8 ms·
I happened to be in Vegas during this. It was weird. Parking at the MGM was free because they had no way to take credit cards. Rumor was that Caesars was hit b
by btilly 3y ago
I happened to be in Vegas during this. It was weird. Parking at the MGM was free because they had no way to take credit cards.
Rumor was that Caesars was hit by the same group, and paid the ransom.
As a reminder, these attacks are overwhelmingly carried out by Russian gangs, and are only possible because of crypto. See https://www.lawfaremedia.org/article/ransomware-problem-bitcoin-problem https://www.lawfaremedia.org/article/ransomware-problem-bitc... for more.
- improv 3y ago>only possible because of crypto Marcus Hutchins: Why Destroying Bitcoin Wouldn't Stop Corporate Ransomware https://youtu.be/LDIGJRd_PyE?si=-TUIEnONm3_D8LzZ https://youtu.be/LDIGJRd_PyE?si=-TUIEnONm3_D8LzZ
- 2OEH8eoCRo0 3y agoWho is this and why should I care what they think? It's a fact these criminals use crypto currencies. Why do they use them?
- mminer237 3y agoThat did not need to be a 12-minute video. I don't know if it would stop it, but without cryptocurrencies, it would certainly be much less. Laundering USD is significantly harder than laundering Bitcoin.
- jandrese 3y agoI have to imagine one of these big corporate hack groups asking MGM to go to their local CVS and buy $500,000 of gift cards like the old days.
- diggan 3y ago> Laundering USD is significantly harder than laundering Bitcoin. What exactly do you think people "launder" Bitcoin to? Why would it be harder to launder dirty USD than Bitcoin? The end goal is the same, clean money you can use for any purpose. With USD, you only need to nestle it into a clean business that doesn't get scrutinized. Add in a step between with Bitcoin and suddenly it becomes harder. I think the main issue is that with USD you need a dirty entry point that could compromise you at the moment of transfer, rather than with Bitcoin where you can chose the exit point whenever you want, and the entry is less risky. But still, adding Bitcoin to mix further complicates and adds risk to the overall process. > without cryptocurrencies, it would certainly be much less Isn't the (estimated) USD black market without cryptocurrencies vastly bigger than the black market of Bitcoin already, has been since forever and seems to continue to be like this for the foreseeable future?
- wongarsu 3y agoI think laundering is the wrong term. You are right that obviously you need to launder it, now matter the currency. But the path of the money is easier to conceal with crypto than with bank transactions, because in crypto there's a large amount of potential middlemen that don't follow any KYC regulations. Of course you can do the same thing with USD by using cash. A package of cash mailed to a fake address (where your courier receives the package from the mailman) is as untraceable as anything you can do with crypto. It is however more effort and potential risk.
- verteu 3y agoA more precise version of GP's comment might be: "Transferring USD to a hostile nation is significantly harder than transferring Bitcoin. Crypto's ratio of criminal to legitimate use-cases is tiny compared to USD, and continues to shrink."
- biggc 3y agoCasinos charge for parking now???
- btilly 3y agoThey do if you're staying at the hotel for multiple days for a conference.
- someotherperson 3y agoProbably offer free parking for LV locals and members of their Casino. I don't see why they wouldn't charge non-members or people out of town. If you can't afford the $10-15 to pay for parking then the likelihood of you going in there to blow your money is reduced. It's actually a great filter: it makes sure that people are already financially committed and keeps away tourists that don't want to spend.
- hazelnut 3y agoCurrently in Vegas. Many hotels charge between $15 and $25 a night
- yard2010 3y agoWhich kinda makes them the real criminals..
- gear54rus 3y agoI sometimes wonder if there's a paid US government campaign to slander crypto. Because I can't see how otherwise tech literate people can't understand the obvious upsides of such a system and keep blaming it for unrelated things.
- jc_811 3y agoI’m tech literate and very much not paid by the US govt From my point of view I rag on crypto because I’ve yet to see it produce any real world value outside of scams, frauds, and illegal activity. Traditional finance is slow and cautious on purpose. Having to deal with each country’s laws, regulations, and individual sovereignty is very much a real thing. A platform like venmo could do instantaneous cross border payments today if it were only a technical problem. But it’s not. It’s a human problem that arises from countries governing themselves with their own banking and finance laws. Now, if your argument is that we should ditch countries sovereignty and ignore laws to make finance quicker, easier, and more private; then that’s argument I can understand. I don’t agree with that argument at all, but if that’s an opinion of someone I can see why an anarchistic point of view could resonate.
- 1970-01-01 3y agoI totally agree, but would like to point out that this hasn't always been true. At first, bitcoin was a legitimate but obscure currency. I have receipts for selling used computer parts on Bitmit. Bitmit shut down in November 2013. Very quickly after, the remaining legitimate online marketplaces disappeared. Bitcoin started as a real world solution and has fully regressed into a joke. https://en.bitcoin.it/wiki/Bitmit https://en.bitcoin.it/wiki/Bitmit
- red-iron-pine 3y agoBTC was never a real solution outside of a few SV hacker bros buying VPNs, hosting, or computer parts with it. How many burritos did you get at 7/11 via BTC payments? I bought a car during COVID -- there weren't any places for me to pay for it with BTC. My mom didn't, and won't, use it for anything. That like 5 dudes in San Fran bought or sold a house with it is really just exceptions proving the rule.
- josu 3y ago>and are only possible because of x[-1] x = ["languages", "alphabets", "keyboards", "electricity", "computers", "linux/windows", "internet", "crypto"] I have the suspicion that we'll be blaming AI soon. Besides, while crypto is definitely useful, the financial system seems to work fine too. "U.S. banks and financial institutions processed roughly $1.2 billion in likely ransomware payments in 2021" https://www.cnbc.com/2022/11/01/us-banks-process-roughly-1point2-billion-in-ransomware-payments-in-2021.html https://www.cnbc.com/2022/11/01/us-banks-process-roughly-1po...
- alephnerd 3y agoHow do you transfer a monetary ransom to an organization operating within a country that is blocked from accessing western financial infrastructure? You can't use USD bank transfers (you open yourself up to SEC and DoJ prosecution), you can't use gold (the logistics are near impossible), and you can't transfer assets (same story as above). Crypto is unique in that it's both a virtual store of assets, and has infrastructure that can exist independent of western financial infrastructure
- strathmeyer 3y agoThey get people to buy gift cards still
- alephnerd 3y agoThat doesn't scale to the $100k-1M+ ransoms such as the MGM example.
- from 3y agoThere's something called "business email compromise" with annual losses about 10x that of ransomware. It relies on tricking companies into paying invoices to an attacker controlled bank account instead of their actual vendors' bank account. Google lost over a hundred million dollars to some Latvian guy who was able to pull this off by pretending to be Quanta Computer. There's also just bank fraud in the Zeus style where they transfer $200000 out of your account to some company in China or Bulgaria. These scams are all still incredibly profitable despite relying entirely on the regular financial system. There is no reason to think ransomware would stop in the absence of cryptocurrency given that extensive infrastructure has existed and currently exists to "cashout" proceeds of fraud. And in the ransomware case it's even easier because the victim is willingly making the payment, and the attacker can just not give the decryption key if the victim trys to stop the payment in any way. And yes, this scales. If you ever looked at the promoted stories on Snapchat a few years ago, you may have seen a user with the name "The Billionaire Gucci Master" living a very opulent lifestyle. That was all paid for with business email compromise money.
- bluetidepro 3y ago> ...only possible because of crypto. Yeah, it's a bummer the perfect/no crime world we lived in pre-crypto got ruined by crypto. /sarcasm
- 1970-01-01 3y ago>and are only possible because of crypto I want to pick on this, because its both true and untrue, depending on how far back you look at this illegitimate business. Ransoms did not use crypto at first, but they are now the de facto payment. Antiquated ransom payment via gift cards, MoneyPak, Western Union, etc. are all still viable options for gangs.
- flatiron 3y ago"yes MGM please go to your local CVS and pick up a green dot card and fill it with 10 million dollars and give me the code on the back once completed"
- kube-system 3y agoThe daily deposit limit is $1500, so it'll take over 18 years to load it all on there.
- oivey 3y agoYou could never extort MGM with gift cards.
- btilly 3y agoThose are all viable options for gangs that target individuals. But it is a whack-a-mole game that severely limits their potential profits. The current scale and profitability is based on hitting companies for large amounts of money. And that very much depends on crypto.
- jghn 3y agoI was at a MGM property in Vegas this weekend and it was still not fully functional. Most things worked but there were little quirks all over the place. For instance one morning some of the food vendors weren't able to charge to rooms, but others were.
- smileysteve 3y agoIf we're going to blame crypto, then you also need to blame the NSA first, EternalBlue being leaked was the starting point for most of these. https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue
- red-iron-pine 3y agocrytpo and ransomware were a thing well before EternalBlue getting leaked in 2017
- LeifCarrotson 3y ago> are only possible because of crypto Perhaps they were first figured out because of crypto, but now that the genie is out of the bottle they can't be regulated away. They'll continue to be possible even if the government of a victim nation cracks down on Bitcoin. As long as: 1. Computers are complicated, it will be possible to trick users into running software that does things they don't want, and 2. Factoring numbers is harder than multiplying numbers, it will be possible to use asymmetric cryptography to encrypt those files, and 3. Money can be sent across international borders, because rich countries want to buy cheap stuff from poor countries, and 4. Jurisdiction ends at national borders, so Russian gangs won't get prosecuted for receiving money from American/European victims, ransomware will continue. Sure, Viagra spam stopped working when credit card companies cracked down because while someone will send $100 over a credit card in the privacy of their home, if you make it too difficult they're going to give up. But the corporate ransomware model doesn't cease to work if instead of having your negotiation team turn the corporation's cash into Bitcoins they instead have to go to Western Union and turn it into rubles. We're talking about a $100M transaction, heck, you could charter a plane to Russia and it would be a rounding error in the end.
- tw04 3y ago> But the corporate ransomware model doesn't cease to work if instead of having your negotiation team turn the corporation's cash into Bitcoins they instead have to go to Western Union and turn it into rubles. We're talking about a $100M transaction, heck, you could charter a plane to Russia and it would be a rounding error in the end. Do you seriously think that: A. Any western union on the planet keeps $10m cash on hand or even 10% of that? B. The US would even allow western union to participate? Crypto is absolutely a requirement for this racket to work.
- lowercased 3y agoI thought I'd heard that the initial compromise was social engineering to get some initial access to a tech person's account. ? All your 4 points stand, but social engineering may be making a comeback too.
- 3y ago
- dumbfounder 3y agoAnd if we didn't have this stupid internet thing these hacks would be almost entirely mitigated! Also, computers too. And humans.
- zaphod420 3y agocryptocurrency is not the problem here. Humans are.
- lesuorac 3y agoRansomware is from 1989 [1] and BitCoin is from 2008 [2] so quite trivially we'd still have ransom demands without crypto. You think those Somali pirates took BitCoin? When you're requesting millions from a target the payment method becomes fungible; do you think MGM has a million bitcoin to give? No they go out and spend cash to get the bitcoin and then give it. If the attackers requested diamonds then instead you'd have to go out and buy diamonds and then give them. Cutting off credit cards worked because the payment method was not fungible. If they didn't accept CC then they're not getting orders. [1]: https://en.wikipedia.org/wiki/Ransomware#History https://en.wikipedia.org/wiki/Ransomware#History [2]: https://en.wikipedia.org/wiki/Bitcoin https://en.wikipedia.org/wiki/Bitcoin
- SoftTalker 3y ago> do you think MGM has a million bitcoin to give? They might... do they accept bitcoin at their casinos or online gambling sites?
- fuzzylightbulb 3y agoA million bitcoin? Absolutely not, that would be 1/19 of all bitcoin ever created and would be worth nearly 28 billion dollars. MGM's market cap is less than 13 billion dollars. A million dollars worth of bitcoin? Probably, and even if they didn't it would be trivial for them to get.
- SoftTalker 3y agoUm yeah, granted. I (mis)read that as $1M worth of bitcoin.
- fuzzylightbulb 3y agoHard disagree. Crypto is the only real way to move large sums of illicit money across the world. The people that attacked MGM aren't going to show up to accept cash or diamonds, and Steve Wynn isn't going to hop on a plane to Moscow with a duffle bag of nonsequential hundred dollar bills. Do you expect the crypto gangs to include a PO box number? Dead drop on a bridge Big Lebowski style? Of course not. Payment networks are obviously not an option. Visa and her peers are not going to deliver the funds. The only thing left is crypto. In fact it is the only use case where crypto is the preferable solution. I'll quote Stephen Diehl: "Any application that could be done on a blockchain could be better done on a centralized database. Except crime." [https://www.stephendiehl.com/blog/nothing-burger.html https://www.stephendiehl.com/blog/nothing-burger.html] Also, the first paragraph of your first link (the Wikipedia page for "Ransomwware") literally ends with "... and difficult to trace digital currencies such as paysafecard or Bitcoin and other cryptocurrencies are used for the ransoms, making tracing and prosecuting the perpetrators difficult." Crypto and ransomware are absolutely intertwined in 2023, and have been for well over a decade.
- tempsy 3y agoInteresting choice because not paying the ransom means throwing their customers under the bus. AFAIK Caesars customers were never exploited after the fact. On Twitter I'm hearing MGM Sports Betting app customers are getting drained right now.
- doakes 3y agoWhile Russian gangs do have a lot of involvement, I don't think these particular casino hacks were attributed to any Russian group. Scattered Spider is attributed and is believed to be 19-22 year old's from US and UK: https://en.wikipedia.org/wiki/Scattered_Spider https://en.wikipedia.org/wiki/Scattered_Spider
- btilly 3y agoThat I hadn't known. But if you follow the trail, Scattered Spider had the hard ransomware work done by ALPHAV, also known as Black Cat, https://en.wikipedia.org/wiki/BlackCat_(cyber_gang) https://en.wikipedia.org/wiki/BlackCat_(cyber_gang). And THEIR developers and money launderers are linked to DarkSide, https://en.wikipedia.org/wiki/DarkSide_(hacker_group) https://en.wikipedia.org/wiki/DarkSide_(hacker_group). Which is based in Russia. So basically a bunch of young Western men participated in the social engineering. But the real computer knowhow and methods of getting paid trace right back to Russian criminals who are willing to work with them.