected government. Theft is theft.
      - stjohnswarts 5y ago
        Doesn't mean it's morally wrong. Robin Hood was taking back and returning what was stolen from peasants by the Sheriff (and other nobles) by overtaxation and straight up "this is mine now" antics. These were people that had no right to what they were taking. If beat the crap out of the guy I ran down after he stole my garden gnome that's justice of a sort.
      - 5y ago
hnlmorg 5y ago
> Worse than that still, imagine one of your affiliates is stupid enough to target inside Russia. You need to keep the Russians happy or all of a sudden trial or extradition become likely outcomes. I read somewhere that a lot of these attacks are orchestrated by Russians because the Russian authorities will turn a blind eye as long as such attacks don't hit domestic targets.
- ianhawes 5y ago
  It has been common knowledge for years that most malware and ransomware look for the presence of a Cyrillic keyboard and exit quietly if it’s found.
  - deleted 5y ago
    [deleted]
  - Sosh101 5y ago
    Anything to support that? Seems like an easy step to protect yourself if true.
    - nvr219 5y ago
      This is where I learned of this "trick": https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
      - sysihyk 5y ago
        Honestly, this looks like yet another Russian Hoax iteration. Also, made me to figure Brian Krebs is merely a journalist, while real infosec researcher is Chris Krebs.
        threeseed 5y ago
        They also talked to other people including the Founder and Chief Research Officers at Unit221B about whether workarounds e.g. adding an additional keyboard were effective. So clearly it's well known that this is real and accurate just as most of the reporting is on Russia.
baybal2 5y ago
FYI: Russia has no extraditions
wikidani 5y ago
>Worse than that still, imagine one of your affiliates is stupid enough to target inside Russia. You need to keep the Russians happy or all of a sudden trial or extradition become likely outcomes. I heard (and it might be just people making stuff up) that if you had cyrilic anything in your PC some ransomware would avoid you entirely, now, that's probably false but I am interested in knowing how would they avoid infecting russian computers.
- Kiro 5y ago
  https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
SenHeng 5y ago
Remember the amazing/terrible hacker movie Swordfish? You just described it. Maybe now other world powers need their own domestic equivalents. Or if they already do, then something that’s a bit more overt.

by rocqua 5y ago

schleck8 5y ago

The Duesseldorf hospital was hit by ransomware and a patient died during the outage. I'm not saying that all ransom gangs are coldhearted, but let's not frame them to have morals

4gotunameagain 5y ago
I don't think it is about morals, but more about avoiding trouble. And I also wouldn't find it too hard to believe that there must be at least some ransomware groups with morals. Not the same as yours, sure
- miohtama 5y ago
  When you hit a national security target, you get NSA and CIA after you. They have vast resources to make your life difficult wherever you are.
  - deleted 5y ago
    [deleted]
  - netrus 5y ago
    On the other hand, why shouldn't NSA and CIA be invested 100% in pushing back on these attacks already? The potential harm from this vector is obviously gigantic, so why wait for a really significant attack to happen?
    - aborsy 5y ago
      Ransomware make private sector aware of security issues and resilient against attacks. It’s like developing antibodies to viruses. NSA rather not to interfere, unless infrastructure is involved. Interference from public sector may actually not be successful in the long run, as companies simply adjust to that, and keep ignoring security at a new equilibrium level.
      - CryptoPunk 5y ago
        Not suggesting you're doing this, but their existence should still not be framed as positive. They are malicious and sophisticated, and should be pursued accordingly. If they're willing to extort others by holding their data ransom, there's no telling what else they may be willing to do. But yes, ransomware does lead to a hardening of network infrastructure, and reduces the likelihood of successful espionage operations, by alerting parties - via the ransomware attack - to security vulnerabilities.
    - vkou 5y ago
      > On the other hand, why shouldn't NSA and CIA be invested 100% in pushing back on these attacks already? For the same reason that neither them, nor the Army doesn't serve drug warrants, or investigate tax evasion. Because policing is not their mandate. That's the job of either your local police department, or the FBI, or any one of a number of the other federal police forces.
      - shkkmo 5y ago
        If ransomware gangs are seen as a potential threat to national security, wouldn't preemptive action against these groups fall under the claimed remit of the NSA or CIA?
GravitasFailure 5y ago
The target was a different university, and when the scammers realized their mistake they handed over the encryption keys. I wouldn't say morals play no role, since someone that is perfectly fine robbing a wealthy institution isn't automatically going to be OK with causing someone's death, but there absolutely is risk management at play since the hunt for someone that stole a few hundred thousand dollars is going to be much lower priority than a hunt for a killer.
rocqua 5y ago
Not at all suggesting they have morals. I'm suggesting it makes business sense to avoid targeting hospitals. Because people will come after you much harder if you do that too often. If the NSA starts deploying the TAO against ransomware crews, the crews are going to have a much MUCH harder time actually making money.
loopback_device 5y ago
An investgation later revealed that the patient's death was not caused by the ransomware attack, and the patient would've died regardless.
Sosh101 5y ago
Surely any ransomware attack is coldhearted? It's only effective if you are threatening something the target really cares about.
- asddubs 5y ago
  Was robin hood coldhearted? I certainly don't mean to suggest any ransomware group has motivations that noble, but I don't think you can generally say that
  - DFHippie 5y ago
    A better question: was Robin Hood a real person whose behavior could serve as evidence?
    - asddubs 5y ago
      does it matter if it's just used as a counterexample to make a point while speaking in general terms?
  - jokethrowaway 5y ago
    Absolutely. Theft is violence and it's morally wrong no matter the circumstances. It doesn't matter if you're stealing a piece of bread not to starve, if you're stealing the money to save the lives of orphans, to help the homeless or pay for hospitals. It doesn't matter if you're an individual, a dictator's army or a democratically elected government. Theft is theft.
    - stjohnswarts 5y ago
      Doesn't mean it's morally wrong. Robin Hood was taking back and returning what was stolen from peasants by the Sheriff (and other nobles) by overtaxation and straight up "this is mine now" antics. These were people that had no right to what they were taking. If beat the crap out of the guy I ran down after he stole my garden gnome that's justice of a sort.
    - 5y ago

hnlmorg 5y ago

> Worse than that still, imagine one of your affiliates is stupid enough to target inside Russia. You need to keep the Russians happy or all of a sudden trial or extradition become likely outcomes. I read somewhere that a lot of these attacks are orchestrated by Russians because the Russian authorities will turn a blind eye as long as such attacks don't hit domestic targets.

ianhawes 5y ago
It has been common knowledge for years that most malware and ransomware look for the presence of a Cyrillic keyboard and exit quietly if it’s found.
- deleted 5y ago
  [deleted]
- Sosh101 5y ago
  Anything to support that? Seems like an easy step to protect yourself if true.
  - nvr219 5y ago
    This is where I learned of this "trick": https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
    - sysihyk 5y ago
      Honestly, this looks like yet another Russian Hoax iteration. Also, made me to figure Brian Krebs is merely a journalist, while real infosec researcher is Chris Krebs.
      - threeseed 5y ago
        They also talked to other people including the Founder and Chief Research Officers at Unit221B about whether workarounds e.g. adding an additional keyboard were effective. So clearly it's well known that this is real and accurate just as most of the reporting is on Russia.

baybal2 5y ago

FYI: Russia has no extraditions

wikidani 5y ago

>Worse than that still, imagine one of your affiliates is stupid enough to target inside Russia. You need to keep the Russians happy or all of a sudden trial or extradition become likely outcomes. I heard (and it might be just people making stuff up) that if you had cyrilic anything in your PC some ransomware would avoid you entirely, now, that's probably false but I am interested in knowing how would they avoid infecting russian computers.

Kiro 5y ago
https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

SenHeng 5y ago

Remember the amazing/terrible hacker movie Swordfish? You just described it. Maybe now other world powers need their own domestic equivalents. Or if they already do, then something that’s a bit more overt.