13 ms·

I struggle to see how this business model would work in the first place. They pay you and you pinky swear not to release it? All you are doing by negotiating is

I struggle to see how this business model would work in the first place. They pay you and you pinky swear not to release it? All you are doing by negotiating is to buy the victim time to harden their systems. This sounds liked a failed ransomware attack. They encrypted the systems - Boeing says "no thank you, we have backups". There were no valuable zero-days to sell to GRU, so give a last ditch offer to try to salvage something.

hnthrowaway0315 3y ago
I wouldn't be surprised if some ransomeware gangs are frontends of national (in)security agencies. They don't care about profits. Sure it's good to have some.
- kramerger 3y ago
  Well, every time Boeing tried to bribe a country, someone leaked emails and audio recordings from their secret meetings. Usually we blame the Chinese, but in this case I think its a toss between CIA and NSA. (I think I'm on some kind of list now) Edit: I am an idiot. I was thinking of Airbus, see @perihelions comment below
  - perihelions 3y ago
    Which incident are you referring to? The NSA took credit for hacking Airbus, but that's Boeing's foreign competitor—not Boeing. https://www.economist.com/special-report/2003/06/12/airbuss-secret-past https://www.economist.com/special-report/2003/06/12/airbuss-... - "According to a European Parliament report, published in 2001, America's National Security Agency (NSA) intercepted faxes and phone calls between Airbus, Saudi Arabian Airlines and the Saudi government in early 1994. The NSA found that Airbus agents were offering bribes to a Saudi official to secure a lion's share for Airbus in modernising Saudi Arabian Airlines' fleet. The planes were in a $6 billion deal that Edouard Balladur, France's then prime minister, had hoped to clinch on a visit to see King Fahd in January 1994. He went home empty-handed." - "James Woolsey, then director of the Central Intelligence Agency, recounted in a newspaper article in 2000 how the American government typically reacted to intelligence of this sort. “When we have caught you [Europeans]...we go to the government you're bribing and tell its officials that we don't take kindly to such corruption,” he wrote. Apparently this (and a direct sales pitch from Bill Clinton to King Fahd) swung the aircraft part of the deal Boeing's and McDonnell Douglas's way."
    - kramerger 3y ago
      You are correct. I think my brain was on a break while I was writing that :)
  - bee_rider 3y ago
    I imagine at least some (probably many) of the engineers who work for Boeing have a basically lawful-good/lawful-neutral temperament and are just disgusted by things like bribery. Maybe one of the parties in the conversation leaked it, no intelligence agencies needed.
  - emodendroket 3y ago
    Why exactly would the CIA or NSA want to do that? Boeing works so closely with the security apparatus they're practically an unofficial member so I don't understand what the motivation would be.
    - hnthrowaway0315 3y ago
      It doesn't hurt to hack into any corporation. You never know what kind of intelligence you might get out. There are also considerations of different factions I guess.
      - emodendroket 3y ago
        But we're not talking about getting information and keeping it but actually making it public. One doesn't get much leverage that way so the only real aim would seem to be damaging the target.
- jowea 3y ago
  For North Korea sure quite believable. Some links existing also sound likely for the Russian gangs.
- jasonwatkinspdx 3y ago
  It's an open secret that FSB et all work with ransomware gangs. As long as they don't target Russian companies they don't care what they do otherwise. So it's not so much they're a front as they're in a sort of quasi officially sanctioned middle ground.
  - terminous 3y ago
    https://en.wikipedia.org/wiki/Letter_of_marque https://en.wikipedia.org/wiki/Letter_of_marque
  - r00fus 3y ago
    Digital privateers
  - hnthrowaway0315 3y ago
    Yeah. I'm also thinking about ways to "promote" malware without getting impacted. Let's say some three digit agencies create sort of malware distribution forums in the darknet. They make sure to only broadcast to people who wants to play with malwares so the net catches the "bad guys" mostly, except for a few curious researchers or journalists maybe. Then they start to share recent generarion malwares they created. They don't need to distribute them by themselves because they already have the CCC servers. Some malware gangs would eventually be the frontend and start the distribution. In this way you not only distribute the malwares without getting impacted, you also get to know the gangs so whenever you want to catch a few fishes you just pull the net. Once the darknet forum dies out or they need to wipe the records, they would just leave and create a new one. Just my wild thought.
  - sofixa 3y ago
    As an example, the DarkSide malware (the one used against the Colonial Pipeline) explicitly checks if it's running on a computer in the CIS (Russia+countries nostalgic of the Soviet Union / without a better choice) and exits.
    - jasonwatkinspdx 3y ago
      Oh interesting, I'd not heard that. Thanks.
- beambot 3y ago
  > How North Korea’s Hacker Army Stole $3 Billion in Crypto, Funding Nuclear Program https://www.wsj.com/articles/how-north-koreas-hacker-army-stole-3-billion-in-crypto-funding-nuclear-program-d6fe8782 https://www.wsj.com/articles/how-north-koreas-hacker-army-st...
- nimih 3y ago
  > They don't care about profits. This isn't really true in general: intelligence agencies often want access to funds with less/no oversight from (or to skirt controls enacted by) other parts of the government. As an example, that was the dynamic at the basis of the Iran-Contra affair in the US.
RandallBrown 3y ago
> They pay you and you pinky swear not to release it? Yes. If any of this information does end up getting leaked, it kills the credibility of the ransomware group and they'll never get paid again. Sort of mutually assured destruction. Now of course, most people don't really trust criminals anyway so the business has a pretty strong bargaining position and I believe many of the ransoms are negotiated way down.
- tanelpoder 3y ago
  Wouldn't it be easy to just pick a new name for the ransomware group then? (or do we need eBay-like "seller ratings" and customer reviews for ransomware groups?)
  - ceejayoz 3y ago
    A no-name ransomware group is less likely to be trusted to hold up their end of the bargain than one with an established reputation. Didn't Silk Road have eBay-style ratings/reviews?
    - jeron 3y ago
      What good are the reviews? “5 stars, didn’t leak data after ransom paid”
      - barryrandall 3y ago
        It's more like, "Security Company X says this gang has behaved predictably in their previous interactions."
      - csydas 3y ago
        SilkRoad was a dark web market, so the comparison from the parent is a bit strange for me, but regarding your comment on reviews, yes they're very important and for the sites I've used, the reviews have been very reliable and useful. My understand is that since it's a much more limited market, access is very difficult even under normal circumstances (not because of security but just because dark web markets usually have awful performance for various reasons), so it's a far different review landscape than say shopping on Amazon, at least the ones I have used. The markets themselves were fantastic about refunds/conflict resolution, better than most normal online shops. Reputation is key for basically everything dark web, and the main actors in this space are notoriously petty and bold towards anyone that makes it harder to conduct business. I imagine it's very similar with Ransomware as there has to be some reason for the targets of the attack to believe paying the ransom is worth it, and anyone who upsets that balance for the ransomware gangs unexpectedly becomes rapidly unpopular, and usually a target for the other gangs. It very much so is heavily relying on the honor system, but it seems the groups are committed to such a system.
emodendroket 3y ago
You could say the same about any "ransom"-based business, really. Kidnappers could decline to release the kidnapped person after they get their money.
- JohnFen 3y ago
  And they often do.
  - emodendroket 3y ago
    Yet it is not unusual for the ransoms to be paid.
willseth 3y ago
You'd think that, but in practice these ransomware groups are pretty reliable, and actually many rasomees have remarked on how good the customer service is! Their ability to make money is dependent on them maintaining a reputation for being in the business for money, not lulz, and tmk the pinky swears are typically upheld.
- jameson 3y ago
  > in practice these ransomware groups are pretty reliable Hard to say... You're effectively trusting the liar they wont lie again Its possible they leak it to high profile customers without publicly announcing it Business should make decision assuming the data will be leaked eventually regardless of random paid or not Perhaps only thing business can assume is the data wont be publicly released in short amount of time
matthewdgreen 3y ago
That’s why you secret share the data across six Intel SGX instances using software that only reveals the plaintext if it doesn’t receive a blockchain-based payment after 30 days. (No, nobody does this. But they could!)
- adriancr 3y ago
  why would anyone trust the data is only on those instances?
  - matthewdgreen 3y ago
    Because you write your ransomware to encrypt to a hardcoded set of public keys that include an SGX attestation from those instances. This can be verified forensically and the unencrypted plaintext never leaves the victim organization.
    - crotchfire 3y ago
      ...and then Intel will simply have their HSM sign the cheat-code firmware for the EPIDs of those six chips. Trust isn't all-or-nothing. When I ride a bus I'm trusting the driver with my life, but I wouldn't trust them to babysit my kids. Mutability is deniability. I don't trust hardware companies with that. And I don't have to, either. Stop hawking this SGX snakeoil. Except maybe to ransomware authors, who deserve what they'll get.
      - matthewdgreen 3y ago
        Intel could presumably help the ransomware authors bypass SGX protections but that’d be dumb. They might have some capability to trace attestations to a specific motherboard but I doubt any sophisticated ransomware group will be foiled by this.
        crotchfire 3y ago
        I was implying that Intel would help the victims. Attestations are quite certainly traceable to the EPID, which is a fuse array -- it's on the die, not the motherboard. In order to attest, the key that encrypts the victim's data would have to be SGX-generated. What kind of RNG do you think it uses? Maybe Dual_EC_DRDBG?
jasonfarnon 3y ago
What benefit is it to the ransomware group to release the data? They may be sloppy or careless with their data (like their victims) but I don't see a for-profit/non-ideological ransom group reneging and intentionally leaking the data. And plenty of reasons eg repeat actors to do their best not to. Actually I'm often surprised that many ransomers/hostage-takers go through with their threats when they don't get their demands. The only reason I can see them doing it is if reputation matters to them for future negotiations. more than the risks from the greater liabilities they incur by going through with the threats.
- michaelt 3y ago
  The benefit would be getting paid a second time, by extracting a second ransom. It doesn't have to be the whole group; perhaps one guy decides to branch out on his own, and grabs the data on his way out the door.
  - jasonfarnon 3y ago
    You mean "yeah we were lying yesterday about this same thing, but we're telling the truth right now" type of negotiation? Has that ever worked for ransoms (of any kind) anywhere?
deleted 3y ago
[deleted]
NoPicklez 3y ago
It's a business model that has certainly been working. If your business has been crippled due to your systems having been encrypted then you do often consider paying the ransom. However if you have adequate backup and recovery mechanisms in place then you're not the best to prey on. It's a business model that works until the majority of targets have appropriate backup and recovery processes.

hnthrowaway0315 3y ago

I wouldn't be surprised if some ransomeware gangs are frontends of national (in)security agencies. They don't care about profits. Sure it's good to have some.

kramerger 3y ago
Well, every time Boeing tried to bribe a country, someone leaked emails and audio recordings from their secret meetings. Usually we blame the Chinese, but in this case I think its a toss between CIA and NSA. (I think I'm on some kind of list now) Edit: I am an idiot. I was thinking of Airbus, see @perihelions comment below
- perihelions 3y ago
  Which incident are you referring to? The NSA took credit for hacking Airbus, but that's Boeing's foreign competitor—not Boeing. https://www.economist.com/special-report/2003/06/12/airbuss-secret-past https://www.economist.com/special-report/2003/06/12/airbuss-... - "According to a European Parliament report, published in 2001, America's National Security Agency (NSA) intercepted faxes and phone calls between Airbus, Saudi Arabian Airlines and the Saudi government in early 1994. The NSA found that Airbus agents were offering bribes to a Saudi official to secure a lion's share for Airbus in modernising Saudi Arabian Airlines' fleet. The planes were in a $6 billion deal that Edouard Balladur, France's then prime minister, had hoped to clinch on a visit to see King Fahd in January 1994. He went home empty-handed." - "James Woolsey, then director of the Central Intelligence Agency, recounted in a newspaper article in 2000 how the American government typically reacted to intelligence of this sort. “When we have caught you [Europeans]...we go to the government you're bribing and tell its officials that we don't take kindly to such corruption,” he wrote. Apparently this (and a direct sales pitch from Bill Clinton to King Fahd) swung the aircraft part of the deal Boeing's and McDonnell Douglas's way."
  - kramerger 3y ago
    You are correct. I think my brain was on a break while I was writing that :)
- bee_rider 3y ago
  I imagine at least some (probably many) of the engineers who work for Boeing have a basically lawful-good/lawful-neutral temperament and are just disgusted by things like bribery. Maybe one of the parties in the conversation leaked it, no intelligence agencies needed.
- emodendroket 3y ago
  Why exactly would the CIA or NSA want to do that? Boeing works so closely with the security apparatus they're practically an unofficial member so I don't understand what the motivation would be.
  - hnthrowaway0315 3y ago
    It doesn't hurt to hack into any corporation. You never know what kind of intelligence you might get out. There are also considerations of different factions I guess.
    - emodendroket 3y ago
      But we're not talking about getting information and keeping it but actually making it public. One doesn't get much leverage that way so the only real aim would seem to be damaging the target.
jowea 3y ago
For North Korea sure quite believable. Some links existing also sound likely for the Russian gangs.
jasonwatkinspdx 3y ago
It's an open secret that FSB et all work with ransomware gangs. As long as they don't target Russian companies they don't care what they do otherwise. So it's not so much they're a front as they're in a sort of quasi officially sanctioned middle ground.
- terminous 3y ago
  https://en.wikipedia.org/wiki/Letter_of_marque https://en.wikipedia.org/wiki/Letter_of_marque
- r00fus 3y ago
  Digital privateers
- hnthrowaway0315 3y ago
  Yeah. I'm also thinking about ways to "promote" malware without getting impacted. Let's say some three digit agencies create sort of malware distribution forums in the darknet. They make sure to only broadcast to people who wants to play with malwares so the net catches the "bad guys" mostly, except for a few curious researchers or journalists maybe. Then they start to share recent generarion malwares they created. They don't need to distribute them by themselves because they already have the CCC servers. Some malware gangs would eventually be the frontend and start the distribution. In this way you not only distribute the malwares without getting impacted, you also get to know the gangs so whenever you want to catch a few fishes you just pull the net. Once the darknet forum dies out or they need to wipe the records, they would just leave and create a new one. Just my wild thought.
- sofixa 3y ago
  As an example, the DarkSide malware (the one used against the Colonial Pipeline) explicitly checks if it's running on a computer in the CIS (Russia+countries nostalgic of the Soviet Union / without a better choice) and exits.
  - jasonwatkinspdx 3y ago
    Oh interesting, I'd not heard that. Thanks.
beambot 3y ago
> How North Korea’s Hacker Army Stole $3 Billion in Crypto, Funding Nuclear Program https://www.wsj.com/articles/how-north-koreas-hacker-army-stole-3-billion-in-crypto-funding-nuclear-program-d6fe8782 https://www.wsj.com/articles/how-north-koreas-hacker-army-st...
nimih 3y ago
> They don't care about profits. This isn't really true in general: intelligence agencies often want access to funds with less/no oversight from (or to skirt controls enacted by) other parts of the government. As an example, that was the dynamic at the basis of the Iran-Contra affair in the US.

RandallBrown 3y ago

> They pay you and you pinky swear not to release it? Yes. If any of this information does end up getting leaked, it kills the credibility of the ransomware group and they'll never get paid again. Sort of mutually assured destruction. Now of course, most people don't really trust criminals anyway so the business has a pretty strong bargaining position and I believe many of the ransoms are negotiated way down.

tanelpoder 3y ago
Wouldn't it be easy to just pick a new name for the ransomware group then? (or do we need eBay-like "seller ratings" and customer reviews for ransomware groups?)
- ceejayoz 3y ago
  A no-name ransomware group is less likely to be trusted to hold up their end of the bargain than one with an established reputation. Didn't Silk Road have eBay-style ratings/reviews?
  - jeron 3y ago
    What good are the reviews? “5 stars, didn’t leak data after ransom paid”
    - barryrandall 3y ago
      It's more like, "Security Company X says this gang has behaved predictably in their previous interactions."
    - csydas 3y ago
      SilkRoad was a dark web market, so the comparison from the parent is a bit strange for me, but regarding your comment on reviews, yes they're very important and for the sites I've used, the reviews have been very reliable and useful. My understand is that since it's a much more limited market, access is very difficult even under normal circumstances (not because of security but just because dark web markets usually have awful performance for various reasons), so it's a far different review landscape than say shopping on Amazon, at least the ones I have used. The markets themselves were fantastic about refunds/conflict resolution, better than most normal online shops. Reputation is key for basically everything dark web, and the main actors in this space are notoriously petty and bold towards anyone that makes it harder to conduct business. I imagine it's very similar with Ransomware as there has to be some reason for the targets of the attack to believe paying the ransom is worth it, and anyone who upsets that balance for the ransomware gangs unexpectedly becomes rapidly unpopular, and usually a target for the other gangs. It very much so is heavily relying on the honor system, but it seems the groups are committed to such a system.

emodendroket 3y ago

You could say the same about any "ransom"-based business, really. Kidnappers could decline to release the kidnapped person after they get their money.

JohnFen 3y ago
And they often do.
- emodendroket 3y ago
  Yet it is not unusual for the ransoms to be paid.

willseth 3y ago

You'd think that, but in practice these ransomware groups are pretty reliable, and actually many rasomees have remarked on how good the customer service is! Their ability to make money is dependent on them maintaining a reputation for being in the business for money, not lulz, and tmk the pinky swears are typically upheld.

jameson 3y ago
> in practice these ransomware groups are pretty reliable Hard to say... You're effectively trusting the liar they wont lie again Its possible they leak it to high profile customers without publicly announcing it Business should make decision assuming the data will be leaked eventually regardless of random paid or not Perhaps only thing business can assume is the data wont be publicly released in short amount of time

matthewdgreen 3y ago

That’s why you secret share the data across six Intel SGX instances using software that only reveals the plaintext if it doesn’t receive a blockchain-based payment after 30 days. (No, nobody does this. But they could!)

adriancr 3y ago
why would anyone trust the data is only on those instances?
- matthewdgreen 3y ago
  Because you write your ransomware to encrypt to a hardcoded set of public keys that include an SGX attestation from those instances. This can be verified forensically and the unencrypted plaintext never leaves the victim organization.
  - crotchfire 3y ago
    ...and then Intel will simply have their HSM sign the cheat-code firmware for the EPIDs of those six chips. Trust isn't all-or-nothing. When I ride a bus I'm trusting the driver with my life, but I wouldn't trust them to babysit my kids. Mutability is deniability. I don't trust hardware companies with that. And I don't have to, either. Stop hawking this SGX snakeoil. Except maybe to ransomware authors, who deserve what they'll get.
    - matthewdgreen 3y ago
      Intel could presumably help the ransomware authors bypass SGX protections but that’d be dumb. They might have some capability to trace attestations to a specific motherboard but I doubt any sophisticated ransomware group will be foiled by this.
      - crotchfire 3y ago
        I was implying that Intel would help the victims. Attestations are quite certainly traceable to the EPID, which is a fuse array -- it's on the die, not the motherboard. In order to attest, the key that encrypts the victim's data would have to be SGX-generated. What kind of RNG do you think it uses? Maybe Dual_EC_DRDBG?

jasonfarnon 3y ago

What benefit is it to the ransomware group to release the data? They may be sloppy or careless with their data (like their victims) but I don't see a for-profit/non-ideological ransom group reneging and intentionally leaking the data. And plenty of reasons eg repeat actors to do their best not to. Actually I'm often surprised that many ransomers/hostage-takers go through with their threats when they don't get their demands. The only reason I can see them doing it is if reputation matters to them for future negotiations. more than the risks from the greater liabilities they incur by going through with the threats.

michaelt 3y ago
The benefit would be getting paid a second time, by extracting a second ransom. It doesn't have to be the whole group; perhaps one guy decides to branch out on his own, and grabs the data on his way out the door.
- jasonfarnon 3y ago
  You mean "yeah we were lying yesterday about this same thing, but we're telling the truth right now" type of negotiation? Has that ever worked for ransoms (of any kind) anywhere?

deleted 3y ago

[deleted]

NoPicklez 3y ago

It's a business model that has certainly been working. If your business has been crippled due to your systems having been encrypted then you do often consider paying the ransom. However if you have adequate backup and recovery mechanisms in place then you're not the best to prey on. It's a business model that works until the majority of targets have appropriate backup and recovery processes.