[HN Gopher] Ransomware gangs are complaining that other crooks a...
___________________________________________________________________
Ransomware gangs are complaining that other crooks are stealing
their ransoms
Author : PretzelFisch
Score : 269 points
Date : 2021-10-02 12:40 UTC (1 days ago)
(HTM) web link (www.zdnet.com)
(TXT) w3m dump (www.zdnet.com)
| junon wrote:
| So they're basically publicly admitting they're script kiddies.
|
| Hilarious.
| rocqua wrote:
| usually these affiliates do the actual hacking themselves. They
| simply outsource the payload development. They aren't
| necessarily script kiddies. Outsourcing your non-core work is
| just efficient. It's good business.
|
| That this model is breaking is good news! It means that the
| efficiencies that trust allows are eroding in the ecosystem.
| alisonkisk wrote:
| "script kiddie" is just a slur for "outsourcing".
| jokethrowaway wrote:
| They could just be buying exploits.
|
| I can't imagine professionals capable of hacking useful
| targets having problems writing a script that encrypts some
| files with a public key and needs a private key to be
| unlocked.
| trulyme wrote:
| What is the best defence against this? Is there some software on
| hdd/sdd level that can detect file being encrypted?
| marcosdumay wrote:
| > What is the best defence against this?
|
| Backups.
| ericbarrett wrote:
| Stored offline or at least immutable, e.g. via S3 bucket
| lifetime policy. Lots of cases of casual backup servers being
| infected & encrypted as well.
| normaler wrote:
| We are using borg to backup our Servers and each Server has
| its own user in the backupsystem, that allows to execute
| only the backup command in append mode, so an infected
| server can not destroy its backups.
| marcosdumay wrote:
| Yeah, for protecting against ransomware, the computers you
| are backing-up must not have permission to write in your
| backups, and the place you are writing your backups on must
| not have the same security flaws as them.
|
| Both offline media and well configured S3 can do. Although,
| I'd personally bet much more on my capacity of configuring
| a server than S3. Anyway, you can't go wrong with offline.
| The one thing you can't have is a NAS where your computers
| directly write the data.
| ericbarrett wrote:
| I favor cloud storage here since you can configure write-
| only storage pools (without delete, or at least with
| versioning). Whereas "offline" backups must come online
| for new copies, and that's a window for infection of the
| hosting file system, barring well-configured snapshots or
| the like. Also it can be your second location for the
| "three copies, two locations" rule of thumb, especially
| if you are an SMB with only one physical space.
|
| (The opposite plays here, too. If everything you have is
| in the cloud, you should keep _local_ backups.)
| birksherty wrote:
| There are few. One is Cryptoprevent, the free version is what
| I've been using. It blocks rather than detect encryption which
| some other apps do.
|
| https://www.d7xtech.com/cryptoprevent-anti-malware/
| staticassertion wrote:
| I'd recommend a few things.
|
| 1. File history preservation. We use Dropbox Paper, which
| preserves file history - if someone were to delete all of our
| documents we could recover them.
|
| This is harder to do for production data, which may take up
| petabytes of space. Archiving out the data in big chunks can
| help here (we back up our kafka data to S3, for example, and
| the exporter will do that in batches).
|
| You can also enable object versioning on those S3 buckets or
| prevent deletion/ mutation of objects. Another good idea is to
| use a uuid in the key name so that they can't be guessed.
|
| 2. Remove all forms of lateral movement. Move to a 'zero trust'
| system. Ransoming one machine is not worthwhile, attackers need
| to own a lot of your network if they want to monetize. They
| usually do this by traversing over as many machines as
| possible.
|
| None of our systems can communicate with each other in
| corporate environments, and there's no remote execution
| protocols like SSH in our production environment (between
| servers). All access is explicitly authenticated and
| authorized.
|
| There's lots of other good defenses but IMO if you do these two
| things you're in a very good place.
|
| I wouldn't recommend "backups" generically. It's hard to do
| backups well and safely. (1) is technically a backup, but it's
| how the system works normally, it isn't some separate backup
| system that never gets tested. Backups are also very expensive,
| whereas zero trust is cheap.
| gpm wrote:
| There exist a few products targeted at enterprises that attempt
| to detect suspicious patterns of encrypting files at the OS
| and/or backup level and flag that if it happens.
|
| I wouldn't describe that as the "best" defense though, it's an
| "earlier warning system" but not early enough to prevent
| damage. You've already been hacked, the criminals have already
| exfiltrated all the data they can, have already installed
| whatever backdoors they are going to, and have even already
| started preventing you from accessing some of your own data.
| (That doesn't mean earlier warning doesn't help, and it's
| probably worthwhile, but it's a component in a broader last
| line of defense system that you never want to use in the first
| place).
|
| The best defense is not getting hacked in the first place, and
| not letting malware spread when you do. If you are a big enough
| target that the "detect ransomware" solutions are remotely
| affordable you should hire some experts on this topic, but
| think about things like good phishing training, good firewalls,
| good software engineering, keeping everything entirely up to
| date, and so on and so forth.
|
| Backups help (a lot!) but are not the cure all that people like
| to pretend they are. Apart from all the other damage hackers do
| apart from deleting things, hackers do attempt to delete
| backups too, and sometimes they succeed.
|
| (Disclaimer: I use to work on one of these products)
| mdeck_ wrote:
| No honor among thieves? Color me shocked.
| gigatexal wrote:
| Fuck all of them. Criminals stealing from criminals, cry me a
| river.
| [deleted]
| billpg wrote:
| Oh-Dear-How-Sad-Never-Mind.gif
| matheusmoreira wrote:
| > Cyber criminals using a ransomware-as-a-service scheme have
| been spotted complaining that the group they rent the malware
| from could be using a hidden backdoor to grab ransom payments for
| themselves.
|
| That's hilarious. You'd think they'd know better than to trust
| code they did not write...
| [deleted]
| lilSebastian wrote:
| >That's hilarious. You'd think they'd know better than to trust
| code they did not write...
|
| Most humans trust code they didn't write
| anyfactor wrote:
| Always going to be a bigger fish. But it is scary to hear that
| there is an entire supply chain dedicated to this sort of
| activity.
| bryanrasmussen wrote:
| how many of these people actually write their own code though?
| I mean if there is ransomware as a service, it would imply not
| a lot.
| Waterluvian wrote:
| Yeah. I've always assumed most of these people are low-
| skilled thugs. The Russian equivalent of tax or tech support
| call scammers in India.
| [deleted]
| rocqua wrote:
| I thiink I can see why Revil added the backdoor. It's not to
| steal ransoms. It's to prevent too juicy a target.
|
| There have been reports of crews stating "we won't hit hospitals
| in covid". With this backdoor, if your customers hit a hospital,
| you can hold your promise.
|
| Even worse than hospitals (from their perspective) is agitating
| the American intelligence services. Hit too many pipelines, or
| similar high-news high-impact targets and 'national security
| threat' is your new name.
|
| Worse than that still, imagine one of your affiliates is stupid
| enough to target inside Russia. You need to keep the Russians
| happy or all of a sudden trial or extradition become likely
| outcomes.
|
| At the same time, once you have the opportunity, why not use back
| door for some more money.
|
| Glad to see that they still aren't fully cooperating like legal
| businesses yet.
| schleck8 wrote:
| The Duesseldorf hospital was hit by ransomware and a patient
| died during the outage.
|
| I'm not saying that all ransom gangs are coldhearted, but let's
| not frame them to have morals
| 4gotunameagain wrote:
| I don't think it is about morals, but more about avoiding
| trouble.
|
| And I also wouldn't find it too hard to believe that there
| must be at least _some_ ransomware groups with morals. Not
| the same as yours, sure
| miohtama wrote:
| When you hit a national security target, you get NSA and
| CIA after you. They have vast resources to make your life
| difficult wherever you are.
| [deleted]
| netrus wrote:
| On the other hand, why shouldn't NSA and CIA be invested
| 100% in pushing back on these attacks already? The
| potential harm from this vector is obviously gigantic, so
| why wait for a really significant attack to happen?
| aborsy wrote:
| Ransomware make private sector aware of security issues
| and resilient against attacks. It's like developing
| antibodies to viruses.
|
| NSA rather not to interfere, unless infrastructure is
| involved.
|
| Interference from public sector may actually not be
| successful in the long run, as companies simply adjust to
| that, and keep ignoring security at a new equilibrium
| level.
| CryptoPunk wrote:
| Not suggesting you're doing this, but their existence
| should still not be framed as positive. They are
| malicious and sophisticated, and should be pursued
| accordingly. If they're willing to extort others by
| holding their data ransom, there's no telling what else
| they may be willing to do.
|
| But yes, ransomware does lead to a hardening of network
| infrastructure, and reduces the likelihood of successful
| espionage operations, by alerting parties - via the
| ransomware attack - to security vulnerabilities.
| vkou wrote:
| > On the other hand, why shouldn't NSA and CIA be
| invested 100% in pushing back on these attacks already?
|
| For the same reason that neither them, nor the Army
| doesn't serve drug warrants, or investigate tax evasion.
| Because policing is not their mandate. That's the job of
| either your local police department, or the FBI, or any
| one of a number of the other federal police forces.
| shkkmo wrote:
| If ransomware gangs are seen as a potential threat to
| national security, wouldn't preemptive action against
| these groups fall under the claimed remit of the NSA or
| CIA?
| vkou wrote:
| Tax evasion is a potential threat to national security,
| drugs are a potential threat to national security,
| protests are a potential threat to national security,
| q-anonsense is a potential threat to national security,
| especially when it culminates in an invasion of the
| Capitol.
|
| You don't just get to sprinkle 'potential threat to
| national security' to turn criminal activity into a
| problem for the extra-judicial arms of your government.
| How about we let the police do their core competency -
| policing, and the military and the spooks to stick to
| their core competency - extra-judicial violence, and
| kidnapping random people to hold/torture without trial in
| Gitmo.
| shkkmo wrote:
| I'm not doing any such thing, hence the phrasing of my
| comment.
|
| Your comment seems to imply you think the most/all of the
| remit of the CIA is or should be invalid. That position
| doesn't contradict my comment in any way.
|
| That is a rather different claim than saying that
| premptively pursuing ransomware gangs in other countries
| is outside what the relevant decision makers view as the
| remit of the CIA. To me it seems to clearly fall in-line
| with their historic actions (as long as the cyber
| ransomers are outside of the country.)
| rocqua wrote:
| Not at all suggesting they have morals. I'm suggesting it
| makes business sense to avoid targeting hospitals. Because
| people will come after you much harder if you do that too
| often.
|
| If the NSA starts deploying the TAO against ransomware crews,
| the crews are going to have a much MUCH harder time actually
| making money.
| GravitasFailure wrote:
| The target was a different university, and when the scammers
| realized their mistake they handed over the encryption keys.
|
| I wouldn't say morals play no role, since someone that is
| perfectly fine robbing a wealthy institution isn't
| automatically going to be OK with causing someone's death,
| but there absolutely is risk management at play since the
| hunt for someone that stole a few hundred thousand dollars is
| going to be much lower priority than a hunt for a killer.
| loopback_device wrote:
| An investgation later revealed that the patient's death was
| not caused by the ransomware attack, and the patient would've
| died regardless.
| Sosh101 wrote:
| Surely any ransomware attack is coldhearted? It's only
| effective if you are threatening something the target really
| cares about.
| asddubs wrote:
| Was robin hood coldhearted? I certainly don't mean to
| suggest any ransomware group has motivations that noble,
| but I don't think you can generally say that
| DFHippie wrote:
| A better question: was Robin Hood a real person whose
| behavior could serve as evidence?
| asddubs wrote:
| does it matter if it's just used as a counterexample to
| make a point while speaking in general terms?
| jokethrowaway wrote:
| Absolutely. Theft is violence and it's morally wrong no
| matter the circumstances. It doesn't matter if you're
| stealing a piece of bread not to starve, if you're
| stealing the money to save the lives of orphans, to help
| the homeless or pay for hospitals. It doesn't matter if
| you're an individual, a dictator's army or a
| democratically elected government.
|
| Theft is theft.
| stjohnswarts wrote:
| Doesn't mean it's morally wrong. Robin Hood was taking
| back and returning what was stolen from peasants by the
| Sheriff (and other nobles) by overtaxation and straight
| up "this is mine now" antics. These were people that had
| no right to what they were taking. If beat the crap out
| of the guy I ran down after he stole my garden gnome
| that's justice of a sort.
| wikidani wrote:
| >Worse than that still, imagine one of your affiliates is
| stupid enough to target inside Russia. You need to keep the
| Russians happy or all of a sudden trial or extradition become
| likely outcomes.
|
| I heard (and it might be just people making stuff up) that if
| you had cyrilic anything in your PC some ransomware would avoid
| you entirely, now, that's probably false but I am interested in
| knowing how would they avoid infecting russian computers.
| Kiro wrote:
| https://krebsonsecurity.com/2021/05/try-this-one-weird-
| trick...
| hnlmorg wrote:
| > _Worse than that still, imagine one of your affiliates is
| stupid enough to target inside Russia. You need to keep the
| Russians happy or all of a sudden trial or extradition become
| likely outcomes._
|
| I read somewhere that a lot of these attacks are orchestrated
| by Russians because the Russian authorities will turn a blind
| eye as long as such attacks don't hit domestic targets.
| ianhawes wrote:
| It has been common knowledge for years that most malware and
| ransomware look for the presence of a Cyrillic keyboard and
| exit quietly if it's found.
| [deleted]
| bserge wrote:
| Lol, I don't believe that, but I like to entertain the
| thought that malware leaves me alone just because I have
| had a Russian layout installed ever since I can remember.
| sodality2 wrote:
| https://krebsonsecurity.com/2021/05/try-this-one-weird-
| trick...
| Sosh101 wrote:
| Anything to support that? Seems like an easy step to
| protect yourself if true.
| nvr219 wrote:
| This is where I learned of this "trick":
| https://krebsonsecurity.com/2021/05/try-this-one-weird-
| trick...
| sysihyk wrote:
| Honestly, this looks like yet another Russian Hoax
| iteration. Also, made me to figure Brian Krebs is merely
| a journalist, while real infosec researcher is Chris
| Krebs.
| threeseed wrote:
| They also talked to other people including the Founder
| and Chief Research Officers at Unit221B about whether
| workarounds e.g. adding an additional keyboard were
| effective.
|
| So clearly it's well known that this is real and accurate
| just as most of the reporting is on Russia.
| sysihyk wrote:
| > is real and accurate just as most of the reporting is
| on Russia
|
| Except when it turn out to be fake news as it usually
| happens. For instance, linked malware research paper
| doesn't mentions alleged keyboard layout probe and never
| reveal how this probe to be performed. So, bogus.
|
| > workarounds e.g. adding an additional keyboard
|
| Just as bogus as placing succulent plant to "protect from
| computer radiation"
| wepple wrote:
| This is really common, not just keyboards but time zone
| settings and even geo IP lookup.
|
| The effort required to make your enterprise look like
| it's in Russia is definitely not worth the effort given
| that this would only stop one slice of organized crime.
| sysihyk wrote:
| This implies there Russian Conspiracy members are
| actually caring about their domestic cybercrime which is
| clearly not true.
| hnlmorg wrote:
| They do care. That's the point. Russian's largely have a
| free pass to attack international targets _provided_ they
| do not hit domestic targets.
| birdyrooster wrote:
| No need for "orchestration". Pretty straight forward, hackers
| gonna hack and if you don't give them a legal outlet they
| will just attack domestic targets all the same. Works the
| same way here, the feds don't coordinate with black hats to
| attack adversaries. Black hats can become some of the most
| patriotic fighters, it's pretty interesting.
| henvic wrote:
| Now, if I repeat what you told us, someone might say:
|
| "My friend told he read somewhere that someone read somewhere
| that a lot of these attacks are orchestrated by Russians
| because the Russian authorities will turn a blind eye as long
| as such attacks don't hit domestic targets."
|
| How rumors becomes "real"... :)
| porlune wrote:
| TBF, in the sense that it's widely discussed, this
| particular rumor is already "real"
| NicoJuicy wrote:
| Depends on the method. You're safe from Russian
| hackers/malware if you're OS has the Russian keyboard
| added.
|
| It's even a security precaution.
|
| https://krebsonsecurity.com/2021/05/try-this-one-weird-
| trick...
|
| Tldr: it's not hearsay
| batch12 wrote:
| Not a rumor. This is very common. For instance, an example
| from a marketplace advert.
|
| https://postimg.cc/hfQbS6bQ
|
| PROHIBITED: a) UKR, RU, CIS - BAN
| hnlmorg wrote:
| This isn't a rumour and I don't share information unless
| I'm either personally trained on the topic or have learn
| that information from a reputable news source. This feature
| in question even included interviews with some individuals
| who have ran ransomware attacks.
|
| The only reason I said "somewhere" in my original post was
| because I cannot remember which network it was published
| on.
| rocqua wrote:
| That's my point. If your affiliates start targeting Russians,
| you want a way to distance yourself and keep the Russian
| authorities happy.
|
| Without their protection, the ransomware crews are screwed.
| m12k wrote:
| There's indications that the Russian intelligence services
| are intertwined with organized crime. The oligarchs get help
| laundering money out of the state, the intelligence services
| get untraceable money that they can use to bribe foreign
| assets and the organized crime syndicates get paid for their
| money laundering services and get a free pass from the
| authorities as long as they don't inconvenience those in
| power too much. Seems like one of the most impressive rackets
| in history.
| powersnail wrote:
| I think we can assume that all intelligence agencies are
| intertwined with organized crimes in some way. It's not
| like spy activity is completely legal anyway.
| stjohnswarts wrote:
| In Russia the Oligarchs are mob bosses. It's really that
| simple. And who do they work with ? Putin who has access
| to 100% of all government capabilities. It's a big
| birthday cake and there are plenty slices to go around.
| thatguy0900 wrote:
| Wonder how much they make with ransom ware VS the Cia with
| drugs
| bserge wrote:
| They have a long history of turning a blind eye on criminal
| activities like drug trafficking as long as it's not sold in
| Russia. Then again, so do many other governments.
| stjohnswarts wrote:
| Anything that might interfere with the interests of western
| democracies is okay with the Russian authorities as long as
| it doesn't affect Russians finances.
| baybal2 wrote:
| FYI: Russia has no extraditions
| otikik wrote:
| Tiny violin louthiers are rejoicing thanks to this new market
| opportunity.
| elzbardico wrote:
| Well. They should go to the police!
| Waterluvian wrote:
| There's no evidence to suggest it's happening here, but I wonder
| how effective it is to disrupt ransomware activity by making the
| community distrust each other.
| iJohnDoe wrote:
| Very good point. Any type of disruption is beneficial.
| Especially when you start screwing over your affiliates.
|
| It's has been proven that affiliates are the main reason
| ransomware has been so successful. Piss off your affiliates and
| now you no longer have incoming victims/targets.
| staticassertion wrote:
| This happens with scammers a lot from what I've seen. I watch Jim
| Browning and it's interesting to see how often a scammer will say
| "No, that other person was trying to scam you, do not talk to
| them, only talk to us" when they see evidence of a previous scam.
| kappuchino wrote:
| Re: Thieves stealing from thieves ...
|
| I worked(*) with a credit-card scammer who brought in a software
| for creating "yes-cards": Cloned Creditcards that had corrupted
| chip and pin settings(See
| https://www.zeit.de/2016/05/kreditkarten-banken-betrug-siche...,
| sorry its only in german).
|
| It was unheard of at the time that you could do this. So we set
| up a test to clone a credit card of ours. The kicker was, the
| software didn't work when you disconnected the computer it ran on
| from the internet. Security mechanism from the creator? Nope, it
| turns out after tracing/dissassembly it sent the data from the
| cards to a third party to sell it.
|
| Our informant was first confused, then outraged. No honor amongs
| thieves!
|
| (*) journalistically!
| Nursie wrote:
| "Yes" cards were a threat but they had two problems - they
| could only work with static data authentication (which has
| hopefully been phased out by now) and the terminal itself would
| contain 1-in-n goes online regardless checks, plus limits for
| offline transactions.
|
| An oversight in the EMV specs certainly, but not a showstopper.
|
| IIRC I made one of these with an ICC Solutions programmable
| card about 20 years ago (in the context of building an EMV
| system at the time)
|
| I love the story there though :)
| TheJoeMan wrote:
| So to encourage merchants using Dip and Tap instead of swipe,
| brick and mortar cc processor companies said they no longer
| would cover fraud from cloned swipes. Sounds fine right? Except
| their own payment terminals after 2 or 3 dips/taps not working
| just go "fine just use swipe" -_-
| lelanthran wrote:
| That's part of the EMV standards; the terminal parameters set
| by the bank or the merchant are combined with the card
| parameters set by the issuer to determine threshold for risk.
|
| A merchant or bank in a 3rd world country may decide on
| thresholds that effectively never do a fallback transaction.
| fsckboy wrote:
| > _cc processor companies said they no longer would cover
| fraud from cloned swipes. Sounds fine right?_
|
| yes, and it makes sense that it would encourage adoption of
| the new dip-tap machines. That they can also swipe does not
| decrease the incented appeal of the new safer system
| Nursie wrote:
| That very much depends on the terminal settings and the
| merchant agreement with the acquirer...
| quickthrower2 wrote:
| Who do they complain to? Is there an ombudsman?
| gjvnq wrote:
| To Twitter of course :)
| sudhirj wrote:
| Lots. The High Council from John Wick, AIM from Marvel, there's
| probably an Injustice League somewhere as well.
| duskwuff wrote:
| The Guild of Calamitous Intent from Venture Bros also comes
| to mind.
| peter_retief wrote:
| I just upvoted for the headline, clickbaited by the article
| complaining about crooks complaining about other crooks. I wonder
| if there is a name for this?
| BTCOG wrote:
| See right through your C2, seize it, so you see how we move.
|
| also
|
| I don't watch TV - I sit back - and watch cowrie hijack a box -
| patch the hole - like howdy - its me - ya new best friend show me
| the way that you planned to get these ends
|
| Snakes in the grass stay on my toes credentials contained within
| all these SQL rows no time for these hoes So what you gotta say
| to me? I need new information, f** all your old queries I'm
| planted like raspberries, Pycharm's filled with adversaries,
| static build, f** your external libraries.
| ur-whale wrote:
| > other crooks are stealing their ransoms
|
| The hallmark of an ecosystem.
| beermonster wrote:
| Would be a shame if someone else used that same back door to
| assist in capturing the perps.
| drummer wrote:
| I can't get the humancetipede image out of my head with these
| gangs chainfucking eachother with revil being the last link in
| the chain
| ivrrimum wrote:
| lol
| anonymousDan wrote:
| So where is the back door I wonder. In the actual payload that
| gets deployed to the victim's device? Or in some backend part of
| the ransomware software?
| rocqua wrote:
| I would put it in the key generation algorithm used for the
| encryption. If that algorithm was somehow backdoored (like the
| dual-ec curve, or just by (assymertically) encrypting the key
| and putting it in the identifier. Then the RaaS could just use
| the backdoor to recover the key.
| kosasbest wrote:
| Good. Share the (stolen) wealth.
| dylan604 wrote:
| Robin Hood as a service?
| nostrademons wrote:
| Note that REvil is the group behind the Colonial Pipeline hack
| that took down gas supplies down the eastern seaboard earlier
| this year. They were taken offline by (presumably) the U.S.
| intelligence services shortly after that hack.
|
| It's interesting that a.) they're back and b.) a secret backdoor
| that allows REvil to override their affiliates and restore access
| themselves is found shortly afterwards. Particularly since REvil,
| in the immediate aftermath of Colonial Pipeline, before they were
| shut down, sent out a message to their affiliates forbidding any
| attacks on governments or critical infrastructure. An alternative
| explanation is that they cut a deal with the CIA where they are
| allowed to continue to operate in exchange for instituting a
| backdoor and handing over the keys to major Western governments,
| such that if they hit any "politically embarrassing" targets, the
| government can override the affiliate and restore operations.
|
| Keep your friends close and your enemies closer. It's often
| smarter to co-opt an adversary than it is to shut them down
| entirely.
___________________________________________________________________
(page generated 2021-10-03 23:01 UTC)