Hacker News Reader

Hacker News

Comment by mbaha | Hacker News Reader

Full thread

mbaha

A friend sent me the bitcoin address, they've already collected 2600$.

[EDIT] Now 3230$

Source: https://blockchain.info/address/1Mz7153HMuxXTuR2R1t78mGSdzaA...

View on HN

I like one of the more recent transactions:

https://blockchain.info/tx/82698e1f2fbf31914019da738e24515ae...

For 0.0000666 BTC. Sender is theoretically 1FuckYouRJBmXYF29J7dp4mJdKyLyaWXW6

The only other transaction that account has made was to one of the WannaCry addresses. Also a tiny amount.

Similarly, with regards to 666ing: https://www.reddit.com/r/SheepMarketplace/comments/1rvlft/i_...

Very interesting read

Thanks for the address, I made a live counter here: https://franciskim.co/petya-ransomware-live-counter-ransom-d...

Refreshes every 2 seconds.

it seems like a trivially avoidable mistake to use a single wallet for all collections, but maybe i shouldn't be giving them ideas...

how do you konw it's only one wallet

Every infection is showing the same address.

Why do you think it a mistake?

Because now we can watch those funds and know how much money they made, we can watch them to see if they make a mistake.

If every address was different we'd have no idea how much money they're making and only funds paid by people who also reported them would be tainted by the long eyeball of the law.

It does not seem like something wrong directly. I also think showing off might be intention.

They should have pre-loaded more onto the wallet to give the impression that most people are paying.

Less than £10K USD gives the impression that nobody is paying.

It is the same psychology as a product only getting a couple of two star reviews - you don't buy it, you go for the product with hundreds of 4-5 star reviews instead.

Preloading money leaves a paper trail

Probably not viable right now because of the ridiculously high transaction fees.

Transaction fees only need to be high if you are in a hurry. If you can wait a week or two you can go with very small TX fees. As you can see in this graph even very low (5 to 10 Satoshi per byte) fee transaction are confirmed eventually. https://jochen-hoenicke.de/queue/#24h

Okay, then my theory is trash. They just weren't smart about it, then.

Update: Over $4000 now

What a clickbait headline. A paltry $3k and yet the article calls this a "MASSIVE ransomware outbreak". I would be curious to see what a "minor" outbreak is.

it's not, my previous company took everything offline - they got infected via connections to their offices in Ukraine. lots of companies in the Ukraine are infected.

company I work for disabled all working from home VPN accounts for the time being until we do a security audit

There are reports of hundreds to thousands of machines infected across multiple firms in multiple countries. I'd bet >99% of people are never gonna send the $300 in bitcoin to decrypt their machine, instead they'll just clean and restore as much as they can. The $3k is 11 people desperate to restore all their data now, more may come in the future after people have exhausted other options, but the vast majority will never pay unless their backups were hit too.

Exactly. This is a huge attack. The amounts paid don't mean a thing.

Seems like a better approach would be to have the ransom increase higher after every person that paid. Just so you'd have some competetion to pay sooner.

obviously, that number will grow

In Ukraine, banking services nationwide as well as credit card payments on the metro in Kiev, and the airport IT systems, are all down. At what point do we call it massive? When US banks and airports start having trouble?

That's interesting. I've heard a lot about Russia testing out cyberwarfare in Ukraine as a possible proving ground for future targets. Was Ukraine the hardest hit by this latest one?

It'd be interesting if this were actually made to take down infrastructure under the guise of ransomware.

Apparently initially the thing spread through the update of a popular Ukrainian accounting software [1], infecting a lot of networks of Ukrainian companies.

[1] me-doc.com.ua

Ukraine seems to be explicitly targeted, with the initial distribution happening already for some time but having a trigger to start lateral infection (which would be detectable) only 27th June 10:30 ( https://twitter.com/CyberpoliceUA/status/879825132088426499 ) and the actual ransom attacks only some hours after that; so it was intended to spread locally before attracting global attention.

The conversion rate is likely very, very low for these, especially so soon after infection.

You are right. I misjudged.

Amount of money collected != scale of attack. Number of machines + importance of companies/systems = scale of attack.

Reply on news.ycombinator.com