6 ms·

Nokia 'paid millions to software blackmailers six years ago'

117 points by rpledge 12y ago

a2tech 12y ago
'the money was delivered but the police lost track of the culprits' A solid showing by the Helsinki police
- theg2 12y ago
  It's almost out of a movie. One of your larger national companies is being extorted and you fail to follow the people doing so? It also had to be a pretty big vulnerability for them to have to pay that much in the first place.
  - ohashi 12y ago
    It makes it sound like it was the keys to the castle.
    - grrowl 12y ago
      It was. They could have signed any phone application to pretend like it was developed by Nokia, and therefore could have done anything to the phones (hence the malware angle).
  - walshemj 12y ago
    And at the time Nokia was a major part of the entire finish economy - sounds like gross incompetence on the finish authorities.
- iancarroll 12y ago
  You can't exactly arrest them without one of their partners releasing the key. Following them might not end well either.
  - gnur 12y ago
    I think blackmail would be enough to arrest them.
- deleted 12y ago
  [deleted]
- kiiski 12y ago
  It wasn't actually Helsinki police (this didn't even happen in Helsinki), but the National Bureau of Investigation (KRP).
- mushishi 12y ago
  Where did you read that it had something to do with Helsinki police? At least the money exchange took place in Tampere. In Finnish: http://www.aamulehti.fi/Kotimaa/1194907965691/artikkeli/mtv+nokia+maksoi+miljoonia+kiristajalle+lunnaiden+maksu+sarkanniemen+tuntumassa.html http://www.aamulehti.fi/Kotimaa/1194907965691/artikkeli/mtv+...
- nl 12y ago
  A solid showing by the Helsinki police Or a very well planned getaway. Given that the culprits managed to steal Nokia's signing key, I suspect they knew what they were doing.
swatthatfly 12y ago
I always wondered how you do paperwork for something like this. It must be a nightmare from an accountant perspective. What is the bill code for "blackmail" when you file the income tax and you write a 6 figure expense. In the end your cash has to balance out, you cannot not declare it. Anybody with experience in something like this?
- Demiurge 12y ago
  isn't there something fringe like 'theft' or miscellaneous losses?
  - TheCoelacanth 12y ago
    Having a code for theft is definitely a thing. For many businesses, having a small amount of theft is just an unavoidable cost of doing business.
- dublinben 12y ago
  At least for the IRS, you can deduct money paid out for ransom, blackmail, or other forms of theft. http://www.irs.gov/publications/p17/ch25.html#en_US_2011_publink1000173531 http://www.irs.gov/publications/p17/ch25.html#en_US_2011_pub...
pdenya 12y ago
Wow, that's rough. Not much you can do against a vulnerability that'll destroy the trust of your entire customer base. A DDOS is one thing but I probably would have paid the millions in this case.
- mbreese 12y ago
  I wonder how much it would have cost to push out an update to all of the Symbian devices in the wild at the time. It wouldn't have been easy, and would have been a PR nightmare, but it could have been done. The question is: would it have been worth it? I don't know, but hiding things rarely goes well. Then again, I don't know of any public instances where this has happened, but I'm sure Nokia aren't the only ones to have been hit by this.
  - bronson 12y ago
    Assuming you could even reflash the firmware key.
  - 0x0 12y ago
    Code signing key compromise has happened at least for Red Hat and Adobe quite publicly. Plenty of malware use code signed windows device drivers with stolen(?) hw manufacturer keys, too.
fidotron 12y ago
I can fully see how this could happen. Too many companies don't understand the value of keys like this, and won't until they have a similar situation. I wonder how exactly the criminals came to have them in the first place, but would be willing to bet it was ultimately incompetence by someone at Nokia.
- asmosoinio 12y ago
  Having done a few code signings physically at Nokia Tampere back in the Symbian days, I would say they were pretty serious about these codes. Not that the security was 100% tight, but it did involve having to go to a single locked up computer with someone looking at you, keys to the safe in different places, required two separate persons from the signing to be there etc. Impressed myself at least.
- kiiski 12y ago
  The Helsinki Times article[1 english] says they suspect it was an ex employee. "Information obtained by Helsingin Sanomat from two different sources indicates that Nokia believes the blackmailer to be a Finnish citizen who participated in the development of the user interface. The suspect was able to obtain the highly-classified encryption key due to a data security vulnerability." [1] http://www.helsinkitimes.fi/finland/finland-news/domestic/10933-nokia-held-to-ransom-over-symbian-vulnerability.html http://www.helsinkitimes.fi/finland/finland-news/domestic/10...
hyperion2010 12y ago
I'm trying to imagine this happening to someone like Red Hat. BM: "We have the keys to your software repos give us money or we leak." RH: "Here's a tarball of the sources it make your life easier, knock yourselves out! Maybe we'll even get some new developers!" Obviously there are reason's why companies choose to keep their software closed source, but sometimes I wonder.
- tzs 12y ago
  The article is a bit unclear, but it appears that what the blackmailers got were the signing keys for the software. Losing signing keys would be pretty bad for Red Hat, too.
  - 0x0 12y ago
    That happened! And that was also 6 years ago. http://linux.slashdot.org/story/08/08/22/1341247/red-hat-fedora-servers-compromised http://linux.slashdot.org/story/08/08/22/1341247/red-hat-fed...
- porpoisemonkey 12y ago
  I think the analogy is a little off. This would be like someone having the GPG signing key for the Red Hat official repositories. It would give them the ability to insert their own (malicious) software package into the Red Hat update stream without the signature throwing any warnings.
  - hyperion2010 12y ago
    Isn't that why we keep revocation certs around? That doesn't really work for blackmail anyway because it is dependent on preventing the organization from knowing that you have access.
- rplnt 12y ago
  Well, RH isn't the best example. IIRC they do some shenanigans around kernel updates to hide the actual patches. And only paying customers get it.
0x0 12y ago
That's absolutely insane! Even after paying the ransom, how could they be sure noone were still sitting on the keys? Assuming it's code signing keys, it sounds incredibly irresponsible to not (force) update all devices anyways. Is really the only thing protecting the safety of those devices the promise of a blackmailer to not abuse the private keys they were sitting on? ... makes me wonder what else we don't know about all the other vendors...
- josh2600 12y ago
  In 2008, forced updates of mobiles, particularly of the s40 and s60 variety, was not a thing. It turns out that when an operating system is in service for a very long time without updates, bad things happen. Now if you want a real scare, consider for a moment all of the code running on embedded hardware that makes up the entirety of the world energy grid.
  - mobiplayer 12y ago
    Exactly this. Also, for those that still remember Heartbleed, read again the above comment and think what embedded hardware is running around you. It is a bit scary.
    - josh2600 12y ago
      To be fair, you can't exactly "force" an android or an iOS device to update either. It's easier to coach users to update but goddamn would it have been impossible to get s40/60 users to move even one version up. I recall doing an s60 software upgrade and having it crash halfway through, which somehow bricked the baseband and the operating system of the device. Go figure.
      - Maakuth 12y ago
        On S60 there was no separate baseband chip to my understanding, the Symbian kernel was responsible of driving the radio as well. This was said to give Nokia a competitive advantage, as most of the competing smartphone OSes required separate baseband chip with a firmware of its own, which drove costs up back then. Such chips are inside SoCs of course these days and cost next to nothing anyway.
deleted 12y ago
[deleted]
- ossreality 12y ago
  Read the artcile. They had Nokia's signing keys. Much worse than IP theft.
- beernutz 12y ago
  Though the article implies it was source code, it was actually the code signing keys used to limit running code to only properly signed binaries.
  - deleted 12y ago
    [deleted]
fucktheid 12y ago
they got the buckets, they got the source, they are anonymous.... release the code!
broolstoryco 12y ago
Ah yes, the good old days when software extortionists demanded cash in parking lots. To me Bitcoin seems much older than it actually is.
cornholio 12y ago
> Had it done so anyone could then have written additional code for Symbian including possible malware which would have been indistinguishable from the legitimate part of the software. Like a rootkit then ? It's a classic case of robbing the mob, as in 'the people who actually own the phone you think you've bought'.
paulrov 12y ago
What would be the point in paying them, even after being paid they still hold all the cards.

117 points by rpledge 12y ago

a2tech 12y ago

'the money was delivered but the police lost track of the culprits' A solid showing by the Helsinki police

theg2 12y ago
It's almost out of a movie. One of your larger national companies is being extorted and you fail to follow the people doing so? It also had to be a pretty big vulnerability for them to have to pay that much in the first place.
- ohashi 12y ago
  It makes it sound like it was the keys to the castle.
  - grrowl 12y ago
    It was. They could have signed any phone application to pretend like it was developed by Nokia, and therefore could have done anything to the phones (hence the malware angle).
- walshemj 12y ago
  And at the time Nokia was a major part of the entire finish economy - sounds like gross incompetence on the finish authorities.
iancarroll 12y ago
You can't exactly arrest them without one of their partners releasing the key. Following them might not end well either.
- gnur 12y ago
  I think blackmail would be enough to arrest them.
deleted 12y ago
[deleted]
kiiski 12y ago
It wasn't actually Helsinki police (this didn't even happen in Helsinki), but the National Bureau of Investigation (KRP).
mushishi 12y ago
Where did you read that it had something to do with Helsinki police? At least the money exchange took place in Tampere. In Finnish: http://www.aamulehti.fi/Kotimaa/1194907965691/artikkeli/mtv+nokia+maksoi+miljoonia+kiristajalle+lunnaiden+maksu+sarkanniemen+tuntumassa.html http://www.aamulehti.fi/Kotimaa/1194907965691/artikkeli/mtv+...
nl 12y ago
A solid showing by the Helsinki police Or a very well planned getaway. Given that the culprits managed to steal Nokia's signing key, I suspect they knew what they were doing.

swatthatfly 12y ago

I always wondered how you do paperwork for something like this. It must be a nightmare from an accountant perspective. What is the bill code for "blackmail" when you file the income tax and you write a 6 figure expense. In the end your cash has to balance out, you cannot not declare it. Anybody with experience in something like this?

Demiurge 12y ago
isn't there something fringe like 'theft' or miscellaneous losses?
- TheCoelacanth 12y ago
  Having a code for theft is definitely a thing. For many businesses, having a small amount of theft is just an unavoidable cost of doing business.
dublinben 12y ago
At least for the IRS, you can deduct money paid out for ransom, blackmail, or other forms of theft. http://www.irs.gov/publications/p17/ch25.html#en_US_2011_publink1000173531 http://www.irs.gov/publications/p17/ch25.html#en_US_2011_pub...

pdenya 12y ago

Wow, that's rough. Not much you can do against a vulnerability that'll destroy the trust of your entire customer base. A DDOS is one thing but I probably would have paid the millions in this case.

mbreese 12y ago
I wonder how much it would have cost to push out an update to all of the Symbian devices in the wild at the time. It wouldn't have been easy, and would have been a PR nightmare, but it could have been done. The question is: would it have been worth it? I don't know, but hiding things rarely goes well. Then again, I don't know of any public instances where this has happened, but I'm sure Nokia aren't the only ones to have been hit by this.
- bronson 12y ago
  Assuming you could even reflash the firmware key.
- 0x0 12y ago
  Code signing key compromise has happened at least for Red Hat and Adobe quite publicly. Plenty of malware use code signed windows device drivers with stolen(?) hw manufacturer keys, too.

fidotron 12y ago

I can fully see how this could happen. Too many companies don't understand the value of keys like this, and won't until they have a similar situation. I wonder how exactly the criminals came to have them in the first place, but would be willing to bet it was ultimately incompetence by someone at Nokia.

asmosoinio 12y ago
Having done a few code signings physically at Nokia Tampere back in the Symbian days, I would say they were pretty serious about these codes. Not that the security was 100% tight, but it did involve having to go to a single locked up computer with someone looking at you, keys to the safe in different places, required two separate persons from the signing to be there etc. Impressed myself at least.
kiiski 12y ago
The Helsinki Times article[1 english] says they suspect it was an ex employee. "Information obtained by Helsingin Sanomat from two different sources indicates that Nokia believes the blackmailer to be a Finnish citizen who participated in the development of the user interface. The suspect was able to obtain the highly-classified encryption key due to a data security vulnerability." [1] http://www.helsinkitimes.fi/finland/finland-news/domestic/10933-nokia-held-to-ransom-over-symbian-vulnerability.html http://www.helsinkitimes.fi/finland/finland-news/domestic/10...

hyperion2010 12y ago

I'm trying to imagine this happening to someone like Red Hat. BM: "We have the keys to your software repos give us money or we leak." RH: "Here's a tarball of the sources it make your life easier, knock yourselves out! Maybe we'll even get some new developers!" Obviously there are reason's why companies choose to keep their software closed source, but sometimes I wonder.

tzs 12y ago
The article is a bit unclear, but it appears that what the blackmailers got were the signing keys for the software. Losing signing keys would be pretty bad for Red Hat, too.
- 0x0 12y ago
  That happened! And that was also 6 years ago. http://linux.slashdot.org/story/08/08/22/1341247/red-hat-fedora-servers-compromised http://linux.slashdot.org/story/08/08/22/1341247/red-hat-fed...
porpoisemonkey 12y ago
I think the analogy is a little off. This would be like someone having the GPG signing key for the Red Hat official repositories. It would give them the ability to insert their own (malicious) software package into the Red Hat update stream without the signature throwing any warnings.
- hyperion2010 12y ago
  Isn't that why we keep revocation certs around? That doesn't really work for blackmail anyway because it is dependent on preventing the organization from knowing that you have access.
rplnt 12y ago
Well, RH isn't the best example. IIRC they do some shenanigans around kernel updates to hide the actual patches. And only paying customers get it.

0x0 12y ago

That's absolutely insane! Even after paying the ransom, how could they be sure noone were still sitting on the keys? Assuming it's code signing keys, it sounds incredibly irresponsible to not (force) update all devices anyways. Is really the only thing protecting the safety of those devices the promise of a blackmailer to not abuse the private keys they were sitting on? ... makes me wonder what else we don't know about all the other vendors...

josh2600 12y ago
In 2008, forced updates of mobiles, particularly of the s40 and s60 variety, was not a thing. It turns out that when an operating system is in service for a very long time without updates, bad things happen. Now if you want a real scare, consider for a moment all of the code running on embedded hardware that makes up the entirety of the world energy grid.
- mobiplayer 12y ago
  Exactly this. Also, for those that still remember Heartbleed, read again the above comment and think what embedded hardware is running around you. It is a bit scary.
  - josh2600 12y ago
    To be fair, you can't exactly "force" an android or an iOS device to update either. It's easier to coach users to update but goddamn would it have been impossible to get s40/60 users to move even one version up. I recall doing an s60 software upgrade and having it crash halfway through, which somehow bricked the baseband and the operating system of the device. Go figure.
    - Maakuth 12y ago
      On S60 there was no separate baseband chip to my understanding, the Symbian kernel was responsible of driving the radio as well. This was said to give Nokia a competitive advantage, as most of the competing smartphone OSes required separate baseband chip with a firmware of its own, which drove costs up back then. Such chips are inside SoCs of course these days and cost next to nothing anyway.

deleted 12y ago

[deleted]

ossreality 12y ago
Read the artcile. They had Nokia's signing keys. Much worse than IP theft.
beernutz 12y ago
Though the article implies it was source code, it was actually the code signing keys used to limit running code to only properly signed binaries.
- deleted 12y ago
  [deleted]

fucktheid 12y ago

they got the buckets, they got the source, they are anonymous.... release the code!

broolstoryco 12y ago

Ah yes, the good old days when software extortionists demanded cash in parking lots. To me Bitcoin seems much older than it actually is.

cornholio 12y ago

> Had it done so anyone could then have written additional code for Symbian including possible malware which would have been indistinguishable from the legitimate part of the software. Like a rootkit then ? It's a classic case of robbing the mob, as in 'the people who actually own the phone you think you've bought'.

paulrov 12y ago

What would be the point in paying them, even after being paid they still hold all the cards.