8 ms·

For Ransom, Bitcoin Replaces the Bag of Bills

63 points by jhonovich 11y ago

zajd 11y ago
It's hard to take these seriously when they equate digital ransom with actual kidnapping. Clickbait headline if I ever saw one.
- dang 11y ago
  There's nothing wrong with the headline, and the article doesn't mention kidnapping. The comparison it does make is a reasonable one: "a modern day version of a mob shakedown".
sorrythrowaway9 11y ago
I know this is not 100% specific to this article, but this is happening right now to a friend of mine's gmail account. Scammer was able to social engineer the cell phone company to forward his number, then did a password reset, and locked him out of his account. 20BTC Ransom. He followed every single google customer service link/resource he could find and tried to reset link, which said they would contact him in 3-5 days. This was 6 days ago. No response. FBI can't do anything either. Its so disturbing that there is absolute nothing you can do to reach Google once this happens. It could happen on anyone's cell phone as well, how many fortune 500 companies have higher up employees with cell phones and gmail accounts? Imagine in the future trusting google with a self driving car and home automation -- imagine getting locked out of your house or hijacked in a self driving car and having nobody to call. If anybody here knows somebody at google who can reach the group that handles Gmail security, please contact this account so I can give you his info.
- o87dv 11y ago
  Hopefully the next step is going to be switching from Google to a different provider.
  - eru 11y ago
    Use the cryptography based 2FA (with Google Authenticator on your phone). SMS is too open to social engineering, and as a second factor might actually make your account less safe.
    - ikeboy 11y ago
      Think I read that Google Auth falls back to SMS, so that wouldn't help.
      - y4mi 11y ago
        you can freely choose between enabled authentication methods. so, its possible to disable the sms authentication by removing it in the security settings
  - roflchoppa 11y ago
    Yeah thats one way to address the issue (or even using multiple emails), but you know what's even better than that? Having competent customer support, that would be able to address situations like this. Esp. with the amount of people that are using these home automation services with "cloud" support, its only going to get worse the more integrated these services become. My friend has had a similar situation with the good ol Yahoo eMail service, and after being on call waiting for 4hours, they told him they cannot help him, then hung up. I also had a similar service, with my STEAM account, I emailed Valve, and within 45 min the account was restored.
    - fallat 11y ago
      What are more companies like Valve? Seriously...
    - Liru 11y ago
      Wait, you actually had Valve do customer support? I think that's rarer than getting Google customer support, to be honest.
    - 11y ago
- nadams 11y ago
  I'm sorry if this sounds like me being a jerk - that's not my goal. I just want to point out cold hard facts. > but this is happening right now to a friend of mine's gmail account I can't stress this enough but please enable OTP on your accounts. Facebook, gmail, and even your Windows system if you are paranoid enough. Yeah it adds some hassle - but the value of increased security far outweighs the hassle. Also backup the OTP codes somewhere. > Scammer was able to social engineer the cell phone company to forward his number If they are in the US please tell us the name of the provider so we know not to ever use them. This isn't the first this kind of attack has happened [1] (shame on you DigitalOcean). I use Gandi and they state in their documentation that they will not reset it if you ask them [2]. > Its so disturbing that there is absolute nothing you can do to reach Google once this happens. It's a free service - what do you expect? I've heard this story many many times. Yes - google makes billions in profits and could in theory hire someone to handle gmail issues. But, they don't and it makes sense from a business point of view (why spend money on a guy who will support a service that doesn't make money?). > It could happen on anyone's cell phone as well, how many fortune 500 companies have higher up employees with cell phones and gmail accounts? If a Fortune 500 company uses gmail they would buy the google apps for work. If they buy google apps for work they get an 800 number to call if they have problems (and most likely a dedicated account rep because they are probably buying 1000s of accounts). > Imagine in the future trusting google with a self driving car and home automation Again - you would be giving money to google. And in return you will get support. I'm not saying Google is perfect but if self driving cars become a thing I'm sure (hope) there will be an 800 number you can call when your car becomes sentient. [1] - https://news.ycombinator.com/item?id=9596258 https://news.ycombinator.com/item?id=9596258 [2] - https://wiki.gandi.net/en/hosting/gandi-expert/change-root-passwd-in-expert-mode https://wiki.gandi.net/en/hosting/gandi-expert/change-root-p...
  - sorrythrowaway9 11y ago
    The cellphone provider was sprint. My friend is a paid customer of Google Apps. In part of the process he called called Google Apps, and they immediately disabled his Apps account but -- but they couldn't or wouldn't do anything else including helping him escalate to the right people -- They said they did not know who to contact. Eventually after he called back several times, he got a manager/supervisor who was able to create a ticket. He called back the next day and the ticket was deleted! Meanwhile the scammer is making threats to his family and pretending to be him send out emergency BTC loan requests and resetting bank passwords. He could be SWAT'd at any moment. Apparently Google executives are in the mindset that it isn't cost effective for them to provide even the most minimalist crisis support -- a trivial 5 minute look at the account and seeing the ransom artist texting him (through his own gmail) would at least justify an account hold. Google couldn't be bothered-- even at a record 66 billion dollar profit to help him. Why? Because they can't make a profit helping him. Or maybe its that and they are still in the 2003 "beta" mindset. It truly is a real life THX 1138 nightmare for him.
- bakhy 11y ago
  i never activated google's 2factor authentication just out of fear of my phone being stolen. this ugly possibility never even occurred to me. i really cannot understand why this stupid sms-based scheme is pushed down our throats by google. fingers crossed for your friend, i hope it works out!
bdcravens 11y ago
So if a) users don't get smarter about security and b) the use of Bitcoin as a ransom currency doesn't get disincentivized, how will this play out? I can't see the status quo continuing; resigning to "oh well, the nerds have won, we can't do anything" isn't how the government tends to operate. Would the government try to really hammer down on Bitcoin if this becomes the epidemic I think that it might? Government regulation of companies that permit easily "hacked" accounts? The introduction of personal insurance policies for online data that would pay?
kwijibob 11y ago
Why can't you track where they spend the ransom money via the blockchain? Couldn't this be used to identify the criminals?
- eru 11y ago
  It depends how good their mixers are.
codeshaman 11y ago
To me this is a serious downside of cryptocurrencies - the fact that criminals have this secure channel of stealing from victims. Besides malware, one can be blackmailed with information disclosure (everyone has secrets), one can be physically bullied into transferring his BTC or forced to pay bribes by police or corrupt authorities. In western countries some of these may seem impossible, but in a lot of places, police or authorities are worse than criminals. And of course good old hacking. It's also a very good incentive for maybe-criminals to actually go and do the crime - because the risks of being caught are very small. One counter argument is that it's possible to steal cash anonymously too, but of course it's not the same thing, just like crypto is not cash. This is serious problem with (anonymous) crypto and it will only grow bigger and bigger as it goes more mainstream..
- oleganza 11y ago
  If we were running our economy on steam and gold we would have even less problems. Your life expectancy would be 2x lower, but Sherlock Holmes would be able to find the blackmailer. Do you seriously blame the technology and instead of finding a technological solution propose to blame everyone using it for occasional consequences you do not like?
  - codeshaman 11y ago
    > If we were running our economy on steam and gold we would have even less problems. Absolutely. I've lost a lot of coins in various hacks so this is experience talking, not theory ;). > propose to blame everyone using it for occasional consequences you do not like. Not blaming anyone and I'm still quite hopeful about crypto (albeit much less now than before), just saying this is a dark side of crypto which people are afraid to look at and it's not going away. You may remember this discussion if god forbid somebody hacks the service were you hold your coins at (https://bitcointalk.org/index.php?topic=576337 https://bitcointalk.org/index.php?topic=576337) or exploits a vulnerability in your OS and steals your wallet OR does the thing in the article. Right, we are literate, we don't keep our wallets online or on our hard drives. For maximum safety we keep our public key pairs on a piece of paper or wood and hide it away in a dark place.

63 points by jhonovich 11y ago

zajd 11y ago

It's hard to take these seriously when they equate digital ransom with actual kidnapping. Clickbait headline if I ever saw one.

dang 11y ago
There's nothing wrong with the headline, and the article doesn't mention kidnapping. The comparison it does make is a reasonable one: "a modern day version of a mob shakedown".

sorrythrowaway9 11y ago

I know this is not 100% specific to this article, but this is happening right now to a friend of mine's gmail account. Scammer was able to social engineer the cell phone company to forward his number, then did a password reset, and locked him out of his account. 20BTC Ransom. He followed every single google customer service link/resource he could find and tried to reset link, which said they would contact him in 3-5 days. This was 6 days ago. No response. FBI can't do anything either. Its so disturbing that there is absolute nothing you can do to reach Google once this happens. It could happen on anyone's cell phone as well, how many fortune 500 companies have higher up employees with cell phones and gmail accounts? Imagine in the future trusting google with a self driving car and home automation -- imagine getting locked out of your house or hijacked in a self driving car and having nobody to call. If anybody here knows somebody at google who can reach the group that handles Gmail security, please contact this account so I can give you his info.

o87dv 11y ago
Hopefully the next step is going to be switching from Google to a different provider.
- eru 11y ago
  Use the cryptography based 2FA (with Google Authenticator on your phone). SMS is too open to social engineering, and as a second factor might actually make your account less safe.
  - ikeboy 11y ago
    Think I read that Google Auth falls back to SMS, so that wouldn't help.
    - y4mi 11y ago
      you can freely choose between enabled authentication methods. so, its possible to disable the sms authentication by removing it in the security settings
- roflchoppa 11y ago
  Yeah thats one way to address the issue (or even using multiple emails), but you know what's even better than that? Having competent customer support, that would be able to address situations like this. Esp. with the amount of people that are using these home automation services with "cloud" support, its only going to get worse the more integrated these services become. My friend has had a similar situation with the good ol Yahoo eMail service, and after being on call waiting for 4hours, they told him they cannot help him, then hung up. I also had a similar service, with my STEAM account, I emailed Valve, and within 45 min the account was restored.
  - fallat 11y ago
    What are more companies like Valve? Seriously...
  - Liru 11y ago
    Wait, you actually had Valve do customer support? I think that's rarer than getting Google customer support, to be honest.
  - 11y ago
nadams 11y ago
I'm sorry if this sounds like me being a jerk - that's not my goal. I just want to point out cold hard facts. > but this is happening right now to a friend of mine's gmail account I can't stress this enough but please enable OTP on your accounts. Facebook, gmail, and even your Windows system if you are paranoid enough. Yeah it adds some hassle - but the value of increased security far outweighs the hassle. Also backup the OTP codes somewhere. > Scammer was able to social engineer the cell phone company to forward his number If they are in the US please tell us the name of the provider so we know not to ever use them. This isn't the first this kind of attack has happened [1] (shame on you DigitalOcean). I use Gandi and they state in their documentation that they will not reset it if you ask them [2]. > Its so disturbing that there is absolute nothing you can do to reach Google once this happens. It's a free service - what do you expect? I've heard this story many many times. Yes - google makes billions in profits and could in theory hire someone to handle gmail issues. But, they don't and it makes sense from a business point of view (why spend money on a guy who will support a service that doesn't make money?). > It could happen on anyone's cell phone as well, how many fortune 500 companies have higher up employees with cell phones and gmail accounts? If a Fortune 500 company uses gmail they would buy the google apps for work. If they buy google apps for work they get an 800 number to call if they have problems (and most likely a dedicated account rep because they are probably buying 1000s of accounts). > Imagine in the future trusting google with a self driving car and home automation Again - you would be giving money to google. And in return you will get support. I'm not saying Google is perfect but if self driving cars become a thing I'm sure (hope) there will be an 800 number you can call when your car becomes sentient. [1] - https://news.ycombinator.com/item?id=9596258 https://news.ycombinator.com/item?id=9596258 [2] - https://wiki.gandi.net/en/hosting/gandi-expert/change-root-passwd-in-expert-mode https://wiki.gandi.net/en/hosting/gandi-expert/change-root-p...
- sorrythrowaway9 11y ago
  The cellphone provider was sprint. My friend is a paid customer of Google Apps. In part of the process he called called Google Apps, and they immediately disabled his Apps account but -- but they couldn't or wouldn't do anything else including helping him escalate to the right people -- They said they did not know who to contact. Eventually after he called back several times, he got a manager/supervisor who was able to create a ticket. He called back the next day and the ticket was deleted! Meanwhile the scammer is making threats to his family and pretending to be him send out emergency BTC loan requests and resetting bank passwords. He could be SWAT'd at any moment. Apparently Google executives are in the mindset that it isn't cost effective for them to provide even the most minimalist crisis support -- a trivial 5 minute look at the account and seeing the ransom artist texting him (through his own gmail) would at least justify an account hold. Google couldn't be bothered-- even at a record 66 billion dollar profit to help him. Why? Because they can't make a profit helping him. Or maybe its that and they are still in the 2003 "beta" mindset. It truly is a real life THX 1138 nightmare for him.
bakhy 11y ago
i never activated google's 2factor authentication just out of fear of my phone being stolen. this ugly possibility never even occurred to me. i really cannot understand why this stupid sms-based scheme is pushed down our throats by google. fingers crossed for your friend, i hope it works out!

bdcravens 11y ago

So if a) users don't get smarter about security and b) the use of Bitcoin as a ransom currency doesn't get disincentivized, how will this play out? I can't see the status quo continuing; resigning to "oh well, the nerds have won, we can't do anything" isn't how the government tends to operate. Would the government try to really hammer down on Bitcoin if this becomes the epidemic I think that it might? Government regulation of companies that permit easily "hacked" accounts? The introduction of personal insurance policies for online data that would pay?

kwijibob 11y ago

Why can't you track where they spend the ransom money via the blockchain? Couldn't this be used to identify the criminals?

eru 11y ago
It depends how good their mixers are.

codeshaman 11y ago

To me this is a serious downside of cryptocurrencies - the fact that criminals have this secure channel of stealing from victims. Besides malware, one can be blackmailed with information disclosure (everyone has secrets), one can be physically bullied into transferring his BTC or forced to pay bribes by police or corrupt authorities. In western countries some of these may seem impossible, but in a lot of places, police or authorities are worse than criminals. And of course good old hacking. It's also a very good incentive for maybe-criminals to actually go and do the crime - because the risks of being caught are very small. One counter argument is that it's possible to steal cash anonymously too, but of course it's not the same thing, just like crypto is not cash. This is serious problem with (anonymous) crypto and it will only grow bigger and bigger as it goes more mainstream..

oleganza 11y ago
If we were running our economy on steam and gold we would have even less problems. Your life expectancy would be 2x lower, but Sherlock Holmes would be able to find the blackmailer. Do you seriously blame the technology and instead of finding a technological solution propose to blame everyone using it for occasional consequences you do not like?
- codeshaman 11y ago
  > If we were running our economy on steam and gold we would have even less problems. Absolutely. I've lost a lot of coins in various hacks so this is experience talking, not theory ;). > propose to blame everyone using it for occasional consequences you do not like. Not blaming anyone and I'm still quite hopeful about crypto (albeit much less now than before), just saying this is a dark side of crypto which people are afraid to look at and it's not going away. You may remember this discussion if god forbid somebody hacks the service were you hold your coins at (https://bitcointalk.org/index.php?topic=576337 https://bitcointalk.org/index.php?topic=576337) or exploits a vulnerability in your OS and steals your wallet OR does the thing in the article. Right, we are literate, we don't keep our wallets online or on our hard drives. For maximum safety we keep our public key pairs on a piece of paper or wood and hide it away in a dark place.