This is a business that actually provides better support than a regular business.

From conversations with friends in the Infragard side of this, and the agencies that collaborate, they have 24/7 English support available before and after payment, as well as decryption remote support if you can't get your files decrypted... there are also instances of refunds if they can't decrypt your files due to technical issues.

Unlike regular businesses, support is a sales channel since it's the way to ensure you get paid so a lot of resources go to support activities in these "organizations".

The thing I find fascinating from a sociology perspective about ransomware is that they have to. To be a successful ransomware company, you have to simultaneously be:

1. Completely immoral enough to attack companies, hold their data ransom and potentially put them out of business and reveal the private details of thousands of people.

2. Create enough trust in the company you attacked that they believe you will give the data back once you pay them.

It is crazy that they are psychologically savvy enough to simultaneously attain those directly conflicting goals.

step 1: "join my disruptor gang and we'll protect your lifestyle/income/status in exchange for tribute, or at least not becoming a disruptee yourself."

step 2: end up eventually recapitulating the exact same system you disrupted, but now you get all the spoils of the incumbent power

There's definitely a hierarchy to it. Any particular group may not necessarily develop or own the software or infrastructure they're using. You can probably liken it to drug markets, where there are some top-level central players and many tiers below that make up the whole supply and distribution chain. (And potentially, the absolute top-level / "The Commission" may be certain elements of certain nations' governments, in some cases, or at least closely associated with them, which further complicates matters.)

You might find this 2020 interview with a ransomware operator interesting: https://talos-intelligence-site.s3.amazonaws.com/production/...

Not much capital is needed though and the affiliate and licensing model is better, which also just means an address is hardcoded that splits payment, or a server controls the private key (or master private key for infinite unique address creation) to addresses and automatically splits received payments to the RaaS service

I get that was supposed to be a joke, its exactly the same or even more streamlined than the licit economy. There is no major distinction except the kinds of “risk factors” one might list.

I would like to hear more about this, that sounds kind of hilarious. "Ah, apologies, we'll get that back to you within 3 business days. Have a nice day, I hope you had backups"

I mostly dont do ransomware housecalls anymore, but my teammates tell me the situation has mostly not improved.

They're available for their interests, not yours. They're actively robbing you and will be highly available to keep things moving efficiently, the same way physical bank robbers used to make sure staff were comfortable enough to open the safe and provide cover.

What level of support do you get for a 5 million dollar AWS budget?

A customer willingly pays to get value in return. Having your resources stolen (even with the option to choose between data or money) just makes you a victim.

$5M on AWS gets you $5M of services. If they didn't have to actually provide anything then they could have an entire team to talk to you 24hrs a day. But these comparisons are beyond ridiculous and you know it.

$5M on ransomware may have saved you either $10k or $10M on security before you had to pay out.

Sadly my experience is that organisations like this will take their $5m ransom (or other remediation cost), assume it's a one-off, then divide it by their number of ransom-free years, and proclaim it was better value for money than hiring 2 or 3 senior security gurus on $300k /yr with 60 vacation days, and letting them bring in a team to deliver meaningful security.

Beyond taking security out of the hands of bean-counters though, I'm not sure how you address this. Pursuing organisations that pay ransoms and prosecuting senior CEO/CFO-type executives for conspiracy to commit money laundering (and pushing for criminal convictions) could discourage paying ransoms. If it's left to businesses as something they can write down as a "cost", I don't see it getting better - there has to be a risk to the liberty of the CEO/CFO before they'll take security seriously in my experience. 90 days in federal prison would certainly sharpen their focus in future.

It's a gamble. It's easy to point fingers at the company that was caught out, but for the hundreds or thousands that aren't ransomed and aren't paying the extra money for security, they took that gamble and so far they've come out ahead not having spent all that money on prevention.

I'm not advocating that these companies to have less security or not do better on security, but the fact is a lot of them have made the objectively correct decision for themselves, which will continue to be correct right up until they're hit, if they ever are. The whole situation is analogous to health insurance in a way, and the same incentives are at play, along with similar consequences for individual companies and all of us as a whole, as providing easy targets for these groups allows them to thrive and grow and target others.

The criminal penalties for executives in leadership and board positions (and I'm not saying this is my preferred approach) would certainly go a long way toward changing the calculus of this exchange.

One natural solution would be to subsidize cyberdefense. The political difficulty is that a rational subsidy would be proportional to the harm of an attack, which would mean giving the most money to the biggest corporations.

The best solution would be for the firm to raise their prices the very small amount necessary to cover the expense, and for consumers to tolerate the expense because they know it's worth it. But a pipeline is a natural monopoly, presumably charging a monopoly-optimal price that (correctly) assumes a populace ignorant of such concerns until it's too late.

If a business externalizes the cost, does it matter to them?

Civil penalties levied by regulators will drive the change that matters.

I mean, yes? Maybe not before next quarter's revenue statement, but eventually it will have to start to matter?

If your dog goes and craps in the yard every day, you eventually have to clean it up or you will get flies in the yard, and if you have to open the door or leave the house at all then sooner or later you will have flies in the house, it matters, yes. It's really not any more complicated than that.

If you are responsible for dumping toxic waste out the back door of your factory, it's only a matter of time before it's in your drinking water at your house, a couple of miles down the road. Externalizing a problem doesn't really get rid of it, just makes it someone else's problem (for now at least.) Those other people are real people, and they will find you.

> In an apparent industry first, the global insurance company AXA said Thursday it will stop writing cyber-insurance policies in France that reimburse customers for extortion payments made to ransomware criminals.

https://www.insurancejournal.com/news/international/2021/05/...

The outcome here shows that executives made the right call. The $5MM fee was easily paid, less than the costs of security, and the insurance company will probably cover it anyway. And the government/people were so outraged that the attackers were met with fucking swift justice.

The company will probably get some grants or something to cover the cost of "securing their infrastructure." Never let a good crisis go to waste.

Any employee choosing to spend millions to avoid the cost of a heretofore unencountered cyberattack would be making a strategic decision, while probably not being empowered to make decisions at that level. So they do not take action.

Bureaucracies do not take visionary action. They stay the course.

Everyone want's to make the calculation and hope it's not them, but if it's everyone at once, or there is no ransom option it's a completely different ball game. This is a situation where we are asking private companies to take responsibility for something outside of a profit motive and the results are some what less than surprising.

Maybe now utilities going to the US for a similar reason will be in everyone's DR/IR plan (even if Colonial didn't reach out to the US admin).

But a more precise calculus would take into account that (1) the proliferation in ransomware is recent and explosive, and (2) getting hit by one ransomware group doesn't mean a second group won't strike soon. (Although I'm guessing the second wouldn't be allowed to use the same ransomware-as-a-service platform, as that would harm the platform's reputation.)

"OK, now that you have our attention, and the eyes of the entire international media apparatus are on us, here's how we're going to do this. We're going to send some integer number of million money dollars down this pipe, and you're going to turn that gas pipe back on like you said you would.

Then here's what happens next... we're going to give you an integer number of minutes running head start before the drone strikes start raining down on these 12 sites we've identified as likely candidates for your location, ... now how many millions was it that you were asking for from us again?"

Doesn't really matter how much it was, either, if it has really been seized already in less than 24 hours. Was it enough to convince the boss guy or gal to take the bait and risk revealing themselves? (Probably not, but IMHO that wasn't likely to happen anyway, at least not since the heat started getting turned up on them all.)

The servers that were claimed to be seized were on cloud platforms.

And even then, we don't know if this is true or if it's just an exit strategy.

I'm inclined to agree that our cyber-security apparatus is not up to the task, but it's also true that nobody has perfect OpSec, (and I'd guess there are few out there have deeper pockets to track down and make sure the perpetrators regret this, than the combination of US government + oil companies.)

If you want to be a criminal who gets away with it you really need exactly one big action, and at most a few tiny practice runs before the big one. Choose your target well because once the big one is done you have to be done. (and don't do anything copycat - investigations to get the first guy might find you instead)

Yep. Compromised people on the inside, informants, "intensive interrogation" etc. are more likely the way, as has always been the case.

Also the agencies that would know who these people are would not want to reveal what they know in order to save random XYZ Corp's bacon. With this being seen as a "critical infrastructure" attack and something closer to an act of war/terrorism, the stakes got higher.

The US government has a long reach, but even they cannot do anything to you if you are in Russia, for example.

The USA threatening to rain drones on Russia is just going to get laughed at. Nuclear war isn't breaking out over darkside.

Putin already denied responsibility and Biden apparently accepted that, so we wouldn't be attacking the Russian government. Wink

[1] https://krebsonsecurity.com/2021/05/a-closer-look-at-the-dar...

Yeah, just dirtbags making money.

Times have changed and when govt agencies see this as an attack on critical infrastructure, you're looking at some serious jail time. I would say its only a matter of time until they're tracked down. When you're being hunted like that, the govt works 24/7 and never stops. People on the run don't have that luxury.

I had gotten into an argument with a professor on a discussion board. He used derogatory terms to refer to me, which pissed me off. I sent him a virus that was supposed to just damage files and delete some random files. It turns out it propagated onto their main network and crashed the entire universities network.

Suddenly, you feel untouchable (even though the virus had gotten out of control, which I didn't mean it to do). You feel like you can do anything and are beyond the reach of law enforcement. I'd never done anything like that and you felt really powerful, in control. You now had this idea if someone slights you, you have something to shut them down and they can't reach you.

Then the feds show up in your class, bring you to a windowless room on campus you didn't even know existed and start threatening you with jail time while they question you. This happened in the late 90's and the CFAA was still really new and DA's really didn't know how to apply it. I was pretty lucky for sure. The stuff they were threatening me with was like interference with interstate commerce, identity theft, stuff like that. They gave me the old, "You have a bright future kid, don't fuck it up." speech at the end. That was enough to scare me straight so to speak. I lost my campus network access for a year, which sucked, but the whole experience was enough for me to stop doing what I was doing.

It was just in time too, because you saw during the early aughts, the feds really started going after hackers. They started using the broad powers of the CFAA to put some really high profile people in jail with some pretty hefty prison times. To this day, I still look back and feel like I dodged a bullet there.

> the virus had gotten out of control, which I didn't mean it to do

This isn't just a whoops, how do you "accidentally" create a virus that leaves the boundaries of the computer and traverses their network?

I copied an existing virus someone had given me. The last part of the virus was to multiply and seek out any other computers attached to the network and delete and damage the files on those computers as well. I didn't know that. When it damaged the professors PC, he was using it on his home network, so he said there was only one PC it infected.

When he got back to campus, he sent the email to the network team (a group of students and professors) and they tried testing it out on a group of PC's. They thought the PC's were sandboxed. Turns out they weren't. The next 24 hours the virus rampaged and pillaged PC's attached all over the network. I'm still not sure how it eventually crashed the network. All the people involved refused to tell me exactly how it crashed their network - they said they didn't want me encouraging others to do it, so I was never told the full story.

To this day, I'm still not sure what happened, but it had to be bad enough to call in the Feds, right?

Save the malware there, then anybody on the network with access can run it.

Nobody cares if you sabotage a random small business. Lots of people care when you attack a fuel pipeline. Attention is bad for this business.

Sure. In the same way the mugging people is a response to undervaluing “beating the crap out of people and taking their money” skills.

"When the system fails you, you create your own system."

Which relates to what you're saying. When clever, intelligent people are ostracized and marginalized, they then use those skills to get illegally what society has prevented them from getting legally.

At some point, the idea of getting caught doesn't even register anymore.

If we just paid engineers more would this type of crime disappear?

Or is greed, ego, arrogance also a part of their actions?

We probably will never know. A lot of hackers turn to hacking because of various reasons - some ideological, others because they felt they didn't fit in anywhere else.

>> If we just paid engineers more would this type of crime disappear?

Probably not. You cannot get rid of one type of crime by simply paying people NOT to do it. It is what is - at no time in human history has any civilization had zero crime. That's regardless of punishments and financial incentives.

>> Or is greed, ego, arrogance also a part of their actions?

I think its different things at different times. When I was hacking, it was arrogance, thinking I was smarter than others and trying to prove it. That leads to thinking you are beyond law enforcement when you get away with it (ego). If you're into it solely for financial gain, then the other two feed your greed. Get one nice payout for your ransomware and now you think its easy to do and you'll never be caught - increasing your greed to get more.

They all kind of play into each other:

arrogance: "I'll never get caught."

ego: "They'll never catch me, my ops sec is too good for law enforcement."

greed: "This was too easy, next time I'll target a bigger company for a bigger payout."

Ehh, maybe. Or maybe they’re just bored sociopaths who get thrills looking for a big score.

It's just digital Privateering - Francis Drake with a laptop.

> If a market correction occurs...

The English solved it by expanding their Navy and enlisting those who would otherwise pirate. Seems like as good a solution as any here.

In anycase disparity of oppourtunity is what breaks trust and therefor collaboration. The world needs to universally operate in the ballpark of fairness or we are all at risk in the long term. (This comment is also influenced by the under valued tech resources thought).

Edit (sorry some more thought while fixing typos): When the disparity of oppourtunity is at state level there are privateers and wars, when at a personal level there are muggings and burglaries etc.

*this is all probably stupidly obvious.. but as its against uncontrolled capitalism or classist segregation we dont seem to want to say it too much maybe?

This is the "organized" in organized crime. It's not lone bored teenagers doing this stuff.

Ransomware gangs aren't the vigilante heroes/embodiment of the undervalued IT security worker. They're a group of people looking to make a quick buck and don't give a damn about the harm they cause or who they cause it to.

Most ransomware hackers are not so amoral enough to go around murdering people or calling hits. Some are, but most ain't.

Almost all crime syndicates work this way. There is a balancing point where the crime you do does enough damage to make you money, but not so much money that the government dedicates elites to come knocking on your door. What DarkSide did was veer too far in the wrong direction.

They only don’t get credit for that in mainstream media. In the Cyber Security world, Ransomware as a Service (and various other malware-aaS) groups have been discussed as well organized, customer-focused entities for quite some time.

I swear this is the first time it seems the world is hearing about RaaS, which feels weird since it’s a pretty dominant model today.

Reminds me of this negotiation: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-...

Previously discussed here: https://news.ycombinator.com/item?id=24032779