Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

justice.gov

Post reply on HN
Print view View original

101–110 of 296 posts

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#101

Post by dragonwriter »

TZubiri wrote: post #95
ianhawes wrote: post #6

Earlier quoted context omitted.

Netsec Twitter's theory is that the attacker(s) had a VPS operating in the US that the FBI was able to access and which contained the key to the wallet where the final payment ended up.

The connections need to pass through the US just once in order to give the US a chance to attack it. Since they created the internet, they have field advantage. It's almost impossible not to use a US based provider, it goes as deep as ipv4 distribution.

> The connections need to pass through the US just once in order to give the US a chance to attack it.

Less than once if the US were, purely hypothetically, to have a well-funded foreign sigint operation that might cooperate with domestic law enforcement on priority issues.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#102

Post by blhack »

rejectedandsad wrote: post #82
koheripbal wrote: post #60

Earlier quoted context omitted.

Colonial paid 75 BTC, and they recovered 63.7 BTC.

I'm guessing the rest was fees/etc coming out of the crypto tumblers they used?

They didn't use any tumblers, that's how they got caught.

edit: it says so in the article:

As alleged in the supporting affidavit, by reviewing the Bitcoin public ledger, law enforcement was able to track multiple transfers of bitcoin and identify that approximately 63.7 bitcoins, representing the proceeds of the victim’s ransom payment, had been transferred to a specific address

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#103

Post by mnouquet »

vmception wrote: post #61
mortehu wrote: post #47

Earlier quoted context omitted.

This could have been far downstream from the hackers themselves. They might just have been monitoring the bitcoins and waiting for some to land in one of many addresses for which they have the private key. Presumably FBI is continuously scooping up whatever private keys they can.

Yeah Elliptic and Chainanalysis make all their money by convincing people that all transfers are of the same Ultimate Beneficial Owner until it hits an exchange As long as the ignorance stays high, they get government contracts

That's utter bs, exchanges generates unique BIP32 addresses for deposit. There isn't a master exchanges key used among all customers.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#104

Post by edgyquant »

shiftpgdn wrote: post #50
kibwen wrote: post #48

Earlier quoted context omitted.

"Save face" for whom? It wasn't the US gov who got hacked or paid the ransom, it was the Colonial Pipeline Company.

The US Judicial system which tries to flex its "unlimited" reach.

I don’t think it’s an understatement to say that their reach kind of is. If sanctioned the US government could almost certainly 51% attack any given crypto and redirect funds to whoever they want. This isn’t what happened but it’s laughable to think the US government isn’t capable of tracking down the account and seizing coins.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#105

Post by mnouquet »

paulpauper wrote: post #74

I am guessing that the key pair generation process was faulty. The FBI found an exploit in a wallet used by the hackers allowing the private key to be predicted. The prefix is bc1,which is uncommon. A few weeks ago there was such a vulnerability with Cake Wallet. Or they installed malware on the hacker's computers and were able to log the private key as it was generated. Or the hackers foolishly stored the key pairs…

Summary of your post: you have no idea what you are talking about.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#106

Post by russian-hacker »

shiado wrote: post #24

This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There nee…

Exactly. Until DOJ provides proof, this is pure FUD.

Anyone competent enough to extort a foreign company out of millions is not going to attempt to cash out through an exchange.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#107

Post by User23 »

staticassertion wrote: post #46
sneak wrote: post #41

Earlier quoted context omitted.

I think you are assigning too much “us vs them” to the ransomware marketplace. With ransomware criminals, “us” is the attacker, and “them” is everyone with a computer who might pay. Political boundaries don’t factor in to it at all. It is by nature an anonymous attack, hence the term “ransom”. It is strange to me that almost all high-profile ransomware attacks that have been publicized in the US are claimed by the FB…

When your government greenlights criminal activities against their enemies it helps a lot. Many* cyber criminals act as mercs for hire, and are in fact hired for official government operations against the US. It's simply not true that political boundaries don't factor in. They're a massive part - most obviously, consider extradition or whether the attacker's government will cooperate with the US. * I say many, but it…

I always thought it would be fun, if one had enough pull, to get a Letter of Marque and Reprisal issued to oneself snuck onto one of the giant omnibus bills that nobody in the Congress reads in its entirety before voting on it. It could easily be interpreted to cover cyberprivateering.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#108

Post by encryptluks2 »

nkrisc wrote: post #23
encryptluks2 wrote: post #7

LOL... I simply don't believe any of these press releases. For all we know, the government negotiated a deal with the cyber-attackers to create this press release as a way to try to thwart future attacks. Seriously wouldn't put it past them one bit.

Do you have a specific reason to not believe it?

Yes, the countless lawsuits and evidence that the government lies on a consistent basis, especially involving acts of national security. We can pretend the Iraq War never happened based on fake evidence.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#109

Post by brown9-2 »

russian-hacker wrote: post #106
shiado wrote: post #24

This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There nee…

Exactly. Until DOJ provides proof, this is pure FUD. Anyone competent enough to extort a foreign company out of millions is not going to attempt to cash out through an exchange.

Are you saying the government didn’t actually recover the money that they claim to have recovered?

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#110

Post by duskwuff »

h3cate wrote: post #76
yamrzou wrote: post #68

Earlier quoted context omitted.

I wondered the same thing, so I went looking for answers and found this excellent video by 3Blue1Brown: How secure is 256 bit security? : https://www.youtube.com/watch?v=S9JGmA5_unY

Really informative video but this is talking about hashing functions. Private keys are created differently using (some) shared information between the private and public keys. If there was one area I could see the us investing their time and effort since RSA came out it's here. Don't get me wrong, it would be out there if they could crack even one key but like I said, if anyone can it's them.

Bitcoin keys are ECDSA (secp256k1) keys. The same scheme is used in many other areas of computer security; it would be incredibly foolish for the NSA to reveal an exploit they're sitting on, even indirectly.
Post reply on HN