36 ms·

Finland has recently a significant attack against one of Finland's largest psychotherapy clinics, Vastaamo, The criminal stole all personal information + thera

by nabla9 2y ago

Finland has recently a significant attack against one of Finland's largest psychotherapy clinics, Vastaamo, The criminal stole all personal information + therapy notes, then started to blackmail company and patients (over 20k victims, many of them very vulnerable, leading to suicides). National Bureau of Investigation traced the hacker trough Monero transaction. First they sent 0.1 Bitcoin to the blackmailer's address and used that for statistical analysis tracing the money into and out of Monero. ps. The police unecrypted 64-character password was used to protect sensitive data on his hard drive. It was not random enough. They 'took fingerprint' from a digital imange and used it for identification. The criminal on the run took a photo showing only his hand holding a glass. It was enough to see a fingerprint.

nunobrito 2y ago
That statement is incorrect. The payment was made in bitcoin to a wallet on binance: https://www.bleepingcomputer.com/news/security/vastaamo-hacker-traced-via-untraceable-monero-transactions-police-says/ https://www.bleepingcomputer.com/news/security/vastaamo-hack... Inside binance the attacker converted the money to monero and from there the trail was lost but they already had enough personal info from binance to inspect his personal bank accounts. In summary, Monero remains untraceable. Even more now that the goverments forced binance to remove monero support. Now attackers will use centralized exchange sites where no western authorities can ask for help or simply use decentralized P2P exchanges.
- nabla9 2y ago
  Statement is correct. Monero remains technically untraceable, not in practice. Money must go in and out to be useful and it can be traced. They payment was made into bitcoin address, then transferred into Monero, then it was sent into another Monero wallet. After that they used statistical analysis to determine the most likely receiver. All sections of the additional investigation report where KRP discloses its methods have been retracted. Details about the analysis of Monero traffic are not revealed.
  - Tiberium 2y ago
    "Money must go in and out to be useful and it can be traced." - not if you pay directly in Monero.
    - nabla9 2y ago
      When people start paying their toilet paper with Monero that becomes an issue.
      - jamil7 2y ago
        Are you arguing that the attacker would have to eventually exchange XMR for something they could purchase goods with, like toilet paper? Because I think that's shifting the original argument a little. The point being made is that had they had the victim(s) buy XMR on an exchange and send it directly to their XMR wallet and maybe cycle it through a few wallets, it would not have been traceable, which still holds true. How the attacker would actually use that money is a separate discussion. I've never looked into it but I'd guess there are illegal/grey services that would provide this service for a fee.
        futuramaconarma 2y ago
        A few sites you can buy $500+ gift cards with them for low fee
        nabla9 2y ago
        original argument: In this instance police was able to trace Modero payment trough with statistical analysis. Monero is technically safe, not necessarily in practice. >and maybe cycle it through a few wallets, Your argument: Monero + extra protocol is safe. The general pattern of these arguments: Argument: Technology X is not necessarily 100% safe. Counterargument: there exist way to use technology safely so it is.
        nunobrito 2y ago
        Cycling through a few wallets is unnecessary, that is mostly applicable to bitcoin users trying to make their transactions harder to follow. In monero there is privacy on each transaction. Of course it isn't complicated to match public transactions if you transfer 100k EUR from binance to monero and then magically 99k EUR are credited into your personal bank account within 1~2 days. Finland is a small country, deposits from bank accounts related to crypto exchanges are easy to find. Not even monero could save a person with such awful practices.
yamrzou 2y ago
Here is a discussion about it in r/Monero subreddit: https://www.reddit.com/r/Monero/comments/19emsfe/finlands_national_bureau_of_investigation_claims/ https://www.reddit.com/r/Monero/comments/19emsfe/finlands_na... See also: Tracing the WannaCry 2.0 Monero Transactions — https://medium.com/@nbax/tracing-the-wannacry-2-0-monero-transactions-d8c1e5129dc1 https://medium.com/@nbax/tracing-the-wannacry-2-0-monero-tra..., https://twitter.com/bax1337/status/1442846034460282886 https://twitter.com/bax1337/status/1442846034460282886
- meowster 2y ago
  Old reddit, clickable link: https://old.reddit.com/r/Monero/comments/19emsfe/finlands_national_bureau_of_investigation_claims/ https://old.reddit.com/r/Monero/comments/19emsfe/finlands_na...
kuskosho 2y ago
> The police unecrypted 64-character password was used to protect sensitive data on his hard drive. It was not random enough. Any source of this? Was this some bitlocker or another FDE?
Borgz 2y ago
The hacker accidentally published their entire home directory (including ~/.ssh) along with the stolen patient records, which I imagine made things pretty easy for the authorities. https://krebsonsecurity.com/2022/11/hacker-charged-with-extorting-online-psychotherapy-service/ https://krebsonsecurity.com/2022/11/hacker-charged-with-exto...
dgellow 2y ago
That was in 2022, no?
deleted 2y ago
[deleted]
edm0nd 2y ago
That is not how the hacker was caught. He was caught because he uploaded all of the stolen data but accidently included a directory of all his passwords and personal information.

by nabla9 2y ago

nunobrito 2y ago

That statement is incorrect. The payment was made in bitcoin to a wallet on binance: https://www.bleepingcomputer.com/news/security/vastaamo-hacker-traced-via-untraceable-monero-transactions-police-says/ https://www.bleepingcomputer.com/news/security/vastaamo-hack... Inside binance the attacker converted the money to monero and from there the trail was lost but they already had enough personal info from binance to inspect his personal bank accounts. In summary, Monero remains untraceable. Even more now that the goverments forced binance to remove monero support. Now attackers will use centralized exchange sites where no western authorities can ask for help or simply use decentralized P2P exchanges.

nabla9 2y ago
Statement is correct. Monero remains technically untraceable, not in practice. Money must go in and out to be useful and it can be traced. They payment was made into bitcoin address, then transferred into Monero, then it was sent into another Monero wallet. After that they used statistical analysis to determine the most likely receiver. All sections of the additional investigation report where KRP discloses its methods have been retracted. Details about the analysis of Monero traffic are not revealed.
- Tiberium 2y ago
  "Money must go in and out to be useful and it can be traced." - not if you pay directly in Monero.
  - nabla9 2y ago
    When people start paying their toilet paper with Monero that becomes an issue.
    - jamil7 2y ago
      Are you arguing that the attacker would have to eventually exchange XMR for something they could purchase goods with, like toilet paper? Because I think that's shifting the original argument a little. The point being made is that had they had the victim(s) buy XMR on an exchange and send it directly to their XMR wallet and maybe cycle it through a few wallets, it would not have been traceable, which still holds true. How the attacker would actually use that money is a separate discussion. I've never looked into it but I'd guess there are illegal/grey services that would provide this service for a fee.
      - futuramaconarma 2y ago
        A few sites you can buy $500+ gift cards with them for low fee
      - nabla9 2y ago
        original argument: In this instance police was able to trace Modero payment trough with statistical analysis. Monero is technically safe, not necessarily in practice. >and maybe cycle it through a few wallets, Your argument: Monero + extra protocol is safe. The general pattern of these arguments: Argument: Technology X is not necessarily 100% safe. Counterargument: there exist way to use technology safely so it is.
        nunobrito 2y ago
        Cycling through a few wallets is unnecessary, that is mostly applicable to bitcoin users trying to make their transactions harder to follow. In monero there is privacy on each transaction. Of course it isn't complicated to match public transactions if you transfer 100k EUR from binance to monero and then magically 99k EUR are credited into your personal bank account within 1~2 days. Finland is a small country, deposits from bank accounts related to crypto exchanges are easy to find. Not even monero could save a person with such awful practices.

yamrzou 2y ago

Here is a discussion about it in r/Monero subreddit: https://www.reddit.com/r/Monero/comments/19emsfe/finlands_national_bureau_of_investigation_claims/ https://www.reddit.com/r/Monero/comments/19emsfe/finlands_na... See also: Tracing the WannaCry 2.0 Monero Transactions — https://medium.com/@nbax/tracing-the-wannacry-2-0-monero-transactions-d8c1e5129dc1 https://medium.com/@nbax/tracing-the-wannacry-2-0-monero-tra..., https://twitter.com/bax1337/status/1442846034460282886 https://twitter.com/bax1337/status/1442846034460282886

meowster 2y ago
Old reddit, clickable link: https://old.reddit.com/r/Monero/comments/19emsfe/finlands_national_bureau_of_investigation_claims/ https://old.reddit.com/r/Monero/comments/19emsfe/finlands_na...

kuskosho 2y ago

> The police unecrypted 64-character password was used to protect sensitive data on his hard drive. It was not random enough. Any source of this? Was this some bitlocker or another FDE?

Borgz 2y ago

The hacker accidentally published their entire home directory (including ~/.ssh) along with the stolen patient records, which I imagine made things pretty easy for the authorities. https://krebsonsecurity.com/2022/11/hacker-charged-with-extorting-online-psychotherapy-service/ https://krebsonsecurity.com/2022/11/hacker-charged-with-exto...

dgellow 2y ago

That was in 2022, no?

deleted 2y ago

[deleted]

edm0nd 2y ago

That is not how the hacker was caught. He was caught because he uploaded all of the stolen data but accidently included a directory of all his passwords and personal information.