Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Oncoming Ransomware Storm

stephendiehl.com

Post reply on HN
Print view View original

81–90 of 147 posts

Re: The Oncoming Ransomware Storm

#81

Post by rini17 »

duckfang wrote: post #32

My big question, and I would love an answer: Why is it that an organization can topple to malware and ransomware by some L1 tech clicking on a "bad email"? People are going to click on shit. That's a 100% guaranteed fact - be it intentional or not. But WHY is our computing and communications paradigm so brittle that any Jack or Jane can click a link and pwn the infrastructure?

Imagine hypothetical L1 techs which would only accept "good email" such as plain ASCII (I mean really, 7bit) text email without attachments.

Everyone would consider such a service broken and route around it.

Re: The Oncoming Ransomware Storm

#82

Post by alrs »

mhh__ wrote: post #75
alrs wrote: post #5

Ransomware is great. 1. Creates a huge financial incentive to try and break PGP encryption. 2. Pushes aside all of the lame corporate compliance "infosec" people whose job it is get lied to about PCI compliance and bitch about version numbers that they don't understand. 3. Proves useless all of the "ex-special-forces" "red team" "master safecracker" Defcon LARPers. 4. Gives the insurance companies enough room to attr…

I'm not sure what point 3 refers to?

#infosec "thought leaders" with a cool-sounding military history who purport to be able to do underwater lockpicking but can't put together a for loop. Their shtick exists to sell services to clients and to sell recent graduates on a Special Forces Awesome Security Career that in reality will be QA at best, corporate compliance at worst.

Re: The Oncoming Ransomware Storm

#83

Post by Fellshard »

amelius wrote: post #21

Governments should make it illegal to pay ransom. Only the government should be allowed to pay (in the name of victims) but under very strict conditions. EDIT: slightly different but I wasn't the only one with an idea in this direction: https://www.reuters.com/article/us-treasury-cyber-idUSKBN26M...

Congrats, you've just marked the government as the sweetest target, and I guarantee it's already the most vulnerable.

Re: The Oncoming Ransomware Storm

#84

Post by tharne »

splithalf wrote: post #17
seafoam wrote: post #3

"A future in which ransomware and mass data theft are so ubiquitous they’ve worked their way into our daily lives" >>> True "The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency" >>> False

Incentives matter. Bitcoin incentivizes certain types of criminal activity. As Bitcoin grows the negative externalities will become more pronounced. I truly don’t get the ethics of it. It is killing people, literally blood money as a great new technology. Bonus points for incentivizing climate destruction and burning of fossil fuels. I don’t understand the ethics of it.

The overwhelming majority of criminal commerce is conducted using traditional currencies such as U.S. Dollars or Euros. I truly don't get the ethics of it. It is killing people, literally blood money...

Re: The Oncoming Ransomware Storm

#85

Post by tharne »

riccardomc wrote: post #14
SteveNuts wrote: post #4

Earlier quoted context omitted.

Right, it's definitely a contributing factor as to why it's profitable, but the attacks themselves could be done entirely out of malice if they wanted to.

Sure it can be done entirely out of malice, but it is now clear that cryptocurrencies enable the incentive of doing it for money. It is becoming more and more evident that ransomware attacks are the killer app of crypto.

Because there was no such thing as cyber crime prior to the invention of cryptocurrency.

Re: The Oncoming Ransomware Storm

#86

Post by daaang »

mytherin wrote: post #53
daaang wrote: post #20

> The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency. And is entirely enabled by this one technology, it could not exist otherwise. Huh, cryptocurrency existed in 1989, when the first ransomware was active? Did the author even google the word "ransomware?" Wire transfers and all types of pre-paid voucher services were used well before cryptocurrencies were even created.

The article directly addresses your point in the paragraph surrounding the sentence you cherry picked. > Now this is not a new phenomenon by any means. But what is new is that the level of these attacks has gone parabolic in the last few years because of one simple fact. With the addition of bitcoin to the problem it’s insanely profitable, low-risk, and almost the perfect crime. It’s also a very real economic tool th…

I agree, the author contradicts themselves immediately. Cryptocurrency is not the "singular" reason, and it is not why these attacks are even "possible."

The hypothetical they picked might not work. The methods that ransomware was using for decades to extort hundreds of thousands of dollars did, and will continue to work.

Re: The Oncoming Ransomware Storm

#87

Post by headmelted »

TheBill wrote: post #43
tracedddd wrote: post #11

Why are arguments of this form so pervasive? Cryptocurrency is bad and must be banned because ransomware. Encryption is bad because pedos, let’s ban Tor and Signal. We need a permanent surveillance state and forfeit most of our rights to privacy because terrorists bad, what do you have to hide? Is it an appeal to emotion? Fear?

It's an appeal to authoritarianism. The author wants "someone" with power to tell everyone what they're allowed, and not allowed to do. " The free flow of money from US banks to cryptocurrency exchanges is the root cause and needs to halt. " Direct quote. Author is in London, but believes that #TeamAmericaWorldPoliece needs to step in because the only viable on/off ramp to cryptocurrencies is the US Bank System. The…

Not to speak to the author or the article, as I’m not familiar with their other writing, but this exact argument is why I think this battle for free speech ultimately gets lost.

Given two options A and B:

Option A) Status quo stays as is. Option B) Legally ban end-to-end encryption.

My experience has been that most tech people advocate for A.

Personally, I have no desire to have every conversation I expect to be private with the government watching over my shoulder, but that’s exactly where we’re headed if the tech community’s response to the problem of perverts/pedos/launderer/druglords boils down to “oh well gotta break a few eggs”.

Techies can balk all day long at the idea of the government legislating away end-to-end encryption but the voting public won’t (and I don’t blame them, given the tech community’s response of ignoring this issue so far).

Now, you might be thinking “but it doesn’t make sense! if you ban encryption, evildoers will still use it, and everyone else will have lost their privacy for nothing”. True.

The tech community needs to find an Option C that resolves criminality before Option B is forced on everyone.

(I have no suggestions for this, and doubt it’s possible, but maybe there’s a novel idea no-one has thought of.)

Re: The Oncoming Ransomware Storm

#88

Post by 1vuio0pswjnm7 »

"The singular reason why these attacks are even possible is due entirely to rise of cryptocurrency."

So-called crytocurrency may not be the sine qua non, but it is arguably a substantial factor in what is causing these campaigns of automated attacks. Without an easy way to launder the "ransom" payments, could these attacks be systematically executed on a large scale with a level of success (receiving the payments without getting caught) necessary to justify the risk.

Re: The Oncoming Ransomware Storm

#89

Post by tharne »

TheBill wrote: post #45
sebastien_bois wrote: post #12

Earlier quoted context omitted.

But not entirely inaccurate. I mean, 20 years, maybe even just 10 years ago we would've shrugged off the type of attacks happening now as "pure science fiction".

30 years ago there was ransomware in the wild: 1989 -Popp/ AIDS trojan 2005 - GPCoder trojan 2017 - notpetya (AKA the moller maersk hack) https://actzero.ai/resources/white-paper/the-rise-of-ransomw...

Amazing how quickly people forget the past.

Re: The Oncoming Ransomware Storm

#90

Post by jodrellblank »

robot_no_419 wrote: post #42
jodrellblank wrote: post #33

Earlier quoted context omitted.

Why are comments in the form of putting words into someone's mouth which they didn't say, so pervasive? The blog says "reign in and regulate", not "ban". But, to address your point, because they're good arguments. "We need to regulate $thing" has saved lots of lives. No longer can you sell plain river water to drink, dump sewage directly back into rivers, dump industrial waste into rivers, build houses which collapse…

The author has multiple articles calling for an outright blanket ban on all cryptocurrencies. So in the author's own words, he is calling for a ban on all cryptocurrency.

In this article being discussed the author's own words are: "'legislation and intervention in the financial system at only the level nation states can act. The free flow of money from US banks to cryptocurrency exchanges is the root cause and needs to halt'"

Which is a call for regulating, not banning. If you want to use something different which the author said somewhere else, to back some other point and say that it outweighs what the author says here, then actually do all those things. What are the author's own words elsewhere, where, and what point are you trying to make by vaguely gesticulating towards them?

Post reply on HN