7 ms·

Does anyone remember REvil arrest anymore? https://krebsonsecurity.com/2022/01/at-request-of-u-s-russia-rounds-up-14-revil-ransomware-affiliates/ https://krebs

Does anyone remember REvil arrest anymore? https://krebsonsecurity.com/2022/01/at-request-of-u-s-russia-rounds-up-14-revil-ransomware-affiliates/ https://krebsonsecurity.com/2022/01/at-request-of-u-s-russia... Those people must be now be back to the business, national heroes and the era of ransomware diplomacy ended as fast as it started.

jacquesm 5y ago
The Russian version of a recruitment drive?
CryptoBanker 5y ago
Those 14 are just a drop in the bucket. Neither their arrest nor release will make much of a difference
- javajosh 5y ago
  Why is Russia so into hacking? Would it help if there was a startup community there to absorb the talent? Or is this the inevitable byproduct of bright people living under a brutally corrupt and dishonest dictator and his cronies for most of their lives?
  - uluyol 5y ago
    What makes you think Russia is special in this regard?
    - bee_rider 5y ago
      Well, you hear about Russian hackers on the news a lot, which would seem to indicate that either: 1) they are very good at hacking 2) they are not so good at hacking 3) Russia is a popular place for hackers to set up proxies
      - weq 5y ago
        All of the above!
      - xtian 5y ago
        4) The news is not geopolitically neutral
      - oefrha 5y ago
        Alternatively, news about hacking that you read, including their primary sources like Google/Microsoft/FireEye/whatever, usually suppress news about hacking by U.S. and allies. IIRC last year Google publicly announced a zero day actively exploited by the U.S. which was considered highly unusual, since apparently they usually just patch it without fuzz. The article was discussed here but I can’t find it now.
        fomine3 5y ago
        That's why Kaspersky is important. I wish they survive.
        bee_rider 5y ago
        This thread was kicked off by discussion about ransomware hacking, though. I'm sure US intelligence agencies get up to all sorts of no good, and I'm sure our news is less likely to report on it, but there doesn't seem to be an equivalent ransomware industry in the US (and the news has no reason to cover for petty hacking criminals in the US). Actually I don't see a ton of news about national-security related hacking by Russia.
        oefrha 5y ago
        Oh, TFA is about nation states so I was talking about that. Asymmetric commercial hacking is pretty easy to explain: hacking foreign entities is safer than hacking domestic ones in terms of risk exposure, and hacking entities in countries richer than yours is more attractive than the other way round.
        5y ago
  - labster 5y ago
    Which would you rather earn, 1000 rubles or 1000 dollars? Corruption is much more profitable than honesty in Russia.
  - bregma 5y ago
    This sort of thing has always been the domain of organized crime syndicates. Narcotics, prostitution, gambling, smuggling, and computer crime all take organization and capitalization. It's just that in some places such organizations control the reigns of political power brazenly and shamelessly.
  - godelski 5y ago
    > Why is Russia so into hacking? Same reason NK is. Same reason every country is. It is rather cheap in comparison. I mean even the largest super computers only cost a few hundred million. That's rather cheap when you consider other military adventures. One state of the art super computer is roughly the price of one (maybe 2) modern jets. The biggest cost is people. And you can do a ton of damage with hacking. The costs are low, benefits are high. [0] Summit was $350m, and a F22 costs $140m (per jet, not including development costs which is hundreds of billions)
    - ethbr0 5y ago
      What do super computers have to do with hacking?
      - tspike 5y ago
        The most immediate use case that comes to mind is breaking encryption.
      - speed_spread 5y ago
        Successfully hacking the Gibson it the ultimate challenge!
      - godelski 5y ago
        Not really much, but it was giving an example of the costs of computing in general. More like an upper bound. That you could buy crazy expensive computers and it would cost nowhere near what actual weapons systems cost. I was just trying to say that the cost for hacking is more in man power rather than machinery. And man power is far cheaper than machinery.
    - mrep 5y ago
      Where are you getting hundreds of billions? Wikipedia says "As production wound down in 2011, the total program cost is estimated to be about $67.3 billion, with $32.4 billion spent on Research, Development, Test and Evaluation (RDT&E) and $34.9 billion on procurement and military construction (MILCON) in then year dollars."
  - jazzyjackson 5y ago
    1. The Russian gov't looks the other way. Hackers in any other country might fear prosecution & extradition, but Russian hackers are protected as long as they don't attack Russians. There was some malware going around at one point where someone realized the payload didn't run if the user had a Russian keymap installed. 2. Kind of a "worse is better" phenomenon. This is apocryphal but while Americans and Europeans were digging into Apple IIs and Commodores, Russia just had crappy knockoff machines that didn't follow the behavior of the machines they were meant to be clones of, so anyone who stuck with it long enough basically taught themselves reverse engineering and the operation of "weird machines", how to operate in environments of undefined behavior. Thats just how I heard it, I'd like to learn more about their history since their space program was pretty one-to-one with ours, they definitely had computer engineers and programmers just as sophisticated as USA
    - javajosh 5y ago
      >they definitely had computer engineers and programmers just as sophisticated as USA Russians also have a world-class reputation in math and physics. At least they did in the 20th century. Now that experiments are so capital intensive, theoretical physics has become unfalsifiable silliness, I would assume that these people went into software. Although I could be wrong.
    - heavyset_go 5y ago
      > The Russian gov't looks the other way. Hackers in any other country might fear prosecution & extradition, but Russian hackers are protected as long as they don't attack Russians. You can see some of this with Anonymous and the FBI these days, too, and NSO Group and Israel. I wouldn't be surprised if most countries do this, now.
      - javajosh 5y ago
        How does that even work? Does the NSA post on 4chan asking for l33t hax0rs to do a job?
        dylan604 5y ago
  - webmaven 5y ago
    > Why is Russia so into hacking? Would it help if there was a startup community there to absorb the talent? Or is this the inevitable byproduct of bright people living under a brutally corrupt and dishonest dictator and his cronies for most of their lives? It may be worth taking a look at the conditions that first gave rise to the eastern European malware scene in the late 80's, particularly in the Soviet Union and Bulgaria: https://bontchev.nlcv.bas.bg/papers/factory.html https://bontchev.nlcv.bas.bg/papers/factory.html In particular, the presence of the necessary information and lack of economic opportunity gave rise to the original scene, and today that has transformed into an environment where the economic opportunity is directly tied to various for-profit black-hat activities (ransomware, identity theft and credit card fraud, etc.). It is possible to link the relative lack of other economic opportunities to corruption, and that is a valid observation, but if black hat activities weren't profitable and relatively safe from retaliation (as long as you avoid Russian targets), the scene would still be typified by disaffected individuals rather than organized professional groups. I'm not sure if creating a bunch of startups to soak up the extra talent would work, as the incentives to get a leg up on the competition via the Dark Arts (DDOS your competitor, spear-phishing their sales people, etc.) would still be pretty strong.
    - er4hn 5y ago
      This is the key comment. Free college education, glut of college trained programmers, lack of a legitimate job market.
      - afr0ck 5y ago
        France and Germany have free college education.
        ArnoVW 5y ago
        And an economy. Russian has the economy of Spain, with three times the population. And that economy is 50 percent oil and gas.
        5y ago
  - steve76 5y ago
  - raverbashing 5y ago
    On that subject we might ask if the Eastern recruiters care about things like background searches, "polygraphs" or what recreational substances the subjects use on their free time. But yeah it's all of the factors you mentioned.
  - Gravityloss 5y ago
    Less opportunities for startups for running actual stable business products there isn't helping either. I have heard a first hand story how the government just stopped some cloud access, which caused some company that had built its product on top of it to immediately close down.
cormacrelf 5y ago
Since the war began, a number of supposedly independent ransomware groups have publicly announced their allegiance to the Kremlin and the war effort, and their intention to carry out strikes. So the idea of the January arrests was probably part of a larger pattern of arresting criminals and telling them they get out of jail free if they come work for the state. Whether these particular ones have already been turned into assets useful against Ukraine is not clear. At minimum they’re not working against Putin. The idea of “ransomware diplomacy” was probably just a side benefit.

jacquesm 5y ago

The Russian version of a recruitment drive?

CryptoBanker 5y ago

Those 14 are just a drop in the bucket. Neither their arrest nor release will make much of a difference

javajosh 5y ago
Why is Russia so into hacking? Would it help if there was a startup community there to absorb the talent? Or is this the inevitable byproduct of bright people living under a brutally corrupt and dishonest dictator and his cronies for most of their lives?
- uluyol 5y ago
  What makes you think Russia is special in this regard?
  - bee_rider 5y ago
    Well, you hear about Russian hackers on the news a lot, which would seem to indicate that either: 1) they are very good at hacking 2) they are not so good at hacking 3) Russia is a popular place for hackers to set up proxies
    - weq 5y ago
      All of the above!
    - xtian 5y ago
      4) The news is not geopolitically neutral
    - oefrha 5y ago
      Alternatively, news about hacking that you read, including their primary sources like Google/Microsoft/FireEye/whatever, usually suppress news about hacking by U.S. and allies. IIRC last year Google publicly announced a zero day actively exploited by the U.S. which was considered highly unusual, since apparently they usually just patch it without fuzz. The article was discussed here but I can’t find it now.
      - fomine3 5y ago
        That's why Kaspersky is important. I wish they survive.
      - bee_rider 5y ago
        This thread was kicked off by discussion about ransomware hacking, though. I'm sure US intelligence agencies get up to all sorts of no good, and I'm sure our news is less likely to report on it, but there doesn't seem to be an equivalent ransomware industry in the US (and the news has no reason to cover for petty hacking criminals in the US). Actually I don't see a ton of news about national-security related hacking by Russia.
        oefrha 5y ago
        Oh, TFA is about nation states so I was talking about that. Asymmetric commercial hacking is pretty easy to explain: hacking foreign entities is safer than hacking domestic ones in terms of risk exposure, and hacking entities in countries richer than yours is more attractive than the other way round.
        5y ago
- labster 5y ago
  Which would you rather earn, 1000 rubles or 1000 dollars? Corruption is much more profitable than honesty in Russia.
- bregma 5y ago
  This sort of thing has always been the domain of organized crime syndicates. Narcotics, prostitution, gambling, smuggling, and computer crime all take organization and capitalization. It's just that in some places such organizations control the reigns of political power brazenly and shamelessly.
- godelski 5y ago
  > Why is Russia so into hacking? Same reason NK is. Same reason every country is. It is rather cheap in comparison. I mean even the largest super computers only cost a few hundred million. That's rather cheap when you consider other military adventures. One state of the art super computer is roughly the price of one (maybe 2) modern jets. The biggest cost is people. And you can do a ton of damage with hacking. The costs are low, benefits are high. [0] Summit was $350m, and a F22 costs $140m (per jet, not including development costs which is hundreds of billions)
  - ethbr0 5y ago
    What do super computers have to do with hacking?
    - tspike 5y ago
      The most immediate use case that comes to mind is breaking encryption.
    - speed_spread 5y ago
      Successfully hacking the Gibson it the ultimate challenge!
    - godelski 5y ago
      Not really much, but it was giving an example of the costs of computing in general. More like an upper bound. That you could buy crazy expensive computers and it would cost nowhere near what actual weapons systems cost. I was just trying to say that the cost for hacking is more in man power rather than machinery. And man power is far cheaper than machinery.
  - mrep 5y ago
    Where are you getting hundreds of billions? Wikipedia says "As production wound down in 2011, the total program cost is estimated to be about $67.3 billion, with $32.4 billion spent on Research, Development, Test and Evaluation (RDT&E) and $34.9 billion on procurement and military construction (MILCON) in then year dollars."
- jazzyjackson 5y ago
  1. The Russian gov't looks the other way. Hackers in any other country might fear prosecution & extradition, but Russian hackers are protected as long as they don't attack Russians. There was some malware going around at one point where someone realized the payload didn't run if the user had a Russian keymap installed. 2. Kind of a "worse is better" phenomenon. This is apocryphal but while Americans and Europeans were digging into Apple IIs and Commodores, Russia just had crappy knockoff machines that didn't follow the behavior of the machines they were meant to be clones of, so anyone who stuck with it long enough basically taught themselves reverse engineering and the operation of "weird machines", how to operate in environments of undefined behavior. Thats just how I heard it, I'd like to learn more about their history since their space program was pretty one-to-one with ours, they definitely had computer engineers and programmers just as sophisticated as USA
  - javajosh 5y ago
    >they definitely had computer engineers and programmers just as sophisticated as USA Russians also have a world-class reputation in math and physics. At least they did in the 20th century. Now that experiments are so capital intensive, theoretical physics has become unfalsifiable silliness, I would assume that these people went into software. Although I could be wrong.
  - heavyset_go 5y ago
    > The Russian gov't looks the other way. Hackers in any other country might fear prosecution & extradition, but Russian hackers are protected as long as they don't attack Russians. You can see some of this with Anonymous and the FBI these days, too, and NSO Group and Israel. I wouldn't be surprised if most countries do this, now.
    - javajosh 5y ago
      How does that even work? Does the NSA post on 4chan asking for l33t hax0rs to do a job?
      - dylan604 5y ago
- webmaven 5y ago
  > Why is Russia so into hacking? Would it help if there was a startup community there to absorb the talent? Or is this the inevitable byproduct of bright people living under a brutally corrupt and dishonest dictator and his cronies for most of their lives? It may be worth taking a look at the conditions that first gave rise to the eastern European malware scene in the late 80's, particularly in the Soviet Union and Bulgaria: https://bontchev.nlcv.bas.bg/papers/factory.html https://bontchev.nlcv.bas.bg/papers/factory.html In particular, the presence of the necessary information and lack of economic opportunity gave rise to the original scene, and today that has transformed into an environment where the economic opportunity is directly tied to various for-profit black-hat activities (ransomware, identity theft and credit card fraud, etc.). It is possible to link the relative lack of other economic opportunities to corruption, and that is a valid observation, but if black hat activities weren't profitable and relatively safe from retaliation (as long as you avoid Russian targets), the scene would still be typified by disaffected individuals rather than organized professional groups. I'm not sure if creating a bunch of startups to soak up the extra talent would work, as the incentives to get a leg up on the competition via the Dark Arts (DDOS your competitor, spear-phishing their sales people, etc.) would still be pretty strong.
  - er4hn 5y ago
    This is the key comment. Free college education, glut of college trained programmers, lack of a legitimate job market.
    - afr0ck 5y ago
      France and Germany have free college education.
      - ArnoVW 5y ago
        And an economy. Russian has the economy of Spain, with three times the population. And that economy is 50 percent oil and gas.
        5y ago
- steve76 5y ago
- raverbashing 5y ago
  On that subject we might ask if the Eastern recruiters care about things like background searches, "polygraphs" or what recreational substances the subjects use on their free time. But yeah it's all of the factors you mentioned.
- Gravityloss 5y ago
  Less opportunities for startups for running actual stable business products there isn't helping either. I have heard a first hand story how the government just stopped some cloud access, which caused some company that had built its product on top of it to immediately close down.

cormacrelf 5y ago

Since the war began, a number of supposedly independent ransomware groups have publicly announced their allegiance to the Kremlin and the war effort, and their intention to carry out strikes. So the idea of the January arrests was probably part of a larger pattern of arresting criminals and telling them they get out of jail free if they come work for the state. Whether these particular ones have already been turned into assets useful against Ukraine is not clear. At minimum they’re not working against Putin. The idea of “ransomware diplomacy” was probably just a side benefit.