Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DarkSide ransomware gang quits after servers, Bitcoin stash seized

krebsonsecurity.com

Post reply on HN
Print view View original

551–560 of 623 posts

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#551

Post by rishabhd »

Too much attention and too brazen attack tactics. XSS shut down ransomware discussion and ransomware groups are having a market correction moment as of now. Shutting funds was easier, probably Kremlin asked gents at whitebit to hand off things before anyone loses fingers. Ultimately, this would simply mean that the targets would be carefully chosen, affiliates screened and new ransomware would be announced in coming months (or weeks even) which would target enterprise/ businesses.

Key lesson as summed up beautifully by an old timer in our team "You don't mess with big oil."

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#552

Post by WrtCdEvrydy »

manigandham wrote: post #543
WrtCdEvrydy wrote: post #104

Earlier quoted context omitted.

> seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. This is a business that actually provides better support than a regular business. From conversations with friends in the Infragard side of this, and the agencies that collaborate, they have 24/7 English support available before and after payment, as well as decryption remote support if you can't get…

That's not support. You're not a customer. They're not providing any value. This isn't some glorified version of business, it's just organized crime. They're available for their interests, not yours. They're actively robbing you and will be highly available to keep things moving efficiently, the same way physical bank robbers used to make sure staff were comfortable enough to open the safe and provide cover.

Of course I am... if I'm paying 5 million dollars to someone, I'm a customer.

What level of support do you get for a 5 million dollar AWS budget?

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#553

Post by dannyw »

duxup wrote: post #362
21eleven wrote: post #254

Earlier quoted context omitted.

Or one of the members of the criminal gang ran off with all the cryptocurrency and then made a public post claiming some form of law enforcement seized the crypto.

They seem to be trying to operate under new rules. That's not what you do if you just stole everyone's money / should run...

It's exactly what you do to give yourself plausible deniablility. You have to play the part.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#554

Post by dannyw »

gameswithgo wrote: post #457
robocat wrote: post #396

Earlier quoted context omitted.

Also perhaps a fair reason for some part of taxation. Owning millions in .*coin, and the ability to freely wander around in a first world country while not getting hit with a wrench has a whole lot of value.

Indeed, something I've tried to communicate to wealthy friends and family is that a higher tax rate,used halfway effectively, means you don't have to live in a gated community, in fear. You can roll around in your Ferrari, live where you want, and be reasonably safe.

And a better economy means your stocks and business ventures will do better.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#555

Post by dannyw »

almost_usual wrote: post #310
ur-whale wrote: post #308

Earlier quoted context omitted.

While I tend to agree with your argument, there is a difference: crypto is safe if no one knows it exists, or rather no one can link ownership to owner. It's very hard to do this with gold.

So you accrue wealth and can never use it. What’s the point?

Plenty of ways to use crypto wealth. It isn't that hard hard go from accessing Tor on a public WiFi, to say cashing out $100k in physical cash.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#556

Post by dannyw »

TacticalCoder wrote: post #412
RandallBrown wrote: post #248

Earlier quoted context omitted.

If you store your coins on a hard drive there's nothing the government can do to get them right? They would need your private key and your hard drive?

> They would need your private key and your hard drive? Most people serious about cryptocurrencies do not trust computers/harddrives anymore since years. They use "hardware wallets", which are HSMs with a very small attack surface. It's not impossible that hacks happen but there's a gap so wide between "a Windows 10 computer running some Bitcoin software wallet" and "a Ledger Nano S" hardware wallet that it's basical…

Note that hardware wallet attacks tend to get published at least once per year, but so far most/all of them have relied on physical access. Not just sending some buffer overflow via the USB link, but actually opening up the device and messing with capacitors or something.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#557

Post by dannyw »

JumpCrisscross wrote: post #517
this_user wrote: post #245

Earlier quoted context omitted.

The fact that their coins were apparently easily stolen also debunks another favourite talking point of the crypto people that it secures your money from government access. Clearly, ways and means have been developed to do just that if necessary.

> another favourite talking point of the crypto people that it secures your money from government access Credibly threatening repeated 51% attacks against Bitcoin is well within any G7 member’s budget.

Actually this ignores the fact that bitcoin uses ASICs now, and every ASIC built for bitcoin hashing is probably already hashing.

Semiconductor production can't be scaled up instantly, so 51% attacks require seizure of assets.

Even if the USA purchased every single CPU, GPU, FPGA, and ASIC made in the next month, it's unlikely they will have more than 10% of the network or so.

To seize the majority of the hashpower, they'd have to seize Chinese miners, which require either US-China cooperation or a world war.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#558

Post by dannyw »

simias wrote: post #320
ur-whale wrote: post #303

Earlier quoted context omitted.

No. It just demonstrates that they're incompetent.

This doesn't really improve the optics. If anything it makes it worse: if very technical people who clearly want to escape government oversight can't, what hope would my 60yo "I think Windows and Word are the same thing" father have to use them correctly? Beyond all the technical discussion about the value of cryptocurrencies I never believed that the idea that everybody would carry their cryptocurrency wallet with t…

Banks are fine if they're optional. The sheer option of being your own bank, forces banks to be more competitive.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#559

Post by dannyw »

asperous wrote: post #234
rini17 wrote: post #204

Earlier quoted context omitted.

It was a mistake to attack overtly . I believe $5 million can be easily drained covertly and inconspicuously from megacorporations. I'm pretty sure it's actually happening we just don't hear about it.

There’s a huge network of financial controls to prevent and detect this sort of thing, it’s one of the foundations of the fields of accounting. Often there are departments looking for fraud regularly. I suspect small or medium organizations rather then megacorps would be easier targets if they haven’t invested money in accounting controls.

A $5m covert negotiation with the USG has a decent chance of securing the desired payout.

Plenty, if not all, corporate level financial controls will be bypassed by the executive branch showing up in suits.

Re: DarkSide ransomware gang quits after servers, Bitcoin stash seized

#560

Post by dannyw »

WrtCdEvrydy wrote: post #104
g_p wrote: post #43

> The REvil representative said its program was introducing new restrictions on the kinds of organizations that affiliates could hold for ransom, and that henceforth it would be forbidden to attack those in the “social sector” (defined as healthcare and educational institutions) and organizations in the “gov-sector” (state) of any country. Affiliates also will be required to get approval before infecting victims. Sta…

> seem to point to ransomware activities being far more coordinated and "business-like" than they often get credit for. This is a business that actually provides better support than a regular business. From conversations with friends in the Infragard side of this, and the agencies that collaborate, they have 24/7 English support available before and after payment, as well as decryption remote support if you can't get…

Yeah. If you're dealing with a ransomware org with a reputation, you can pretty much be assured you're getting your files back minutes after paying, or a refund and apology.
Post reply on HN