Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German police name alleged leaders of GandCrab and REvil ransomware groups

krebsonsecurity.com

Post reply on HN
Print view View original

161–170 of 175 posts

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#161

Post by mschild »

mulmen wrote: post #79
mschild wrote: post #54

Earlier quoted context omitted.

"Doxing" has negative connotations. Its almost always associated with a private person (ie not police or anyone of a judicial system) releasing personal information with malicious intent. As the person above you said, semantics are important. This is a judicial system specifically searching for a person they believe to have caused severe criminal harm.

While I don’t think this case is accurately described as Doxxing I also reject the definition that the state can’t commit Doxxing. The reason this situation doesn’t count is because of due process, not simply state action. The state is not infallible, regardless of what immunity may try to establish.

That's a fair point and I agree with you on both counts.

As you said, in this particular case, the respective judicial entities purposefully released the personal information with the intent of arresting both. Whether that is successful or not remains to be seen but that's a different story.

For me personally, I understand doxing to be the release of personal information with malicious, indirect intent. For example, hoping that an angry mob will find the home of a person and attack them, send the person death threats through the post, etc.

Assuming a decently functional justice system, I don't consider an arrest warrant a malicious intent.

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#162

Post by Vespasian »

groby_b wrote: post #121
foepys wrote: post #99

Earlier quoted context omitted.

It also has something to do with the so called "Hackerparagraph" [1] under which whitehat hacking is basically impossible in Germany. Even writing a program that could potentially be used for hacking is a crime. If you followed the law word for word the authors of e.g. curl could be charged under this law. 1: https://de.wikipedia.org/wiki/Vorbereiten_des_Aussp%C3%A4hen... [de]

> If you followed the law word for word the authors of e.g. curl could be charged under this law. They really couldn't. BVerfG (Germany's constitutional court) has clearly said that dual use tools have a presumption of not being tools to break the law. It's been very clear that mens rea matters. And that a narrow reading of the law is the only constitutional reading. The problem here is taking "word for word" as "by…

> The problem here is taking "word for word" as "by dictionary meaning", which is never how laws are read.

Back in the days of "smart contracts" and "DAOS" this was something many well-meaning technical people struggeled with. Humans and their societies are flexible and therefore laws must be flexible as well (to a certain degree before it becomes damaging).

It's also why a lawyer/expert is usually recommended when engaged with legal matters: We as layman lack all the context around seemingly "simple" concepts, procedures and definitions. You can learn all of that or hire a professional.

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#163

Post by fwn »

mikkupikku wrote: post #105
a2800276 wrote: post #94

Earlier quoted context omitted.

More to the point, if the police or whoever shoot someone in self defence, that someone is "killed". If I, or the police shoot someone for fun, it's "murder". In both cases the victim is "killed"

True, self defense isn't called murder. But if the government drone strikes an American citizen without a trial or anything, that's "extrajudicial killing", not murder.

Murder is a universal concept. There are also varying criminal laws that are called murder, but just because these exist, one must not be thrown off track: the moral, pre-legal concept of an act known as murder remains unaffected.

'Extrajudicial killing' is just an apologetic euphemism. An indirect term, since murder is usually considered to be a bad thing.

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#164

Post by krono »

Barrin92 wrote: post #106
krono wrote: post #73

Earlier quoted context omitted.

So it is doxxing if the doxxed committed wrongdoings from the perspective of... the doxxer? Ideals, morality, alignment, goals and purpose are and have always been a static constant for all humankind. There is no pineapple pizza, it is a lie, for I don't like it, and therefore nobody else ever did either.

doxxing is a term that is commonly reserved for private information that the doxxed individual has an expectation to be treated as such, that is to say, it's not in the public interest. Someone who breaks the law and is actively searched for obviously has no expectation of privacy, or do you think the people visiting Epstein's island were doxxed?

I know, that's exactly the point I'm trying to make.

Yesterday I drank a beer out in public - a perfectly legal and culturally/morally acceptable thing to do here in The Netherlands, but deemed wrong to such a degree that it is apparently punishable by death in Iran[1].

I have actively broken Iran's moral stance, societal norms, and laws/jurisprudence against public alcohol consumption from without their jurisdiction, and as being a person unbeholden to their societal norms in any way, shape, or form.

Do I obviously now have no expectation of privacy? Is it now okay for these peoples finding themselves to grievously offended by my actions to collect and publish my private data with damaging intent? Is it then doxxing? Am I really a bad person now? Or maybe it depends on the color of your glasses, maybe there exists an entire world outside of ones own cocoon?

[1]: https://www.hrw.org/news/2012/06/29/iran-quash-death-sentenc...

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#165

Post by Pfeil »

jojomodding wrote: post #53

So apparently some CCC-connected hackers already unmasked one of them years ago (as reported in the update, which could have also just linked to the talk here: https://media.ccc.de/v/37c3-12134-hirne_hacken_hackback_edit... ) Makes you wonder if the investigators discovered this independently, or decided to maybe ask the hackers already involved in defending against them for help...

Linus Neumann himself was also wondering in this recent german podcast episode why this is happening now. https://logbuch-netzpolitik.de/lnp550-wes-brot-ich-ess-des-l...

Apparently they had not been contacted.

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#167

Post by pjc50 »

lukan wrote: post #155
edm0nd wrote: post #137

Earlier quoted context omitted.

>but AFAIK there generally isn't a warm connection between the CCC and the BND nor should there be. Similar to how us American hackers have a huge dislike and distrust of the FBI. Your own law enforcement agency will lie to you, manipulate you, raid you, extort you, and imprison you over bullshit.

"Your own law enforcement agency will lie to you, manipulate you, raid you, extort you, and imprison you over bullshit." But this is not, how it should be. And not all law enforcement agencies are like this.

It's very difficult to stop them doing this. The extent to which it happens varies a lot, and some countries and places have a much worse problem than others, but fundamentally if you "cause trouble" to "respectable people and companies" you're going to get hassled by law enforcement. Yes, the sarcasm quotes are important.

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#168

Post by ffsm8 »

lovich wrote: post #110
ffsm8 wrote: post #101

Earlier quoted context omitted.

It's just the usual millennials and zoomers finding out that their fantasies aren't actually how the world works Most of us grew up on the Internet, and consequently our world view is incredibly screwed and not particularly based on facts

I grew up on the internet but early enough that the phrase “the internet isn’t real life” was bandied about, which I think made it easier to understand the different set of rules existing.

Isn't that belief the source of the issue?

The Internet is real life, that's why the judicial documents will cite the real names of the people, wherever they want to or not.

There aren't different sets of rules, the real lifea rules apply everywhere. You may just also have additional conventions some people may follow online, too. Entirely optional and liable to go out the window as soon as there is a conflict

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#169

Post by DFHippie »

Computer0 wrote: post #141
DFHippie wrote: post #130

Earlier quoted context omitted.

If a business is destroyed by ransomware, all its employees lose their jobs. The business's customers lose the services the business was providing. The families supported by these jobs are now all at risk. All that money goes somewhere. Much of it goes towards clothing, feeding, and housing people. Also, in most places it's a crime to rob anyone, even selfish assholes.

What if it is of my belief that businesses should not exist, and a job should not be a requirement for basic needs.

That seems beside the point. The ransomware extortionists aren't doing a utilitarian calculation and transferring funds from Exxon to Oxfam. They're taking money where they can and using it to fund a lavish lifestyle and more extortion. In particular, they aren't channeling it towards transforming any society into one in which basic needs are met by something other than jobs and businesses of the familiar sort. The extortionists cause suffering. They parasitize other people's labor. Their acts have actual, identifiable victims. The escorts serving them Moët at their birthday parties funded by other people's suffering aren't doing it for fun, love, or charity. For the escorts, it's a job.

Re: German police name alleged leaders of GandCrab and REvil ransomware groups

#170

Post by throawayonthe »

Vespasian wrote: post #162
groby_b wrote: post #121

Earlier quoted context omitted.

> If you followed the law word for word the authors of e.g. curl could be charged under this law. They really couldn't. BVerfG (Germany's constitutional court) has clearly said that dual use tools have a presumption of not being tools to break the law. It's been very clear that mens rea matters. And that a narrow reading of the law is the only constitutional reading. The problem here is taking "word for word" as "by…

> The problem here is taking "word for word" as "by dictionary meaning", which is never how laws are read. Back in the days of "smart contracts" and "DAOS" this was something many well-meaning technical people struggeled with. Humans and their societies are flexible and therefore laws must be flexible as well (to a certain degree before it becomes damaging). It's also why a lawyer/expert is usually recommended when e…

What Colour are your bits?

https://ansuz.sooke.bc.ca/entry/23

Post reply on HN