Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DarkSide ransomware gang quits after servers, Bitcoin stash seized

krebsonsecurity.com

Post reply on HN
Print view View original

431–440 of 623 posts

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#431

Post by jascii »

ryanlol wrote: post #306
jascii wrote: post #283

Earlier quoted context omitted.

It's pretty clear that the Russian Gov is not actively prosecuting cyber criminals, provided they attack foreign competition. On top of that, there is a fair amount of forensic data indicating shared resources between hacker groups and GRU operatives.

> On top of that, there is a fair amount of forensic data indicating shared resources between hacker groups and GRU operatives. Go on

You could start to look at the spread of Diskcoder.C across several attacks and the shared code with ExPetr and NotPetya... This forms the basis for the DOJ indictment against 6 officers of GRU Unit 74455.

There is much more if you care to go down that rabbit hole.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#432

Post by 867-5309 »

bredren wrote: post #45

It was a mistake to attack the business side of the oil company, because it created what could be sold as reasonable doubt to shut down the pipeline. As a result, the ransom had the optics of an attack on infrastructure. As evidenced by the coverage of Americans desperately filling up containers. This created the impetus for the US to treat this as an incident far and above the ambient ransomware activities leading u…

>Servers were seized (country not named)

>gave the US an opportunity to show how effective it could be

unless you know something we don't, that's quite a conclusion to jump to

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#433

Post by [deleted] »

wongarsu wrote: post #404
thesuperbigfrog wrote: post #325

Earlier quoted context omitted.

On the high seas of the Internet there is a thin line between pirates and state actors. There could even be "privateer" ( https://en.wikipedia.org/wiki/Privateer ) attackers who work for a nation and for profit at the same time. From the victim's perspective it matters less who is attacking you or why they are attacking you and much more what the results of the attack are, how you can mitigate and recover from the da…

Just causing terror doesn't make it terrorism. Causing terror as a means to further some political (or religious) goal would make it terrorism.

[deleted]

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#434

Post by shadowgovt »

this_user wrote: post #245
bredren wrote: post #45

It was a mistake to attack the business side of the oil company, because it created what could be sold as reasonable doubt to shut down the pipeline. As a result, the ransom had the optics of an attack on infrastructure. As evidenced by the coverage of Americans desperately filling up containers. This created the impetus for the US to treat this as an incident far and above the ambient ransomware activities leading u…

The fact that their coins were apparently easily stolen also debunks another favourite talking point of the crypto people that it secures your money from government access. Clearly, ways and means have been developed to do just that if necessary.

As the old xkcd comic notes, no amount of mathematically-proven security protects your encrypted data if the private keys can be beaten out of you with a lead pipe (or, the cleaner version of that, "If you can be incentivized to hand them over given the alternative of jail time that lasts until you divulge your computer's password to the authorities").

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#435

Post by SpinsInCircles »

It's easy to quit went your a bunch of cunts and find our that you have poked the big dog and now are scared, fuck them, and anyone like them. As I said earlier insurers should put a bounty on these pricks, lets put an open bounty on them and theirs.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#436

Post by Scoundreller »

AlexCoventry wrote: post #300
bostik wrote: post #237

Earlier quoted context omitted.

The truly cynical take is that they managed to take down Colonial's billing . In response, Colonial shut down the pipeline - because obviously delivering oil without getting paid is out of the question. Yes, it's guesswork and pretty extreme conjecture but it has just the right amount of coldheartedness to it: https://zetter.substack.com/p/biden-declares-state-of-emerge...

They don't actually own the oil they're pumping, right? So if their billing was compromised to the point that they don't know what oil needs to be pumped where, they had a legal duty to refrain from pumping it willynilly.

Shouldn’t they have a paper-based/offline downtime procedure for this?

(Oh shit, everything just went down, turn on the generator, go plug that printer and laptop in, and print off all the reports of where we were from the offsite/offline/whatever backup).

What did they do before computers?

Failing to plan is planning to fail and all.

I like the idea of monthly planned downtimes where possible so people don’t run around like a headless chicken when things go down. No different than a fire drill.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#437

Post by soheil »

this_user wrote: post #245
bredren wrote: post #45

It was a mistake to attack the business side of the oil company, because it created what could be sold as reasonable doubt to shut down the pipeline. As a result, the ransom had the optics of an attack on infrastructure. As evidenced by the coverage of Americans desperately filling up containers. This created the impetus for the US to treat this as an incident far and above the ambient ransomware activities leading u…

The fact that their coins were apparently easily stolen also debunks another favourite talking point of the crypto people that it secures your money from government access. Clearly, ways and means have been developed to do just that if necessary.

Or it didn't happen and this is just a story being told.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#439

Post by omgwtfbbq »

bluefirebrand wrote: post #416
wongarsu wrote: post #404

Earlier quoted context omitted.

Just causing terror doesn't make it terrorism. Causing terror as a means to further some political (or religious) goal would make it terrorism.

With that definition this is explicitly not terrorism, because it was for money not for political or religious reasons?

Just like how robbing a bank may cause terror to the people in the bank or the neighborhood but it was done for profit not politics.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#440

Post by Scoundreller »

aerostable_slug wrote: post #128
geofft wrote: post #69

Earlier quoted context omitted.

I think the question is, how come an attack on a hospital does not have the optics of an attack on infrastructure? (It almost seems oil does not require infrastructure - you can, theoretically, prep for an oil infrastructure outage by storing it containers, same as you do with water and food. But you can't really prep for a medical infrastructure outage. Is it just that, as a result, there were no photos of people ho…

I think the point people are missing is that hospitals don't just stop providing services when they are hit by ransomware, at least not in my admittedly limited experience. There's a ton of paper involved even today and life could move on with ballpoint pens and forms. The game was changed when Colonial closed the valves and services were impacted.

And downtime procedures. They’re not perfect, but like pipelines, they existed and operated before computers.
Post reply on HN