4 ms·

I saw a pitch for a security startup (the name escapes me) that did exactly this. They put like ten thousand dollars in a bitcoin wallet and hide it on all your

by mike_d 5y ago

I saw a pitch for a security startup (the name escapes me) that did exactly this. They put like ten thousand dollars in a bitcoin wallet and hide it on all your end users machines. The idea being that an attacker will cash out the wallet giving you a heads up you are breached before they move on to ransomware or whatever.

na85 5y ago
I remember that startup too, but they apparently have awful SEO because I have been trying to find them for like 10 minutes and can't. There's a lesson for founders here.
bowmessage 5y ago
That key word being _before_. A savvy attacker could be taking note of the private keys as they went; cashing out the Bitcoin only when the customer data has been fully pilfered and the ransomware installed. I suppose the balancing act here is in ensuring the Bitcoin amount is enticingly large enough to get an attacker to jump on it first?
- goodside 5y ago
  It’s not worth it, because there’s a risk of the money being moved to another wallet if the intrusion is discovered. You want to take the money the instant you can.
  - heavyset_go 5y ago
    If someone or a group is going to hit businesses with ransomware, they're looking to get more than $10k.
    - throwaway290 5y ago
      That's 100% guaranteed $10k now vs. ransom maybe (how do you know if they have backup) paid some time later.
      - loceng 5y ago
        There's a pretty high payout rate.
      - heavyset_go 5y ago
        At least to me, it's like putting a $100 bill under a business' doormat to ward off burglars who know that there's 3 to 4 orders of magnitude more money and assets inside if they break in. It's a nice bonus, but if they're working with other people for high stakes payouts, a small amount of money like that isn't going to be worth it for them to move on. $10k is nothing when split between other people and when you can demand hundreds of thousands to millions otherwise.
        throwaway290 5y ago
        I do not think literally hundreds of people work on these hacks. But besides, in remote environment it is easier to be that guy who grabs the money and runs. $10k is $10k for a single person.
  - dmurray 5y ago
    You could also just rotate the private keys every week or month by policy, and make sure attackers know it's at least likely you're doing this.
    - reflexco 5y ago
      Even better, rotate at random intervals.
suction 5y ago
I don't want to be the Hacker who as to go to Putin to explain that their nation-state sponsored hack was caught and failed because they were trying to make 10 grand on the side. So, this won't help much against nation-state attacks.
- capableweb 5y ago
  Not everyone has the sole aim of protecting themselves from nation-state attacks. And for the ones that do have the aim, few things will actually protect you, as they basically have infinitive ways of getting in and failing technical vectors, they have legal ones too.
beckman466 5y ago
> They put like ten thousand dollars in a bitcoin wallet and hide it on all your end users machines. The idea being that an attacker will cash out the wallet giving you a heads up you are breached before they move on to ransomware or whatever. wow that is the craziest justification i have heard so far for sustaining a planet-eating, nightmare 'currency'
Jonydude 5y ago
we’ve been offering a similar service for the past year at: bittrap.com
Jonydude 5y ago
Hi everyone… just a quick intro, we are BitTrap, the company you are referring to in multiple posts of this thread…. Criticism on SEO is noted and acknowledged…we’ll fix that. Regarding the Stakedy article, that is exactly what we do: BitTrap is a blockchain-based intrusion detection system that provides alarms when a system was compromised. We do so by granting hackers an economic incentive (bounty) in crypto to reveal their position within the organization's network and dissuade them to continue the attack therefore minimizing their dwell time in the system. We calculate the right economic incentive by running tests in our Lab to replicate possible outcomes in diverse situations and we also protect pretty much any device you can think of (even offline devices) becoming a real Universal Intrusion Detection System. As we don’t want to get pitchy here, we’ll just leave some reference links to let you find out more about us: www.bittrap.com We have a few whitepapers and articles you may also find interesting: https://www.bittrap.com/resource/articles-whitepapers https://www.bittrap.com/resource/articles-whitepapers Let us know if you’d like more info or detail. Thanks for the (indirect) mention :) Jony BitTrap CEO

by mike_d 5y ago

na85 5y ago

I remember that startup too, but they apparently have awful SEO because I have been trying to find them for like 10 minutes and can't. There's a lesson for founders here.

bowmessage 5y ago

That key word being _before_. A savvy attacker could be taking note of the private keys as they went; cashing out the Bitcoin only when the customer data has been fully pilfered and the ransomware installed. I suppose the balancing act here is in ensuring the Bitcoin amount is enticingly large enough to get an attacker to jump on it first?

goodside 5y ago
It’s not worth it, because there’s a risk of the money being moved to another wallet if the intrusion is discovered. You want to take the money the instant you can.
- heavyset_go 5y ago
  If someone or a group is going to hit businesses with ransomware, they're looking to get more than $10k.
  - throwaway290 5y ago
    That's 100% guaranteed $10k now vs. ransom maybe (how do you know if they have backup) paid some time later.
    - loceng 5y ago
      There's a pretty high payout rate.
    - heavyset_go 5y ago
      At least to me, it's like putting a $100 bill under a business' doormat to ward off burglars who know that there's 3 to 4 orders of magnitude more money and assets inside if they break in. It's a nice bonus, but if they're working with other people for high stakes payouts, a small amount of money like that isn't going to be worth it for them to move on. $10k is nothing when split between other people and when you can demand hundreds of thousands to millions otherwise.
      - throwaway290 5y ago
        I do not think literally hundreds of people work on these hacks. But besides, in remote environment it is easier to be that guy who grabs the money and runs. $10k is $10k for a single person.
- dmurray 5y ago
  You could also just rotate the private keys every week or month by policy, and make sure attackers know it's at least likely you're doing this.
  - reflexco 5y ago
    Even better, rotate at random intervals.

suction 5y ago

I don't want to be the Hacker who as to go to Putin to explain that their nation-state sponsored hack was caught and failed because they were trying to make 10 grand on the side. So, this won't help much against nation-state attacks.

capableweb 5y ago
Not everyone has the sole aim of protecting themselves from nation-state attacks. And for the ones that do have the aim, few things will actually protect you, as they basically have infinitive ways of getting in and failing technical vectors, they have legal ones too.

beckman466 5y ago

> They put like ten thousand dollars in a bitcoin wallet and hide it on all your end users machines. The idea being that an attacker will cash out the wallet giving you a heads up you are breached before they move on to ransomware or whatever. wow that is the craziest justification i have heard so far for sustaining a planet-eating, nightmare 'currency'

Jonydude 5y ago

we’ve been offering a similar service for the past year at: bittrap.com

Jonydude 5y ago

Hi everyone… just a quick intro, we are BitTrap, the company you are referring to in multiple posts of this thread…. Criticism on SEO is noted and acknowledged…we’ll fix that. Regarding the Stakedy article, that is exactly what we do: BitTrap is a blockchain-based intrusion detection system that provides alarms when a system was compromised. We do so by granting hackers an economic incentive (bounty) in crypto to reveal their position within the organization's network and dissuade them to continue the attack therefore minimizing their dwell time in the system. We calculate the right economic incentive by running tests in our Lab to replicate possible outcomes in diverse situations and we also protect pretty much any device you can think of (even offline devices) becoming a real Universal Intrusion Detection System. As we don’t want to get pitchy here, we’ll just leave some reference links to let you find out more about us: www.bittrap.com We have a few whitepapers and articles you may also find interesting: https://www.bittrap.com/resource/articles-whitepapers https://www.bittrap.com/resource/articles-whitepapers Let us know if you’d like more info or detail. Thanks for the (indirect) mention :) Jony BitTrap CEO