Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US travel firm $4.5M ransom negotiation open chat

twitter.com

Post reply on HN
Print view View original

161–170 of 480 posts

Re: US travel firm $4.5M ransom negotiation open chat

#161

Post by el_nahual »

shajznnckfke wrote: post #145
chrisseaton wrote: post #114

Earlier quoted context omitted.

Do you not tie yourself to your Bitcoin when you try to use it for something physical like turning it into cash or buying a physical asset? Can you not track all Bitcoins going in and out of a mixer?

When you use a mixer, there’s a delay between when you put your money in and when it comes back out. The mixing service randomly splits up the transaction into batches and sends them out at different times. So even if you know that somebody sent to a mixer (perhaps as an investigator you could find out mixer addresses by sending lots of transactions to the mixer service yourself), you wouldn’t be able to associate th…

Wouldn't using multiple mixers increase the risk? You only need to be traced once.

Re: US travel firm $4.5M ransom negotiation open chat

#162

Post by NotSammyHagar »

yyyk wrote: post #120
momokoko wrote: post #92

Let this be a lesson to those that say bitcoin and other cryptocurrency has no real value outside of speculation. This kind of attack would be almost impossible in the pre-bitcoin era. The difficulty of receiving that volume of money in that short of a period of time in a difficult to trace manner is a new thing. We are entering a new era where crime can pay in very large sums with orders of magnitude less complexity…

>Let this be a lesson to those that say bitcoin and other cryptocurrency has no real value outside of speculation. >This kind of attack would be almost impossible in the pre-bitcoin era.... Instead democratizing currency, we're democratizing large scale crime. Just wanted to make this same point - right now, cryptocurrency has negative value for society. Perhaps this is a justification for banning the current impleme…

We need to make laws in western countries that paying off these kinds of ransoms is illegal. It gives money to criminal elements and only encourages this. I also thought it would be possible for powerful law enforcement groups to follow the bitcoins even through exchanges. Why does this not run into the worldwide hunt for the perpetrators?

Re: US travel firm $4.5M ransom negotiation open chat

#163

Post by vdfs »

gruez wrote: post #158
jhgorrell wrote: post #146

Earlier quoted context omitted.

Kinda funny to see 1BTC sent to check it worked before they sent the rest. Cant undo it like a wire transfer...

But why 1 BTC? That's worth more than 10k. Surely they could have sent a fraction? Or maybe they didn't know bitcoins can be split?

10k out of 4.3m

Re: US travel firm $4.5M ransom negotiation open chat

#164

Post by gruez »

momokoko wrote: post #92

Let this be a lesson to those that say bitcoin and other cryptocurrency has no real value outside of speculation. This kind of attack would be almost impossible in the pre-bitcoin era. The difficulty of receiving that volume of money in that short of a period of time in a difficult to trace manner is a new thing. We are entering a new era where crime can pay in very large sums with orders of magnitude less complexity…

>This kind of attack would be almost impossible in the pre-bitcoin era.

Is it? VIPs are regularly held for ransom in unstable countries, so much so that ransom insurance is a thing[1]. If those ransoms can be safely received, why can't it be the case for ransomware ransoms?

[1] https://en.wikipedia.org/wiki/Kidnap_and_ransom_insurance

Re: US travel firm $4.5M ransom negotiation open chat

#166

Post by scrollaway »

ryan_j_naughton wrote: post #27
dannyw wrote: post #17

Earlier quoted context omitted.

To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. The money is funnelled to a criminal group, but what difference does it make? Some people consider the USG to be a criminal group; many people are out on the streets for that. My tax dollars directly go to corrupt crooks and nonexistent companies claimi…

> It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. That argument could be used to justify any theft or even kidnapping. I know many people who grew up in countries where kidnapping was a very real concern. Consequently, they had to adopt "greater security practices" and it had a very real, negative effect on their lives. There are real harms to ra…

Physical and digital security aren't the same thing. There's no such thing as "this website is in a bad internet neighbourhood and should take extra precautions".

I get where you're coming from but you can't really just flat out say "you can justify kidnapping with the same logic". Like, no, you can't. Fully agreed the government should be the ones playing the role of incentivizing security, but you can't then go back and say that security takes time and money those companies should not have to spend. They should, regardless of who keeps them accountable for it...

Re: US travel firm $4.5M ransom negotiation open chat

#167

Post by trianglem »

0x00000000 wrote: post #156
hellotomyrars wrote: post #40

While these stories are becoming all too common I’d like to think that while we’re in a golden age of being a ransomware payouts, it will lead to actually caring about security by many of the high-profile affected companies. While the overall cost may be low for them, if they don’t make meaningful changes to prevent these issues in the future, it’s not hard to imagine it might add up quickly. I don’t support these at…

Nothing will change until they make it a felony to pay a ransom.

Impossible. Some things are just worth more than any amount of money and punishing the victim will not change that.

Re: US travel firm $4.5M ransom negotiation open chat

#168

Post by ars »

smabie wrote: post #88
ars wrote: post #10

Earlier quoted context omitted.

The US needs to pass a Federal law making it personally (not just "corporately") illegal to pay ransom. That would stop them because it would kill the market. Historically it's how they stop kidnapping in countries where it's common. It REALLY sucks for the first few people after the law is passed, but after that things get better.

What countries are you talking about? Because kidnap insurance is still a moderate size business

https://www.nytimes.com/1998/02/01/world/italian-ban-on-payi...

Re: US travel firm $4.5M ransom negotiation open chat

#169

Post by chrisrogers »

eckza wrote: post #71
nradov wrote: post #45

Earlier quoted context omitted.

In general paying off kidnappers is also a bad policy. However I see a huge difference between protecting human lives versus protecting corporate assets.

What's the difference? Cut deeply enough - take out entire companies - and people lose their jobs. People can't eat. People lose their health insurance that allows them to afford their life-saving medication. At some point, it's not just "big corporations"; it's the people that work for them, too.

Job loss is not the equivalent of death. Full stop.

Re: US travel firm $4.5M ransom negotiation open chat

#170

Post by ars »

paulcole wrote: post #55
ars wrote: post #10

Earlier quoted context omitted.

The US needs to pass a Federal law making it personally (not just "corporately") illegal to pay ransom. That would stop them because it would kill the market. Historically it's how they stop kidnapping in countries where it's common. It REALLY sucks for the first few people after the law is passed, but after that things get better.

> Historically it's how they stop kidnapping in countries where it's common. It REALLY sucks for the first few people after the law is passed, but after that things get better. Is this based in reality? What countries have banned ransom payments for human kidnapping and what people did it “suck” for? My hunch is that if your spouse gets kidnapped and you have the means to get them back, you’ll risk it.

https://www.nytimes.com/1998/02/01/world/italian-ban-on-payi...

They are not the only ones, just the first I found on Google.

Post reply on HN