Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The ransomware surge

bbc.com

Post reply on HN
Print view View original

191–200 of 216 posts

Re: The ransomware surge

#191

Post by uncletammy »

londons_explore wrote: post #61
tootahe45 wrote: post #22

Earlier quoted context omitted.

Already happening with 'unhosted' wallets being blocked or heavily scrutinized. My personal experience is as follows: Sent over 20 transactions from US exchange -> US exchange and no problems. Sent a single transaction from my unhosted software wallet -> US exchange, and got my account locked. Questioned on everything including my employer's information, had do re-do advanced KYC, source of funds etc. (The unhosted w…

I wonder how exchanges know each other's addresses? Don't they tend to use a new address for every incoming and outgoing payment? Do they have private API's to verify addresses?

They are fairly easy to pick out simply based on the way money flows in and out of the addresses. Also, they become known over time as customers share them then they are eventually labeled by companies (exchanges included) performing blockchain analytics. Many of the public blockchain explorers show labels for popular addresses. I've seen labels on big exchanges, Satoshi's coins, seized silk road coins, coins from hacks, etc.

Re: The ransomware surge

#192

Post by A_No_Name_Mouse »

Can anyone elaborate on what a company wide restore operation looks like in a big company? I worry about this because IT support teams tend to test restores per system. But what if it's thousands of systems going down at the same time? If this happens I even wonder how long it would take to restore productivity if the ransom is being paid. Also, what percentage of systems would typically be infected?

Re: The ransomware surge

#193

Post by networkimprov »

naturalauction wrote: post #185
citrin_ru wrote: post #168

Earlier quoted context omitted.

This problem is partially solved by DMARC/SPF/DKIM. There a few issues with DMARC, but the main one - adoption by senders is well below 100% so you just cannot block mail without DMARC. But the main question I have - does a typical mail users actually care about sender domain? I suspect - not at all. And I see two main reasons for this. First notion of domain is de-emphasized everywhere - browsers turned address bar…

>There a few issues with DMARC, but the main one - adoption by senders is well below 100% so you just cannot block mail without DMARC. I wonder if this could be fixed by email clients marking emails that fail DKIM as spam/attaching a large warning. Most users use email clients and they really don't do a great job of notify users of potential spoofing issues (with Gmail, you have to find "view original" to see that DK…

My understanding is that most phishing attacks are launched from webmail accounts, which implement DMARC.

Re: The ransomware surge

#194

Post by 908B64B197 »

gizmo686 wrote: post #28
davethedevguy wrote: post #6

The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetra…

Implicit in this comment is the assumption that current technology is pretty much the best we can do? > IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group? Modern security…

> Why is it that even slightly old systems are so buggy that they are trivially hackable for a moderately well funded group?

Slightly old here means 13 years after the latest release in case of Windows XP.

That's a very long time for anyone to upgrade.

Re: The ransomware surge

#195

Post by 908B64B197 »

davethedevguy wrote: post #6

The difficulty with ransomware attacks and the like, is that it's less a technical problem and more a people problem. IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP). Users will always open attachments from people they don't know, click links, or even pick up random USB sticks. The perpetra…

> IT departments will never have enough money/time/staff to keep systems up to date with the latest OS (look at the number of people still running critical systems on Windows XP).

It's not like Microsoft has an explicit EOL date announced for every OS release...

Re: The ransomware surge

#196

Post by nicbou »

AnIdiotOnTheNet wrote: post #151
nicbou wrote: post #103

Earlier quoted context omitted.

This applies to average people too. I wonder who among us can say they meet your (reasonable) standard. Like you said, backups are annoying and unglamorous. Yet, the data on my laptop is the only thing I could not replace. It's more important to me than my passport or my birth certificate. Its preservation is certainly worth a bit of thought.

...really? What are you keeping on your laptop that is so important to you? I can't think of anything on my computer that I couldn't lose and pretty much just shrug off.

Photos, journals and other personal data.

Re: The ransomware surge

#197

Post by nicbou »

disabled wrote: post #108
nicbou wrote: post #103

Earlier quoted context omitted.

This applies to average people too. I wonder who among us can say they meet your (reasonable) standard. Like you said, backups are annoying and unglamorous. Yet, the data on my laptop is the only thing I could not replace. It's more important to me than my passport or my birth certificate. Its preservation is certainly worth a bit of thought.

> Like you said, backups are annoying and unglamorous. It’s called having a network attached storage (NAS) device. I have a Synology NAS, which I backup to, continuously at 5 minute intervals. Warning: Microsoft image and file backups sometimes do not work. I recommend Acronis True Image instead, which comes with antivirus. It pretty much always works, never falter never fail. Get the version that allows you to back…

I use rsync and hard links to create incremental backups, and Google Drive as a convenience backup. First to a collection point, then to remote locations.

It's actually managed by a side project of mine: https://github.com/nicbou/timeline

Re: The ransomware surge

#198

Post by leifg »

greenn wrote: post #181
nikanj wrote: post #176

Ransomware got way more viable thanks to crypto. No more need for money mules and shady shell companies, just take moneys in crypto and you’re golden

That crypto has to become real money at some point. If the ransom is in something like bitcoin (very common) then identification is just a waiting game for that conversion

I doubt that any of the ransomware people will use any crypto exchange.

I suspect there is whole network of people that will sell crypto for cash to people who want to buy drugs/other things on the darknet.

Maybe there is a handful of corrupt exchanges but the bigger ones already check where your crypto is coming from.

Re: The ransomware surge

#199

Post by closeparen »

Jabbles wrote: post #179
closeparen wrote: post #159

Earlier quoted context omitted.

That’s all well and good for weather data, but if anything in your backup is in any way related to user behaviors or transactions, immutability is a crime.

Immutability in this context doesn't mean "kept forever", it just means the permission to hard-delete is separate from soft-delete. GDPR requires that good data-stewards keep backups: the controller and the processor shall implement... the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident https://gdpr-info.eu/art-32-gdpr/ For more detai…

It also requires that user data can be hard-deleted on command. The ability to wipe data from backups needs to be kept close at hand.

Re: The ransomware surge

#200

Post by matheusmoreira »

paulpauper wrote: post #9

Exchanges are good at blacklisting BTC ,so this means it will be hard for hackers to cash out. Just converting BTC into XMR is not a trivial process, as it needs to go through an exchange. Trustless cross chain transactions are still in infancy .

Why convert BTC to XMR if they can just ask for XMR instead of BTC?
Post reply on HN