Hacker News Reader

Comment by judge2020 | Hacker News Reader

judge2020

Since WeChat is a central authority, it would be foolish to ask for payment to the ransomware author's actual WeChat ID. It's very likely whatever ID they're asking for payments to is automatically generated/pulled/guess/etc so that the ransomeware's only purpose is to cause havoc and/or waste the government's time. If the ransomware was created to earn money it would ask for cryptocurrency like all the others, but then it wouldn't have made as many headlines.

View on HN

Alternative possibility: given the simple, traceable, almost begging-to-be-caught nature of the malware, and that it so easily led researchers to a name and address of a potential author, perhaps its goal is actually to frame someone... to take out a rival hacker, revenge, lulz, ...?

Not saying it's what's actually happening here, but it's something that has crossed my mind before about malware - that it would be comparatively easy to lead one or more false trails to shift blame for whatever reason, and I wonder how many pieces of malware have actually managed to pull this off, and pinned the blame on an obvious target, e.g. Chinese government, "russian hackers", etc.

What's to say the Chinese Government didn't infect the machines and use it to pin the blame on someone they wanted neutralized?

Because they don't justification to take someone down. If the Party could take down high ranking Party members like Bo Xilai or massively popular celebs like Fan Bingbing or foreign citizens like that Swedish publisher or a group of people like the million Uighurs, they hardly need an elaborate scheme like this to take someone into custody.

You're overthinking it.

I guess it depends on the image they want to project and the message they want to send. Sometimes there is a political end to a Government's posturing. Sometimes it's more than the end they're looking for, sometimes they need to set the scene first to control the narrative in a way that sells the story they want for their own political gain.

It's the game of wits from Princess Bride. They might want to take someone out, so you can't choose the wine in front of you. But, they must know you know that, so you can't choose the wine in front of them. But they may be trying to protect their image, and if so, you can't choose the wine in front of them either.

I heard recently about the degree of rivalry between Chinese Hacker groups and how some get rid of competition by framing them for attacks. Which is absolutely brutal if you remember some hacking offenses face the death penalty.

That, or the creator is just stupid

Reads to me like someone writing viruses that doesn't know a thing about writing viruses

> "Reads to me like someone writing viruses that doesn't know a thing about writing viruses"

someone who infected 100,000 machines knows at least 'a thing' about writing viruses

I mean yes, it is a remarkable technical achievement.

To use the analogy of an art thief, this is as if he had simply smashed some glass and made a run for it, without dealing with security systems and whatnot. He might make it out the door, but now the museum has him on video, they have his fingerprints, and they're probably going to get the stolen art back.

A person capable of writing even a simple virus is not an idiot. How can you live in China and not be aware how these things work?

Why not just use mules (if that's the right term)?

The world has no shortage of desperate people who will jump at the chance to earn a few bucks "working from home," where they help "hardworking businessmen between banks" move money. Perhaps the excuse is different and culture-specific, but peoples' inclination to look the other way when they think it benefits them is universal.

It's very likely whatever ID they're asking for payments to is automatically generated/pulled/guess/etc

If that's true then it's kind of like the robin hood of malware.

Twist: use the previous victim as a recipient for the payment.

This would create an interesting spread incentive for the attack: once you are infected and you pay, you can still be reimbursed if you manage to infect someone else. You could even make this into a pyramid where several person's payment go to a parent carrier, and people will even want to be infected quickly to be closer to the top of the pyramid.

Or just use a random previous victim id. Now it becomes a viral non-consensual lottery and you benefit from spreading it.

You can't just signup for a WeChat ID right now. As of late 2017, when you signup for a WeChat ID it shows you a sign-up QR code. Someone who is a verified WeChat user (someone with WeChat Pay which has RealID) must scan and verify you before you are allowed.

Why not have the real WeChat ID hidden among randomly generated 'noise' WeChat ID's? Then the real attacker could get paid and still have plausible deniability.

This criminal mind is going to get me in trouble some day...

It's not hard to steal money. It's hard to get away with it.

Part of the difficulty is fighting greed, as the people that get caught are the ones that push their luck way too far. They're often wildly successful at first with more cautious approaches, but as they get more brazen they end up getting busted.

I think you make sense, but the hacker may control some percentage of the "lucky" account holders.

Reply on news.ycombinator.com