Seems like no one fell for this though. https://www.blockchain.com/btc/address/1ES14c7qLb5CYhLMUekct...
Probably a unique wallet in each message. It seems to be that way in scam email ransoms.
Git ransom campaign incident report
41–50 of 76 posts
Re: Git ransom campaign incident report
#421. Stop using 'git add .' This is a bad habit I see people keep suggesting to new git users. Stop recommending it and stop doing it. 2. Never store your password in .git/config. Why are you doing that? That shouldn't be stored in .git/config.
Maybe I misunderstood something, but I read the text as people (or .. services like the three doing the announcement) offering URLs containing an access token?
As in https://example.com/mlindner/project1/821372asd1786d21das or something?
If you use this approach to manage access to a repository, then .. that gets stored in the .git/config. No need to store a password or something.
(Then again, maybe I didn't understand the explanation correctly?)
Re: Git ransom campaign incident report
#43Earlier quoted context omitted.
”the whole cryptolocking business model falls down if the attacker isn't at least moderately honest” Nitpick: it only requires most attackers to be somewhat honest. Having a few unscrupulous ones may make life harder for the “honest” ones, but they themselves can be better of, e.g. by, after receiving payment, demanding more money.
Is it more unethical to release an "honest cryptolocker" or one that lies and never gives the files, degrading the trust the entire cryptolocker grift relies on?
It's pretty obvious that it's worse to be an actual criminal, than someone who goes around and pretends to be one.
In the same way that it's worse to shoot someone with an actual gun than to threaten to shoot them with a Nerf gun.
The negative network effects on other scammers are also nice.
Re: Git ransom campaign incident report
#44Earlier quoted context omitted.
An ssh key is 2FA
How so? An SSH key is a single factor. You could argue that a password-protected private key provides a second factor, but that still falls in the category of "something you know."
A TOTP challenge is also "something you know", which is a really large portion of total "2FA".
Re: Git ransom campaign incident report
#45Earlier quoted context omitted.
How many people can recite their SSH key? Surely an SSH key is "something you have".
Having two different static passwords on an account isn't actually two different factors, whether you can recite them or not. The fact that one time passwords expire and change is what makes them a different factor than a static password.
> The fact that one time passwords expire and change is what makes them a different factor than a static password.
If you're getting your 2FA code by SMS message or the like, this can be true.
If you're using TOTP (e.g. Google Authenticator), that's just as static as your other passwords. The TOTP code never expires nor changes. What changes is the code you're supposed to send over the wire.
Re: Git ransom campaign incident report
#46How does one withdraw bitcoin to fiat or even use it without it being traceable? Are there laundering or anonymizing services for bitcoin withdrawals to fiat?
Re: Git ransom campaign incident report
#47Earlier quoted context omitted.
Is it more unethical to release an "honest cryptolocker" or one that lies and never gives the files, degrading the trust the entire cryptolocker grift relies on?
It's pretty obvious that it's worse to be an actual criminal, than someone who goes around and pretends to be one. In the same way that it's worse to shoot someone with an actual gun than to threaten to shoot them with a Nerf gun. The negative network effects on other scammers are also nice.
In this case both are actual criminals but one returns your data after payment while the other doesn't
Re: Git ransom campaign incident report
#48> Otherwise, you can still clone the repository and make use of: git reflog or git fsck to find your last commit and change the HEAD.
I don't understand: when I clone a repo, I get a copy of all the branches/tags and the commits they point to & the trees/blobs from those commits. If the repo is wiped, I get a single master branch with a single commit with a single tree and a single blob, and no reflog because that is local to the repo, and I (as a fresh cloner) haven't updated any refs.
Perhaps they are thinking about a mirror clone? That still won't include the reflog, but you can at least find dangling commits and guess which one was master.
Re: Git ransom campaign incident report
#49Earlier quoted context omitted.
It's pretty obvious that it's worse to be an actual criminal, than someone who goes around and pretends to be one. In the same way that it's worse to shoot someone with an actual gun than to threaten to shoot them with a Nerf gun. The negative network effects on other scammers are also nice.
In this case both are actual criminals but one returns your data after payment while the other doesn't
[deleted]
Re: Git ransom campaign incident report
#50How does one withdraw bitcoin to fiat or even use it without it being traceable? Are there laundering or anonymizing services for bitcoin withdrawals to fiat?
AFAIK there have been bitcoin laundering services for years (bitcoin in, bitcoin out).
As for spending, there used to be pre-loaded credit cards that you could from bitcoin.