The ransomware surge • Hacker News Board

Re: The ransomware surge

#21

Post by g_p » Fri, Apr 30, 2021, 7:21 PM UTC

tootahe45 wrote: post #13

I don't get why everybody cares so much about the ransomware/cryptominer part, but not the data being exfiltrated and sold/used for criminal activity part..

My cynical suspicion is because exfiltration/sale doesn't prevent the business from continuing to operate, pretending nothing is wrong, and gaslighting their users via reassuring language if anyone finds out or is approached.

When the data is encrypted and locked up, the company itself cries foul (not out of care for people's data) as it can't keep doing whatever mundane things it was doing day-to-day.

Re: The ransomware surge

#22

Post by tootahe45 » Fri, Apr 30, 2021, 7:21 PM UTC

sneak wrote: post #3

This is going to be the rationale given for the heavy-handed cryptocurrency regulation they're going to bring down on all the exchanges that US persons can access. Pretty soon all you'll be able to legally access as a USian is "Bitcoin!(tm)"[1] (like what PayPal is doing), not the actual uncut blockchain bitcoin that you can send and receive at will. [1]: https://www.epsilontheory.com/in-praise-of-bitcoin/

Already happening with 'unhosted' wallets being blocked or heavily scrutinized. My personal experience is as follows:

Sent over 20 transactions from US exchange -> US exchange and no problems.

Sent a single transaction from my unhosted software wallet -> US exchange, and got my account locked. Questioned on everything including my employer's information, had do re-do advanced KYC, source of funds etc. (The unhosted wallet was funded from an exchange which makes it stupid, and i didn't use any coinjoins or anything).

Re: The ransomware surge

#23

Post by RcouF1uZ4gsC » Fri, Apr 30, 2021, 7:21 PM UTC

I think it is likely that there will be a real world kidnapping where the kidnappers demand a Bitcoin ransom.

Once this happens, Bitcoin will get rapidly regulated out of existence by governments.

Imagine if it follows the usual stereotypical news coverage. An attractive, photogenic American woman goes to a foreign country and gets kidnapped. Later the kidnappers send ransom demands with a Bitcoin address.

This would be wall-to-wall 24/7 news coverage on all the major channels.

After that, the public would likely support almost any type of regulation on crypto-currency.

Re: The ransomware surge

#24

Post by amelius » Fri, Apr 30, 2021, 7:22 PM UTC

danuker wrote: post #16

amelius wrote: post #7

Earlier quoted context omitted.

Personally, I don't see the problem. 1. Bitcoin drives up GPU costs. 2. Bitcoin makes it ridiculously easy to commit certain forms of crime. 3. And Bitcoin's energy footprint hurts the planet.

4. It snuffs those pesky troublemakers and brings them back in line through monetary inflation across generations.

Monetary inflation can also be a good thing as it reduces wealth inequality and income inequality.

Re: The ransomware surge

#25

Post by Bukhmanizer » Fri, Apr 30, 2021, 7:23 PM UTC

jude- wrote: post #10

Ransomware wouldn't be a problem if the software industry took quality assurance seriously (or was regulated to do so), like every other engineering industry. There's little difference to me between an insecure program that allows hackers to hold your data for ransom, and a defective home appliance that occasionally starts electric fires.

I mean I disagree completely. A lot of ransomware occurs completely incidentally to the programs.

Not to mention a lot of actors getting hit with ransomware aren’t software companies. They’re governments, schools, and hospitals. Never mind taking QA seriously, these institutions don’t even take IT seriously.

Re: The ransomware surge

#26

Post by edflsafoiewq » Fri, Apr 30, 2021, 7:27 PM UTC

djoldman wrote: post #20

Can someone tell me where I'm wrong here: The solution to ransomware is to daily mirror every system to an append only backup and then just flash everything back if you get hit. You lose a few days...

Your data has still been leaked. A few days ago there was a story about a ransomware gang threatening to expose police informants if they didn't get paid.

Re: The ransomware surge

#27

Post by billytetrud » Fri, Apr 30, 2021, 7:27 PM UTC

RcouF1uZ4gsC wrote: post #23

I think it is likely that there will be a real world kidnapping where the kidnappers demand a Bitcoin ransom. Once this happens, Bitcoin will get rapidly regulated out of existence by governments. Imagine if it follows the usual stereotypical news coverage. An attractive, photogenic American woman goes to a foreign country and gets kidnapped. Later the kidnappers send ransom demands with a Bitcoin address. This would…

Kidnappers can also demand dollars for ransom. Are governments going to regulate dollars out of existence? Or are you saying they'll just use it as an excuse to harass bitcoin?

Re: The ransomware surge

#28

Post by gizmo686 » Fri, Apr 30, 2021, 7:28 PM UTC

davethedevguy wrote: post #6

The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetra…

Implicit in this comment is the assumption that current technology is pretty much the best we can do?

> IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP).

Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group?

Modern security is based primarily on security through obscurity. As long as you stay up to date, all of the bugs you have are sufficiently obscure that knowledge about them is probably too expensive for the type of hacker that would target you.

> Users will always open attachments from people they don't know, click links, or even pick up random USB sticks.

Why is any of that a problem? A user should not be able to threaten an organization's IT system even if they were outright hostile (unless they were put in a specific position of trust within IT; but even then the amount of damage they should be able to do from their personal work computer should be limited).

Re: The ransomware surge

#29

Post by seibelj » Fri, Apr 30, 2021, 7:30 PM UTC

danuker wrote: post #18

paulpauper wrote: post #9

Exchanges are good at blacklisting BTC ,so this means it will be hard for hackers to cash out. Just converting BTC into XMR is not a trivial process, as it needs to go through an exchange. Trustless cross chain transactions are still in infancy .

> Trustless cross chain transactions are still in infancy . They can technically exist?

Yes and are being actively developed by multiple teams https://eprint.iacr.org/2020/1126.pdf

Re: The ransomware surge

#30

Post by djoldman » Fri, Apr 30, 2021, 7:31 PM UTC

edflsafoiewq wrote: post #26

djoldman wrote: post #20

Can someone tell me where I'm wrong here: The solution to ransomware is to daily mirror every system to an append only backup and then just flash everything back if you get hit. You lose a few days...

Your data has still been leaked. A few days ago there was a story about a ransomware gang threatening to expose police informants if they didn't get paid.

Yes, definitely that.

But I think a lot of businesses really have a problem with the mechanics of just getting their business running again, like the one in the article. This seems fairly straightforward to defend against.