Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

justice.gov

Post reply on HN
Print view View original

241–250 of 296 posts

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#241

Post by avhwl »

mrkramer wrote: post #232
blhack wrote: post #150

I think that the people here speculating about the FBI and private keys are greatly overestimating the competency of these hackers. While it's possible this it he FBI flexing some muscle that they have a backdoor into bitcoin's hashing algorithm, what seems much more likely (to me) is: There is a more sophisticated hacking group which created this particular ransomware package. They sell this ransomware package to le…

They seized private key and if it was encrypted/hashed they cracked it. It could've Bitcoin brain wallet and they cracked the actual ASCII password of the wallet.

If the private key was hashed, and they only had the hash, then they could not crack it. Hashing is not the same as encryption.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#242

Post by Ekaros »

majormajor wrote: post #51
SavantIdiot wrote: post #31

Earlier quoted context omitted.

"Script kiddies" got their name because 20 years ago any kid could download some code and create a DDoS attack by running a pre-written script. Ransomware hacks seem a bit more sophisticated, even with today's highly modular malware. I think it is an interesting proposal: a fake attack as shown by the disparity in savvy between the attack and the payment, or a really dumb screw up. EDIT: as "koheripbal" says below, m…

There's been some reporting of basically a new version of that for the modern "as a service" times, like here https://www.zdnet.com/article/darkside-the-ransomware-group-... > According to FireEye, affiliates are required to pay up to 25% of ransom payments under $500,000, and 10% of any successful extortion attempts over $5 million. So the ransomware authors might not always be the people collecting the initial paym…

Question really becomes where did that group get the software from? It could be multiple levels of indirection such as people hired to develop the stuff aren't really connected to activities. They might just as well be contractors not so well paid...

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#243

Post by avhwl »

galaxyLogic wrote: post #216

Can someone explain simply why it is supposed to be so hard to track ransomware bitcoin payments, if all bitcoin transactions are in a shared public ledger? If the victim pays someone we know which account it goes to, right? Then we know that account is criminal. If bitcoins move from that account to other accounts we know that accounts that receive them are essentially "hiding stolen goods". So they are criminal acc…

>Can someone explain simply why it is supposed to be so hard to track ransomware bitcoin payments, if all bitcoin transactions are in a shared public ledger?

Clearly, it's not. This is a pervasive misconception. Bitcoin is not, and is not even meant to be, private. Even with obfuscation attempts, nearly every ransomware gang has their bitcoin payments fully tracked, as this one did. There is a robust industry of blockchain analytics that pulls in many many millions each year surveilling the bitcoin blockchain. Virtually all exchanges (fiat on and off ramps) collaborate with those analytics companies and require full KYC/AML of their customers, and can thus apply their KYC label data to blockchain metadata.

Bitcoin is not account based: it is based on unspent transaction output sets. UTXOs can be combined with many other UTXOs, combined into one, or split into many. This leaves a large amount of potential for obfuscation strategies such as CoinJoin[^1]. Nearly all of these gangs attempt to use CoinJoin or similar but make small mistakes such as being representative of a large amount of the volume, leaking information through timing, combining their outputs into one, or countless other potential errors, and often a simple "FIFO" strategy can trace flows. Obfuscation is not a robust anonymity strategy, and pseudonymity is not anonymity. To quote Vitalik Buterin, "If your privacy model has a medium anonymity set, it really has a small anonymity set. If your privacy model has a small anonymity set, it has an anonymity set of 1. Only global anonymity sets (eg. as done with ZK-SNARKs) are truly robustly secure."[^2]

[^1]: https://en.bitcoin.it/wiki/CoinJoin [^2]: https://twitter.com/vitalikbuterin/status/119646811199575654...

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#244

Post by john37386 »

paulpauper wrote: post #74

I am guessing that the key pair generation process was faulty. The FBI found an exploit in a wallet used by the hackers allowing the private key to be predicted. The prefix is bc1,which is uncommon. A few weeks ago there was such a vulnerability with Cake Wallet. Or they installed malware on the hacker's computers and were able to log the private key as it was generated. Or the hackers foolishly stored the key pairs…

bc1 is for bech32 addresses. A feature of the new segwit. Aparently there is a way to predict the private key derived from using multiple times the bc1 address. Details are available here: https://sudonull.com/post/8212-Bitcoin-Pseudo-Random-Number-...

Could it be that bech32 is less secure than thought?

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#245

Post by stef25 »

PeterisP wrote: post #230
jlgaddis wrote: post #176

Earlier quoted context omitted.

Yes, but... if you're in Russia, my understanding is that you really don't have too much to worry about, so long as you only go after targets outside of Russia.

And as long as you're happy with never going outside Russia yourself - I seem to recall a situation some years ago where one culprit was offered a good tech job in the west, and was arrested when arriving at the airport for some scam they did many years ago.

A whole bunch of them have been arrested in or on their way to Dubai, Thailand, Maldives etc.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#246

Post by mrkramer »

avhwl wrote: post #241
mrkramer wrote: post #232

Earlier quoted context omitted.

They seized private key and if it was encrypted/hashed they cracked it. It could've Bitcoin brain wallet and they cracked the actual ASCII password of the wallet.

If the private key was hashed, and they only had the hash, then they could not crack it. Hashing is not the same as encryption.

Hashing is for ensuring data integrity and encryption is for protection of data and information I know it but I meant hashing bitcoin private key with some hashing algorithm in order to conceal it.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#247

Post by 7dare »

galaxyLogic wrote: post #215
onetimemanytime wrote: post #204

Earlier quoted context omitted.

They might be saving for bigger things, however this is a lot more than $3million. It's about holding the US economy hostage, as these will increase in frequency.

Indeed, stopping large-scale oil pipelines means US economy is held hostage, to a degree. Not all of it but some of it. Question is will it increase or not. This FBI action gives us some hope that criminals can be stopped.

Can be stopped? Doesn't sound like this is what happened here, the company paying the ransom is what stopped the hostage. The FBI simply recovered the ransom (and some more), but probably can't cover for the economic damage from the hold-up.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#248

Post by trhway »

>As alleged in the supporting affidavit, by reviewing the Bitcoin public ledger, law enforcement was able to track multiple transfers of bitcoin and identify that approximately 63.7 bitcoins, representing the proceeds of the victim’s ransom payment, had been transferred to a specific address

does it mean that "tainted" BTC can be seized any time, even if the current holder may have no relation to the original crime?

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#249

Post by mrkramer »

avhwl wrote: post #241
mrkramer wrote: post #232

Earlier quoted context omitted.

They seized private key and if it was encrypted/hashed they cracked it. It could've Bitcoin brain wallet and they cracked the actual ASCII password of the wallet.

If the private key was hashed, and they only had the hash, then they could not crack it. Hashing is not the same as encryption.

Second reply: I saw that you work in applied cryptography and blockchain technology @ Cryptography Services (NCC Group) so you might be familiar with somewhat Grey Hat russian forum InsidePro; back in the day I saw people there requesting Bitcoin private key recovery for their lost private keys or if they encrypted and/or hashed wallet private keys and couldn't recover plaintext anymore and I can say that amateur crackers could recover private keys pretty efficiently and I can only wonder what professional law enforcement agency can do.

If FBI could crack smartphone encryption/protection from multi trillion dollar company I'm speaking about Apple and that terrorist's Iphone then they do pretty much anything.

Re: DOJ seizes $2.3M in cryptocurrency paid to the ransomware extortionists Darkside

#250

Post by Wheaties466 »

walrus01 wrote: post #8

The most interesting and unknown question is how the DOJ/FBI came to be in possession of the private key.

I don't understand why so many people are jumping to the conclusion that the FBI broke sha-256.

Theres so many other lower hanging fruit posibilities...

1: they served the server provider with a warrant they provided physical access. 2: their server infra was running vulnerable code for another service. 3. weak passwords / weak security in general 4. they cut a deal with the upstream ransomware providers and were provided with the private key used.

Post reply on HN