8 ms·

CryptoLocker's crimewave: A trail of millions in laundered Bitcoin

77 points by hseldon15 13y ago

pyalot2 13y ago
I'm actually pretty happy cryptolocker's around. No, wait, don't hang me yet, stuff your pitchforks, let me explain. Let's face it, computer security has been pretty bad trough pretty much the entire personal computing era. I don't need to point any fingers, the guilty know who they are. Now unlike some others, Apple and Linux do try to do a few things about that, in different ways, with varying degrees of success. But it's better, by far, than the teeming mess on that other platform we won't be mentioning. I believe if we want to use IT in the future, that this stuff's got to get pretty much bullet and foolproof. And without a credible threat it won't get there. Now, one of the things that held the development of a credible threat back, was the limited ways in which security holes could be monetized. "Fortunately" that's no longer a problem. And now that I think we have a credible threat. Will we now, please, with suggar on top, get computer security right? Isn't like, kinda time?
- NAFV_P 13y ago
  I'm surprised that the NSA hasn't looked into it yet (or have they?...), with what they've been up to over the past decade.
  - dredwerker 13y ago
    I am more worried about cryptolocker than the Silk Road or its derivatives. These people must be getting the money out somehow via the visible blockchain.
    - thrill 13y ago
      The article talks about mixing services. Destroy those and what little anonymity that can be had in virtual currency ceases. As for getting money out, why bother, if you take the (perhaps not that) long view that BTC itself will be generally useful.
  - saraid216 13y ago
    Wouldn't it be the FBI's job?
- ams6110 13y ago
  I had a similar reaction to the Target credit card number situation. Not happy about it, but the thought did cross my mind "maybe this will finally make banks/card companies/retailers take security more seriously." Not really holding out much hope though.
  - vkou 13y ago
    Why would they? Most of the damage (time wasted by their customers dealing with the fallout) is an externality.
    - lukifer 13y ago
      There are situations in which "there is no bad publicity"; a massive security breach isn't one of them. Even if customers are protected by their credit card provider, it's still a massive inconvenience at best to have your card data stolen. I guarantee Target takes a non-trivial sales hit from the incident, particularly online.
- lifeisstillgood 13y ago
  Yes and no. Well mainly no. Crime can leech too much, do too much damage that it actually holds back development (pretty much any dictatorship, many Mafias) It's pretty likely that the major reaction to crypto locker will not be "darn it, let's breakout a can of OpenBSD on our systems." It will be let's buy more norton, let's disconnect from the Internet except Wednesdays, let's print out our important emails. Anyway I still really really struggle with how anyone can get stolen / hot money off the block chain and into their hands, cleanly. There is a limited supply of fools who will accept 10M from a Nigerian in return for laundering it.
  - pyalot2 13y ago
    While I would be glad if people would stop using that unnamed OS, what I meant isn't that everybody should just hop to some *nix. What I meant is that pretty much every OS out there does security completely wrong, for no discernible reason.
- ryanjshaw 13y ago
  Computer science solved this problem (the "Confused Deputy" [1]) decades ago [2] [3] with capability-based security [4]. I don't have the time to find the exact reference I'm thinking of right now, but consider taking a look at one of the papers that give a background to CapDesk [5]: > Which addresses, among other things: > "All Windows and Unix operating systems (referred to as “Winix” hereafter) utterly disregard the concept of POLA [Principle of Least Authority]. When you launch any application—be it a $5000 version of AutoCAD fresh from the box or the Elf Bowling game downloaded from an unknown site on the Web—that application is immediately and automatically endowed with all the authority you yourself hold. Such applications can plant Trojans as part of your startup profile, read all your email, transmit themselves to everyone in your address book using your name, and can connect via TCP/IP to their remote masters for further instruction. This is, candidly, madness." [6] Since then, things have changed slightly - UAC under Windows, for instance, means applications now only have the ability to steal and hold your highly valuable and personal documents for ransom, but hey at least these sneaky trojans don't have admin rights! Which is of course the exact scenario that Cryptolocker happily exploits. There's really no reason a piece of junk attached to your email application should execute any more authority than you explicitly grant it. (And no that doesn't require clicking a bunch of buttons to "Allow" access -- intelligent UI design can make much of this completely transparent, provided the host platform is capability-based.) It's not that companies like Microsoft aren't well aware of capability-based security [7], it just seems to be that the appetite isn't there to really solve user's problems (breaking stuff like the Start Menu appears to be more important), despite the valiant efforts of some really smart people [8]. To be fair, shifting to a capability-based system would be a significant engineering effort, but definitely well within the realms of Microsoft or Apple's capabilities. (Interestingly, some of the ideas on erights.org were influenced by Nick Szabo, who created "Bit gold" and who a few people think might be Nakamoto himself [though he denies it] [9]) [1a] http://www.cis.upenn.edu/~KeyKOS/ConfusedDeputy.html http://www.cis.upenn.edu/~KeyKOS/ConfusedDeputy.html [1b] http://erights.org/elib/capability/deputy.html http://erights.org/elib/capability/deputy.html [2] http://www.cis.upenn.edu/~KeyKOS/Gnosis/Gnosis.html http://www.cis.upenn.edu/~KeyKOS/Gnosis/Gnosis.html [3] http://www.cis.upenn.edu/~KeyKOS/Key370/Key370.html http://www.cis.upenn.edu/~KeyKOS/Key370/Key370.html [4a] http://www.skyhunter.com/marcs/capabilityIntro/index.html http://www.skyhunter.com/marcs/capabilityIntro/index.html [4b] http://erights.org/elib/capability/3parts.html http://erights.org/elib/capability/3parts.html [5] http://www.combex.com/papers/index.html http://www.combex.com/papers/index.html [6] http://www.combex.com/tech/edesk.html http://www.combex.com/tech/edesk.html [7] http://research.microsoft.com/en-us/projects/singularity/ http://research.microsoft.com/en-us/projects/singularity/ [8] http://en.wikipedia.org/wiki/Capability-based_security http://en.wikipedia.org/wiki/Capability-based_security [9a] http://erights.org/related.html http://erights.org/related.html [9b] http://unenumerated.blogspot.com/2011/05/bitcoin-what-took-ye-so-long.html http://unenumerated.blogspot.com/2011/05/bitcoin-what-took-y...
- wrongc0ntinent 13y ago
  Yes, lets. In the meantime, if your data is not in at least two places, it doesn't exist. I'm a fan of three.
  - willvarfar 13y ago
    Eh, cryptolocker will get those duplicates too.
    - Bootvis 13y ago
      He meant physical locations. Of course keeping your data on external backups has been a good practice since forever but many lack the discipline.
    - EvanAnderson 13y ago
      Real backup is both offsite and offline. If your backup doesn't have both attributes then it isn't backup.
  - ufmace 13y ago
    That's one of the real headaches of Cryptolocker, apparently. If you have automatic backups set up, the encrypted files will most likely be backed up there and overwrite the clean ones. To really be safe, you need either secure versioned backups - default Windows and MacOS backups may not work, since the drive is connected and fully accessible to the computer - or to do backups manually to media not normally connected to the computer, and notice that something has gone wrong sometime between when the infection starts and when you connect the drive. Did I mention yuck?
    - wrongc0ntinent 13y ago
      >do backups manually to media not normally connected to the computer Yup. This is really the only 100% way to have control over your stuff, local, physically separated storage. > notice that something has gone wrong sometime between when the infection starts and when you connect the drive. This assumes a chronological/incremental order for complete backups, which in practice is lazy and not related to the value of your data. Your only enemy should be the hardware. Dealing with the ugliest virus/worm/trojan turns into a mere nuisance when you have that kind of headroom.
- PhasmaFelis 13y ago
  So getting fucked by criminals now is good, because it prevents us from getting fucked by criminals in the future? I fail to see how either of those options is better than the other. Reminds me of the database crackers who claimed that publishing a bunch of innocent people's passwords was actually helping those people out by letting them know their passwords were vulnerable. Look, if I think I'm safe from being punched in the face, and someone says "we'll see about that!" and punches me in the face, they haven't done me a favor.
  - dasil003 13y ago
    Yes, because more will be at stake in the future. If we didn't have immune systems the species would have long been extinct in the primordial soup. Strong systems are built from living in a hostile and competitive environment, not from living in a utopia like the first academic computer systems lived in. We have to go through these growing pains at some point.
zequel 13y ago
In a (more) perfect world, the NSA would put considerable resources towards stopping this activity as opposed to spying on their own citizens and allies. A guy can dream...
- powertower 13y ago
  In a more perfect world, the people would understand that for the NSA to be able to find/track/stop this type of activity, they would have to have access to a large amount of global traffic, mine it, throw away what they don't need, keep the rest. You can't have your cake and eat it too.
  - hnnnnng 13y ago
    Except they're not doing that. Quite the opposite infact, they've invented a lot of the malware themselves. maybe this too. If I cant have my cake at least i can choose not to fucking pay for someone else(taxes). Smartass.
  - dasil003 13y ago
    No they wouldn't need that, there is plenty of evidence to investigate here without the need to buy half of the world's production of hard drives in perpetuity. What's needed is law enforcement's cooperation to bring the perpetrators to justice—that might be a little harder to do actually, but as the scale of this sort of things increases even the most crooked of eastern bloc countries are going to start getting a few offers they can't refuse.
    - wmf 13y ago
      If you imagine the NSA minus the espionage, isn't that basically the FBI computer crimes division?
      - tedivm 13y ago
        But with a real budget and people who are actually trained for the job.
losethos 13y ago
God picked me for His temple because I am the best programmer on Earth. I wrote all 130,000 lines of code. God says... I_planned_that BBC liberal furious gambling you_know_a_better_God hilarious break_some_woopass_on_you just_lovely You_fix_it programming Icarus nope merry_christmas why_didn'_you_tell_me Venus eh it_was_nothing I_hate_when_that_happens Tomorrow no_you_cant now_you_tell_me
jrockway 13y ago
Is the file with instructions on how to decrypt your files named "REAMDE"?
- jaxb 13y ago
  That novel has too much Russian mafia inside.
f3llowtraveler 13y ago
Hell, that's nothing. Here's something truly criminal: http://www.rollingstone.com/politics/blogs/taibblog/outrageous-hsbc-settlement-proves-the-drug-war-is-a-joke-20121213 http://www.rollingstone.com/politics/blogs/taibblog/outrageo...
- girvo 13y ago
  I remember reading about that earlier this year. Not surprised by the outcome.
- retube 13y ago
  There is no evidence anyone at HSBC was willfully assisting or complicit in money laundering. The fines are for weak controls that failed to detect money laundering.
  - shiven 13y ago
    Oh please! The fines are for disabling the controls that would have automatically flagged money laundering transactions. Source: the link OP posted. Still, it is a mere slap on the wrist that is guaranteed to have no permanent repercussions to deter such behavior. It's a clusterfuck and I don't see a solution emerging without both the war on drugs ending and multi-year incarceration becoming mandatory for financial crimes.
    - retube 13y ago
      Oh Please! Matt Taibbi is in no way a credible source. > Disabling Or alternatively, just not enabling tougher controls. There's no evidence, or indeed suggestion by prosecutors, that controls were deliberately set low to deliberatly faciliate money laundering.
      - skinnycow 13y ago
        How fucking far is your head up your ass? Oh, you're a pro-censorship christian nut. Great. What is with you and wanting to defend government intrusions at all cost. Censorship good. HSBC and government ripping off people good. Secret TPP partnership good. What a load of mental gymnastics.
adrianwaj 13y ago
Could the bitcoin network reverse spends into the attacker's address(es) if everyone came together and agreed to do so? Or at least prevent spending out of it?
- tinco 13y ago
  If every miner would join in, preventing spending would be possible. Reversing the spending is near impossible (it would take cooperation of not just the miners, but also every address that was in a transaction since the offending transaction).
tyoma 13y ago
Why does Windows still let arbitrary applications downloaded via email run? I'm sure the vast majority of cryptolocker victims have no desire to share binary executables via email. I wish there was an "only run Microsoft approved applications" option I could enable for my parents. Kind of like OS X's Gatekeeper.

77 points by hseldon15 13y ago

I'm actually pretty happy cryptolocker's around. No, wait, don't hang me yet, stuff your pitchforks, let me explain. Let's face it, computer security has been pretty bad trough pretty much the entire personal computing era. I don't need to point any fingers, the guilty know who they are. Now unlike some others, Apple and Linux do try to do a few things about that, in different ways, with varying degrees of success. But it's better, by far, than the teeming mess on that other platform we won't be mentioning. I believe if we want to use IT in the future, that this stuff's got to get pretty much bullet and foolproof. And without a credible threat it won't get there. Now, one of the things that held the development of a credible threat back, was the limited ways in which security holes could be monetized. "Fortunately" that's no longer a problem. And now that I think we have a credible threat. Will we now, please, with suggar on top, get computer security right? Isn't like, kinda time?

NAFV_P 13y ago
I'm surprised that the NSA hasn't looked into it yet (or have they?...), with what they've been up to over the past decade.
- dredwerker 13y ago
  I am more worried about cryptolocker than the Silk Road or its derivatives. These people must be getting the money out somehow via the visible blockchain.
  - thrill 13y ago
    The article talks about mixing services. Destroy those and what little anonymity that can be had in virtual currency ceases. As for getting money out, why bother, if you take the (perhaps not that) long view that BTC itself will be generally useful.
- saraid216 13y ago
  Wouldn't it be the FBI's job?
ams6110 13y ago
I had a similar reaction to the Target credit card number situation. Not happy about it, but the thought did cross my mind "maybe this will finally make banks/card companies/retailers take security more seriously." Not really holding out much hope though.
- vkou 13y ago
  Why would they? Most of the damage (time wasted by their customers dealing with the fallout) is an externality.
  - lukifer 13y ago
    There are situations in which "there is no bad publicity"; a massive security breach isn't one of them. Even if customers are protected by their credit card provider, it's still a massive inconvenience at best to have your card data stolen. I guarantee Target takes a non-trivial sales hit from the incident, particularly online.
lifeisstillgood 13y ago
Yes and no. Well mainly no. Crime can leech too much, do too much damage that it actually holds back development (pretty much any dictatorship, many Mafias) It's pretty likely that the major reaction to crypto locker will not be "darn it, let's breakout a can of OpenBSD on our systems." It will be let's buy more norton, let's disconnect from the Internet except Wednesdays, let's print out our important emails. Anyway I still really really struggle with how anyone can get stolen / hot money off the block chain and into their hands, cleanly. There is a limited supply of fools who will accept 10M from a Nigerian in return for laundering it.
- pyalot2 13y ago
  While I would be glad if people would stop using that unnamed OS, what I meant isn't that everybody should just hop to some *nix. What I meant is that pretty much every OS out there does security completely wrong, for no discernible reason.
ryanjshaw 13y ago
Computer science solved this problem (the "Confused Deputy" [1]) decades ago [2] [3] with capability-based security [4]. I don't have the time to find the exact reference I'm thinking of right now, but consider taking a look at one of the papers that give a background to CapDesk [5]: > Which addresses, among other things: > "All Windows and Unix operating systems (referred to as “Winix” hereafter) utterly disregard the concept of POLA [Principle of Least Authority]. When you launch any application—be it a $5000 version of AutoCAD fresh from the box or the Elf Bowling game downloaded from an unknown site on the Web—that application is immediately and automatically endowed with all the authority you yourself hold. Such applications can plant Trojans as part of your startup profile, read all your email, transmit themselves to everyone in your address book using your name, and can connect via TCP/IP to their remote masters for further instruction. This is, candidly, madness." [6] Since then, things have changed slightly - UAC under Windows, for instance, means applications now only have the ability to steal and hold your highly valuable and personal documents for ransom, but hey at least these sneaky trojans don't have admin rights! Which is of course the exact scenario that Cryptolocker happily exploits. There's really no reason a piece of junk attached to your email application should execute any more authority than you explicitly grant it. (And no that doesn't require clicking a bunch of buttons to "Allow" access -- intelligent UI design can make much of this completely transparent, provided the host platform is capability-based.) It's not that companies like Microsoft aren't well aware of capability-based security [7], it just seems to be that the appetite isn't there to really solve user's problems (breaking stuff like the Start Menu appears to be more important), despite the valiant efforts of some really smart people [8]. To be fair, shifting to a capability-based system would be a significant engineering effort, but definitely well within the realms of Microsoft or Apple's capabilities. (Interestingly, some of the ideas on erights.org were influenced by Nick Szabo, who created "Bit gold" and who a few people think might be Nakamoto himself [though he denies it] [9]) [1a] http://www.cis.upenn.edu/~KeyKOS/ConfusedDeputy.html http://www.cis.upenn.edu/~KeyKOS/ConfusedDeputy.html [1b] http://erights.org/elib/capability/deputy.html http://erights.org/elib/capability/deputy.html [2] http://www.cis.upenn.edu/~KeyKOS/Gnosis/Gnosis.html http://www.cis.upenn.edu/~KeyKOS/Gnosis/Gnosis.html [3] http://www.cis.upenn.edu/~KeyKOS/Key370/Key370.html http://www.cis.upenn.edu/~KeyKOS/Key370/Key370.html [4a] http://www.skyhunter.com/marcs/capabilityIntro/index.html http://www.skyhunter.com/marcs/capabilityIntro/index.html [4b] http://erights.org/elib/capability/3parts.html http://erights.org/elib/capability/3parts.html [5] http://www.combex.com/papers/index.html http://www.combex.com/papers/index.html [6] http://www.combex.com/tech/edesk.html http://www.combex.com/tech/edesk.html [7] http://research.microsoft.com/en-us/projects/singularity/ http://research.microsoft.com/en-us/projects/singularity/ [8] http://en.wikipedia.org/wiki/Capability-based_security http://en.wikipedia.org/wiki/Capability-based_security [9a] http://erights.org/related.html http://erights.org/related.html [9b] http://unenumerated.blogspot.com/2011/05/bitcoin-what-took-ye-so-long.html http://unenumerated.blogspot.com/2011/05/bitcoin-what-took-y...
wrongc0ntinent 13y ago
Yes, lets. In the meantime, if your data is not in at least two places, it doesn't exist. I'm a fan of three.
- willvarfar 13y ago
  Eh, cryptolocker will get those duplicates too.
  - Bootvis 13y ago
    He meant physical locations. Of course keeping your data on external backups has been a good practice since forever but many lack the discipline.
  - EvanAnderson 13y ago
    Real backup is both offsite and offline. If your backup doesn't have both attributes then it isn't backup.
- ufmace 13y ago
  That's one of the real headaches of Cryptolocker, apparently. If you have automatic backups set up, the encrypted files will most likely be backed up there and overwrite the clean ones. To really be safe, you need either secure versioned backups - default Windows and MacOS backups may not work, since the drive is connected and fully accessible to the computer - or to do backups manually to media not normally connected to the computer, and notice that something has gone wrong sometime between when the infection starts and when you connect the drive. Did I mention yuck?
  - wrongc0ntinent 13y ago
    >do backups manually to media not normally connected to the computer Yup. This is really the only 100% way to have control over your stuff, local, physically separated storage. > notice that something has gone wrong sometime between when the infection starts and when you connect the drive. This assumes a chronological/incremental order for complete backups, which in practice is lazy and not related to the value of your data. Your only enemy should be the hardware. Dealing with the ugliest virus/worm/trojan turns into a mere nuisance when you have that kind of headroom.
PhasmaFelis 13y ago
So getting fucked by criminals now is good, because it prevents us from getting fucked by criminals in the future? I fail to see how either of those options is better than the other. Reminds me of the database crackers who claimed that publishing a bunch of innocent people's passwords was actually helping those people out by letting them know their passwords were vulnerable. Look, if I think I'm safe from being punched in the face, and someone says "we'll see about that!" and punches me in the face, they haven't done me a favor.
- dasil003 13y ago
  Yes, because more will be at stake in the future. If we didn't have immune systems the species would have long been extinct in the primordial soup. Strong systems are built from living in a hostile and competitive environment, not from living in a utopia like the first academic computer systems lived in. We have to go through these growing pains at some point.

zequel 13y ago

In a (more) perfect world, the NSA would put considerable resources towards stopping this activity as opposed to spying on their own citizens and allies. A guy can dream...

powertower 13y ago
In a more perfect world, the people would understand that for the NSA to be able to find/track/stop this type of activity, they would have to have access to a large amount of global traffic, mine it, throw away what they don't need, keep the rest. You can't have your cake and eat it too.
- hnnnnng 13y ago
  Except they're not doing that. Quite the opposite infact, they've invented a lot of the malware themselves. maybe this too. If I cant have my cake at least i can choose not to fucking pay for someone else(taxes). Smartass.
- dasil003 13y ago
  No they wouldn't need that, there is plenty of evidence to investigate here without the need to buy half of the world's production of hard drives in perpetuity. What's needed is law enforcement's cooperation to bring the perpetrators to justice—that might be a little harder to do actually, but as the scale of this sort of things increases even the most crooked of eastern bloc countries are going to start getting a few offers they can't refuse.
  - wmf 13y ago
    If you imagine the NSA minus the espionage, isn't that basically the FBI computer crimes division?
    - tedivm 13y ago
      But with a real budget and people who are actually trained for the job.

losethos 13y ago

God picked me for His temple because I am the best programmer on Earth. I wrote all 130,000 lines of code. God says... I_planned_that BBC liberal furious gambling you_know_a_better_God hilarious break_some_woopass_on_you just_lovely You_fix_it programming Icarus nope merry_christmas why_didn'_you_tell_me Venus eh it_was_nothing I_hate_when_that_happens Tomorrow no_you_cant now_you_tell_me

jrockway 13y ago

Is the file with instructions on how to decrypt your files named "REAMDE"?

jaxb 13y ago
That novel has too much Russian mafia inside.

f3llowtraveler 13y ago

Hell, that's nothing. Here's something truly criminal: http://www.rollingstone.com/politics/blogs/taibblog/outrageous-hsbc-settlement-proves-the-drug-war-is-a-joke-20121213 http://www.rollingstone.com/politics/blogs/taibblog/outrageo...

girvo 13y ago
I remember reading about that earlier this year. Not surprised by the outcome.
retube 13y ago
There is no evidence anyone at HSBC was willfully assisting or complicit in money laundering. The fines are for weak controls that failed to detect money laundering.
- shiven 13y ago
  Oh please! The fines are for disabling the controls that would have automatically flagged money laundering transactions. Source: the link OP posted. Still, it is a mere slap on the wrist that is guaranteed to have no permanent repercussions to deter such behavior. It's a clusterfuck and I don't see a solution emerging without both the war on drugs ending and multi-year incarceration becoming mandatory for financial crimes.
  - retube 13y ago
    Oh Please! Matt Taibbi is in no way a credible source. > Disabling Or alternatively, just not enabling tougher controls. There's no evidence, or indeed suggestion by prosecutors, that controls were deliberately set low to deliberatly faciliate money laundering.
    - skinnycow 13y ago
      How fucking far is your head up your ass? Oh, you're a pro-censorship christian nut. Great. What is with you and wanting to defend government intrusions at all cost. Censorship good. HSBC and government ripping off people good. Secret TPP partnership good. What a load of mental gymnastics.

adrianwaj 13y ago

Could the bitcoin network reverse spends into the attacker's address(es) if everyone came together and agreed to do so? Or at least prevent spending out of it?

tinco 13y ago
If every miner would join in, preventing spending would be possible. Reversing the spending is near impossible (it would take cooperation of not just the miners, but also every address that was in a transaction since the offending transaction).

tyoma 13y ago

Why does Windows still let arbitrary applications downloaded via email run? I'm sure the vast majority of cryptolocker victims have no desire to share binary executables via email. I wish there was an "only run Microsoft approved applications" option I could enable for my parents. Kind of like OS X's Gatekeeper.