8 ms·

Tally of Cyber Extortion Attacks on Tech Companies Grows

36 points by mantraxC 12y ago

mantraxC 12y ago
I posted this because I found it of particular interest that the blackmailers ask for payment in Bitcoin. It makes you think if Bitcoin is turning into a giant example of "be careful what you wish for". We have exchange after exchange get hacked and legit Bitcoin users losing their money, and now Bitcoin enables extortion schemes that couldn't work so effortlessly before. Where is this going?
- Tloewald 12y ago
  Bitcoin — assuming it works — also becomes the perfect currency for kidnappers and blackmailers. Awesome, huh?
  - thinggowrrong 12y ago
    yup, we can't have the cake and eat it too. we have to learn how to minimize risks and keeping bitcoin alive
    - deleted 12y ago
      [deleted]
  - jgrowl 12y ago
    You mean like straight cash has been up until now?
    - sanswork 12y ago
      Yup. Except straight cash still needs someone to physically collect it which leaves a point of failure in the crime and a good place for authorities to catch the bad guys. Bitcoin removes that.
      - kolinko 12y ago
        But gives another ways to track the money that was paid. It's a matter of authorities catching up with the technology.
        sanswork 12y ago
        The very nature of it makes it much easier for criminals to avoid authorities once payment is made though. Sure you can screw up and do something stupid like send it to coinbase and cash out but there are lots of ways to use it without the authorities being able to determine your identity or location.
- bunderbunder 12y ago
  > Where is this going? Not far's my guess. If BTC gets too popular as a tool for extortion and money laundering, then the authorities in developed countries are going to start carefully monitoring people who sell large quantities of BTC for sovereign currency or commodities. It would just be another part of their general efforts to combat organized crime. That would make major speculators feel less welcome. If major speculators decide to take their ball and go play somewhere else, the price of BTC will probably tank. That'll discourage everyone else. At which point BTC becomes a terrible medium for money laundering because nobody wants to buy them. I also suspect that the relative anonymity of any one transaction is closely related to overall transaction volume in the BTC economy.
  - dublinben 12y ago
    These organizations aren't in developed countries, so their potential cash-outs wouldn't be noticed. Going forward, I would expect even more of the expenses of running an online criminal operation to be payable in BTC, so you wouldn't even need to convert it.
- Shinkei 12y ago
  Bitcoin is only pseudoanonymous. At some point, the 'bad actor' has to access 'legitimate' banking institutions to exchange the Bitcoins to fiat and that is the weakest link. It requires reporting to relevant tax or other authorities based on arbitrary (and secret) amounts, but targets money laundering, drug trade, gamlbing, etc. I suppose if I had to throw a potentially disruptive idea out there, you could create a database of 'blacklisted addresses.' Let's say when Bitlocker came out, you entered that address into a database and it was verified as being associated with this scam, well it is trivial to track those coins between addresses and every address it enters is blacklisted until it enters a mixer or exchange, at which point you have a potentially complicit corporation that you could actually target with the subpoena or other legal action for discovery of IPs, login, etc.
  - dsl 12y ago
    People have suggested this before. A bad actor then just takes 100 illicit bitcoins and sprinkles them in random amounts across many addresses, 11 to himself at another address, 6 to a non-profit, and 14 to you. You are now indistinguishable from the bad guy.
    - Shinkei 12y ago
      I can't say I would complain if thousands of dollars was given to my address, but you are right... it would represent a difficult problem for enforcement and creative people would come up with clever workarounds.
  - mantraxC 12y ago
    > "At some point, the 'bad actor' has to access 'legitimate' banking institutions to exchange the Bitcoins to fiat and that is the weakest link." And on the contrary they can do the exchange in, say, Nigeria. So Bitcoin's weakest link is also the law enforcement weakest link, because no one has authority over the entire world, and there are plenty of spots where you can do the exchange without trace.
codeddesign 12y ago
i dont get it...why not just switch your dns to cloudflare or a similiar service and run under their protection?
- _up 12y ago
  Feedly did that and was down anyway. Though im interested what they did to stop it.
- joncameron 12y ago
  Right there in the article... Moz signed up with CloudFlare "but Mr. Skinner said the attacker has found new ways to attack their systems." Does anyone know what that might be? There are quite a few people on HN who have zero sympathy for DDoS victims who don't pony up for Cloudflare etc., but I'm curious about situations when that isn't going to help or other attack vectors that will get you regardless.
  - ceejayoz 12y ago
    The underlying hosting that CloudFlare proxies to can be attacked, for one.
- liveoneggs 12y ago
  Maybe your origin has been discovered already.
- opendais 12y ago
  If you have MX records on a cloudflare enabled domain you have to expose the Ip address of your mail server: https://support.cloudflare.com/hc/en-us/articles/200168536-Why-do-I-have-a-dc-subdomain- https://support.cloudflare.com/hc/en-us/articles/200168536-W... If that is in the same DC as the rest of your equipment [or worse, the same server] it might be still possible to figure things out and DDoS you. The underlying hosting is just as vulnerable w/ or w/o Cloudflare. Last week someone spinning up their own botnet threw like 1Gbps at a side project of mine via UDP at the mail server.
- dsl 12y ago
baudehlo 12y ago
And one that resulted in a full shut down: http://www.codespaces.com/ http://www.codespaces.com/
- shiven 12y ago
  Looking at the armchair post-mortems on HN, they had it coming, one way or another. Putting your only backups the same place you host your full product? Priceless foolhardiness!
  - baudehlo 12y ago
    Tough call. S3 is supposed to have 99.999999999 (or whatever) reliability (not uptime, just storage reliability). It's hard to justify backing up to somewhere else when they give you that figure.
    - shiven 12y ago
      All your family jewels in one place? Accessible from a common front-panel? Abso-f-ing-lutely NO offline backups that count? Like I said, they had it coming. Seriously, if you don't have the code-and-data backup that will enable you to switch service providers, even with a downtime penalty, then you and your SAAS truly have it coming. If these guys had any real backups, they could have let the clusterfuck at AWS play out the way it did and still be able to upload everything to DigitalOcean or a colo or whatever and still come back alive a month later. Now that 99.999999999999999 (ad nauseaum) ain't worth squat, is it? I mean, basic (Dev)-Ops-(Sec), real basic. But, then again, I'm just another armchair, after-the-fact, analyst-dude on the internet.
nitrogen 12y ago
DDoS attacks like this wouldn't be so easy if governments actively fixed backdoors in hardware and software instead of creating and stockpiling them. Much harder to build a botnet if there are fewer vulnerable systems to recruit via exploits.
- mpyne 12y ago
  > DDoS attacks like this wouldn't be so easy if governments actively fixed backdoors in hardware and software instead of creating and stockpiling them. The same thing keeping government from regulating the Internet is the same thing keeping government from simultaneously fixing every flaw in every router, switch, and TCP/IP stack. Stockpiling has nothing to do with it by itself, as they are stockpiling individual numbers of bugs in an entire frothing sea of bugs. NSA didn't even know about Heartbleed, and that's one that could have enormously aided NSA in doing what they do.
  - NotAtWork 12y ago
    > NSA didn't even know about Heartbleed Source?
    - mpyne 12y ago
      http://icontherecord.tumblr.com/post/82416436703/statement-on-bloomberg-news-story-that-nsa-knew http://icontherecord.tumblr.com/post/82416436703/statement-o... But also, straight from the mouth of a USCYBERCOM strategist speaking to our class the other week. And also, just plain logic. I pointed out here on HN even before the ODNI released the statement I linked above that Heartbleed is far more damaging to the USG itself than any intel value NSA could have hoped to achieve from it. With the other vulns NSA would have stockpiled they don't need Heartbleed, and leaving Heartbleed open would have hurt a lot of USG (and just as importantly, private US) infrastructure, so even going by crazy USG logic the right thing to do would have been to disclose it, just as NSA has fixed other open source security flaws over the years.
      - NotAtWork 12y ago
microcolonel 12y ago
Anyone want to start a registry of threatening bitcoin addresses, so we can prevent funds from these transactions from being used? (aside from paying other organized criminals)
- _delirium 12y ago
  Isn't that difficult to enforce, unless you also blacklist the public mixers? It's easy to launder moderate amounts of Bitcoins through the mixers, after which blacklisting the original wallets would no longer impede the money being spent. Though if the major mixers were willing to go along with such a blacklist it'd get considerably more effective.
  - microcolonel 12y ago
    You can track the amount through the transaction logs though, and mixers don't want to get stuck with bitcoins which will eventually be invalidated by other parts of the ecosystem. Not a perfect idea at this point though, it'd require considerable organization to get this done, certainly better than throwing away Bitcoin or waiting for it to become criminalized. IMHO
jqm 12y ago
It's amazing to me that people would screw around with this for 2 or 3 hundred dollars. I realize wages are low in many parts of the world and this might represent a significant amount of money, but anyone with access to the resources and possessing the technological know how, to pull this off maybe could make that in a legitimate way. I have no idea, but maybe state actors are involved. Maybe it is a low level warning of what "could" be done. Probably not... but maybe. $300 doesn't seem like it would be worth the trouble and risk but maybe it is.
troels 12y ago
One thing I don't quite understand - wouldn't it be possible to unravel a botnet? If you acquire one of the infected machines, a bit of reverse engineering (or perhaps just monitoring its network traffic) should presumably be able to reveal where it gets instructions from. It would probably take the cooperation of law enforcement, but assuming that, wouldn't it be possible - even practical - to do?
- Mandatum 12y ago
  Yes, in the past when they were more centralized with only a few IRC/C&C's this was an easy solution. However now, a botmaster is able to generate thousands of C&C centers's from hacked boxes, via hidden TOR or I2P nodes, or shared hosting, as well as hundreds of thousands of varying infected malware almost instantly. The only thing that requires effort from the botmaster now is spreading and constantly updating their slaves so they can keep them in control longer. The actual implementation is the easy part of it.
  - troels 12y ago
    I see. Still, the attacker has multiple surfaces to try and trace them through. Unless they are very careful, you would expect that they tend to slip every now and then, making it possible to find them? I would imagine that a dedicated security team within law enforcement would be able to get a pretty good success rate, but that doesn't appear to be the case?

36 points by mantraxC 12y ago

I posted this because I found it of particular interest that the blackmailers ask for payment in Bitcoin. It makes you think if Bitcoin is turning into a giant example of "be careful what you wish for". We have exchange after exchange get hacked and legit Bitcoin users losing their money, and now Bitcoin enables extortion schemes that couldn't work so effortlessly before. Where is this going?

Tloewald 12y ago
Bitcoin — assuming it works — also becomes the perfect currency for kidnappers and blackmailers. Awesome, huh?
- thinggowrrong 12y ago
  yup, we can't have the cake and eat it too. we have to learn how to minimize risks and keeping bitcoin alive
  - deleted 12y ago
    [deleted]
- jgrowl 12y ago
  You mean like straight cash has been up until now?
  - sanswork 12y ago
    Yup. Except straight cash still needs someone to physically collect it which leaves a point of failure in the crime and a good place for authorities to catch the bad guys. Bitcoin removes that.
    - kolinko 12y ago
      But gives another ways to track the money that was paid. It's a matter of authorities catching up with the technology.
      - sanswork 12y ago
        The very nature of it makes it much easier for criminals to avoid authorities once payment is made though. Sure you can screw up and do something stupid like send it to coinbase and cash out but there are lots of ways to use it without the authorities being able to determine your identity or location.
bunderbunder 12y ago
> Where is this going? Not far's my guess. If BTC gets too popular as a tool for extortion and money laundering, then the authorities in developed countries are going to start carefully monitoring people who sell large quantities of BTC for sovereign currency or commodities. It would just be another part of their general efforts to combat organized crime. That would make major speculators feel less welcome. If major speculators decide to take their ball and go play somewhere else, the price of BTC will probably tank. That'll discourage everyone else. At which point BTC becomes a terrible medium for money laundering because nobody wants to buy them. I also suspect that the relative anonymity of any one transaction is closely related to overall transaction volume in the BTC economy.
- dublinben 12y ago
  These organizations aren't in developed countries, so their potential cash-outs wouldn't be noticed. Going forward, I would expect even more of the expenses of running an online criminal operation to be payable in BTC, so you wouldn't even need to convert it.
Shinkei 12y ago
Bitcoin is only pseudoanonymous. At some point, the 'bad actor' has to access 'legitimate' banking institutions to exchange the Bitcoins to fiat and that is the weakest link. It requires reporting to relevant tax or other authorities based on arbitrary (and secret) amounts, but targets money laundering, drug trade, gamlbing, etc. I suppose if I had to throw a potentially disruptive idea out there, you could create a database of 'blacklisted addresses.' Let's say when Bitlocker came out, you entered that address into a database and it was verified as being associated with this scam, well it is trivial to track those coins between addresses and every address it enters is blacklisted until it enters a mixer or exchange, at which point you have a potentially complicit corporation that you could actually target with the subpoena or other legal action for discovery of IPs, login, etc.
- dsl 12y ago
  People have suggested this before. A bad actor then just takes 100 illicit bitcoins and sprinkles them in random amounts across many addresses, 11 to himself at another address, 6 to a non-profit, and 14 to you. You are now indistinguishable from the bad guy.
  - Shinkei 12y ago
    I can't say I would complain if thousands of dollars was given to my address, but you are right... it would represent a difficult problem for enforcement and creative people would come up with clever workarounds.
- mantraxC 12y ago
  > "At some point, the 'bad actor' has to access 'legitimate' banking institutions to exchange the Bitcoins to fiat and that is the weakest link." And on the contrary they can do the exchange in, say, Nigeria. So Bitcoin's weakest link is also the law enforcement weakest link, because no one has authority over the entire world, and there are plenty of spots where you can do the exchange without trace.

codeddesign 12y ago

i dont get it...why not just switch your dns to cloudflare or a similiar service and run under their protection?

_up 12y ago
Feedly did that and was down anyway. Though im interested what they did to stop it.
joncameron 12y ago
Right there in the article... Moz signed up with CloudFlare "but Mr. Skinner said the attacker has found new ways to attack their systems." Does anyone know what that might be? There are quite a few people on HN who have zero sympathy for DDoS victims who don't pony up for Cloudflare etc., but I'm curious about situations when that isn't going to help or other attack vectors that will get you regardless.
- ceejayoz 12y ago
  The underlying hosting that CloudFlare proxies to can be attacked, for one.
liveoneggs 12y ago
Maybe your origin has been discovered already.
opendais 12y ago
If you have MX records on a cloudflare enabled domain you have to expose the Ip address of your mail server: https://support.cloudflare.com/hc/en-us/articles/200168536-Why-do-I-have-a-dc-subdomain- https://support.cloudflare.com/hc/en-us/articles/200168536-W... If that is in the same DC as the rest of your equipment [or worse, the same server] it might be still possible to figure things out and DDoS you. The underlying hosting is just as vulnerable w/ or w/o Cloudflare. Last week someone spinning up their own botnet threw like 1Gbps at a side project of mine via UDP at the mail server.
dsl 12y ago

baudehlo 12y ago

And one that resulted in a full shut down: http://www.codespaces.com/ http://www.codespaces.com/

shiven 12y ago
Looking at the armchair post-mortems on HN, they had it coming, one way or another. Putting your only backups the same place you host your full product? Priceless foolhardiness!
- baudehlo 12y ago
  Tough call. S3 is supposed to have 99.999999999 (or whatever) reliability (not uptime, just storage reliability). It's hard to justify backing up to somewhere else when they give you that figure.
  - shiven 12y ago
    All your family jewels in one place? Accessible from a common front-panel? Abso-f-ing-lutely NO offline backups that count? Like I said, they had it coming. Seriously, if you don't have the code-and-data backup that will enable you to switch service providers, even with a downtime penalty, then you and your SAAS truly have it coming. If these guys had any real backups, they could have let the clusterfuck at AWS play out the way it did and still be able to upload everything to DigitalOcean or a colo or whatever and still come back alive a month later. Now that 99.999999999999999 (ad nauseaum) ain't worth squat, is it? I mean, basic (Dev)-Ops-(Sec), real basic. But, then again, I'm just another armchair, after-the-fact, analyst-dude on the internet.

nitrogen 12y ago

DDoS attacks like this wouldn't be so easy if governments actively fixed backdoors in hardware and software instead of creating and stockpiling them. Much harder to build a botnet if there are fewer vulnerable systems to recruit via exploits.

mpyne 12y ago
> DDoS attacks like this wouldn't be so easy if governments actively fixed backdoors in hardware and software instead of creating and stockpiling them. The same thing keeping government from regulating the Internet is the same thing keeping government from simultaneously fixing every flaw in every router, switch, and TCP/IP stack. Stockpiling has nothing to do with it by itself, as they are stockpiling individual numbers of bugs in an entire frothing sea of bugs. NSA didn't even know about Heartbleed, and that's one that could have enormously aided NSA in doing what they do.
- NotAtWork 12y ago
  > NSA didn't even know about Heartbleed Source?
  - mpyne 12y ago
    http://icontherecord.tumblr.com/post/82416436703/statement-on-bloomberg-news-story-that-nsa-knew http://icontherecord.tumblr.com/post/82416436703/statement-o... But also, straight from the mouth of a USCYBERCOM strategist speaking to our class the other week. And also, just plain logic. I pointed out here on HN even before the ODNI released the statement I linked above that Heartbleed is far more damaging to the USG itself than any intel value NSA could have hoped to achieve from it. With the other vulns NSA would have stockpiled they don't need Heartbleed, and leaving Heartbleed open would have hurt a lot of USG (and just as importantly, private US) infrastructure, so even going by crazy USG logic the right thing to do would have been to disclose it, just as NSA has fixed other open source security flaws over the years.
    - NotAtWork 12y ago

microcolonel 12y ago

Anyone want to start a registry of threatening bitcoin addresses, so we can prevent funds from these transactions from being used? (aside from paying other organized criminals)

_delirium 12y ago
Isn't that difficult to enforce, unless you also blacklist the public mixers? It's easy to launder moderate amounts of Bitcoins through the mixers, after which blacklisting the original wallets would no longer impede the money being spent. Though if the major mixers were willing to go along with such a blacklist it'd get considerably more effective.
- microcolonel 12y ago
  You can track the amount through the transaction logs though, and mixers don't want to get stuck with bitcoins which will eventually be invalidated by other parts of the ecosystem. Not a perfect idea at this point though, it'd require considerable organization to get this done, certainly better than throwing away Bitcoin or waiting for it to become criminalized. IMHO

jqm 12y ago

It's amazing to me that people would screw around with this for 2 or 3 hundred dollars. I realize wages are low in many parts of the world and this might represent a significant amount of money, but anyone with access to the resources and possessing the technological know how, to pull this off maybe could make that in a legitimate way. I have no idea, but maybe state actors are involved. Maybe it is a low level warning of what "could" be done. Probably not... but maybe. $300 doesn't seem like it would be worth the trouble and risk but maybe it is.

troels 12y ago

One thing I don't quite understand - wouldn't it be possible to unravel a botnet? If you acquire one of the infected machines, a bit of reverse engineering (or perhaps just monitoring its network traffic) should presumably be able to reveal where it gets instructions from. It would probably take the cooperation of law enforcement, but assuming that, wouldn't it be possible - even practical - to do?

Mandatum 12y ago
Yes, in the past when they were more centralized with only a few IRC/C&C's this was an easy solution. However now, a botmaster is able to generate thousands of C&C centers's from hacked boxes, via hidden TOR or I2P nodes, or shared hosting, as well as hundreds of thousands of varying infected malware almost instantly. The only thing that requires effort from the botmaster now is spreading and constantly updating their slaves so they can keep them in control longer. The actual implementation is the easy part of it.
- troels 12y ago
  I see. Still, the attacker has multiple surfaces to try and trace them through. Unless they are very careful, you would expect that they tend to slip every now and then, making it possible to find them? I would imagine that a dedicated security team within law enforcement would be able to get a pretty good success rate, but that doesn't appear to be the case?