A lot of people like to think of ransomware attacks as the ultimate stress test as far as security goes, and thus a good thing - but let's not get too blinded by our professions (most probably in tech), these kinds of attacks can have serious consequences: Imagine if some foreign state agency (masquerading as hackers) launches a multiheaded attack on, say, utilities plants - in the middle of the winter. The victims/targets will pay whatever us necessary.
With that said, I understand that many people will recoil at such things - we saw what the patriot act did, and how easy it is to overstep and abuse such laws, in the name of "national security". But it is a serious problem, in the same way actual piracy thrived in the gulf of Aden, as soon as the shipping companies started paying.
A common understanding is that terrorism is intended to frighten people or make them feel unsafe, while various official definitions of terrorism include the idea that it's intended to coercively achieve some particular political goal.
If attackers just intend to get money, they're probably well-described as extortionists (or in some cases, as you said, akin to pirates). If they just intend to damage a particular society without demanding anything from it or getting it to change its behavior, they might be saboteurs.
Attacks with these motives or that pretend to have these motives could still be considered national security threats (and taken very seriously), but maybe shouldn't be described specifically as terrorism.
From the victim's perspective it matters less who is attacking you or why they are attacking you and much more what the results of the attack are, how you can mitigate and recover from the damage, and what needs to be done to prevent future attacks.
For the case of DarkSide and Colonial Pipeline, the attackers did not claim to have a political motive, but the resulting fuel shortages and panic buying might as well have been a form of terrorism.
You can make a reasonable argument that "nothing is apolitical" but but that's not the definition of political being used when people say what terrorism is.
I have to believe that played a role in the response they received as well.
I'm a frequent "everything is political" commenter myself, but since when is naked self interest through theft a political action?
The insanity of it all is incomprehensible.
That only true when right is up and down is left.
How does taxation drive value? Which taxation? There are governments that don't charge income taxes, there are governments that don't charge property taxes, there are governments that don't charge sales taxes.
Tally sticks are an early example of monetized debt as a taxation medium.
Also note that the work of legal historians such as Christine Desan who are not affiliated with MMT economists concurs with this analysis.
Also note that most mainstream economists do actually agree with the tenets of MMT when individually stated but base their disagreement on a deliberate misreading/misstatement of MMT which they then proceed to criticise.
That taxation is sufficient to drive demand for a currency is not contentious, that it is necessary is unconfirmed.
>As noted in previous stories here, during times of conflict with Russia’s neighbors, Slavik was known to retool his crime machines to search for classified information on victim systems in regions of the world that were of strategic interest to the Russian government – particularly in Turkey and Ukraine.
>“Cybercriminals are recruited to Russia’s national cause through a mix of coercion, payments and appeals to patriotic sentiment,” reads a 2017 story from The Register on security firm Cybereason’s analysis of the Russian cybercrime scene. “Russia’s use of private contractors also has other benefits in helping to decrease overall operational costs, mitigating the risk of detection and gaining technical expertise that they cannot recruit directly into the government.
https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-...
maybe in as far as their capabilities go, but the important characteristic of a state actor is that retaliating against them is construed as a retaliation against the state that backs them. Darkside is very different to a state actor, as demonstrated here - retaliation has no significant geopolitical implications, so it can be swift and harsh.
Would that change if they, for example, demanded the release of prisoners of a specific political persuasion?
How would that not be classified as a political motive?
Yes.
"Terrorism is, in the broadest sense, the use of intentional violence to achieve political aims." https://en.wikipedia.org/wiki/Terrorism
Generally though, the Justice department defines terrorism to be "the unlawful use of force and violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives"
These ransomware attacks fall in the middle. They are 'deniable' by state actors as just crooks who happen to be within their borders. They certainly don't push any social objective other than to enrich the criminals. So that leaves them under the jurisdiction of law enforcement.
I have read anecdotal evidence that there are the equivalent to "Letters of Marque"[1] for Russian criminals who attack enemies of the Kremlin. They wouldn't completely qualify as the Russians aren't actually in a declared state of war (this works fine for North Korea) but conceptually if you accept that criminals are gonna crim, then pointing them at people you don't like at least keeps the damage outside of your area of concern.
In this particular case, the fairly rapid take down of these guys gives me pause. One wonders if the FBI and Interpol had Colonial pay with Bitcoin that they then traced to the destination wallets. And then working backward from there to the server infrastructure. That would be an interesting capability if it exists.
If serious ransomware attacks are being conducted by state actors with the sole intent of causing damage, and we want to use powerful terminologies to describe them, "acts of war" seems a reasonable start.
Yes, this is semantics--but some of my concern here is that just freely tossing around "terrorism" gives cover for organizations not to be diligent in at least attempting to secure their networks and digital assets.
The meanings of words is important; rational discussion is impossible when people shift commonly-accepted meanings and definitions to suit their agenda. It's an extremely common strategy in politics. And the word "terrorism" already received more than its fair share of this treatment quite thoroughly in the decade following 9/11.
I don't think it's necessary to staple the term to the action in order to take it seriously. It should, however, be taken seriously as the national security threat it is. For instance, climate change is a national security issue but oil executives, while distasteful, aren't terrorists.
I agree that many folks in the tech community (and especially here, though I don't know if they're overrepresented here) treat technology as platonic. That's not going to cut it moving forward. Technology that enables bad things in the world should be curtailed even if its "neat."
I'm not sure leaving infrastructure hanging out in the breeze can be compensated for by cracking down on personal liberty, however. Unless you're proposing cutting off international computer network integration.
A precise definition of terrorism tends to be difficult to pin down (mostly due to the difficulty of considering what is a legitimate asymmetrical warfare tactic by a nascent liberation movement versus an illegitimate terrorist act). But a general rule of thumb is that terrorism is a) violence b) directed at civilian populations c) to effect policy.
However, there are threats to national security that are not terrorist in nature; gang warfare in Mexico and Central America would be an example of such a threat.
Well... yes? That isn't a sense of the word "terrorism".
Sounds like the ransomeware people finally robbed the wrong people.
Not saying it's false, but the story doesn't ring true to me.
They appear to be sophisticated, yet they made the newbie error of keeping all the funds in a network accessible device, rather than a cold wallet. Really?
Terrorism has a legal definition, and something affecting national security is not the determining factor in calling something terrorism.
"Terrorism includes the unlawful use of force and violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives." [1]
For say a nation engaging in cyber war, this could be flipped around: attacking basic infrastructure but disguising it as smaller groups of criminals trying to make a buck. Not sure how effective the disguise would be, but it could obviously do some serious damage.
Um. Terrorism is basically never a threat to national security.
These people thought they were sticking it to the man but they were actually sticking it to people like me.
I wish Biden realized how hard homeliness can be. Cities, and towns, need to stop ticketing vechicles that are parked overnight, and used as residences. I would like to see any federal, state, or local land, set aside for the homeless.
Hang in there.
Funny fact - one way to get down votes on HN is to say something negative about that shit-tier human Peter Thiel. Apparently becoming rich off of venture capital makes you automatically a good human being.
Ransomware is non-state, not violent, and is done for economic, not political aims.
There’s a well known phenonenom of a certain large nation harbouring cybercrime gangs and keeping them on the government leash. Their economic activity benefits the governments political agenda. Ergo all conditions are true.
That doesn't mean that the large, developed nations in question are engaging in organized crime.
Taking advantage of regulatory arbitrage does not mean that their government is in collusion with them.
If it did, then we could pile a lot of crimes at the feet of Western governments. Some mining firm violently puts down a strike in Central America? Clearly, we can conclude that Canada/the US is engaging in terrorism! [1]
[1] https://digitalcommons.osgoode.yorku.ca/cgi/viewcontent.cgi?... [2]
[2] 28 Canadian companies, 44 deaths, 30 of which were targeted extra-judicial killings. Are we going to lay those at the feet of Parliament, too? [3]
[3] Or do we have one set of standards for Russia, and another for our own behaviour?
Are there no ransomware operations linked to North Korea? I was under the impression that there was some level of activity there to maintain supplies of globally-usable currency.
The Great Firewall is likewise, not remotely similar to the restrictions placed on internet access in North Korea.
That's not what you do if you just stole everyone's money / should run...
In order to seize someone's cryptocurrency, the government has to literally seize the private keys used to sign transactions. This could be as easy as seizing computers containing the key but it could also be as hard as torturing people until they reveal their seed phrase.
They can't simply order the banks to freeze people's assets. They have to physically go there and try to seize them. This puts a limit on the scope of their operations. It's just like surveillance: encryption makes dragnet espionage harder but it's still perfectly possible for a target to be attacked directly.
https://www.treasury.gov/ofac/downloads/sdnlist.txt
> Digital Currency Address - XMR 5be5543ff73456ab9f2d207887e2af87322c651ea1a873c5b25b7ffae456c320;
Note the lack of the 0x prefix. Here's the transaction on the block explorer:
https://localmonero.co/blocks/search/5be5543ff73456ab9f2d207...
You ask that like it seems implausible. To me, given what we know, it sounds light-handed for them.
https://www.nytimes.com/2016/03/30/world/europe/russia-chech...
So which of the following is most likely:
- the government has a tool that can break private key encryption and used it to confiscate a hacker groups funds
OR
- whoever controls the groups wallet transferred it out and is on the run
Someone got a little sloppy on their payment processing server (also seized) or with maintaining separate wallets and control of that server allowed sending of payments to an account specified by whoever was in control - likely since the server was for paying affiliates.
There is something called the "gun test". The crypto on an encrypted hard drive is not more secure than the gold bars in a locked safe. Its security is a function of how the secret holder response to gun-on-their-head events. In this case, since the government is directly involved (and angry), a lot of criminals may pick personal safety over assets.
Frankly, I think a large portion of cryptocurrency proponents are overly confident in its "decentralization" and "safety". Cryptocurrency is only as safe as gold bars in a locked safe; and worse if you use a public exchange.
All the cryptographic, air gapped security hardware doesn’t matter if someone can beat the keys out of you.
That's usually the problem that people who pay a lot of taxes have with the taxes.
In cryptography, rubber-hose cryptanalysis is a euphemism for the extraction of cryptographic secrets (e.g. the password to an encrypted file) from a person by coercion or torture[1]—such as beating that person with a rubber hose, hence the name—in contrast to a mathematical or technical cryptanalytic attack.
If you're tortured to keep revealing keys to deeper and deeper volumes, eventually you're going to hit a point where there are no more volumes, but you can't prove it.
I think the original threat model was someone willing to torture you, but willing to accept plausible deniability once you'd revealed some moderately sensitive information.
In reality, if someone is willing to torture you a couple volumes deep, there's a good chance they're going to just keep torturing you forever. Rubberhose may still work in this model, since in theory the promise of avoiding torture loses most of its power. The downside is that once you format a partition with Rubberhose, you're resigning yourself to being tortured forever.
It's very hard to do this with gold.
B. To bury gold you must transport the valuable property in meat space to your hiding spot after acquiring it. With cryptocurrency, you hide the secrets before they have value and transfer the funds to them without new data actually traveling to the hiding spot, electronically or physically.
My read is that tax enforcement failure is intentional, lubricated by political donations and influence, vs incompetence.
See the high-net-worth enforcement group at the IRS that was quickly shut down for murky reasons.
Most people serious about cryptocurrencies do not trust computers/harddrives anymore since years. They use "hardware wallets", which are HSMs with a very small attack surface. It's not impossible that hacks happen but there's a gap so wide between "a Windows 10 computer running some Bitcoin software wallet" and "a Ledger Nano S" hardware wallet that it's basically two different worlds.
Think a Yubikey (with a tiny screen) to cryptographically sign your transaction.
$5 wrench attack still works but compromising your private key(s) by "logging every OS keystroke in the name of telemetry" or "using one of the tens JavaScript 0-day from today" doesn't.
The idea behind these cryptocurrencies hardware wallets is that ANY computer you connect them to is compromised (which is precisely why you're using an hardware wallet) and that, yet, that's not a problem.
I have to say: it's not a bad way to think about computer (in)security.
If that's not enough and anyone of them is in the USA they do have access
Can your wallet be hard to crack? Yes but either use your zero day to get all data including a Password or book a little bit of supercomputer time for brute forcing.
They might have linguists available to help out with a dictionary attack.
As aluminum foil hat this might have sound in pre Snowden that's how it could have been played out.
What you store is your private key.
Your private key was generated together with your public key, and your public key is, well, public.
So the question is, can someone re-generate your private key?
In theory, yes, it is possible. In practice, it takes a very very long time.
But sometimes flaws are found in the generation process, like a weak pseudo-random number generated used, which significantly reduces the solution space, and then it becomes feasible.
With state actors, you have to assume they have access/backdoors to most modern computing devices, and that device has to connect to the internet only twice - feds activate the backdoor and give it instructions, and have the device send the requested info back to the fed.
Minix being the most popular operating system, thanks to Intel-backdoor-on-a-chip, is only the tip of the iceberg.
Credibly threatening repeated 51% attacks against Bitcoin is well within any G7 member’s budget.
Semiconductor production can't be scaled up instantly, so 51% attacks require seizure of assets.
Even if the USA purchased every single CPU, GPU, FPGA, and ASIC made in the next month, it's unlikely they will have more than 10% of the network or so.
To seize the majority of the hashpower, they'd have to seize Chinese miners, which require either US-China cooperation or a world war.
The latest and greatest Intel i7 can do maybe 30 mh/s.
You would need more than all cpus produced in history. I can believe G7 secretly having a third of total known CPU compute.
I can't believe G7 secretly having multiples of all known CPU compute.
I don't consider that the most likely scenario, but something in the willingness to declare defeat got me into "what if" mode.
"BTC is bad cause it can be used by drug dealers to launder money"
"BTC is not even secure from government access"
Surely someone will point out both can be true but the point is the anti-btc folks seem to be talking out both sides of the mouth
In this case even the pros messed it up, but this is a very high profile case with undoubtedly a massive amount of manpower thrown at it in various agencies. You don't mess with USA's oil.
And even then it's unclear if the money was actually confiscated.
Can you explain how you reach this conclusion? It doesn’t seem to follow.
Both of those seem pretty hard to be true at the same time
That’s what doesn’t seem to follow.
Cash, for example is hard to trace if the serial numbers haven’t already been recorded, and good for money laundering, for example, but it doesn’t secure your money from government access if the government puts resources into it.
The most beautiful being: "The cryptocurrencies scam should all stop but, please, let us collect all the due taxes on the gains you made".
From that standpoint which one is it: are they legal or illegal? Because it's funny that they both want it to be illegal, yet they want people to pay taxes on the gains they made.
Hypocrites.
It just demonstrates that they're incompetent.
Beyond all the technical discussion about the value of cryptocurrencies I never believed that the idea that everybody would carry their cryptocurrency wallet with them at all time was in any way realistic. People would get their wallet stolen, destroyed or lost all the time, locking them away from their savings. The vast majority of people will prefer having the peace of mind of entrusting their coins to a third party who'd handle the technical details and provide insurance against lost and theft. And just like that we've reinvented banks.
(It almost seems oil does not require infrastructure - you can, theoretically, prep for an oil infrastructure outage by storing it containers, same as you do with water and food. But you can't really prep for a medical infrastructure outage. Is it just that, as a result, there were no photos of people hoarding medical care and so there was less political will?)
An attack on a hospital affects someone if they work there or are using that hospital. A pipeline attack affects people who drive cars places and need gas. The latter group is much larger than the former.
Hospital affects workers who work there and people using that hospital VS Pipeline affects workers who work there and people currently refilling their cars with gas from there
Or
Hospital affects workers who work there and everyone within a radius who could need it at any moment VS Pipeline affects works who work there and people who generally rely on that gas to drive
Suddenly the groups seems much similarly sized, while one being important for staying alive VS the other being a nice-to-have, if we consider it being offline for a week or two only.
I know which one I would consider being worse if I was a country. But then we're also talking about a country who's fascination for oil is like no other, so this is hardly surprising.
The number of people reliant on this pipeline is several orders of magnitude greater than would be impacted by taking a single hospital offline. You’d need to have many hospitals impacted to create a similar level of risk. The only big difference is that taking out hospital infrastructure can kill people immediately whereas the impact of a pipeline failure won’t generally be felt for days or weeks.
Edit: Based on your other response it sounds like we are on the same page.
But if you instead compare 40% of the hospitals going offline VS 40% loosing access to gas, with similar conditions, I think the mortality will be higher by attacking hospitals. I think the government could probably somehow logistically ration oil if shit really hits the pan too, so essentials can keep running. Probably worse situation with hospitals, even though the military could probably help out there a bit.
That's why it's weird to not react when people are attacking hospitals, vs oil pipelines. But as said before in my other comment, maybe not too weird.
The average person fills their gas tank once a month, so they are much more likely to notice personally.
If the intended situation is to be able to (for instance) set up a coup attempt on the target country, have it come off well enough to produce chaos, and THEN have your tame cybercriminals knock out key infrastructure, that would be an extremely effective act of war.
Freaking people out while not destroying the target country is a bad, bad misstep. They did indeed kick the hornets' nest, but so ineffectively that the best response would be to try and cover the whole thing up and pretend it was nothing. Might work for some, but I doubt the US government is amused.
The game was changed when Colonial closed the valves and services were impacted.
Hospitals obviously do rely on infrastructure, so you'd see much more panic if someone could disrupt a national supply of blood plasma or insulin or something.
If a hospital is shut down, then people will start dying immediately. The consequences are much more direct and severe.
If a hospital closes, patients can be moved. If there's no gas, patients can't get to any hospital.
Five distinct disciplines compose the ESS, encompassing a wide range of emergency response functions and roles:
* Fire and Rescue Services
* Emergency Medical Services
* Emergency Management
* Public Works
Emergency Medical Services ≠ Hospital
The difference is response is a matter of impact scale. Usually, the infrastructure of a small group of hospitals is at stake. This time an entire state is hoarding gasoline. Both are infrastructure but the latter is causing nationwide effects.
Oil pipelines that serve everything from energy to transportation to manufacturing are far more integral to keeping all aspects of society running for magnitudes more people.
I think a more likely answer is that optics had little to do with it. Attack a hospital and you've got angry hospital administrators mad at you. Attack an oil pipeline and you've got billionaire oil executives and shareholders who have much of the US government in their pocket mad at you.
You really don't want to anger people who can buy US elections.
Which is somewhat disturbing, because first the industry is still considered more important than civil services (city councils, hospitals). And second they will still continue using Windows services in their backbones. I have nothing against using Windows as frontends, but in the backbone of a critical company it's criminal negligence. Easy to hack, no backups, untrained admins with no idea about security. Wasting billions on money on theatre, and not working servers, groupware and email.
What are the sides of any company other than "business"?
Yes, it's guesswork and pretty extreme conjecture but it has just the right amount of coldheartedness to it: https://zetter.substack.com/p/biden-declares-state-of-emerge...
> New details from within Colonial Pipeline have come to light surrounding the decision to shut off supply. Those briefed on the matter have suggested that fuel flows were shut down due to the company's billing system being compromised. Company officials were reportedly concerned that they would not be able to accurately bill customers for fuel delivered, and chose to stop delivery instead.
It’s a privately financed, constructed and operated pipeline. I don’t see why they should be obligated to operate without getting paid.
Colonial obviously have done well in certain ways: their business side and operational side are decoupled. Business side got hit with a major IT problem - and the damage was contained. Pipelines kept working as intended. That's good operational planning, and they deserve credit for it. They were perfectly capable of, quite literally, keeping the lights on for 100M people.
> It’s a privately financed, constructed and operated pipeline. I don’t see why they should be obligated to operate without getting paid.
Because they are critical infrastructure. Colonial are entitled to their profits as long as they keep their side of the bargain: supply oil and fuel for those 100M people who critically depend on them.
This is where role of a regulation comes in. Make it the critical supplier's responsibility to ensure that they supply. If they lose their billing capability, that's their problem. Not their customers'.
Who's been messin' up everything...
In truth both factors probably played a role in this case, perhaps also with a hefty dose of "our software literally can't run if billing is down because it was never designed to handle that".
(Oh shit, everything just went down, turn on the generator, go plug that printer and laptop in, and print off all the reports of where we were from the offsite/offline/whatever backup).
What did they do before computers?
Failing to plan is planning to fail and all.
I like the idea of monthly planned downtimes where possible so people don’t run around like a headless chicken when things go down. No different than a fire drill.
If they did, I would expect their employees to be out of practice with such methods since they weren't working that way day-to-day. Unless they're running regular "all computers are down"-drills to keep their employees sharp, downtime was probably inevitable.
I've long wondered if that really was the case, seemed absolutely sensible...
> After Colonial Pipeline reported that its corporate computer networks were hit by the ransomware attack, the company shut down the pipeline as a precaution due to a concern that the hackers might have obtained information allowing them to carry out further attacks on vulnerable parts of the pipeline.
Operations side performs whatever services the business side has committed to.
Just like with The Silk Road. Once it became large enough and Ross started to taunt the authorities to find him, the police had no choice. It’s continuing existence chipped away the legitimacy of the authorities, they had to shut it down just to maintain appearances.
Just like this ransom ware. Keep it small, it’s not worth going after. Start screwing with the economy and the govt goes from 0 to 10 very quickly.
I'm pretty sure it's actually happening we just don't hear about it.
I suspect small or medium organizations rather then megacorps would be easier targets if they haven’t invested money in accounting controls.
Plenty, if not all, corporate level financial controls will be bypassed by the executive branch showing up in suits.
>gave the US an opportunity to show how effective it could be
unless you know something we don't, that's quite a conclusion to jump to
Not sure what you mean, what did the US do exactly?
https://mobile.twitter.com/TheRecord_Media/status/1393192862...
And why would you say this is desirable to the US? Just general "governments take advantage of crises to gain power" reasons?
The hacker group attacked resources considered "critical infrastructure"; this was closer to an act of war than any other cyber attack has come. The US Cyber Command responded swiftly.
> "governments take advantage of crises to gain power"
Please, elaborate? I fail to see how the US Govt is taking advantage of this crisis for more power.
OP used all kinds of language we associate with governments doing sketchy stuff: "what could be sold as reasonable doubt to shut down the pipeline"; "created the impetus" ("impetus" is often used to claim the real motivations were something else); "political cover"; etc.
I just didn't know how else to interpret all the cloak-and-dagger language about the US's behavior. Personally, it seems to me like our response was pretty reasonable. I think the "government takes advantage of crises" line of argument only goes so far, and at its extreme leads to dumb stuff like 9/11 truthers.
It's the same as domestic operations here in the USA: GRU comes up with ways to run loosely controlled groups that are accomplishing roughly the same ends. It's about making the battle space more confusing and unpredictable, and it's been going on for quite some time, very successfully. The soldiers don't report back to central control: they're NOT controlled, they're just loosely directed.
This would be the same. The hackers doing this don't have to be direct agents here, they're sheltered by the Russian state and only need to have some indication of where and what to strike. It's one-way communication, and it's possible to get the desired feedback through things like Facebook and Google Analytics (by paying for it like any ordinary customer).
Go on
There is much more if you care to go down that rabbit hole.
https://blog.malwarebytes.com/threat-analysis/2017/06/eterna...
Why call it diskcoder.c anyway? It’s Petya
See also: https://en.m.wikipedia.org/wiki/Argumentum_ad_populum
During the conspiracy, the FSB officers facilitated Belan’s other criminal activities, by providing him with sensitive FSB law enforcement and intelligence information that would have helped him avoid detection by U.S. and other law enforcement agencies outside Russia, including information regarding FSB investigations of computer hacking and FSB techniques for identifying criminal hackers. Additionally, while working with his FSB conspirators to compromise Yahoo’s network and its users, Belan used his access to steal financial information such as gift card and credit card numbers from webmail accounts; to gain access to more than 30 million accounts whose contacts were then stolen to facilitate a spam campaign; and to earn commissions from fraudulently redirecting a subset of Yahoo’s search engine traffic.
Here's what the Treasury had to say about it in April [2]:
To bolster its malicious cyber operations, the FSB cultivates and co-opts criminal hackers, including the previously designated Evil Corp, enabling them to engage in disruptive ransomware attacks and phishing campaigns.
More about Evil Corp etc in [3].
[1] https://www.justice.gov/opa/pr/us-charges-russian-fsb-office...
[2] https://home.treasury.gov/news/press-releases/jy0127
[3] https://apnews.com/article/business-technology-general-news-...
As a result, the ransom had the optics of an attack on infrastructure. As evidenced by the coverage of Americans desperately filling up containers.
This created the impetus for the US to treat this as an incident far and above the ambient ransomware activities leading up to this.
It also gave the US an opportunity to show how effective it could be when it had the political cover to do so.