Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DarkSide ransomware gang quits after servers, Bitcoin stash seized

krebsonsecurity.com

Post reply on HN
Print view View original

491–500 of 623 posts

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#491

Post by lovemenot »

hinkley wrote: post #463
TrackerFF wrote: post #202

Earlier quoted context omitted.

I got downvoted for saying that maybe it's time to treat serious ransomware attacks (infrastructure, security, health, etc.) as terrorism - as in the sense that they're a threat to the national security. But this kinda shows the response I was referencing to. A lot of people like to think of ransomware attacks as the ultimate stress test as far as security goes, and thus a good thing - but let's not get too blinded b…

As far as I'm concerned, ransomware attacks essentially fall into the same classification as highwaymen, bandits, and pirates. We tend to take those pretty seriously. Or at least, we did once they've robbed the wrong people. Sounds like the ransomeware people finally robbed the wrong people.

We have only DarkSide's word for what happened to them. No corroboration.

Not saying it's false, but the story doesn't ring true to me.

They appear to be sophisticated, yet they made the newbie error of keeping all the funds in a network accessible device, rather than a cold wallet. Really?

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#492

Post by suifbwish »

wongarsu wrote: post #404
thesuperbigfrog wrote: post #325

Earlier quoted context omitted.

On the high seas of the Internet there is a thin line between pirates and state actors. There could even be "privateer" ( https://en.wikipedia.org/wiki/Privateer ) attackers who work for a nation and for profit at the same time. From the victim's perspective it matters less who is attacking you or why they are attacking you and much more what the results of the attack are, how you can mitigate and recover from the da…

Just causing terror doesn't make it terrorism. Causing terror as a means to further some political (or religious) goal would make it terrorism.

Money is pure politics. The attacker becoming rich can legally be considered a political goal as the nature of money is political. If they endanger an entity or someone else’s resources to gain that political goal they are guilty of terrorism as they used fear to enact political change.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#493

Post by hooande »

snypher wrote: post #373
hooande wrote: post #193

Earlier quoted context omitted.

Darkside was a legit business. They routinely collected ransoms ten or twenty times larger than what they got from Colonial. if they were going to retire, they would have done it a long time ago

Didn't Colonial pay $5m? I don't think Darkside ever received a $50m-$100m ransom. Do you have any more details?

They don't have financial reports and insurance companies don't routinely disclose ransom amounts.

Darkside has opened negotiations in the tens of millions in the past [0], with an average demand in the millions [1]

[0] https://krebsonsecurity.com/2021/05/a-closer-look-at-the-dar...

[1] https://www.areteir.com/darkside-ransomware-caviar-taste-on-...

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#494

Post by suifbwish »

omgwtfbbq wrote: post #439
bluefirebrand wrote: post #416

Earlier quoted context omitted.

With that definition this is explicitly not terrorism, because it was for money not for political or religious reasons?

Just like how robbing a bank may cause terror to the people in the bank or the neighborhood but it was done for profit not politics.

Wealth is the primary means of expanding ones political influence. It’s a primitive tool like a talking stick to coerce all the other monkeys to do shit for you. Trying to gain money is absolutely political

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#495

Post by [deleted] »

doomroot wrote: post #294
thanhhaimai wrote: post #275

Earlier quoted context omitted.

Opinions are my own. There is something called the "gun test". The crypto on an encrypted hard drive is not more secure than the gold bars in a locked safe. Its security is a function of how the secret holder response to gun-on-their-head events. In this case, since the government is directly involved (and angry), a lot of criminals may pick personal safety over assets. Frankly, I think a large portion of cryptocurre…

In the bitcoin space it’s colloquially known as the “$5 wrench attack.” All the cryptographic, air gapped security hardware doesn’t matter if someone can beat the keys out of you.

[deleted]

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#496

Post by EamonnMR »

suifbwish wrote: post #487
EamonnMR wrote: post #485

Earlier quoted context omitted.

No imagination required; this cyberattack on infrastructure masqueraded as ransomware: https://en.wikipedia.org/wiki/Petya_(malware)

I will never understand why people link to paid articles in a public forum. There are too many other reliable sources for that exact info for anyone who isn’t wealthy to pay for dumb sites like that.

Fair enough, I just wanted to find an article that explained NotPetya. But wikipedia does a fine job.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#497

Post by jtchang »

ggggtez wrote: post #70
jtchang wrote: post #19

Just like the mob there are some targets that just aren't worth it because they bring too much heat. They are learning this is bad for business all around so they are stepping back and encouraging others to do the same.

This is it. Governments have cyber abilities that far outstrip individual organizations. And when cyber fails, there are still other diplomatic and less diplomatic tools. I wouldn't be surprised if the US Government here reached out to foreign governments for assistance in dismantling their infrastructure (it almost certainly was not on US soil). An individual hospital probably couldn't garner that kind of backing, b…

Exactly. Also not sure why everyone says Bitcoin is anonymous. It's as anonymous as how deep someone is willing to spend to uncover your address. If we are talking multiple nation states who are interested in tracking you down you are pretty much screwed.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#498

Post by mhluongo »

suifbwish wrote: post #492
wongarsu wrote: post #404

Earlier quoted context omitted.

Just causing terror doesn't make it terrorism. Causing terror as a means to further some political (or religious) goal would make it terrorism.

Money is pure politics. The attacker becoming rich can legally be considered a political goal as the nature of money is political. If they endanger an entity or someone else’s resources to gain that political goal they are guilty of terrorism as they used fear to enact political change.

The mental gymnastics here are incredible.

I'm a frequent "everything is political" commenter myself, but since when is naked self interest through theft a political action?

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#499

Post by meowface »

knolan wrote: post #397
jmkni wrote: post #349

Earlier quoted context omitted.

I actually laughed out loud reading this, These guys are giving ransomware a bad name , ahahaha, what?!

I read it as more of a “they’ve ruined it for the rest of us” whinge.

Exactly.

It's maybe a tiny bit like SWATing before the police shot and killed one of the victims. Before, SWATers rationalized it as a prank, generally. (Of course, in reality it always was a potentially murderous prank, as most people recognized.) Once someone was killed and the SWATer was arrested and sentenced to life in prison, they got a wake-up call to the magnitude and potential consequences of their actions.

Unfortunately, in this case the ransomers will probably rarely ever face any repercussions (as long as they never travel internationally), since they live under a government that shields and permits their activities as long as the victims are far away.

They might risk getting hacked, like what ostensibly happened here, though this could easily also just be a cover story for them to disappear (and maybe retire for good) so the heat can die down. Could indeed potentially be a legitimate breach by a government or vigilante or rival though, though, due to how much this story blew up.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#500

Post by meowface »

jtchang wrote: post #497
ggggtez wrote: post #70

Earlier quoted context omitted.

This is it. Governments have cyber abilities that far outstrip individual organizations. And when cyber fails, there are still other diplomatic and less diplomatic tools. I wouldn't be surprised if the US Government here reached out to foreign governments for assistance in dismantling their infrastructure (it almost certainly was not on US soil). An individual hospital probably couldn't garner that kind of backing, b…

Exactly. Also not sure why everyone says Bitcoin is anonymous. It's as anonymous as how deep someone is willing to spend to uncover your address. If we are talking multiple nation states who are interested in tracking you down you are pretty much screwed.

The problem is the US doesn't have any jurisdiction over Russia, and the Russian government turns a blind eye to these activities (and sometimes works with certain cybercriminals) as long as Russian citizens aren't victimized. Not only will they not extradite, they won't do anything at all to address it. So another government would have to resort to extralegal methods like what ostensibly happened in this case, if it isn't a smokescreen. (I think either scenario is plausible.)

(This isn't some anti-Russian screed or anything; this is just one particular point where the Russian government is IMO behaving improperly. I could elaborate if needed.)

Post reply on HN