People overestimate criminals. The ones that get caught, especially.

What would you do if you were a foreign intelligence service? Participate in attacks yourself?

No! You would drop hints and supply tools sideways to sloppy groups of idiots enabling them to be destructive, maybe acquiring some funds, and keeping your hands as clean as possible. Then when it comes out that "elite russian hackers" were incompetent idiots, it makes people think the claims of your connection to the crimes are even less likely.

Tricks and disinformation are the name of the game.

If you actually were elite, you would hide and practice and save your actual actions for critical moments and not show your hand for a few million dollars. Or you'd go into security consulting which is a far safer, more profitable, and overall smarter thing to do.

I think it was the RSA hack where the second (and presumed more elite) team had gained access to the first group of hackers and just followed their APTs. Noone really found out about the second group when the story was reported on.

> If you actually were elite

exactly. Look at stuxnet - nobody knew it was an attack until it was over!

People also underestimate the amount of people trying to commit crimes like this.

If there are millions of people trying to ransomware businesses and hundreds of important businesses with really bad security, depending on how talented the best hackers are - the odds could be quite high you get hacked by a not-so-talented hacker.

hacker gangs can make tens of millions dollars. No security consultant makes that much.

Gangs are multiple people, they have higher expenses (can’t go to a normal bank, have to pay off local police, etc.), and the long-term prospects are risky so they need to get rich and find safe places to store the money after laundering it. Plus every so often you get on the wrong side of someone nasty and end up involved in something much riskier or dead.

Even if you’re completely amoral, getting a hefty paycheck, 401k, etc. is going to be appealing to most people with that skill level. It’s not a coincidence that a lot of this happens in places where people have poor career options which makes that more appealing.

Yes, but... if you're in Russia, my understanding is that you really don't have too much to worry about, so long as you only go after targets outside of Russia.

And as long as you're happy with never going outside Russia yourself - I seem to recall a situation some years ago where one culprit was offered a good tech job in the west, and was arrested when arriving at the airport for some scam they did many years ago.

A whole bunch of them have been arrested in or on their way to Dubai, Thailand, Maldives etc.

Hacker gangs also apparently lose 2.4 million dollars at the drop of a hat, which is something that no security consultant ever has to worry about.

> which is something that no security consultant ever has to worry about

There's enough self-styled cypherpunk infosec experts that might insist on being paid only in BTC and then lose their decrypted wallet...

They could also be paid in cash, use that to buy BTC and then lose their wallet. It's a random problem, not related to receiving valid payment for legitimate work.

Yeah, but the same goes for any job. You can't blame your new job when you forgot the keycard to your new office.

Those gangs aren’t one person, and neither are the IT security companies that are making tens (or hundreds) of millions.

right, the deployers are not the people creating the tools.

this is a true criminal SaaS, partly because its low risk, high reward for the developers and partly because its a russian funded op that needs to cover its ass in the nature of its attacks on democracy and corporatism.

“I'm supposed to believe some elite Russian hacking group keeps …”

Why not. Remember Elite Russian GRU hackers identified because they all registered their cars with the DMV at the same address? https://www.bellingcat.com/news/uk-and-europe/2020/10/22/rus...

Smart people do dumb things.

The Mossad did something dumb like that once. Neckties are not widely worn in Israel, so the photo office that made fake passports had some neckties on hand when taking pictures. But only three different neckties. After a while, some other countries caught on.

If they were elite they would have asked for more than $2 million

Who says they're elite? I know that ironically many hackers have poor security practices themselves.

While I suspect the DOJ is leaving out critical information, it is true that these gangs are not nearly as elite as some people imagine.

They just happen to be in an untouchable legal jurisdiction.

It's even more ironic (and troubling) that seeming amateurs managed to shutdown an entire pipeline :)

Can't wait to read this report!

I encountered this myself. I was hit by a browse-and-get-owned zero day. I found out one day later from a blog post, where an anonymous person had hacked the command and control server and wiped the hacker's database in a remarkably brief time. Clearly, their skills were not on par.

The responsible vulnerability was in Java applets, which I had disabled for security reasons. But Java secretly re-enabled itself after updating. I kept Java uninstalled for a long time after that.

I think this is accurate.

If you imagine the extremely unlikely scenario where the DOJ put out a statement that anyone in the US who happened to extract money out of persons or companies in Russia would not be prosecuted or hindered by US law enforcement, what sort of people would jump in to try their hand at that. It seems to me it would certainly be an attractive idea for script kiddies to jump on to if they felt it was low/no risk.

> I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key?

What is it that's so implausible? That's just one possible interpretation. I see many possibilities here. Below are some, where "The FBI" loosely refers to the bureau, collaborating agencies and their partners and contractors:

* The FBI has (through active exploitation of hosts/services) gained access to a large number of BTC private keys, which they can utilize if and when they become a point of interest

* The FBI has some channel to index and get access to cryptocurrency wallets/private keys from hosts running on cooperating service providers such as GCP, AWS and Azure.

* The FBI continuously monitors for BTC addresses/public keys and opportunistically bruteforces them looking for weak keys, keeping a catalogue of broken ones and waiting until they become a point of interest

* These coins were sent through some anonymization network/protocol/service and the wallet in question actually has no relationship to the hack at all but just belonged to some clueless user.

I have already been assuming all of the above to be going on and this particular instance could be a result of either.

There is also the more boring explanation that these 64 something BTC was supposedly "tumbled" but not enough, transferred to a centralized exchange and subsequently frozen. It's also important to remember that it's not a single group/entity responsible for the whole chain here. Darkside provides the software and affiliate program, and maybe some servers. The attacks themselves are performed by "partners" (who just pay for access and could be anyone anywhere). Most likely the wallet here was not under control of Darkside ("The Russan elite hacker group") themselves but some affiliate who could be anything from a "lucky" clueless script kiddie and an actual professional who made one stupid mistake along the way.

> The errors present by these hackers are so comical it's simply unbelievable.

True crime stories abound with comical errors (as do plenty of true not-crime stories). As it turns out, real people fuck up in comical ways all the time.

> I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key?

No, you aren't supposed to believe either (a) that DarkSide are an elite group, or (b) any particular narrative about how the FBI got the private key. AFAICT, no one is selling the first claim, and the only people selling narratives about how the FBI got the private key are doing conspiracy-theory-level creative interpretation of documents.

Also completely baffled how the feds got access to the private key and why an elite Russian hacking group would store their crypto on a US based server.

At the same time, the obvious tin foil hat answer of it was the feds who concocked the entire scheme also doesn't add up. If the NSA/CIA was behind it, they would be smart enough to not use a US based server / wallet. That makes the story inconsistent, and brings up the questions I am asking here. Instead, they would just use a clean wallet (preferably out of Russia). I.E. the misdirection and misinformation does not add up if it was an "inside job" by the US government.

The implausibility of all these scenarios is making me increasingly nervous regarding the other possible ones.

If SHA256 and asymmetric crypto are compromised to this extent, we have a far bigger problem to worry about.

No, they’re not elite, they’re just script kiddies with a payout mechanism.

"Script kiddies" got their name because 20 years ago any kid could download some code and create a DDoS attack by running a pre-written script. Ransomware hacks seem a bit more sophisticated, even with today's highly modular malware. I think it is an interesting proposal: a fake attack as shown by the disparity in savvy between the attack and the payment, or a really dumb screw up.

EDIT: as "koheripbal" says below, maybe their tumbler is a boob (paraphrased).

There's been some reporting of basically a new version of that for the modern "as a service" times, like here https://www.zdnet.com/article/darkside-the-ransomware-group-...

> According to FireEye, affiliates are required to pay up to 25% of ransom payments under $500,000, and 10% of any successful extortion attempts over $5 million.

So the ransomware authors might not always be the people collecting the initial payments. Although according to the press release here, it was siezed from the DarkSide group itself? So it's still a bit confusing.

Question really becomes where did that group get the software from? It could be multiple levels of indirection such as people hired to develop the stuff aren't really connected to activities. They might just as well be contractors not so well paid...

> "Script kiddies" got their name because 20 years ago any kid could download some code and create a DDoS attack by running a pre-written script. Ransomware hacks seem a bit more sophisticated, even with today's highly modular malware.

They're downloadable and leased out.

This allows people to focus on choosing targets instead of the entire vertical integration and liability at each step.

How much sophistication does it take to attack a computer system running software that hasn’t been patched in years?

Many so called "professionals" are still running operations with 5+ year old distributions that haven't been patched in almost as many years, and servers that people are afraid to reboot. I was once contracted by a company that was literally afraid to have any employees reboot a server because they had no idea how it worked, if it would come back up, and what to do if something didn't restart. They wanted an outside guy to take the blame.

Would’ve been a decent opportunity to contract a job paid half up front.

I took the job on the side. It was literally the equivalent of "set up a couple of static web servers with FTP accounts, and move everything over." It was about 8 hours of work and 100 hours of meetings.

./nestea.o

I was reading the article in utter confusion too. I personally think it's the authorities trying to save face, as I don't think even a computer-literate high school kid would make these mistakes.

"Save face" for whom? It wasn't the US gov who got hacked or paid the ransom, it was the Colonial Pipeline Company.

The US Judicial system which tries to flex its "unlimited" reach.

„ If sanctioned the US government could almost certainly 51% attack any given crypto and redirect funds to whoever they want”

51% attacks don’t allow for withdrawing funds from an account - only for rolling back recent transactions

Most mining takes place in China, so no, they can't do anything.

I don’t think it’s an understatement to say that their reach kind of is. If sanctioned the US government could almost certainly 51% attack any given crypto and redirect funds to whoever they want. This isn’t what happened but it’s laughable to think the US government isn’t capable of tracking down the account and seizing coins.

I doubt they could 51% Bitcoin with any sort of haste. Perhaps with a few year plan. Simply put it’s a procurement issue. There are limited ASICS and they are distributed among many operators, mostly foreign. There aren’t massive ASIC stockpiles in the US just waiting to be purchased. A government 51% attack would probably involve doing a private chip run.

> I doubt they could 51% Bitcoin with any sort of haste.

From when they planned for the capacity, probably not. But how do we, at any time, know that hasn’t happened in the past?

> A government 51% attack would probably involve doing a private chip run.

Sure, and when that classified capacity is acquired via, say, the NSA’s black budget, we’ll all know before (or, heck, even after, until they decide to something disruptive with it) they decide to light up the capacity...how?

OTOH, any attack won’t just be to redirect funds, because that can’t be done without broader disruption that would make it pointless for that purpose.

Also even if 51% attack is succeeded, then BTC price would crash so victim can't collect original $.

then the hackers would just send a little bit at a time in case it gets intercepted

It was just an example. If the US government is dead set on hurting you they can and will; that’s my point.

Do we have reason to believe they don’t have that capability? There are very few who have escaped the long arm of the DOJ.

That you know of.

This could have been far downstream from the hackers themselves. They might just have been monitoring the bitcoins and waiting for some to land in one of many addresses for which they have the private key. Presumably FBI is continuously scooping up whatever private keys they can.

Yeah Elliptic and Chainanalysis make all their money by convincing people that all transfers are of the same Ultimate Beneficial Owner until it hits an exchange

As long as the ignorance stays high, they get government contracts

That's utter bs, exchanges generates unique BIP32 addresses for deposit. There isn't a master exchanges key used among all customers.

Which is not something I commented on at all

Genuinely curious why you think your response was related or even mutually exclusive

I actually probably commented on the wrong comment :-/

Why are they elite? Ransomware is the new smash and grab.

The reason why this story doesn't make sense is because it's most likely a lie.

Think about it for a second.

If they wanted to discourage copycat criminals, the easiest way to do it would be to claim they seized the crypto, right?

But what proof do we have that the feds actually seized anything? Is the bitcoin transaction publicly listed anywhere where we can audit what happened? And even if you see the coins were moved, how do we know it was actually the feds that moved them and not the actual criminals?

> what proof do we have that the feds actually seized anything?

I'm sure the feds will sell the bitcoin in the fullness of time, like this:

https://www.usmarshals.gov/assets/2020/febbitcoinauction/

Won't they hand them back to the pipeline owner who paid the ransom?

I don’t know, I can thing of reasons not to. They want to discourage companies both from lax security standards and from paying ransoms when they get attacked. Not paying them back would provide economic incentive that even if the DOJ is working to combat hacking, they won’t be saving you from your own incompetence.

Not saying that’s what they will do, just that I think it would make sense to me.

> And even if you see the coins were moved, how do we know it was actually the feds that moved them and not the actual criminals?

If the feds falsely claimed to have done it, the criminals could embarrass them by moving the coins again.

Ugh... because the pipeline is going to ask for that money back?

The "elite" hackers are the ones who wrote the ransomware software. You can tell because (apparently) most of them haven't been caught yet.

Computer security is hard. That's why ransomware attacks exist. It's just as hard for ransomware attackers as for their victims. If they were good at computer security, they'd be working a legitimate job. I find your incredulity strange, it's like hearing about the Valentine's day massacre and being shocked that mobsters could be at the receiving end of a Thompson for once.

> If they were good at computer security, they'd be working a legitimate job.

Um, what? Did you do a survey of all people who are good at computer security?

Furthermore, maybe the attackers _are_ working a legitimate job. Do we know attacker's life details?

"Russians did it!" - the modern Bugs Bunny

>I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host.

They host their hacking tools and other software close to the victim because if you see your network infrastructure logs linking back to an IP address in Russia or China for example it would immediately rise alarm and suspicion.

It always struck me as improbable that all these high profile (and notoriously hard/impossible to attribute) attacks on “critical infrastructure” or whatever are always instantly and authoritatively pinned (by US authorities) on groups operating in the US’s geopolitical enemies.

“Russian hackers” once again, eh?

You find it improbable that geopolitical enemies tend to be the ones that attack us? Feels like saying "I find it weird that people I insult disproportionately punch me in the face".

It's also a very old technique to proxy attacks through countries without extradition treaties.

I don't disagree, obviously. But the question here is if it's reasonable to find that hackers in countries that we consider to be political enemies disproportionately are the ones hacking us.

There are numerous incentives that, to me, make it not only reasonable but extraordinarily likely.

Plus, recent political history and the kinds of benefits delivered by political actors suggest several things: hacking's taken on a special significance as wielded by state actors, there's a considerable amount of delegation to shall we say less expert practitioners who are only loosely controlled, and there's a great deal of effort put forth to deny ANYTHING of the sort ever goes on, ever ever.

To me all this seems par for the course. There's nothing unusual about any of it. It's what you would expect. It's basically like distributed stochastic terrorism, indirectly/loosely driven by a more capable state actor with specific intent to establish deniability.

Not even plausible deniability. Just some convenient way to say 'Nyet! And we are VERY OFFENDED that you would even suggest such a thing!'.

Just the fortunes of war, really.

I think you are assigning too much “us vs them” to the ransomware marketplace.

With ransomware criminals, “us” is the attacker, and “them” is everyone with a computer who might pay. Political boundaries don’t factor in to it at all. It is by nature an anonymous attack, hence the term “ransom”.

It is strange to me that almost all high-profile ransomware attacks that have been publicized in the US are claimed by the FBI to be Russian or Chinese. There are plenty of other countries with greedy criminals that know software, too.

> I think you are assigning too much “us vs them” to the ransomware marketplace.

Attacking things in a foreign jurisdiction is massively appealing from a "what will get me thrown in jail by my own government if things go wrong" perspective. You don't need any political loyalty for that calculation.

The problem is that state-level actors are considerably more sophisticated in their activities than what was seen here. There was a story on HN a while back that can best be summed up as "Defending against this is impossible: Mossad is gonna Mossad and there is nothing you can do about it: https://news.ycombinator.com/item?id=26591669

There's a difference between a criminal who is state sanctioned and a state-level actor.

When your government greenlights criminal activities against their enemies it helps a lot. Many* cyber criminals act as mercs for hire, and are in fact hired for official government operations against the US.

It's simply not true that political boundaries don't factor in. They're a massive part - most obviously, consider extradition or whether the attacker's government will cooperate with the US.

* I say many, but it's more like "it happens", but it feels important to point out.

I always thought it would be fun, if one had enough pull, to get a Letter of Marque and Reprisal issued to oneself snuck onto one of the giant omnibus bills that nobody in the Congress reads in its entirety before voting on it. It could easily be interpreted to cover cyberprivateering.

It is absolutely trivial for an attacker in the US or anywhere to make their ransomware attack appear to come from Russia (to someone who doesn’t know that).

I don't see how that's relevant to the incentives of foreign enemies attacking us. As I said, there are many. It basically stops being criminal activity.

Do you really think that's not the case, or that that isn't going to considerably skew where these attacks come from?

I think he's making the point that the attributions of "This came from <insert geopolitical enemy here>" are without any evidence. How exactly do you determine that a hack originated in Russia when Russian ips will not hand over their traffic to US authorities? Just because a lot of illicit web traffic originates from Israeli servers, for example, does not mean that it originated in Israel. In reality, our cyber security agencies have no idea where these guys are coming from: it COULD very well be from Russia, sure, but it could also be from your neighbor next door who vpn'd in through a chain of servers starting in france and ending in mali.

> I think he's making the point that the attributions of "This came from <insert geopolitical enemy here>" are without any evidence.

Badly, I guess, because no one has mentioned evidence or a lack of evidence anywhere in the thread.

> How exactly do you determine that a hack originated in Russia when Russian ips will not hand over their traffic to US authorities?

There are a lot of different ways. GEOIP is just one method. Examining the artifacts for code-reuse from other malware is another big one. Looking at the types of attacks is another ie: "this malware uses these techniques, and these are favored by groups 1,2,3".

There's a lot more to it than that, and not all of it is public. I've seen attribution done through backdoor channels that were not strictly legal.

> In reality, our cyber security agencies have no idea where these guys are coming from

No, more often than not we definitely do.

That might be easier to believe if these ransomware strains didn't do things like automatically disable themselves on computers with Russian language support installed.

Yes, nobody in the west using a compromised russian box for c&c would ever put such code in their ransomware payload. That would obfuscate its origin, and we all know criminals aren't clever enough for that sort of thing.

There can only be one explanation: russian hackers operating with Putin's tacit approval. Us in the west should add this to the mounting pile of "evidence" supporting going into another cold war, because that will surely improve the entire situation. Attributing the unattributable to our preconceived enemies to escalate a conflict always ends well.

Snark aside, on a technical, factual level, this simply isn't evidence of origin, not even a little bit. "russian hackers" is such a tired punchline now that if I, being in the west, were to suddenly jump the fence after 3 decades and choose A Life Of Crime, using russian configuration file names, UTC+3 daytime operating hours, russian-hosted c&c IPs (or, better yet, russia-controlled but plausibly deniable ones like belarus or kazakhstan), and silly stuff like skipping infection of ru-locale machines would be obvious things I would be doing to fuel this existing narrative sailwind. It's utterly silly to think that this in any way suggests origin.

Exactly, people do not understand how trivially easy it is to completely halt US investigations into internet traffic origins just by pivoting off of a box in a country which doesn't hand over its ip logs to the United States. I would imagine that, should you choose to hack a russian target, you would pivot off of an american box (or would the US hand those logs over? I actually think they might even if Russia wouldn't reciprocate).

Russian and a bunch of other CIS countries. It could very well originate from Moldova or Kazakhstan.

I think you’re conflating a wide range of things: most attacks aren’t linked to those countries and the ones which are often take time to link. Ransomware attacks have been happening frequently for ages, but most of them don’t reach the level where they’re being classed as infrastructure attacks — they’re gangs of opportunists looking for easy money. You find them in countries like Russia because there are only a few places which don’t cooperate with US/EU law enforcement, especially at the level where someone without powerful backers can rely on it. These guys caught a much bigger fish than they were prepared for and weren’t anywhere close to being prepared for a nation-state to seriously pursue them. Anyone trying this from most other countries would either be caught or much better at staying hidden.

Well, "Russian hackers" doesn't mean, Russian military. If I was a Russian hacker, and didn't want to piss off my own government, I may well consider that my best targets would be my country's political enemies. From what I hear, it might even eventually get you a sweet job with gov.

There are only a few countries which don't extradite cybercriminals to the west and don't prosecute them for foreign attacks - so these few countries are very attractive from which to run such operations; and even for international crime organizations it's good to have the "dirty work" done from such places, where the grunts won't get arrested and be motivated to sell you out for a plea deal.

The problem is you don't even have to run your operation from the country: you just have to pivot off of a box in that country as part of your obfuscation chain. In Cyber Security land, a lot of bad actors originate out of Israel, but that doesn't mean they originated there.

It’s well known that the Kremlin is very hospitable to cyber criminals as long as the stay away from the Soviet bloc. It also just so happens that a country with that sort of reckless policy, has lots of other bad policies which make them an enemy of the US and many other countries…

It’s not a conspiracy. You just have the cause and effect backwards.

I can't think of a better place to launch an attack on the US than the US's geopolitical enemies, can you?

I recall seeing on HN lots of descriptions of just how hard it is to maintain strict opsec, or anonymity. Obscurity sometimes is the best security, but these clowns made themselves a big a$$ target for the FBI. Its one thing to be one among hundreds of small-time ransomware attacks, and another to be the one behind shifting the price of oil of the entire southeast US, and to be the subject of thousands of memes about Americans stockpiling gasoline in the backs of their SUVs.

Agreed, there is something that is not being told here.

Maybe the US struck a deal with whoever did this to safe face or something.

Indeed was just discussing the same thing. Perhaps they simply are tracking if the money goes anywhere or using this as a way to hide their incompetence? Just saying they can do something they really can’t or put a legal hold on that wallet so if any exchange receives it they get fined?

Alot of professional criminals are such because they aren't competent enough to make money legally.

Also, how exactly do you "seize" cryptocurrency without hard forking it?

They send it to another wallet/account that they control. Not hard to understand.

And if they don't send? With electronically stored fiat, the feds can just ask the bank to give them the money right out of their account, and I'm sure the banks would cooperate. With paper cash they can just hold their arm while the SWAT team go on a rampage through their bedsheets for the cash.

What does one do for Bitcoin, short of a hard fork?

In crypto „seizing” means getting access to the wallet and sending funds to the one that gov’t has under it’s sole control

How do they get access to the wallet, assuming the dude won't tell them? With fiat they can do it with force, that's the difference. If the dude won't tell them they have no way to get access to it, other than the $5 wrench.

> If the dude won't tell them they have no way to get access to it, other than the $5 wrench.

This assumes perfect opsec: the guy is unphishable, has a quick-response switch to wipe their computers when their house is raided, etc. They get a lot of people through simple gaps: bust the door down when the target is in the bathroom, grab the unlocked computer in a public setting, etc.

The other big assumption is that the only copy of the key belonged to someone in the gang who is a high-value target. If it’s an exchange, they need to make an official request. Someone offering laundering services or a lower-value person in the gang, the offer is likely going to be offered a plea bargain for cooperating to get bigger fish versus a much longer sentence.

Even if it is the most culpable member of the gang, the prospect of a very long prison sentence versus something shorter is going to weigh heavily — especially if you know that they’re just going to leave you in jail until you give them the key anyway.

If the key is solely located only in the hacker's brain, yes it is out of their reach. Usually, however, if you gain access to the hacker's comp, they'll have it written down somewhere.

Maybe they go through their bedsheets looking for the passphrase written on a sticky note? I'm sure US intelligence can be quite persuasive.

That would require a hard fork or the key to the sending utxo.

I was assuming they are able to obtain the key. Nobody believes hard forking is a practical solution to seizure.

Exactly. Until DOJ provides proof, this is pure FUD.

Anyone competent enough to extort a foreign company out of millions is not going to attempt to cash out through an exchange.

Are you saying the government didn’t actually recover the money that they claim to have recovered?

I think, at this point, doubting anything the government claims without hard evidence proving their case is the wiser play based on pure pattern recognition.

When the FBI sells the coins won't it be pretty obvious?