33 ms·
Alliance of 40 countries to vow not to pay ransom to cybercriminals, US says
- nimbius 3y ago>Neuberger told journalists a new “black list” will also be created by the US treasury department to identify and highlight digital wallets being used to deposit and move ransomware payments. >The establishment of these information sharing platforms means that “if one country is attacked, others can quickly be defended”, Neuberger said. pardon the dust whilst I apply my 14th century naval hammer to this clearly 21st century nail.
- tekla 3y agoI'm fairly sure the 14th century hammer works just fine in hammering the 21st century nail.
- pixl97 3y agoHey, but I can sell you a 21st century e-hammer with AuthentiCode licensing. Swing power savings of up to 2% can be achieved. (Requires constant internet connection).
- malux85 3y agoSell?! Where’s your recurring? It’s a subscription model (paid yearly up front), with mandatory upgrades and a brutal depreciation policy
- deleted 3y ago[deleted]
- hotnfresh 3y agoCan we get letters of marque as NFTs? C'mon, anything to make the cyberpunk future less lame than it's turned out to be.
- jowea 3y agoI honestly feel like the attackers operating out of Russia are 21st century privateers.
- OkayPhysicist 3y agoLetters of marque aren't transferable, so making them NFTs is kinda silly. Their entire purpose is that the state has entrusted you, captain of the ship, to abide by certain rules (don't plunder our ships, take prisoners when possible). That said, cyber-privateering is actually a good idea. Cyberwarfare is in the same space as naval warfare was in the 17th century: it's not really an overt act of war, it's mostly committed by criminal organizations with the occasional big news state actor action, and there's a lot of money to be made.
- hotnfresh 3y ago> Letters of marque aren't transferable, so making them NFTs is kinda silly. Precisely! These would be! This is the kind of innovation the blockchain enables! /s
- bee_rider 3y agoThere have also been centuries of advancement on the idea of a hammer. The US and friendly countries have just a hammer, in the same way that a forge with a power hammer has just a hammer, or a wrecking ball could be seen as a complicated sledgehammer.
- acdha 3y agoCould you expand why you believe an old hammer doesn’t work with current nails? As a metaphor it seems completely the opposite of your intended meaning since it’s a good example of an ancient technology which still works compatibly. Adding wallets to a black list is highly effective because while there was a lot of dishonest marketing around blockchains improving privacy they’re actually perfect for censorship since a public ledger allows you to transitively taint every transaction downstream, significantly reducing the value of certain tokens and removing the ability of people to say they didn’t know the funds they are receiving were connected to a crime.
- nimbius 3y agoAh yes, my Monero nails. https://en.wikipedia.org/wiki/Monero https://en.wikipedia.org/wiki/Monero Observers cannot decipher addresses trading Monero, transaction amounts, address balances, or transaction histories, but im sure my old 14th century hammer will address this issue somehow even though subaddresses can be created that arent even remotely linked to my main address. https://monerodocs.org/public-address/standard-address/ https://monerodocs.org/public-address/standard-address/
- rnk 3y agoYou just ban Monero then. If something is a problem, and you want to ensure financial visibility then ban all transaction types that hide visiblity, like banning mixers. This is separate from whether it's a good idea or not.
- dogman144 3y agoAnd then you mix in DeFi. Or into and out of L2/HTLCs. Or via atomic swaps, which went live but are buggy, and won’t show the monero interaction. Or cross-chain. And on and on. Let’s ban it all?
- rnk 3y agoYes, that's where I think financial regulators are heading. And anyone who thinks for one second of course sees that these are also problems with cash that drug cartels deal with by sending bales of $100 bills around. And so we added kyc and discourage cash. I don't think you can ban people doing crypto entirely, but you can make the financial exchange points where cash goes in and out ever more difficult.
- MichaelZuo 3y agoIt's unclear who in the USG is actually responsible for enforcing this, especially against those organizations that do send payments anyways.
- deleted 3y ago[deleted]
- kube-system 3y agoAny executive action on this would be via sanctions, I presume.
- MichaelZuo 3y agoAction by who? The President himself?
- kube-system 3y agoThe Treasury's Office of Foreign Assets Control is the executive branch department tasked with enforcing sanctions.
- MichaelZuo 3y agoOn domestic organizations, local governments, etc.?
- kube-system 3y agoYes, everyone within the legal arms-length of the US is required to comply with sanctions prohibitions -- if sanctions are applied. The OFAC has a lot of power.
- MichaelZuo 3y agoHuh, seems like quite a misnomer then.
- amima 3y agoSo let's imagine a company like Garmin experiences a ransomware attack. Their business is paralyzed. What would stop them from paying the ransom and what could possibly be an alternative to that?
- jupp0r 3y agoI was assuming that countries would make it illegal to pay these ransoms.
- pc86 3y agoThe article doesn't seem to suggest that anywhere.
- jupp0r 3y agoYou are right. It's kind of a toothless tiger without that part though.
- kube-system 3y agoThe data sharing mentioned in the article will help authorities to target the criminals directly.
- Workaccount2 3y agoAn insurance fund that requires periodic air gapped backups. So you roll back to the last snapshot and get money to cover losses incurred.
- pc86 3y agoThere are a handful of problems with this approach, which is part of why these types of insurance policies are incredibly expensive. The entire MO of these operations is to infect a company's systems, and wait until most or all of the backups are affects before locking the system down. They will wait months or for bigger targets, years.
- zx8080 3y agoFirst of all, it's not a nation who pays in case of a breach. It's some company. Nation as countries do not have anything to do with it, unless they create some laws denying payments. Which would tight control of any businesses in hands of politicians signing off indulgences (exceptions to pay as "too big to fail").
- InitialLastName 3y agoI would guess that the affected entities here are not companies, but public entities. Federal departments, the state governments, and municipal governments all run their own IT systems and have been affected by ransomware; if there is a top-down policy of "don't pay the ransom" it presumably affects policy for all of those.
- londons_explore 3y agoEven if there is a top down policy of not paying ransoms, the attackers still have an incentive to format the drives and leak the data to gain credibility for their next attack. Many types of attack don't actually know where they're breaking into at the time they break in. And once you're in, you might as well try running a ransom attack.
- pixl97 3y agoNations setting up financial regulations on who you can and cannot pay is a standard accounting practice these days. If you consider that a tight control, then we're already far past that.
- acdha 3y ago“These days”? Nations have been restricting trade for millennia.
- kube-system 3y agoEssentially all countries do this, regulating trade is a very basic governmental function.
- varjag 3y agoSo there's that woman I follow who used to work in hostage and ransom negotiation business, and she's adamant there's no such thing as "no negotiations with terrorists" no matter public rhetoric or legislation. When push comes to shove, side channels and loopholes are inevitably found and third party contractors like her are getting hired. I strongly suspect this too will end up mostly a jurisdiction/accounting nuance rather than a substantial change.
- hfuyf65 3y ago[dead]
- salamanderss 3y agoIt wouldn't surprise me if places like Nigeria have a bunch of semi-whitewashed English speaking faces/voices to perform this kind of grey area work. Even better if some of their family is part of a hostage taking gang so they can burn the candle from both ends.
- boeingUH60 3y agoNigeria (my country) is pretty bad, but we don't do ransomware, lol.
- salamanderss 3y agoI responded to a comment on hostage and ransom negotiation business. Hostages aren't normally considered ransomware, although said negotiators would have excellent overlapping skill set. Travel.gov has an advisory for hostage taking in your country. I can assure you there are well spoken negotiators in your nation to deal with that.
- nerdypirate 3y agoI'm afraid, you are wrong, criminal gangs or masterminds are not that organized in Nigeria
- brightball 3y agoIt's about dang time. Years ago I attended a security conference where an FBI guy was actually advising people to pay the ransom. I was shocked.
- Mistletoe 3y agoI wish my health provider had paid the ransom. They screwed up and got hacked and wouldn’t or couldn’t pay the ransom, now the entire clinic has no health records for their patients. My doctor can’t see any health info older than a few years. I couldn’t believe what she was telling me.
- mensetmanusman 3y agoIt hurts, but it’s the only way we can get the wealthy to take security seriously. Otherwise, to take an exaggerated example, only rich hospitals will be able to pay ransoms and poor people /hospitals will have no records (globally).
- digging 3y agoOr instead of banding together to not pay, organizations/nations could pool money to help poorer hospitals pay. Maybe that, too, would make the rich think more about global security.
- qup 3y agoSo some asshat will be in charge of IT at [poor hospital], some rich people will foot the bill, and somehow that will improve...what? What is "global security?"
- digging 3y agoOh, I forgot the poor are meant to suffer. Global security meaning: Perhaps, if the rich found that the cost of supporting poor hospitals was high, they'd determine that they would prefer to invest in cybersecurity in poor hospitals. (Not likely, considering how few wealthy organizations care about cybersecurity in their own organizations.)
- ooterness 3y agoThe HN title matches the article headline, but the article headline is horribly inaccurate. This is not about making ransom payments illegal, as many commenters have assumed. They are setting up an international information-sharing system to help track cryptocurrency wallets that are receiving ransom payments.
- arbuge 3y agoIndeed. "take steps to try to end" would have been more accurate.
- kube-system 3y agoThe headline isn't inaccurate. "End ransomware payments" doesn't necessarily mean "make illegal the act of victims sending ransom payments", even though many are presuming that. Most of the action on this is on the receiving end of the payment process -- making it difficult for criminals to cash out, freezing their assets, or finding them.
- dang 3y ago(The submitted headline was "US-led coalition of nations agrees to end ransomware payments to hackers". We since changed the URL - more at https://news.ycombinator.com/item?id=38088780 https://news.ycombinator.com/item?id=38088780.)
- m3kw9 3y agoIf stakes are high enough nations will pay, this is different than enforcing corps not paying. It will be hard to detect at a national level if there was a hack or a payment unless they decide to declassify it
- diego_moita 3y agoSorry for my cynicism but it seems that any cryptocurrency that is able to solve the traceability problem has now one more business opportunity.
- simiones 3y agoExcept that if this gains any teeth, it's likely to receive the Tornado Cash treatment: ban its use and (possibly illegally) jail its developers.
- denismenace 3y agoMonero is already untraceable.
- kube-system 3y agoPrevious statements by the white house on this indicates they intend to implement KYC requirements. https://www.whitehouse.gov/briefing-room/statements-releases/2022/11/01/international-counter-ransomware-initiative-2022-joint-statement/ https://www.whitehouse.gov/briefing-room/statements-releases...
- Jemm 3y agoHow is this being reported without a list of the countries?
- JohnFen 3y agoGood. Paying those criminals is unethical and makes the problem worse for everyone.
- deleted 3y ago[deleted]
- jokoon 3y agoYup. Maybe it's also time that companies take cybersecurity more seriously, and maybe not just companies, but governments too. If insurance companies would cover ransomware damage, you can be certain those insurance companies would IMMEDIATELY lobby the government to enforce cyber security standards, audits, pentesting etc. It's not happening as long as the NSA is on top of the race of cyberweapons, but once that changes, you can be certain that software is going to be more secure.
- colatkinson 3y agoNot sure if you're aware, but ransomware insurance is already a significant industry, and the contracts usually stipulate that the client company undergoes some type of regular auditing. From what I've heard, insurance companies are actually kinda souring on the business because it's incredibly bad from an actuarial perspective: many of those targeted are SMBs (i.e. they're not paying the kind of premiums that would make it worthwhile), but even for large corps as time passes the odds of a ransom event approach 1. I mean, can anyone think of a large non-tech enterprise that doesn't have that doesn't have that one load-bearing Windows Server 2008 machine in a closet? So to an extent, this seemingly represents the industry collectively declaring that even massive monthly insurance premiums are insufficient for companies to get their security posture together, and so they're trying to cut it off at the source by making ransomware as an endeavor unprofitable.
- dukeyukey 3y ago> that one load-bearing Windows Server 2008 machine in a closet Hah, that is literally how an old employer of mine got hacked and ransomwared big time.
- arbuge 3y ago> This will see the launch of two new information-sharing platforms for participating countries. One will be created by Lithuania while another will be jointly created and hosted by Israel and the United Arab Emirates. Nice to see smaller countries taking the initiative and also being trusted for projects like this.
- willcipriano 3y ago> The members of the International Counter Ransomware Initiative (CRI)— Australia, Austria, Belgium, Brazil, Bulgaria, Canada, Croatia, Czech Republic, Dominican Republic, Estonia, France, Germany, India, Ireland, Israel, Italy, Japan, Kenya, Lithuania, Mexico, the Netherlands, New Zealand, Nigeria, Norway, Poland, Republic of Korea, Romania, Singapore, South Africa, Spain, Sweden, Switzerland, United Arab Emirates, United Kingdom, United States, and Ukraine, and the European Union.. https://www.whitehouse.gov/briefing-room/statements-releases/2022/11/01/international-counter-ransomware-initiative-2022-joint-statement/ https://www.whitehouse.gov/briefing-room/statements-releases...
- 2OEH8eoCRo0 3y agoA good way to prevent crime is to make it not profitable. Why invest in security when you can just pay the ransom?
- fortran77 3y agoI think this needs to be combined with ways to make companies more resistant to ransomware attacks, and more able to restore their computers if an attack does happen. If companies could get back on line within 24 hours, they wouldn't pay the ransomware.
- dang 3y agoThe submitted URL https://www.itpro.com/security/ransomware/coalition-of-nations-agree-to-end-ransomware-payments-to-hackers https://www.itpro.com/security/ransomware/coalition-of-natio... doesn't seem to link to the reporting it's drawing on, so I changed it to a reasonable candidate.
- billpg 3y ago"I have your lottery winnings. Send (amount) to me to process sending you the money." That's a scam, right? "I have encrypted your files. Send (amount) and I'll decrypt them for you." Not a scam?
- jerf 3y agoIt often isn't. The criminals know that the game theory is such that the criminals know that if they don't actually provide the files when paid, none of them will get paid in the future as people will just assume the files are destroyed unrecoverably and move on. The scam critical depends on you being able to be confident that the files actually are recoverable and thus that paying the ransom is a viable option. Encryption viruses are probably some of the best QA'ed code in the world.
- billpg 3y agoI've heard of enough cases where the ransomware gang have not followed through after payment of the ransom, that I think that time ("if they don't actually provide the files when paid") has already passed.
- snapetom 3y agoTwo thoughts: 1) There's no way to enforce this to private companies in the US without passing some sort of Federal law. I'm pretty certain no states have passed anything like this either. 2) So, we can assume the alliance is government agencies not paying ransomware. For the US, it's only the Federal government agreeing to this. If the County Court of Middle of Nowhere Nebraska gets ransomwared. The Feds can put all the pressure they want on them not to pay, but at the end of the day, they can't stop them from paying.
- rurban 3y agoOf course, because they do have backups. Lol. So far only the central bank of Sambia had a backup and could just ignore the ransom.
- NoPicklez 3y agoThe reality of where the pay/don't pay falls down. If your records have been encrypted and taken, you have already taken a reputational hit to sensitive information. If you can recover your operations then you shouldn't even think about paying the ransom. However, if your systems have been encrypted AND you can't recover them in a reasonable way AND not having your systems is catastrophic to your business continuing then this is where companies consider paying. Hopefully with a renewed understanding of how important it is to have appropriate information security controls in place. The only way not paying ransoms will happen, is if it is made illegal or there are significant penalties as a result of doing so. Otherwise, for some businesses not paying the ransom when their systems are offline is just too risky.
- Charon77 3y ago> Partner countries will share a "black list" through the U.S. Department of Treasury that will include information on digital wallets being used to move ransomware payments I don't think they realize how easy it is to generate new wallet. Nobody is going to use their home wallet address to demand ransom
- maryfisherr6 3y agoThey have vast solutions to all online issues contact them through their mail remotespywise @gmil com Their services includes hacking phone,database,record expungements,spy,and private investigator .Their hacking service is completely anonymous and very easy to use. The most interesting thing about this is, it is very fast and comes with lots of features
- incompatible 3y ago"She added that the effort will use artificial intelligence to analyze blockchain with a view to identifying illicit funds." Watch out, people still using last year's favourite buzzword, we'll sic this year's favourite on you.
- darknavi 3y agoI know those are traditionally buzz words but are they here? Trying to analyze traditionally anonymous payment methods that are virtual the only way randsomware is paid off seems like not a crazy idea.
- incompatible 3y agoIt's not crazy, but tracing blockchain transactions has been done since blockchains were invented. I'm not sure if new AI techniques are helpful or not.
- jdietrich 3y ago"Identifying non-obvious patterns in messy data" is a textbook application for ML. I don't know if it'd be helpful or not - it's unwise to believe anyone who asserts that ML will definitely work better than traditional statistical methods - but it's definitely worth trying.
- polski-g 3y agoRansomware-ing companies is terrorism. Knocking a hospital computer system offline is equivalent to bombing it and should be treated as such. There should be renditions/assassinations as a retaliatory measure.
- orlp 3y agoIt's not terrorism if done purely for profit and without a political motive. Words have meanings.
- pharmakom 3y agoThis is basically cartel pricing, which is never a stable arrangement.