News for hackers. Stuff that matters.
Re:DEV-0537 targeting organizations for data exfiltration an... by toyg on Wednesday March 23, 2022 @08:37AM (#30777804)
Microsoft: "these are bad guys motivated by theft and destruction, practicing extortion as a business model"

HN: "These are kids doing it for the lulz"

I'm hardly a MS supporter, but the facts seem to be on MS side here. The minute you pay somebody to gather access and then proceed to blackmail the organisation, you are organized crime. Just because they brag about it, it doesn't mean they're in it for the fun; they just think they are untouchable because they're outside US territory.

It is somewhat sad that this can even be considered "hacktivism" these days. Extortion has nothing to do with activism.

Re:DEV-0537 targeting organizations for data exfiltration an... by mrkramer on Wednesday March 23, 2022 @08:55AM (#30777951)
One month ago in my country(Croatia) a high school pupil hacked big Telecom/ISP, stole personal information of 100 000 customers and demanded $500 000 extortion fee so he won't leak all that personal information he stole. Kids are not alright these days; this guys are most likely not kids but they are not your typical cybercriminals who operate in stealth. They are all out/public about their operations and hacks and that's not how financially motivated adversaries act.
Re:DEV-0537 targeting organizations for data exfiltration an... by scotty79 on Wednesday March 23, 2022 @03:34PM (#30782355)
> ... a high school pupil hacked big Telecom/ISP, stole personal information of 100 000 customers and demanded $500 000 extortion fee

I think it's a sign of a cultural shift. Not in hacking but in perception of money.

Money used to have this unique value, representing work somebody has put in.

Nowadays real money is increasingly looking like some dumb in-game currency, generally useful only for buying cosmetics and consumables. Awarded arbitrarily, so some people and organisations have awarded themselves or cheesed out of others completely astronomical amounts of it. And on the low end you might doing three job-quests every day and still not have enough for consumables you need daily just to play the game without suffering too much.

Governments apparently are able to pull hundred billions out of their a-ses to buy bunch of tanks from whomever despite lamenting poor economy just a while ago.

In the eyes of the kid demanding 500k RL karma points is not a crime, just trying to utilize opportunity similar to those so many old folk already apparently exploited. Because there's no way they could earn it by working average job.

Re:DEV-0537 targeting organizations for data exfiltration an... by mrkramer on Wednesday March 23, 2022 @08:06PM (#30785117)
>I think it's a sign of a cultural shift. Not in hacking but in perception of money.

I think it is cultural shift in both hacking and in money. Computers and internet enabled kids to consume unlimited amount of information, it enabled them to learn, communicate and play around easier than ever. Some of them play video games and some of them play with "hacking". Hacking is something like stealing money from other kids but nowadays it is in the digital realm and not only stealing money from other kids but stealing money from everybody.

On the other hand there are cryptocurrencies which enabled them to move money around with ease and without any legal requirements. It's not like the underaged high school kid could open a bank account and then demand extortion payment to be made. The only thing he must do is to download a Bitcoin wallet.

But I agree with your assertion that the line is blurred between hard cash and digital cash including in-game currencies, cryptocurrencies plus all other digital representations of value.

Re:DEV-0537 targeting organizations for data exfiltration an... by arsunol on Thursday March 24, 2022 @02:35PM (#30793717)
its not really the kind of cultural shift you think it is, the world gets more and more competitive each day and if you view this from the perspective of a high schooler, you can see its not as easy as it was 10 or 20 years before, the motivation is not just for fun or have money to spend on "wants", its rather money to survive in this world where competitiveness is too high for some, as a fellow high schooler i say this
Re:DEV-0537 targeting organizations for data exfiltration an... by mrkramer on Thursday March 24, 2022 @05:49PM (#30795745)
But do you realize if you get caught you will go to jail and your competitiveness goes to zero instantly; not only in the present but also in the future because ex-convicts are having a hard time finding a job.

>you can see its not as easy as it was 10 or 20 years before

It was never easy. In the past living standards were lower and there was less education available hence 90% of people were farmers with no education or very little formal education.

Re:DEV-0537 targeting organizations for data exfiltration an... by ASalazarMX on Wednesday March 23, 2022 @04:34PM (#30782978)
This a very insightful take on the current crypto and hacking cultures. Some people literally hoard money like dragons, then the megacorporations buy anything that threatens their virtual monopolies, then the rulers make questionable decisions that seem against the public good. The game feels rigged, and some people are tired of it and trying to play by other rules or plainly cheat.

People who (like many of us HN readers) can live well playing by the rules are the NPCs.

Re:DEV-0537 targeting organizations for data exfiltration an... by ethbr0 on Wednesday March 23, 2022 @09:48AM (#30778418)
Are we surprised there's a hacker equivalent to WallStreetBets? "I bet it all on black" etc.

I think both speak to the mindset of our times for a large segment of the population.

Re:DEV-0537 targeting organizations for data exfiltration an... by scotty79 on Wednesday March 23, 2022 @01:43PM (#30781155)
> Microsoft: "these are bad guys motivated by theft and destruction, practicing extortion as a business model"

> HN: "These are kids doing it for the lulz"

Who are you gonna trust on that? Salary worshiping corporate security drones? Or a random guy on HACKER News?

Re:DEV-0537 targeting organizations for data exfiltration an... by tinus_hn on Friday March 25, 2022 @09:37AM (#30802004)
Why can’t it be both? Plenty of movies about ruthless mafiosi bragging about their exploits.
Re:DEV-0537 targeting organizations for data exfiltration an... by andybak on Wednesday March 23, 2022 @08:55AM (#30777949)
> partially financially motivated, partially hacktivist and partially bragging around

Didn't you slightly oversimplify there?

Re:DEV-0537 targeting organizations for data exfiltration an... by mrkramer on Wednesday March 23, 2022 @09:05AM (#30778040)
They are impossible to decipher because their demands are changing[0].

Their extortion of Nvidia:

"Remove a feature known as LHR, short for "Lite Hash Rate," or see the further leaking of stolen data."

"We decided to help mining and gaming community," Lapsus$ members wrote in broken English. "We want nvidia to push an update for all 30 series firmware that remove every lhr limitations otherwise we will leak hw folder. If they remove the lhr we will forget about hw folder (it's a big folder). We both know lhr impact mining and gaming."

"Lapsus$ modified its demand. Now, the group also wants Nvidia to commit to making its GPU drivers completely open source. If Nvidia does not comply, Lapsus$ says, the company can expect to see a new leak that would include the complete silicon, graphics, and computer chipset files for all its recent GPUs."

[0] https://arstechnica.com/information-technology/2022/03/cyber...

Re:DEV-0537 targeting organizations for data exfiltration an... by toyg on Wednesday March 23, 2022 @09:11AM (#30778092)
That's either extremely naive, or just a diversion while they go about something else.
Re:DEV-0537 targeting organizations for data exfiltration an... by rolph on Wednesday March 23, 2022 @11:57AM (#30779820)
yes it is a method, to observe, profile, then troll someone into creating an opening or leverage