Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Worsening State of Ransomware

cacm.acm.org

Post reply on HN
Print view View original

131–139 of 139 posts

Re: The Worsening State of Ransomware

#131

Post by selfhoster11 »

thorwasdfasdf wrote: post #101
hn_throwaway_99 wrote: post #23

The article briefly touches on this, but my belief is the one thing that may eventually "take down" cryptocurrency is ransomware. That is, ransomware as it exists today is only possible because secure, anonymous, non-reversible methods of payment exist in the form of cryptocurrency. Things like bearer bonds were outlawed decades ago because of a similar desire to make large anonymous, easily transportable payments im…

Bitcoin is not anonymous. there are strict KYC rules in place. Bitcoin is not for speculators, it's primary use case is a Store of value. There's large demand for a store of value, especially now that the bond market is finished.

The exchanges may require KYC, but there's nothing in Bitcoin proper to enforce that.

Re: The Worsening State of Ransomware

#132

Post by selfhoster11 »

netflixandkill wrote: post #31
tgb wrote: post #11

Earlier quoted context omitted.

I want this on a simpler scale: an external drive that has a physical switch. In normal operation the switch is in "append only" mode and the drive ensures that nothing can be erased. Only when the switch is temporarily hit to a "unsafe" mode would it allow deleting to make more space. I don't know how easy or difficult this would be (I assume external drives don't typically know about filesystem-level information li…

There are USB drives that do vaguely similar things but it's all in software. It's difficult to do that unless the filesystem has append only functionality, metadata blocks are rewritten all the time even if data isn't. For anyone who has serious (I.e. $$$) need of that they already have tapes and optical WORM media though. You can do something conceptually similar with any sort of NAS that provides immutable snapsho…

A software switch might as well not exist at all. They are not secure, or useful, because they can just be ignored by the host machine.

Re: The Worsening State of Ransomware

#133

Post by selfhoster11 »

shahar2k wrote: post #108
rectang wrote: post #9

> Not surprisingly, dozens of major ransomware gangs now exist worldwide, including in Russia, Eastern Europe, and North Korea. To what extent should ransomware activity be considered low-grade economic warfare by nation-states who can't or won't police cyber-criminals, and thus justification for robust national responses such as sanctions?

to the same extent that Hollywood movies function as cultural warfare / propaganda

So, "yes where applicable"?

Re: The Worsening State of Ransomware

#134

Post by Isinlor »

intrasight wrote: post #46
Isinlor wrote: post #16

> Some, including the U.S. Treasury, have promoted the idea of making it illegal to pay a ransom, though the idea has not gained widespread support. That's probably the only solution, besides the obvious ones like actually protecting the systems.

I'm not sure how such a rule could be enforced. But let's assume that it could. I think this would cause a huge shift in IT. For example, companies would be more eager to switch from Windows to something more secure. Or if they continued to use Windows, it would be in the form of ephemeral VMs, perhaps on AWS, that lack an attach surface area. But I would hope that financial pressure - like insurance companies not in…

Introduce obligation to report successful cyber attacks under penalty for delay. EU is already doing it. Also make a fine of 10 times the ransom for paying the ransom. Additionally introduce criminal liability for intentionally hiding a ransomware attack in order to pay the ransom.

The biggest reason is to starve the attackers of incentive and resources. If you get 10 million dollars from an attack you can hire 10 people for a year to work on more attacks.

But it's unlikely that companies will change anything besides reporting in their practices. People are bad at evaluating tail risks of 0.001% chance happening in their lifetime.

Re: The Worsening State of Ransomware

#135

Post by toss1 »

megameter wrote: post #126
toss1 wrote: post #121

Earlier quoted context omitted.

No question, nothing is ever perfect, and best efforts should be made to utilize the available tracking. Especially so, when the threat is rising to the level of national security concerns as attacks start moving to infrastructure, and are sponsored or unofficially sanctioned by criminal nation-sates, where the response should be kinetic. The problem is that to kill ransomware, we would need a near-perfect system, an…

I don't see this going in the direction of a heavily enforced response, although some places may talk big. While a collective ban is rationally sensible, nations are made of individuals and every person will do a calculation of personal benefit relative to national interest. Crypto is valuable as a refuge, so a recurring story is currently playing out in destabilized nations all over the world where crypto is used to…

I like your thinking here! Of course it raises several questions

Will any substantial number of govts have the foresight to setup such a system of on/offramp controls + rules/bailout + investigation and enforcement soon enough?

If the ransomeware plague stays in the non-critical commercial realm, it would work

The key looming problem I see is that it is already sanctioned by criminal adversary nation-states, and there will be a lot of profit temptation to go after critical or military infrastructure - some ransomware gangs are just going to be that short term 'smart' long-term stupid. A sufficiently serious enough attack could cause war-level damage...

Re: The Worsening State of Ransomware

#136

Post by sodality2 »

hsbauauvhabzb wrote: post #128
sodality2 wrote: post #72

Earlier quoted context omitted.

Write only setting perhaps

No, because you’re reading the local file system using the local processor, which could corrupt reads or writes. Even DMA reads won’t solve it - malware could encrypt/decrypt transparently for a period undetected, then toss away the decryption key once it’s likely that backups are no longer viably usable..

I mean, if the malware is in the system before backups are even set up, sure it could be broken..

Re: The Worsening State of Ransomware

#137

Post by hollerith »

intrasight wrote: post #46
Isinlor wrote: post #16

> Some, including the U.S. Treasury, have promoted the idea of making it illegal to pay a ransom, though the idea has not gained widespread support. That's probably the only solution, besides the obvious ones like actually protecting the systems.

I'm not sure how such a rule could be enforced. But let's assume that it could. I think this would cause a huge shift in IT. For example, companies would be more eager to switch from Windows to something more secure. Or if they continued to use Windows, it would be in the form of ephemeral VMs, perhaps on AWS, that lack an attach surface area. But I would hope that financial pressure - like insurance companies not in…

>companies would be more eager to switch from Windows to something more secure

That would be true if in 2021 the alternatives were more secure than Windows, which I doubt.

Re: The Worsening State of Ransomware

#138

Post by cutemonster »

bradleyjg wrote: post #42
hn_throwaway_99 wrote: post #23

The article briefly touches on this, but my belief is the one thing that may eventually "take down" cryptocurrency is ransomware. That is, ransomware as it exists today is only possible because secure, anonymous, non-reversible methods of payment exist in the form of cryptocurrency. Things like bearer bonds were outlawed decades ago because of a similar desire to make large anonymous, easily transportable payments im…

Crypto, or at least bitcoin, is not anonymous. On the contrary the payment trail is there for the whole world to see. Governments could blacklist those coins such that no exchange or legitimate vendor would ever take them. They choose not for whatever reason but not because the technology offers anonymity.

> Governments could blacklist those coins

How would they know if the coin is from ransomware? If the randomware criminals say it's not, so it's word against word? And if they accepted just one payment to the wallet (so there's not a pattern of accepting money from strangers)

Or if the organization that got broken in to, doesn't want to be public about that? (Doesn't want to talk with the government)

(I don't know much about crypto coins.)

Re: The Worsening State of Ransomware

#139

Post by hsbauauvhabzb »

sodality2 wrote: post #136
hsbauauvhabzb wrote: post #128

Earlier quoted context omitted.

No, because you’re reading the local file system using the local processor, which could corrupt reads or writes. Even DMA reads won’t solve it - malware could encrypt/decrypt transparently for a period undetected, then toss away the decryption key once it’s likely that backups are no longer viably usable..

I mean, if the malware is in the system before backups are even set up, sure it could be broken..

Not even before, it just has to exist long enough to trash backups for a while - reverting from a month old backup would be substantially damaging.
Post reply on HN