7 ms·

Pizzerias Receiving Extortion Letters Demanding Bitcoin

72 points by ldayley 12y ago

ccozan 12y ago
"What the heck is a BitCoin??" I bet there is no actual extortion going on, but kind of a "let's educate the business owners into the new digital economy, and, if necessary, by force". The pranksters probably estimate, once the business owners find out what is the idea of Bitcoin, they will say, hey, let's offer this to our customers.
- talmand 12y ago
  Um, no, that's a pretty clear cut example of extortion. Whether they follow through with the threats or not is irrelevant. The act of extortion has already been committed.
- PhasmaFelis 12y ago
  So your theory is that, having been introduced to a new idea by gut-churning fear and anger, business owners will immediately think "Hey, this is pretty cool! We should use it!" Have you met many humans?
- robert_tweed 12y ago
  Replying because I don't think your post deserves all the downvotes, even though I think your argument is stupid. TBH, my first thought when I saw the "notice of extortion" letter was that it was a joke. Not a particularly funny one for the restaurateurs, but perhaps someone's lame idea of a prank that got a bit out of hand. However, as others have pointed out already, it is most definitely a clear-cut case of extortion whether or not they have any intent of following through on the threats. Just as robbery with an unloaded gun is still robbery and threatening with a deadly weapon: nobody knows whether it's loaded, so they have to assume it is. In that case the induce fear and panic is quite real. People have been known to have heart attacks in such situations. In that case the the perpetrator has committed a homicide, regardless of intent. It's also not a very good way of winning hearts and minds if education is the goal.
kyllo 12y ago
Page has a pop-up with autoplay video ad. No thanks.
- pavel_lishin 12y ago
  Adblock/Flashblock/Ghostery seem to have blocked it for me.
Timmmmbob 12y ago
I hope they reported that to the police!
ngoel36 12y ago
My girlfriend's father had a hacker break into their network drive, encrypt all their files, and extort the company for $500 of Bitcoin in exchange for the password...
- logicallee 12y ago
  That's some cheap-ass pentesting. Here you go buddy! (j/k) To explain the joke... companies spend tens of thousands doing "pentesting" to stave off vectors for concerted attacks. In this case, they would be spending tens of thousands to prevent the...$500 being extorted. My joke is that it is just as easy to pay the guy $500 for finding the errors. It's just a joke, though. You shouldn't pay extortionists a dime. (Even if that's all they ask for.)
  - Scoundreller 12y ago
    There is some logic of burying wallet.dat files in various places in your systems and monitoring them. If/when they go missing, you know you have a problem. Possibly set-up a periodic cycling system that drives the intruder to move them now, before they get cycled and might lose their bounty forever.
- ceejayoz 12y ago
  Your girlfriend's father opened an email attachment he shouldn't have, you mean? edit: C'mon, folks. Cryptolocker isn't a bunch of hackers targeting individual network drives. It's spread via email. http://en.wikipedia.org/wiki/CryptoLocker http://en.wikipedia.org/wiki/CryptoLocker
  - joezydeco 12y ago
    Well, he had to tell his wife something...
  - drivingmenuts 12y ago
    Sure, and stupid people deserve to be taken advantage of, right? Cos' that's what I see you saying.
VLM 12y ago
Obviously the victim isn't the local pizzera its Coinbase. Someone just spent "not very much money" to make them look incredibly bad. Should be fairly easy to track them down, just analyze the pattern of yellow dots on the color laser print to figure out the make, model, and serial number of the printer making the extortion letters, then contact whichever of coinbase's competitors made those letters and ... Now if I was thinking a little more clearly I'd figure out how to track them down myself, and let it be known to coinbase's competitor that I'd keep these facts quiet if I was too busy eating pizza bought by, say, 5000 BTC from whichever coinbase competitor made the letters.
- Nakatomi_Plaza 12y ago
  It's likely coinbase was chosen simply because it's the easiest way for their victims to buy coins. There is a vulnerability with Pizza businesses in that they trust the caller is making a legit order, and don't ask for pre-payment before delivery thus leaving them open to fraud. Whoever is doing this is clearly bluffing and hoping just a handful of businesses pay the extortion and likely flooded the mail system with these letters. I bet the payment address is the same for each extortion letter meaning they have no way of knowing if a company pays or not.
  - pavel_lishin 12y ago
    Read your username as "Nakatomi Pizza".
    - dobbsbob 12y ago
      This extortion attempt could create a new startup: Nakatomi Pizza that processes calls to check for fingerprints of fraud, and to verify orders. "Now I have a machine learning caller-ID with advanced heuristics ho, ho ho"
  - VLM 12y ago
    Yeah you guys are probably right, after all. If it demanded cash and suggested visiting your local Citibank Branch or Citibank In Network ATM that clearly would also be an equally random and meaningless data point, totally not trying to make Citibank look bad or anything.
Nakatomi_Plaza 12y ago
It's cheaper for the Pizza company to eat some of the fraudulent orders than pay the $600 extortion fee.
- pavel_lishin 12y ago
  That's if the extortionists even bother carrying through with their threat. It's pretty cheap to print up a thousand letters and mail them to pizzerias all over the country; if even a couple cough up the money, that's probably money and effort spent well enough. The deadline is far enough in the future that it's not really worth it to prove that punitive measures will be taken.
  - larrys 12y ago
    I guess I assumed these were coming from out of the country. Do we know that they are being mailed in the US? If that is the case the postal service almost certainly knows which post office these were mailed out of.
    - schrodinger 12y ago
      How useful is that? Someone could drive an hour, dump them all in a mailbox anonymously...
      - larrys 12y ago
        Could be useful if triangulated with other information. And it's always possible that whatever mailbox they dumped them in was in view of a video camera or perhaps their car passed video surveillance (or walked by). Or maybe used an ATM nearby. Or paid a toll. People slip up. For that matter what about all that stuff about embedding things in printers (micro traces or whatever they are called). Otoh, I constantly get all sorts of scams from overseas wanting to charge me ridiculous amounts of money for trademark registries (approx. $2000 USD iirc) of zero value. They have been pretty consistent over the years and I'm guessing that even with the cost of foreign postage they are a net win for the perps. Otherwise I can't imagine they would keep sending them.
steffenfrost 12y ago
The address doesn't seem to be a valid BTC address.
coreymgilmore 12y ago
Some quick digging around: not much to be found on the wallet addresses on the extortion letters. One wallet was tied to a 0.001 transaction on 6/27. wallet: 17gt1BancvtnnJwy4BA41VBUH3pfbUvzE block: 308079
- snorkel 12y ago
  Can't coinbase just ban whatever id was presented in the letter?
  - DanBC 12y ago
    See also "joe job", "reputation attack", and "denial of service".
  - deleted 12y ago
    [deleted]
- Scoundreller 12y ago
  Even if money goes in, you can't be assured someone didn't just deposit it for the lolz, or if it was the perpetrators just moving their own coin around.
privatedan 12y ago
If I were a pizza parlor owner, I would frame this letter and hang it in my restaurant.
naturalethic 12y ago
This would be a great way for the Fed to push back on their competition.
- ascorbic 12y ago
  The Fed is in the pizza business?
jzf 12y ago
I came here to upvote anything stephenson - reamde and for pizzerias, snowcrash.
NoMoreNicksLeft 12y ago
They might as well be asking for plutonium or stolen Picassos... pizzerias don't have bitcoins, and generally-speaking have no idea how to get them. Seriously. Should have included two pages instructing them how to acquire the things...
sharemywin 12y ago
Apparently they've never worked in pizza. I could just see them sending it to my dad. First off, What's a bitcoin? Negative Online review...what's an Online review. Harrassing telephone calls...you mean a friday night? Farudulant delivery orders...10 all the way pizzas with anchovies...sure we'll make those right up and deliver them...ya right... Illegal drug sales...don't be primising illegal drugs to the delivery drivers unless your going to follow through. Health department -- they visit every six months anyway. BBB...I once watched a customer complain and get an attitute about his pizza ...he took his pizza and threw it in the trash handed him his money back and said dominos is down around the corner. I used to try to talk him into advertising too get more customers and he'd always tell me he didn't want anymore customers. He used to keep a saw'd shotgun behind the counter because the gangs that live in the apartment complex behind us were talking about robbing us. There's still a hole on the floor from where one the employees got shot 'cause they just wanted to shoot someone.
- Scoundreller 12y ago
  Would you mind doing us all a favour and building a database of every pizza place like this on the planet? It sounds like my (our?) kind of place.
  - sharemywin 12y ago
    It's simple find the most run down looking place you can find that's over 5 years old. You know if they're still in business it's not because if the atmosphere and the service, it's because of the food. Also, as for hacking it's hard to hack an order pad and a pen.
- read 12y ago
  An alternate theory would be the whole thing is a submarine: a way of advertising Bitcoin to pizza owners, under the pretense of a threat. What could make them take Bitcoin more seriously than the threat of them being harmed by it? It wouldn't be surprising if the whole thing was orchestrated by a Bitcoin startup. And its an easy trick to pull too. You stuff printed letters in a mailbox and they find their way out there. How could anyone prove who did it? Frankly it's impressive :) After a whole day on HN nobody brought up this possibility. There's also a lesson of strategy here. When you are not making progress being direct about something, try doing its opposite. What I'm more curious about is how they'll follow up without making it too obvious that they are advertising. How will the make the now worried pizza owner casually bump into a promising Bitcoin company that protects them from extortion and all bad Bitcoin things? Run an ad in the paper or local TV?
steanne 12y ago
actually, my local hole-in-the-wall takes bitcoin.

72 points by ldayley 12y ago

"What the heck is a BitCoin??" I bet there is no actual extortion going on, but kind of a "let's educate the business owners into the new digital economy, and, if necessary, by force". The pranksters probably estimate, once the business owners find out what is the idea of Bitcoin, they will say, hey, let's offer this to our customers.

talmand 12y ago
Um, no, that's a pretty clear cut example of extortion. Whether they follow through with the threats or not is irrelevant. The act of extortion has already been committed.
PhasmaFelis 12y ago
So your theory is that, having been introduced to a new idea by gut-churning fear and anger, business owners will immediately think "Hey, this is pretty cool! We should use it!" Have you met many humans?
robert_tweed 12y ago
Replying because I don't think your post deserves all the downvotes, even though I think your argument is stupid. TBH, my first thought when I saw the "notice of extortion" letter was that it was a joke. Not a particularly funny one for the restaurateurs, but perhaps someone's lame idea of a prank that got a bit out of hand. However, as others have pointed out already, it is most definitely a clear-cut case of extortion whether or not they have any intent of following through on the threats. Just as robbery with an unloaded gun is still robbery and threatening with a deadly weapon: nobody knows whether it's loaded, so they have to assume it is. In that case the induce fear and panic is quite real. People have been known to have heart attacks in such situations. In that case the the perpetrator has committed a homicide, regardless of intent. It's also not a very good way of winning hearts and minds if education is the goal.

kyllo 12y ago

Page has a pop-up with autoplay video ad. No thanks.

pavel_lishin 12y ago
Adblock/Flashblock/Ghostery seem to have blocked it for me.

Timmmmbob 12y ago

I hope they reported that to the police!

ngoel36 12y ago

My girlfriend's father had a hacker break into their network drive, encrypt all their files, and extort the company for $500 of Bitcoin in exchange for the password...

logicallee 12y ago
That's some cheap-ass pentesting. Here you go buddy! (j/k) To explain the joke... companies spend tens of thousands doing "pentesting" to stave off vectors for concerted attacks. In this case, they would be spending tens of thousands to prevent the...$500 being extorted. My joke is that it is just as easy to pay the guy $500 for finding the errors. It's just a joke, though. You shouldn't pay extortionists a dime. (Even if that's all they ask for.)
- Scoundreller 12y ago
  There is some logic of burying wallet.dat files in various places in your systems and monitoring them. If/when they go missing, you know you have a problem. Possibly set-up a periodic cycling system that drives the intruder to move them now, before they get cycled and might lose their bounty forever.
ceejayoz 12y ago
Your girlfriend's father opened an email attachment he shouldn't have, you mean? edit: C'mon, folks. Cryptolocker isn't a bunch of hackers targeting individual network drives. It's spread via email. http://en.wikipedia.org/wiki/CryptoLocker http://en.wikipedia.org/wiki/CryptoLocker
- joezydeco 12y ago
  Well, he had to tell his wife something...
- drivingmenuts 12y ago
  Sure, and stupid people deserve to be taken advantage of, right? Cos' that's what I see you saying.

VLM 12y ago

Obviously the victim isn't the local pizzera its Coinbase. Someone just spent "not very much money" to make them look incredibly bad. Should be fairly easy to track them down, just analyze the pattern of yellow dots on the color laser print to figure out the make, model, and serial number of the printer making the extortion letters, then contact whichever of coinbase's competitors made those letters and ... Now if I was thinking a little more clearly I'd figure out how to track them down myself, and let it be known to coinbase's competitor that I'd keep these facts quiet if I was too busy eating pizza bought by, say, 5000 BTC from whichever coinbase competitor made the letters.

Nakatomi_Plaza 12y ago
It's likely coinbase was chosen simply because it's the easiest way for their victims to buy coins. There is a vulnerability with Pizza businesses in that they trust the caller is making a legit order, and don't ask for pre-payment before delivery thus leaving them open to fraud. Whoever is doing this is clearly bluffing and hoping just a handful of businesses pay the extortion and likely flooded the mail system with these letters. I bet the payment address is the same for each extortion letter meaning they have no way of knowing if a company pays or not.
- pavel_lishin 12y ago
  Read your username as "Nakatomi Pizza".
  - dobbsbob 12y ago
    This extortion attempt could create a new startup: Nakatomi Pizza that processes calls to check for fingerprints of fraud, and to verify orders. "Now I have a machine learning caller-ID with advanced heuristics ho, ho ho"
- VLM 12y ago
  Yeah you guys are probably right, after all. If it demanded cash and suggested visiting your local Citibank Branch or Citibank In Network ATM that clearly would also be an equally random and meaningless data point, totally not trying to make Citibank look bad or anything.

Nakatomi_Plaza 12y ago

It's cheaper for the Pizza company to eat some of the fraudulent orders than pay the $600 extortion fee.

pavel_lishin 12y ago
That's if the extortionists even bother carrying through with their threat. It's pretty cheap to print up a thousand letters and mail them to pizzerias all over the country; if even a couple cough up the money, that's probably money and effort spent well enough. The deadline is far enough in the future that it's not really worth it to prove that punitive measures will be taken.
- larrys 12y ago
  I guess I assumed these were coming from out of the country. Do we know that they are being mailed in the US? If that is the case the postal service almost certainly knows which post office these were mailed out of.
  - schrodinger 12y ago
    How useful is that? Someone could drive an hour, dump them all in a mailbox anonymously...
    - larrys 12y ago
      Could be useful if triangulated with other information. And it's always possible that whatever mailbox they dumped them in was in view of a video camera or perhaps their car passed video surveillance (or walked by). Or maybe used an ATM nearby. Or paid a toll. People slip up. For that matter what about all that stuff about embedding things in printers (micro traces or whatever they are called). Otoh, I constantly get all sorts of scams from overseas wanting to charge me ridiculous amounts of money for trademark registries (approx. $2000 USD iirc) of zero value. They have been pretty consistent over the years and I'm guessing that even with the cost of foreign postage they are a net win for the perps. Otherwise I can't imagine they would keep sending them.

steffenfrost 12y ago

The address doesn't seem to be a valid BTC address.

coreymgilmore 12y ago

Some quick digging around: not much to be found on the wallet addresses on the extortion letters. One wallet was tied to a 0.001 transaction on 6/27. wallet: 17gt1BancvtnnJwy4BA41VBUH3pfbUvzE block: 308079

snorkel 12y ago
Can't coinbase just ban whatever id was presented in the letter?
- DanBC 12y ago
  See also "joe job", "reputation attack", and "denial of service".
- deleted 12y ago
  [deleted]
Scoundreller 12y ago
Even if money goes in, you can't be assured someone didn't just deposit it for the lolz, or if it was the perpetrators just moving their own coin around.

privatedan 12y ago

If I were a pizza parlor owner, I would frame this letter and hang it in my restaurant.

naturalethic 12y ago

This would be a great way for the Fed to push back on their competition.

ascorbic 12y ago
The Fed is in the pizza business?

jzf 12y ago

I came here to upvote anything stephenson - reamde and for pizzerias, snowcrash.

NoMoreNicksLeft 12y ago

They might as well be asking for plutonium or stolen Picassos... pizzerias don't have bitcoins, and generally-speaking have no idea how to get them. Seriously. Should have included two pages instructing them how to acquire the things...

sharemywin 12y ago

Apparently they've never worked in pizza. I could just see them sending it to my dad. First off, What's a bitcoin? Negative Online review...what's an Online review. Harrassing telephone calls...you mean a friday night? Farudulant delivery orders...10 all the way pizzas with anchovies...sure we'll make those right up and deliver them...ya right... Illegal drug sales...don't be primising illegal drugs to the delivery drivers unless your going to follow through. Health department -- they visit every six months anyway. BBB...I once watched a customer complain and get an attitute about his pizza ...he took his pizza and threw it in the trash handed him his money back and said dominos is down around the corner. I used to try to talk him into advertising too get more customers and he'd always tell me he didn't want anymore customers. He used to keep a saw'd shotgun behind the counter because the gangs that live in the apartment complex behind us were talking about robbing us. There's still a hole on the floor from where one the employees got shot 'cause they just wanted to shoot someone.

Scoundreller 12y ago
Would you mind doing us all a favour and building a database of every pizza place like this on the planet? It sounds like my (our?) kind of place.
- sharemywin 12y ago
  It's simple find the most run down looking place you can find that's over 5 years old. You know if they're still in business it's not because if the atmosphere and the service, it's because of the food. Also, as for hacking it's hard to hack an order pad and a pen.
read 12y ago
An alternate theory would be the whole thing is a submarine: a way of advertising Bitcoin to pizza owners, under the pretense of a threat. What could make them take Bitcoin more seriously than the threat of them being harmed by it? It wouldn't be surprising if the whole thing was orchestrated by a Bitcoin startup. And its an easy trick to pull too. You stuff printed letters in a mailbox and they find their way out there. How could anyone prove who did it? Frankly it's impressive :) After a whole day on HN nobody brought up this possibility. There's also a lesson of strategy here. When you are not making progress being direct about something, try doing its opposite. What I'm more curious about is how they'll follow up without making it too obvious that they are advertising. How will the make the now worried pizza owner casually bump into a promising Bitcoin company that protects them from extortion and all bad Bitcoin things? Run an ad in the paper or local TV?

steanne 12y ago

actually, my local hole-in-the-wall takes bitcoin.