News for hackers. Stuff that matters.
Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by judge2020 on Wednesday December 05, 2018 @09:37AM (#18608510)
Since WeChat is a central authority, it would be foolish to ask for payment to the ransomware author's actual WeChat ID. It's very likely whatever ID they're asking for payments to is automatically generated/pulled/guess/etc so that the ransomeware's only purpose is to cause havoc and/or waste the government's time. If the ransomware was created to earn money it would ask for cryptocurrency like all the others, but then it wouldn't have made as many headlines.
Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by zero_iq on Wednesday December 05, 2018 @09:58AM (#18608704)
Alternative possibility: given the simple, traceable, almost begging-to-be-caught nature of the malware, and that it so easily led researchers to a name and address of a potential author, perhaps its goal is actually to frame someone... to take out a rival hacker, revenge, lulz, ...?

Not saying it's what's actually happening here, but it's something that has crossed my mind before about malware - that it would be comparatively easy to lead one or more false trails to shift blame for whatever reason, and I wonder how many pieces of malware have actually managed to pull this off, and pinned the blame on an obvious target, e.g. Chinese government, "russian hackers", etc.

Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by balabaster on Wednesday December 05, 2018 @11:15AM (#18609569)
What's to say the Chinese Government didn't infect the machines and use it to pin the blame on someone they wanted neutralized?
Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by nindalf on Wednesday December 05, 2018 @11:24AM (#18609674)
Because they don't justification to take someone down. If the Party could take down high ranking Party members like Bo Xilai or massively popular celebs like Fan Bingbing or foreign citizens like that Swedish publisher or a group of people like the million Uighurs, they hardly need an elaborate scheme like this to take someone into custody.

You're overthinking it.

Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by balabaster on Wednesday December 05, 2018 @11:48AM (#18609953)
I guess it depends on the image they want to project and the message they want to send. Sometimes there is a political end to a Government's posturing. Sometimes it's more than the end they're looking for, sometimes they need to set the scene first to control the narrative in a way that sells the story they want for their own political gain.
Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by TallGuyShort on Wednesday December 05, 2018 @11:51AM (#18610000)
It's the game of wits from Princess Bride. They might want to take someone out, so you can't choose the wine in front of you. But, they must know you know that, so you can't choose the wine in front of them. But they may be trying to protect their image, and if so, you can't choose the wine in front of them either.
Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by cf141q5325 on Wednesday December 05, 2018 @11:49AM (#18609977)
I heard recently about the degree of rivalry between Chinese Hacker groups and how some get rid of competition by framing them for attacks. Which is absolutely brutal if you remember some hacking offenses face the death penalty.
Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by tomc1985 on Wednesday December 05, 2018 @11:36AM (#18609822)
That, or the creator is just stupid

Reads to me like someone writing viruses that doesn't know a thing about writing viruses

Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by autokad on Wednesday December 05, 2018 @01:45PM (#18611157)
> "Reads to me like someone writing viruses that doesn't know a thing about writing viruses"

someone who infected 100,000 machines knows at least 'a thing' about writing viruses

Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by tomc1985 on Thursday December 06, 2018 @12:10AM (#18615594)
I mean yes, it is a remarkable technical achievement.

To use the analogy of an art thief, this is as if he had simply smashed some glass and made a run for it, without dealing with security systems and whatnot. He might make it out the door, but now the museum has him on video, they have his fingerprints, and they're probably going to get the stolen art back.

Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by TomMarius on Wednesday December 05, 2018 @12:40PM (#18610506)
A person capable of writing even a simple virus is not an idiot. How can you live in China and not be aware how these things work?
Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by jjoonathan on Wednesday December 05, 2018 @10:13AM (#18608869)
Why not just use mules (if that's the right term)?

The world has no shortage of desperate people who will jump at the chance to earn a few bucks "working from home," where they help "hardworking businessmen between banks" move money. Perhaps the excuse is different and culture-specific, but peoples' inclination to look the other way when they think it benefits them is universal.

Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by dec0dedab0de on Wednesday December 05, 2018 @09:42AM (#18608553)
It's very likely whatever ID they're asking for payments to is automatically generated/pulled/guess/etc

If that's true then it's kind of like the robin hood of malware.

Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by jobigoud on Wednesday December 05, 2018 @10:58AM (#18609398)
Twist: use the previous victim as a recipient for the payment.

This would create an interesting spread incentive for the attack: once you are infected and you pay, you can still be reimbursed if you manage to infect someone else. You could even make this into a pyramid where several person's payment go to a parent carrier, and people will even want to be infected quickly to be closer to the top of the pyramid.

Or just use a random previous victim id. Now it becomes a viral non-consensual lottery and you benefit from spreading it.

Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by NedIsakoff on Wednesday December 05, 2018 @10:18AM (#18608924)
You can't just signup for a WeChat ID right now. As of late 2017, when you signup for a WeChat ID it shows you a sign-up QR code. Someone who is a verified WeChat user (someone with WeChat Pay which has RealID) must scan and verify you before you are allowed.
Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by danesparza on Wednesday December 05, 2018 @10:18AM (#18608918)
Why not have the real WeChat ID hidden among randomly generated 'noise' WeChat ID's? Then the real attacker could get paid and still have plausible deniability.

This criminal mind is going to get me in trouble some day...

Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by astrodust on Wednesday December 05, 2018 @11:41AM (#18609863)
It's not hard to steal money. It's hard to get away with it.

Part of the difficulty is fighting greed, as the people that get caught are the ones that push their luck way too far. They're often wildly successful at first with more cautious approaches, but as they get more brazen they end up getting busted.

Re:Ransomware Infects 100K PCs in China, Demands WeChat Payment by itake on Wednesday December 05, 2018 @09:51AM (#18608643)
I think you make sense, but the hacker may control some percentage of the "lucky" account holders.