[HN Gopher] The Oncoming Ransomware Storm
___________________________________________________________________
The Oncoming Ransomware Storm
Author : tenslisi
Score : 92 points
Date : 2021-05-11 18:19 UTC (4 hours ago)
(HTM) web link (www.stephendiehl.com)
(TXT) w3m dump (www.stephendiehl.com)
| zabzonk wrote:
| > we've seen the entire NHS hospital service shutdown
|
| We have? As an NHS user, how did I miss this this?
| boringg wrote:
| Things enabled by BTC/crypto: ransomewear, climate change,
| overnight speculation millionaires!
|
| Also article is a bit dystopian and blaming capitalism (per usual
| these days).
| sebastien_bois wrote:
| But not entirely inaccurate.
|
| I mean, 20 years, maybe even just 10 years ago we would've
| shrugged off the type of attacks happening now as "pure science
| fiction".
| TheBill wrote:
| 30 years ago there was ransomware in the wild:
|
| 1989 -Popp/ AIDS trojan 2005 - GPCoder trojan 2017 - notpetya
| (AKA the moller maersk hack)
| https://actzero.ai/resources/white-paper/the-rise-of-
| ransomw...
| tharne wrote:
| Amazing how quickly people forget the past.
| bradleyjg wrote:
| Make coins paid in ransom subject to seizure wherever they may be
| found. It's not a silver bullet but it would help and it's an
| easy change to make.
| randomhodler84 wrote:
| Already the case/law. The US had seized and sold many BTC over
| the years. The Silk Road seized coins were sold to the highest
| bidder.
| _wldu wrote:
| The article failed to mention tor. IMPO, tor and cryptocurrency
| combined are the reason for the explosion of ransomware. Payment
| websites running as tor location hidden services combined with
| anon payments (XMR) is hard to beat (when done correctly).
| seafoam wrote:
| "A future in which ransomware and mass data theft are so
| ubiquitous they've worked their way into our daily lives"
|
| >>> True
|
| "The singular reason why these attacks are even possible is due
| entirely to rise of cryptocurrency"
|
| >>> False
| splithalf wrote:
| Incentives matter. Bitcoin incentivizes certain types of
| criminal activity. As Bitcoin grows the negative externalities
| will become more pronounced. I truly don't get the ethics of
| it. It is killing people, literally blood money as a great new
| technology. Bonus points for incentivizing climate destruction
| and burning of fossil fuels. I don't understand the ethics of
| it.
| tharne wrote:
| The overwhelming majority of criminal commerce is conducted
| using traditional currencies such as U.S. Dollars or Euros. I
| truly don't get the ethics of it. It is killing people,
| literally blood money...
| literally_lit wrote:
| Wealth incentivizes that activity. Cryptocurrency is one easy
| way to transfer it, but it's not the "singular" reason
| ransomware is "possible."
|
| > literally blood money
|
| ("Blood money" is an idiom, a colloquial metaphor. So a
| virtual currency is "literally" a metaphor? Ugh.)
| splithalf wrote:
| I am trying to say that Bitcoin has caused a change in the
| types of crimes that are being committed. It's easily
| quantifiable. When I say it is blood money I mean that it
| is a way to pay for assassinations. Assassination markets
| are not new but Bitcoin as technology changes scale. Scale
| matters, regardless of what you believe.
| fouric wrote:
| Cryptocurrency has properties that make many kinds of
| criminal activity far _easier_ than most other kinds of
| "wealth".
|
| There's a reason that ransomware payments are now
| exclusively transferred through Bitcoin.
| McDyver wrote:
| Replace "Bitcoin" with "Banks", in your argument.
|
| Doesn't change anything
| xxxtentachyon wrote:
| It only works if you ignore everything in the "pro" column.
| Try to imagine what a world without credit would look like.
| It's a much poorer world.
| McDyver wrote:
| Without consumerism and unneeded use of resources, you
| mean?
| SteveNuts wrote:
| Right, it's definitely a contributing factor as to why it's
| profitable, but the attacks themselves could be done entirely
| out of malice if they wanted to.
| riccardomc wrote:
| Sure it can be done entirely out of malice, but it is now
| clear that cryptocurrencies enable the incentive of doing it
| for money.
|
| It is becoming more and more evident that ransomware attacks
| are the killer app of crypto.
| akiselev wrote:
| _> It is becoming more and more evident that ransomware
| attacks are the killer app of crypto._
|
| Illegal activities were always the killer app. I doubt
| bitcoin would be where it is today without the silk road
| sites.
| tharne wrote:
| Because there was no such thing as cyber crime prior to the
| invention of cryptocurrency.
| VectorLock wrote:
| Not on the scale we're seeing now.
| CountDrewku wrote:
| > but the attacks themselves could be done entirely out of
| malice if they wanted to
|
| But then it's not really ransomware anymore.
| LeifCarrotson wrote:
| Cryptocurrency does make it easier, sure. But without it we'd
| still have Western Union/wire transfers to overseas
| jurisdictions, or Paypal, or gift cards, or money mules, or any
| number of less-traceable ways of turning ransomware into cash.
| 1vuio0pswjnm7 wrote:
| "The singular reason why these attacks are even possible is due
| entirely to rise of cryptocurrency."
|
| So-called crytocurrency may not be the _sine qua non_ , but it is
| arguably a substantial factor in what is causing these campaigns
| of automated attacks. Without an easy way to launder the "ransom"
| payments, could these attacks be systematically executed on a
| large scale with a level of success (receiving the payments
| without getting caught) necessary to justify the risk.
| mousepilot wrote:
| I remember reading about malware like this some time back. I
| tried everything I could to prepare but got vetoed at every turn
| by management. My idea was to do "pull" backups to a server,
| instead of "push" backups to shares, instead my boss's boss
| bought some commercial backup package that while ok, when it
| bombed a t-log chain, they blamed microsoft's implementation of
| native sql server backups, and of course was nowhere near my
| dream "pull" server thing, heck, I don't know if my idea was even
| valid, I'm not that smart a guy honestly, you gotta know your
| limits.
|
| I wanted flash removed from my desktop, because being the
| intellectual slug I am, I google everything, like how to get the
| correct date and time. My previous job was as a convenience store
| clerk, and as I'm in the process of getting fired right this very
| week, I suspect it'll be my next job too. I was told by my boss's
| boss and his cousin the gaming guy who built servers that "our
| firewall blocks everything".
|
| Of course, I got a text message one morning from my boss, while I
| don't remember the exact text, I remember it included the word
| "armagghedon". I came in to work carrying my uninfected laptop,
| and heck, my pc looked pretty normal except the icons had changed
| and sort of "doubled up", each second version contained the same
| message, you know the drill.
|
| I'm an sql guy, I know I'm not all CS smart like everyone here
| but I gotta say it was obvious even to me what was coming, its
| like an enemy doing bombing raids in the next city over and
| people are still out there watering their lawns like nothing is
| happening. Friggin malware, I guess it pays well tho.
| JackFr wrote:
| GPT-3
| mousepilot wrote:
| heh
|
| interestingly enough, I've learned that machine learning is a
| trend in malware protection nowadays and rather than being
| signature based, it watches for malware like behavior. after
| the attack, we installed something like that, and it removed
| some of the very small vb programs I had put my heart and
| soul into.
| tnzm wrote:
| This guy, and not the amygdala-hijacked no-theory-of-minders
| that rolled in the other day?
| mousepilot wrote:
| I managed to wire up sirc to a perl eliza implementation
| once. My cobol instructer in community college thought I
| was a pervert for doing so and in hindsight she was
| probably right, I think I only ran it once honestly.
| Nowadays I just run an old eliza in another terminal when I
| chat on irc and copy and paste between the two terminals,
| this gets rid of the ethical concerns as there is a human
| between the interface acting as a guard against AI run
| amuck so I think I'm good.
| api wrote:
| "Our firewall blocks everything."
|
| LOL. Firewalls are security theater.
| mousepilot wrote:
| they added memory after the malware attack so its probably
| better now.
| api wrote:
| This histrionic piece really reduces this author's credibility in
| my mind. I say this as someone fairly skeptical of
| cryptocurrency, or at least of the value of present-day
| cryptocurrency.
| Sevii wrote:
| Today is the beginning 'wild west' stage of the information
| technology industry. Software ate the world and now security is
| starting to matter to the bottom line.
|
| GDPR and privacy are another big factor which I think will push
| the professionalization of the industry.
|
| I do think the worst case scenario outlined in this article is
| unlikely. We can build systems that are not that vulnerable to
| ransomware. You can have backups that are safely stored off
| network. It is just that old industries have slowly computerized
| without updating their processes and view of themselves.
|
| Every company is a tech company now.
| theshadowknows wrote:
| I don't really have any answers. I don't think cryptocurrency
| really makes the 'ransomware storm' possible. Maybe it makes it
| easier or easier to get away with the cash.
|
| I do know that I work at a company with very tight controls on
| what we can and can't do with our computers. But we're free to
| install Chrome extensions as we please. Which doesn't strike me
| as a great idea, but maybe that's not really even the problem.
|
| A lot of what I see in big corp environments comes down to finger
| pointing. I'm on a weeks old thread this very day where different
| groups are saying 'this isnt X's fault it's Y's fault' and it is
| going nowhere. At the end of the day we need to stop assigning
| blame and work together to fix problems. But that means we have
| to be able to actually admit 'maybe this system isnt as fool
| proof as we thought' which, of course, opens the company up to
| legal liability. It's a tough and complex problem, I think.
| Because no one wants to 'admit fault' for fear of being sued, but
| not admitting fault ends up obscuring root cause. And round and
| round we go.
| randomhodler84 wrote:
| More blaming money for crime. Cryptocurrency is money. Crime will
| always exist as long as there are laws. Laws will exist as long
| as there is society. Money will exist as long as there is trade.
| Society<=>Trade. Stephen once again shouts at the inanimate money
| or tech to blame it for societies ills. This is a dangerous
| attitude can lead to cryptography restrictions, like banning of
| e2e or tor.
| alrs wrote:
| Ransomware is great.
|
| 1. Creates a huge financial incentive to try and break PGP
| encryption.
|
| 2. Pushes aside all of the lame corporate compliance "infosec"
| people whose job it is get lied to about PCI compliance and bitch
| about version numbers that they don't understand.
|
| 3. Proves useless all of the "ex-special-forces" "red team"
| "master safecracker" Defcon LARPers.
|
| 4. Gives the insurance companies enough room to attribute attacks
| to nation-state actors, making them "acts of war," and thus
| uninsurable. If companies can't half-ass this stuff and let their
| insurer clean up the mess, they're going to stop half-assing this
| stuff.
|
| 5. Put an end to the "I dunno, I pulled it off Dockerhub"
| madness.
| alrs wrote:
| 6. You used to need to wonder: Have I been hacked? How bad? Now
| you get an invoice day-of.
| api wrote:
| Items 2 and 3 will increase massively as people who don't know
| what they're doing attempt to cover their butts.
| alrs wrote:
| a steep climb in the short term that falls off a cliff in the
| not-so-short-term as those employers cease to exist.
| api wrote:
| That's not how the world works my friend.
| alrs wrote:
| so long as encryption-as-we-know-it holds-up, there's no
| rescue for orgs that repeatedly get hit and can't get
| their backup strategy together. Sure, you make a
| regulatory mis-step and you have friends in high places,
| they will look the other way. This indeed, is how the
| world works. If your entire infrastructure is encrypted
| into a solid block of nothingness it doesn't matter if
| your dad is a senator, you're done.
| fouric wrote:
| Name a single company that has died due to data breaches.
|
| Meanwhile, I'll name a dozen that got breached/leaked
| data, and got away with it: Experian, Microsoft,
| Facebook, Google, Marriott, Yahoo, First American
| Financial Corporation, Deep Root Analytics, Court
| Ventures (a subsidiary of Experian), Capital One, Anthem.
|
| Go on, search "list of largest data breaches" and then
| see how many of those companies are still in business.
|
| It sure seems like large companies aren't suffering for
| their breaches.
| alrs wrote:
| "breached data" doesn't matter to companies, as we've
| seen. "gone data" is an existential threat.
| fredgrott wrote:
| why do we need an incentive to break PGP?
|
| Let me explain, the basics:
|
| Any system that has a case where key collisions can occur less
| than random is the only incentive you need...large use of
| bitcoin ensures that case all by itself with the rule that you
| use a new key for every transaction.
|
| LEOs use this track down illicit money.
|
| crypto in practical terms is not secure in that the key
| collision when it occurs and it will unmasks you not directly
| but indirectly and the cost to do the work of that lowers as it
| ages and does not go up computation wise.
|
| It's somewhat perverse where when the world uses more bitcoin
| the more key collisions occur.
| benjohnson wrote:
| 6. Put and end to our data hording. Turns out I don't need to
| keep all the data we have because it's now a liability.
| rawtxapp wrote:
| Yep, if the companies leak our sensitive data, they don't care,
| business as usual. Ransomware will force companies to _finally_
| take this seriously and I, for one, am thankful even if in the
| short term it 's painful.
| mhh__ wrote:
| I'm not sure what point 3 refers to?
| alrs wrote:
| #infosec "thought leaders" with a cool-sounding military
| history who purport to be able to do underwater lockpicking
| but can't put together a for loop. Their shtick exists to
| sell services to clients and to sell recent graduates on a
| Special Forces Awesome Security Career that in reality will
| be QA at best, corporate compliance at worst.
| megameter wrote:
| Also the most likely tonic to platform churn, reinvented
| wheels, codebase growth. The culture will flip towards
| lambasting anything that hasn't been put through the wringer as
| "untrustworthy".
| upofadown wrote:
| I did some searching and didn't find anything about use of the
| OpenPGP standard in ransomware. It appears that ransomware
| creators don't care about interoperability, which makes sense
| for their biz.
|
| A doubt that anyone has ever been motivated to try to break an
| encryption method just because it was used in some particular
| ransomware. The methods used are generally not breakable, the
| mistakes come from stuff like leaving keys laying around in
| memory or even on the disk.
| meowface wrote:
| I'm not sure how satirical the parent's comment was, but
| every single point is completely inaccurate, irrelevant,
| and/or nonsensical.
| Dah00n wrote:
| How so? Seems it's spot on. Since the birth of the internet
| companies haven't given a damn about leaks and there're no
| real consequences. Now they care because it hurts _them_
| instead of just us.
| meowface wrote:
| I work in infosec and agree with the point that a lot of
| companies are overly lax, ignorant, and negligent about
| security. But I could probably write like a 10 page essay
| disputing all of those points. For a summarized version,
| I wrote some semi-relevant comments about this in another
| ransomware thread from the other day, so this is a lazy
| answer but you could Ctrl+F my username in
| https://news.ycombinator.com/item?id=27096137
|
| Basically, I agree in general that a large percentage of
| the industry is a massive joke, but at the same time, I
| think in many cases there's more victim-blaming than is
| warranted. Ransomware isn't what it used to be. Being hit
| or ruined by a ransomware attack doesn't necessarily
| imply negligence or lack of care (even if a high
| percentage of the victims probably are negligent simply
| due to the high base rate of such companies).
| a1369209993 wrote:
| I see nothing there that invalidates any of those points.
| At best it weaken points 1, 4 and 5 on the basis that
| companies will get away with it _by paying ransoms_ [0],
| and ransomers have a incentive to not be so extractive
| that they kill the hosts they're parasitising, but that's
| still a idiot tax for said companies.
|
| 0: rather than their previous strategy of ignoring the
| problem entirely because other poeple's privacy doesn't
| show up on their balance sheet
| meowface wrote:
| Indeed, I'd need to explicitly address each point to
| explain exactly why and how I disagree.
|
| They're not exactly wrong in a general sense (which I
| know sounds a little contradictory given I said "every
| single point is completely inaccurate, irrelevant, and/or
| nonsensical"), but I think they're wrong in a fundamental
| way when talking about the ransomware problem. And point
| 1 is a total non-sequitur in at least three different
| ways.
|
| It's a complex topic. Basically, I just think that even
| though a ton of cynicism (about this, about the infosec
| industry, about companies' approach to security) is
| absolutely and overwhelmingly warranted, they're being
| too cynical.
| yabones wrote:
| As somebody who's not that familiar with how financial
| institutions handle fraud/money laundering detection, is it
| possible for ransomware to have become so prevalent without
| cryptocurrencies? I know HSBC was in the news a few years ago for
| turning a blind eye towards a drug cartel, but would this type of
| attack at scale be tolerated by the major banks/credit unions?
| dragontamer wrote:
| I don't think cryptocurrencies are the only solution. Before
| the rise of cryptocoins, you'd just shuttle physical gift cards
| around.
|
| But cryptocoins are definitely more efficient than traditional
| forms of money laundering.
| celestialcheese wrote:
| The big corporate targets and the >1m ransoms aren't doable
| with gift cards.
|
| A large hospital chain in San Diego[1] last week was hit with
| a $100m[2] ransomware attack that shut down the hospital.
| Can't pay that with gift cards.
|
| [1] - https://www.sandiegouniontribune.com/news/health/story/
| 2021-... [2] - Source internal said that was the ransom
| amount
| dragontamer wrote:
| You'd ask for cash. A middleman would pick it up, convert
| it to gift cards or Tide laundry detergent (so that the
| traced cash would go cold) and then pass it forward through
| the criminal network.
|
| The middleman needs to be paid because it's high risk (cops
| would trace the cash to the middleman... but no further).
| So cryptocoin are way cheaper. But still, there's plenty of
| ways to do things using old school techniques.
| VectorLock wrote:
| You also need to trust that your criminal middleman with
| $100M doesn't just abscond with your money.
|
| With cryptocurrency when its in your wallet, its yours,
| and the risk of relying on a 3rd party to transport your
| ill gotten gains is much lower.
| dragontamer wrote:
| I assume a money-laundering step (aka: a cryptocoin mixer
| service) needs to be used to practically extract wealth
| from a criminal activity.
|
| If you directly use the money from a wallet directly
| related to a ransomware attack, the police would be on
| your tail almost immediately.
|
| A cryptocoin mixing service is cheaper than traditional
| money laundering. So cryptocoins are the ideal solution
| to criminal activities (at least, better than Tide
| Laundry pod trading, or gift-card exchanges).
| VectorLock wrote:
| Some places the cops don't care.
|
| And $100M would be a lot of Tide pods.
| duckfang wrote:
| My big question, and I would love an answer:
|
| Why is it that an organization can topple to malware and
| ransomware by some L1 tech clicking on a "bad email"?
|
| People are going to click on shit. That's a 100% guaranteed fact
| - be it intentional or not. But _WHY_ is our computing and
| communications paradigm so brittle that any Jack or Jane can
| click a link and pwn the infrastructure?
| bena wrote:
| As I've told someone today, we're shooting lightning through
| sand and somehow it all works.
|
| There are network effects of network effects at work inside
| computer systems. We can harden a path. Two paths, sure. Three,
| why not. 4 billion? No way to be sure.
|
| It's also a matter of it being an aggressor's game. The defense
| has to be perfect every single time. The offense just has to
| win once. And they get infinite tries. And they suffer no
| penalty for failure.
| Veserv wrote:
| Impacts were small.
|
| Just a few years ago, one of the most high profile financially-
| motivated ransomware attacks, WannaCry, hit the NHS and various
| other government agencies and companies around the world and
| demanded the unbelievable sum of $300 per computer [1], an
| amount that most of those organizations could only find by
| looking through their pocket lint for amounts so small. They
| spent 100x-1000x more money solving the residual problems than
| they did or would have needed to pay dealing with the ransom
| itself.
|
| Just a few years ago, the worst case impacts were so small that
| the problem was not even worth caring about. What they did not
| realize is that the amounts were small because the ransomware
| groups likely consisted of young people with more technical
| ability than business sense. They did not realize how deep the
| money well went and how much they could really ask for, the
| criminal equivalent of a bunch of college students making a B2B
| startup and being worried that their $1k price tag might be too
| expensive since they would personally think that is a lot to
| spend. This is borne out by the fact that the targets even a
| few years earlier were mostly personal computers of random
| people who might actually have a problem paying $300 to get
| their family photos back. However, these ransomware groups have
| been rapidly wising up and now realize they were doing the
| effective equivalent of robbing the bank for their pens. They
| are starting to ask for reasonable amounts of money that
| businesses might actually worry about and with that money they
| are expanding their operations as fast as they can to try to
| exploit the entire market. They just have not gotten there
| quite yet since they do not have access to vast gobs of VC cash
| and need to instead bootstrap themselves up to a multi-billion
| dollar criminal enterprise.
|
| The unfortunate problem for all of their targets is that none
| of their things work and they did not think the problem was
| serious since the impact of failure was so small. They did not
| realize that was not because more could not be done, but
| because the people doing it did not know what they were doing
| and that they were actually at the start of a serious
| exponential ramp.
|
| If you want more technical reasons, it is because every
| commercially available solution is completely inadequate for an
| environment where people with modest amounts of money want to
| attack your system. Nobody selling commercial IT systems has
| the first clue how to make systems that are actually robust
| against credible threat actors. The absolute best of the best
| can maybe protect a system against attacks funded at the ~$10M
| level, but when you are talking about companies with literally
| $100B revenue streams, that is a rounding error of a rounding
| error. Exactly 0 executives at such a company would think that
| being defenseless against attackers with $10M is acceptable if
| told directly and I think most of their shareholders and
| customers would be horrified if they had to put that in their
| commercials in big bold letters, but that is the best that they
| can get.
|
| [1] https://en.wikipedia.org/wiki/WannaCry_ransomware_attack
| muttled wrote:
| You're completely right in your thinking that it's largely
| ridiculous and avoidable. The answer is generally lack of
| separation of duties and least privilege. That L1 tech in a
| smaller organization might be a member of the domain admins
| group. And to avoid UAC prompts, might sign into his computer
| as domain admin account. If something runs as him, it runs as
| admin. Large file shares where every user has edit permissions
| are also extremely prevalent. Every user has the ability to
| destroy the shared drive. I've seen a lot of small
| organizations where the owner insisted on being an admin,
| despite having no technical knowledge. He clicks something
| wrong and the malware's got carte blanche. Old line of business
| applications will often require exact versions of
| Flash/Java/whatever which are riddled with security holes.
|
| Outside that, there's the 0 days and exploits. But a lot of
| what I see are setups that grew from small, insecure setups
| where it didn't matter to big, insecure setups where it did.
| Combine that with the ROI on security not being immediately
| tangible, and it's hard to get approval for projects to fix it.
| Even if you design the most secure systems, unless you've got a
| seat at the executive table someone will probably overrule you
| and make exceptions.
| CountDrewku wrote:
| https://www.cisecurity.org/resources/advisory/?type=advisory
|
| Take a quick look at all the vulnerabilities out there. Google
| has been releasing 1-2 fixes a week for the last month or so.
| It's a constant battle keeping this stuff patched.
| rini17 wrote:
| Imagine hypothetical L1 techs which would only accept "good
| email" such as plain ASCII (I mean really, 7bit) text email
| without attachments.
|
| Everyone would consider such a service broken and route around
| it.
| robin_reala wrote:
| Are there any active non-Windows ransomware infections going on?
| I don't recall seeing any macOS / Linux / Android / iOS attacks.
| wepple wrote:
| I'm willing to bet SaaS ransomware will be up next.
|
| Imagine a user is tricked into adding a browser addon (common),
| and the malicious addon encrypts all the data in a salesforce,
| Dropbox, and online mail account
| tnzm wrote:
| And then users are going to be thankful that their data is
| not encrypted at rest. Classic pincer maneuver
| muttled wrote:
| One of the reasons why it's so important to disable the
| ability for users to consent on behalf of the organization
| for applications in suites such as 365 where the default is
| to allow the user to do so.
| daaang wrote:
| > The singular reason why these attacks are even possible is due
| entirely to rise of cryptocurrency. And is entirely enabled by
| this one technology, it could not exist otherwise.
|
| Huh, cryptocurrency existed in 1989, when the first ransomware
| was active? Did the author even google the word "ransomware?"
|
| Wire transfers and all types of pre-paid voucher services were
| used well before cryptocurrencies were even created.
| mytherin wrote:
| The article directly addresses your point in the paragraph
| surrounding the sentence you cherry picked.
|
| > Now this is not a new phenomenon by any means. But what is
| new is that the level of these attacks has gone parabolic in
| the last few years because of one simple fact. With the
| addition of bitcoin to the problem it's insanely profitable,
| low-risk, and almost the perfect crime. It's also a very real
| economic tool that nation states can use to disrupt each
| other's infrastructure.
|
| > The singular reason why these attacks are even possible is
| due entirely to rise of cryptocurrency. Consider the same
| situation on top of the existing international banking system.
| Go to your local bank branch and try to wire transfer $200,000
| to an anonymous stranger in Russia and see how that works out.
| Modern ransomware could not exist without Bitcoin, it has
| poured gasoline on a fire we may not be able to put out.
| daaang wrote:
| I agree, the author contradicts themselves immediately.
| Cryptocurrency is _not_ the "singular" reason, and it is not
| why these attacks are even "possible."
|
| The hypothetical they picked might not work. The methods that
| ransomware was using for decades to extort hundreds of
| thousands of dollars did, and will continue to work.
| mytherin wrote:
| You are still taking words out of context. Clearly the
| author agrees that cryptocurrency is not the singular
| reason behind *all* ransomware, considering he states it is
| not a new phenomenon. The sentence you took out of context
| relates to *modern* ransomware:
|
| > The singular reason why these attacks are even possible
| is due entirely to rise of cryptocurrency.... _Modern_
| ransomware could not exist without Bitcoin, it has poured
| gasoline on a fire we may not be able to put out.
|
| The question is not if ransomware would still exist without
| cryptocurrency (obviously it would, it existed before
| then). The question is if it would still be as pervasive as
| it has become in the last few years without cryptocurrency.
| daaang wrote:
| I agree, it's _very_ poorly written.
|
| "These attacks" are defined as "automated exploitation of
| computer networks that aims to extract cash from the
| owner of that network" and "cryptocurrency" is "the
| singular reason" why "these attacks" are "even possible."
|
| Later on the author shamelessly tries to shift that
| definition to " _modern_ ransomware " (the same trick
| you're attempting here).
|
| Why do they need to resort to that? Because they're
| wrong.
| amelius wrote:
| Governments should make it illegal to pay ransom. Only the
| government should be allowed to pay (in the name of victims) but
| under very strict conditions.
|
| EDIT: slightly different but I wasn't the only one with an idea
| in this direction: https://www.reuters.com/article/us-treasury-
| cyber-idUSKBN26M...
| Fellshard wrote:
| Congrats, you've just marked the government as the sweetest
| target, and I guarantee it's already the most vulnerable.
| bena wrote:
| That's not exactly going to do what you think it does.
|
| It potentially makes the victims criminals. That's just not
| what the law should be doing. It is decidedly unjust. It also
| drives the whole thing further from the public eye as no one
| will admit they're being held up for ransom because paying is
| now illegal.
|
| If making something illegal was a perfect solution, ransomware
| wouldn't be a thing in the first place.
| momothereal wrote:
| What's the punishment for paying? A fine? Then you might as
| well add that to the ransom and pay...
|
| Snark aside, there's just no simple, hand-waving solution to
| this. Even if you held the company owners criminally liable for
| paying a ransom, pretty much any small company will shut down
| for not being able to afford top-notch security.
|
| It also opens the door to blackmail:
|
| > We've encrypted your files. Pay us $AMOUNT BTC by tomorrow,
| or your files are gone. And with a recurring payment of $AMOUNT
| BTC per month, I promise not to report you to the FBI for
| paying!
| api wrote:
| This is the only good answer. Making it illegal to pay any form
| of ransom under any circumstance would hobble a ton of
| different extortion activities.
|
| Ransom only encourages more crime. It's a form of aiding and
| abetting.
| djrogers wrote:
| > Governments should make it illegal to pay ransom.
|
| That won't really change anything, other than add 'break a law'
| to 'lose tons of $$' and 'lose data/time' to the list of bad
| things a company will deal with to recover from a ransomware
| attack.
| Siira wrote:
| > Only the government should be allowed to pay
|
| The gov is the one entity that should not be allowed to pay at
| any cost, as it has infinite paying power.
| robot_no_419 wrote:
| FYI, the author has a huge conflict of interest whenever he
| writes about cryptocurrency, seeing as he's the founder of
| Adjoint, Inc, a company which digitizes cash and settlement
| processes for multinational corporates.
|
| So it's easy to see why he hates a technology that renders his
| entire company useless.
| TheBill wrote:
| Something that would be relevant. Would love to know who's
| downvoting you.
| [deleted]
| rini17 wrote:
| Since stolen credit cards are used in the same illicit way as
| cryptocurrency, they should be banned too :)
| scg wrote:
| The same shortsighted argument could've been done at various
| times against cryptography, against torrents, against remote
| access, against the internet, and against using computers
| (inherently hackable). Now it's crypto payments, and tomorrow
| it's going to be something else because criminals use technology
| to scale as much as everyone else.
|
| Crypto networks are especially good at cross-border payments, and
| they are hard to censor by a state actor. Indeed, these were
| among the design constraints of Bitcoin. If one wishes to argue
| that such a technology shouldn't exist, good luck with that; it
| exists, has legitimate use cases, and banning outright it is
| shortsighted in the same way opposing cryptography is
| shortsighted.
| DrPhish wrote:
| "Imagine a world in which every other month you're forced to bid
| for your personal data back from hackers who continuously rob
| you. And a world where all of this is is so commonplace there are
| automated darknet marketplaces where others can bid on your data,
| and every detail of your personal life is up for sale to the
| highest bidder. Every private text, photo, email, and password is
| just a digital commodity to be traded on the market. Because
| that's what the market demands and that's what capitalism left
| unchecked will provide."
|
| Maybe I'm in a minority, but I think I'd air-gap my personal data
| if this world ever came to pass...I'm considering it already to
| be perfectly honest.
|
| Would the general population just give up if things got that bad?
| As per TFA, I imagine state level actors will step in if things
| get much worse, lest people start unhooking en masse due to the
| risk/reward ratio flipping.
| NateEag wrote:
| > Would the general population just give up if things got that
| bad?
|
| I suspect the general population is already mostly- immune to
| this.
|
| I think most people keep their pictures and all other important
| data in Google or Apple's services. Movies from Netflix, music
| with Spotify.
|
| Those companies have backups.
|
| If your phone or laptop gets hacked, you just wipe it and
| reinstall Chrome.
|
| Access to email is what most normals need to protect.
|
| Ransomware is really better shaped for attacking organizations
| than individuals, IMO.
|
| ...I still burn our family photos to write-once M-Discs, mind.
| f38zf5vdt wrote:
| Banning cryptocurrency only fixes one side of the global-
| internet-being-security-broken problem. If you're a nation-state
| actor and you can still break into computer systems throughout
| the world, you can still:
|
| - Manipulate and profit in foreign stock markets by short/long
| selling based on insider information
|
| - Choose who gets elected by making dirty laundry public
|
| - See military planning by the enemy, live, as it happens
|
| - Trick critical foreign infrastructure into self-destruction
|
| - Discover and cultivate corporate espionage assets based on what
| you know about their personality from emails/SMS/metadata/etc
|
| - Plant incriminating evidence against political or corporate
| adversaries, for example by using their home internet connection
| for something nefarious
|
| The future hell described in the article is not a future hell. It
| is the present hell. Ransomware is just one small part of it.
| obviouslynotme wrote:
| But that only applies to targets who are "in the game." If you
| are a government entity or listed company or act as their
| agents, then you know that security is an issue and are paid
| well enough to make a decent effort. Whether you do or not is a
| different issue.
|
| Grandma doesn't have security audits, wouldn't know how to do
| one, and couldn't afford it if she did. She is the victim here.
| She might call the police but they will file a report and
| forget it. The only chance of getting caught is some larger
| agency like the FBI picking it up and going after you. This is
| highly unlikely.
|
| The only thing stopping Grandma from getting ransomed is making
| it difficult to pay. If your ransom depends on walking Grandma
| through the 15 step process of paying you, then it's unlikely
| to happen or be profitable.
| fouric wrote:
| > But that only applies to targets who are "in the game."
|
| The problem is that _any_ entity in a nation that you 're
| aggressive with can be "in the game". You can steal IP from
| foreign companies, damage foreign infrastructure, and find
| the personal data of high-value persons in the datasets of
| otherwise "boring" companies.
| f38zf5vdt wrote:
| I believe that subversion of the democratic process and
| economic efficiency hurts everyone, if not initially or
| obviously. Recent election cycles have been tumultuous.
|
| Grandmas are currently targeted by scammers who ask for
| iTunes gift card numbers and not Bitcoin, I'm not sure that
| much will change. I've yet to hear people call for a ban on
| iTunes gift cards, but maybe we will get there.
| alrs wrote:
| ^ ^ ^ If there's any Keanu-pill to swallow, it's this.
| Intelligence agencies don't "make us safe," they drive
| financial gain for insiders. I'd bet the ratio of effort spent
| on "market manipulation" versus "find the evil doers" to be
| 10:1.
| edem wrote:
| > Cryptocurrencies are almost entirely used for illicit activity
| and investment frauds
|
| This made clear that this guy has __no knowledge__ about
| cryptocurrencies. The article is just bogus.
| meowface wrote:
| I'm not an unequivocal fan of cryptocurrencies or any particular
| cryptocurrency by any means, but it appears this author really
| hates cryptocurrency and this is just an opportunity for them to
| argue that governments should ban cryptocurrency. Which is
| completely understandable and obviously in good faith given
| ransomware is bad and they think cryptocurrencies are bad, but I
| just wanted to point out their stance and that this is an anti-
| cryptocurrency blog rather than a security/tech blog.
|
| Every blog post they've ever published is about why they think
| cryptocurrency is awful: https://www.stephendiehl.com/blog.html
|
| >The Oncoming Ransomware Storm - May 11, 2021
|
| >Et tu, Signal? - April 7, 2021
|
| >The Political Case for a Blanket Cryptocurrency Ban - March 30,
| 2021
|
| >Bitcoin: The Postmodern Ponzi - February 27, 2021
|
| >The Crypto Chernobyl - February 10, 2021
|
| >Gamestop, Bitcoin and the Commoditization of Populist Rage -
| February 3, 2021
|
| >Facebook Libra is Architecturally Unsound - November 2, 2019
|
| I think they make many valid criticisms, but they remind me of
| the inverse of the standard Bitcoin maximalist. It seems there
| are a lot of people who think Bitcoin or Ethereum or something
| else should become the universal currency of the world and is the
| best and most innovative thing ever, and a lot of other people
| who think they should all be made illegal and are the worst thing
| ever. Also somewhat reminiscent of pg's fanboy/hater dichotomy:
| http://www.paulgraham.com/fh.html
| pja wrote:
| This is just an ad hominem response to Stephen's argument.
| literally_lit wrote:
| It shows a clear bias on the part of the author and a reason
| to believe they would argue in bad faith.
|
| The author being a founder a company for which
| cryptocurrencies are competitors makes this doubly true.
| meowface wrote:
| >The author being a founder a company for which
| cryptocurrencies are competitors makes this doubly true.
|
| I totally missed this. That makes it worse. The company's
| tagline is "[company name] digitises cash and settlement
| processes for multinational corporates [sic?]", which is a
| pretty clear overlap. I don't necessarily see any evidence
| he's doing anything in bad faith, though - I just think
| he's extremely biased and narrowly agenda-driven.
|
| My main issue is just how much he seems to _viscerally_
| hate cryptocurrencies. It makes it harder to take it
| seriously. Like how incredibly snarky and spiteful he comes
| across in his most recent ostensibly-about-programming blog
| post: https://www.stephendiehl.com/posts/fpt.html
| cryptoBusinessLogic = bid $ 10000000 $ do profits
| <- runRansomware launderMoney profits drugCartels
| void $ smashPuppies
|
| It's all starting to feel so political and a little bit
| religious. I sense a lot of parallels between staunchly
| pro- and anti-cryptocurrency people and the US political
| divide and culture wars. I know it's an annoying trope
| (https://xkcd.com/774/), but in the case of both politics
| and cryptocurrency, each side seems insufferable. I feel
| "accidentally moderate"
| (http://www.paulgraham.com/mod.html) on both topics.
| meowface wrote:
| It 100% is an ad hominem response. I'm not trying to address
| his arguments whatsoever and am very low on Graham's
| hierarchy of disagreement. And again, I do agree with many of
| his points.
|
| I just personally don't think banning cryptocurrencies (or
| pretty much anything) is the answer, and the very "ban-happy"
| attitude colors my impression of all of this and makes it
| less likely that I'd want to attempt to address their
| arguments, because I know they've very likely already made up
| their mind that they think the only solution is a government
| crackdown.
| tracedddd wrote:
| Why are arguments of this form so pervasive?
|
| Cryptocurrency is bad and must be banned because ransomware.
| Encryption is bad because pedos, let's ban Tor and Signal. We
| need a permanent surveillance state and forfeit most of our
| rights to privacy because terrorists bad, what do you have to
| hide?
|
| Is it an appeal to emotion? Fear?
| alfor wrote:
| 1- Crypto is made to evade government control.
|
| 2- Government are there to ensure law and order.
|
| Result:
|
| Crypto is a great tool to evade law and order
|
| Governments will have to control crypto or governments will
| stop working
| syshum wrote:
| >>governments will stop working
|
| hmm... seems like all positive to me
| Agathos wrote:
| Yay, anarchy.
|
| The half-life of anarchy is measured in hours. Then the
| gangs show up. Gangs are basically governments, except even
| less responsive to your needs and more openly committed to
| enriching their own leadership.
| syshum wrote:
| You got the first part right... Governments are gangs....
|
| However I have to completely disagree that governments
| are responsive to anyone needs, or that they are not
| committed to their own enrichment
| rawtxapp wrote:
| I'd say crypto is made to remove government control on money,
| not to evade law and order. That's certainly doable, but you
| can also evade law and order with normal fiat currency (ex:
| HSBC laundering billions of dollars for cartels).
| jodrellblank wrote:
| Why are comments in the form of putting words into someone's
| mouth which they didn't say, so pervasive? The blog says "reign
| in and regulate", not "ban".
|
| But, to address your point, because they're good arguments. "We
| need to regulate $thing" has saved lots of lives. No longer can
| you sell plain river water to drink, dump sewage directly back
| into rivers, dump industrial waste into rivers, build houses
| which collapse, build hotels with no fire consideration, build
| using asbestos, make buildings with electric wiring without
| circuit breakers, adulterate food with sawdust and plaster,
| sell products with lead paint, burn leaded gasoline in places
| where people breathe, and on and on and on.
|
| That's progress; try things, filter out the things which are
| badder than they are good.
| scg wrote:
| > reign in and regulate
|
| Crypto is heavily regulated at least in the US, Western
| Europe and huge swaths of Asia. Exchanging to/from fiat can
| only be done through entities subject to KYC, AML laws, and
| OFAC regulations. Additional regulations are coming - see
| "travel rule".
|
| Bitcoin is infinitely more traceable than cash. Here's one of
| the most popular software routinely used by law enforcement
| to trace crypto payments: https://www.chainalysis.com/.
| Tumblers / mixers, etc. have only limited cloaking power.
| VectorLock wrote:
| >Crypto is heavily regulated at least in the US
|
| Most of these criminals perpetrating ransomeware aren't in
| the US or Western Europe.
| robot_no_419 wrote:
| The author has multiple articles calling for an outright
| blanket ban on all cryptocurrencies. So in the author's own
| words, he is calling for a ban on all cryptocurrency.
| jodrellblank wrote:
| In this article being discussed the author's own words are:
| " _' legislation and intervention in the financial system
| at only the level nation states can act. The free flow of
| money from US banks to cryptocurrency exchanges is the root
| cause and needs to halt'_"
|
| Which is a call for regulating, not banning. If you want to
| use something different which the author said somewhere
| else, to back some other point and say that it outweighs
| what the author says here, then actually do all those
| things. What are the author's own words elsewhere, where,
| and what point are you trying to make by vaguely
| gesticulating towards them?
| robot_no_419 wrote:
| How about this article, titled "The Political Case for a
| Blanket Cryptocurrency Ban"?
| https://www.stephendiehl.com/blog/banbitcoin.html
|
| The author is extremely prolific and vocal about his
| support for outright banning cryptocurrency. It's all
| over his blog, it's all over his Twitter. He is proud to
| admit it. It could have taken you 30 seconds to verify
| what I was saying, but instead you chose to double down
| on your ignorance.
| jodrellblank wrote:
| That article _doesn 't call for a ban_? It says:
| The most expedient actions would be fourfold:
| Halt all wire transfers of dollars in and out of
| cryptocurrency exchanges. Halt foreign
| entities trading in dollar cash-equivalent crypto assets.
| Add Chinese and other foreign cryptocurrency exchanges
| hiding in tax-havens to sanctioned entities lists.
| Regulate the sale of any existing cryptocurrency assets
| to US persons by classifying them as securities
| investment contracts moving forward.
|
| If you can still sell existing cryptocurrency assets, and
| exchanges still exist, that's not banned, is it?
|
| > " _It could have taken you 30 seconds to verify what I
| was saying, but instead you chose to double down on your
| ignorance._ "
|
| I'm asking what relevance your comment has. "He calls for
| a ban" - so what? Make a point.
| [deleted]
| robot_no_419 wrote:
| Here is a tweet where he literally says "crypto should be
| outright banned":
| https://twitter.com/smdiehl/status/1391655510760431617
|
| There, can you stop being so obtuse now? You are wrong.
| My point is that the author is calling for a ban and that
| nobody was putting words in his mouth, as you suggested.
| capableweb wrote:
| It's pretty obvious. Imagine that someone comes to you and
| shows you a cube. This cube has lightning inside of it, and you
| can press a button and it creates lightning. This cube can also
| program software, so if you feed it user stories, it outputs
| SaaS businesses. You try to understand how this magic lightning
| works, but to no avail, it's simply too complicated for you to
| understand.
|
| Your first emotion is most likely fear. Like how the hell does
| that thing does it, how does it's magic work?
|
| This is how many people see cryptocurrencies. Something "magic"
| that just somehow is used as money for some people, but it's
| still just ones-and-zeroes, how does anything make sense?!
| First reaction is to be careful around it, and try to "protect"
| yourself from it.
|
| We saw the same thing with the internet initially, until it
| gradually sucked us all in. We saw the same thing with social
| media initially, until it gradually sucked most of us in.
| Siira wrote:
| Perhaps the key is that most people do not perceive huge
| benefits from these, but they perceive huge danger from the
| downsides. People usually both underestimate their own
| downstream benefits because of large inferential distance
| between the thing (encryption) and themselves, and overestimate
| the dangers of the downsides.
|
| Then we'd have the ages-old dynamic that something that
| benefits everyone a bit but harms a minority a lot will be
| pushed out by people.
| TheBill wrote:
| It's an appeal to authoritarianism. The author wants "someone"
| with power to tell everyone what they're allowed, and not
| allowed to do. " The free flow of money from US banks to
| cryptocurrency exchanges is the root cause and needs to halt. "
| Direct quote. Author is in London, but believes that
| #TeamAmericaWorldPoliece needs to step in because the only
| viable on/off ramp to cryptocurrencies is the US Bank System.
|
| The article has the veneer of being well thought out, however
| if you look at their other writing & twitter there's definitely
| a I think I'm smart & didn't invent/make money/gain referential
| power from crypto so it's a scam & they now have ego tied up in
| being right/seeing the state clamp down on it.
| headmelted wrote:
| Not to speak to the author or the article, as I'm not
| familiar with their other writing, but this exact argument is
| why I think this battle for free speech ultimately gets lost.
|
| Given two options A and B:
|
| Option A) Status quo stays as is. Option B) Legally ban end-
| to-end encryption.
|
| My experience has been that most tech people advocate for A.
|
| Personally, I have no desire to have every conversation I
| expect to be private with the government watching over my
| shoulder, but that's exactly where we're headed if the tech
| community's response to the problem of
| perverts/pedos/launderer/druglords boils down to "oh well
| gotta break a few eggs".
|
| Techies can balk all day long at the idea of the government
| legislating away end-to-end encryption but the voting public
| won't (and I don't blame them, given the tech community's
| response of ignoring this issue so far).
|
| Now, you might be thinking "but it doesn't make sense! if you
| ban encryption, evildoers will still use it, and everyone
| else will have lost their privacy for nothing". True.
|
| The tech community needs to find an Option C that resolves
| criminality before Option B is forced on everyone.
|
| (I have no suggestions for this, and doubt it's possible, but
| maybe there's a novel idea no-one has thought of.)
| [deleted]
___________________________________________________________________
(page generated 2021-05-11 23:02 UTC)