Hacker News Reader

It is exactly analogous to piracy in the 17th and 18th centuries including that pirates operate out of states that are too strong to just outright destroy. When the states were no longer too strong to destroy, they were destroyed as in the 1816 destruction of Algiers by naval bombardment.

It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties.

Exactly.

>It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties.

Indeed. It just so happens that the vast majority of these ransomware gangs operate out of Russia and neighboring states. Probably in part due to the confluence of good technical education options, a huge population, and a government that permits the activity. (Not trying to say anything about Russia or Russians but just its government's policy. If it were the US that had this policy, I'm sure the biggest ransomware gangs would operate in the US, instead.)

Another thing that reminds me of piracy (and also EVE Online piracy, for anyone who's played that game) is the strict adherence to the basic pirate code of honoring ransoms so that future victims will be willing to pay. They're as ruthless as they can be before payment, but if the victim cooperates and pays, then they'll keep their word - they provide the decryption key, don't release any of their data, and mark them to not be targeted in future ransomware campaigns. It's solely about making as much money as possible.

Hi, I would be super interested in any evidence you could provide that ransomware authors won't target victims in future ransomware campaigns.

Especially since that implies they all work together and maintain lists of forbidden targets.

I'm specifically referring to a single group/gang/operator. It doesn't mean a different operator - perhaps using the exact same ransomware software as the initial attacker - won't target them. It might exist, but I'm not aware of any list-sharing between unaffiliated operators.

I can't find a source right now and don't know for a fact how many do this, but I know I've read in at least one interview that a ransomware operator at least claimed they did this.

And regardless of what actually happens in reality - in my opinion, the most economically rational choice would be for all ransomware operators to do this (and to punish other ransomware operators who don't). In general, many of them seem to try to maintain a reputation of honesty and integrity, despite the obvious juxtaposition with the very immoral behavior. I wrote more about this here: https://news.ycombinator.com/item?id=27102646

> It's not just Russia but anywhere that is outside the reach of US court orders and extradition treaties.

Extradition is not a requirement. France, like Russia, will not extradite its own citizens, but you don't see so many criminal gangs operating out of France.

Yeah, it's not merely a matter of Russia not extraditing; they simply don't address the problem at all unless the cybercrime is also affecting other Russian citizens. And in some cases the security services seem to have direct relationships with some cybercriminals. (I'm not sure how friendly or close the relationships are, but there's definitely some tit-for-tat: we let you operate and make all this money, and in return you do us favors when we need them. I believe laundering is one example, like in the BTC-e case.)

It's a very efficient way to operate. This is mostly unrelated, but it reminds me of all those claims of how free market and capitalism promote efficiency wherever they reign.

agree with all points but this one:

  > Technology isn't inherently good or bad; it just is what it is.

I think we need a new framework for looking at this. All of technology creates different variations of the trolley-problem. So it's like saying:

  Trolley-company isn't inherently good or bad; it just is what it is.

In most cases we don't even know there is a trolley so we get away by framing it like this but it's deeply problematic IMO.

Those who write the history books and get to frame things for the future are always the representatives of the trolley company. But just because we have framed it this way throughout human history by using terms such as good, bad or neutral doesn't help either. I'm not saying that tech is bad I'm saying that saying any insinuation of presenting Tech as neutral from a moral (not legal) pov is problematic. Because if we use this by looking into the past then we must also acknowledge all the medical breakthroughs that were created during WWII. (I'm using a flippant point for purpose of illustrating just how problematic this statement is and we're not gonna find a solution by focusing on Technology because it's above all not a technical problem)

Especially people in security would be well positioned to think about this because of the bird-eye pov and adversarial thought that's required to analyse it. But perhaps it's not enough and we also need to integrate people from other domains (or at least stop being hostile to the social sciences as an "inferior science" ... because this is exactly the place where we don't see the forest because of the trees)

>I'm not saying that tech is bad I'm saying that saying any insinuation of presenting Tech as neutral from a moral (not legal) pov is problematic. Because if we use this by looking into the past then we must also acknowledge all the medical breakthroughs that were created during WWII

(I totally understand your point, but my understanding is that actually very little of medical significance happened to be learned from the human experimentation conducted by Nazi Germany and Imperial Japan during WWII, if that's what you're referring to. But for the sake of argument we can assume it did result in medical breakthroughs. Or if you're just referring to all the breakthroughs that occurred due to the pressure of the war, then that works, too.)

You're right, it's difficult to consider all technology as objectively neutral. If someone invents a device that lets any random teenager easily and cheaply release an aerosolized neurotoxin into a city center and kill thousands of people, it's hard to steelman the "it's the people, not the technology" argument in that case.

Philosophically, my post wasn't too rigorous or accurate. I think in the case of cryptocurrencies, though, there's enough of a balance of positive and negative that it's foolish to discard and vilify the entire concept, even if there are many uses (e.g. scams) that do deserve the critical reaction. If something has some positive utility to it, those always need to be kept in mind. Otherwise, all the politicians arguing in favor of banning encryption would have a much easier time, for example.

> If someone invents a device that lets any random teenager easily and cheaply release an aerosolized neurotoxin into a city center and kill thousands of people, it's hard to steelman the "it's the people, not the technology" argument in that case.

Let me try, though, because I think it's important.

Technology doesn't grow on trees. There are about two ways such a deadly device could be made available to a random teenager:

1. Accidental convergence of unrelated technologies. Somehow, it becomes cheap and easy to acquire a potent neurotoxin (an exotic animal or plant, perhaps?), tools to isolate, clarify and refine it (some toolkit from a chemistry lab?), a refillable spray can, a compressor, protective gear. A random teenager could then, technically, use all these to perform a chemical attack on a budget - if they knew how, and had a will to.

2. Turn-key solution. Somehow designs and makes widely available a device for cheaply release aerosolized neurotoxins.

In the first case, it's hard to blame any individual piece of technology involved. It boils down to the person willing to weaponize them, or one teaching others how to do it. Worth noting is that all the technologies mentioned (except maybe the neurotoxin itself) are already widely and cheaply available, and necessary know-how is part of high school chemistry curriculum - and I don't think anybody sees any real risk in this.

In the second case, the turn-key solution was explicitly designed with malicious intent - designed by someone who knew the end goal. Most likely commissioned by someone else, who also knew the end goal. Also made available to random teenagers by someone who knew what it is. That's at least three people with ill intent, without whom the technology would not exist (or it wouldn't be a threat). It seems to me that in this case, it's also the humans should be the center of focus.

With respect to real, instead of hypothetical, discussions about technological neutrality, I feel the constant focus on technologies and technologists in general is one big flock of red herrings - it exists to deflect the focus from the real problem, the people who commission and use these technologies with malicious intent.

> If someone invents a device that lets any random teenager easily and cheaply release an aerosolized neurotoxin into a city center and kill thousands of people

Replace neurotoxin with chemical weapon and this is already a thing — I may be overestimating the industriousness of teenagers, but there is a toxic chemical a motivated teenager can make in two distinct ways using only things found in a normal kitchen.

Thankfully it was a rubbish chemical weapon even when deployed militarily in WW1, but it is a possibility.

Indeed, but the impact would be pretty limited, as you say. I'm thinking something like the Aum Shinrikyo sarin gas attacks, which potentially could've killed many more people than they did.

> And some directly target health care facilities, knowing there'll be more urgency to pay up.

This is a pretty serious allegation, it might be considered terrorist activity depending on how you exactly define that. Same for attacks that intentionally target other critical infrastructure. Putting human lives at risk makes a very real difference here.

Absolutely. Not all ransomware gangs do; like pirates of old, some have a strict ethical code. Some also hate that others are doing it because it attracts more negative international attention towards them. Some care purely about money, though, and see hospitals as easy paydays.

Here's a September 2020 interview with one operator: https://talos-intelligence-site.s3.amazonaws.com/production/...

>The actor appears to have a contradictory code of ethics, portraying a strong disdain for those who attack health care entities while displaying conflicting evidence about whether he targets them himself. This is probably representative of many adversaries engaged in illicit cyber activity.

>Hospitals are considered easy targets, making ransom payments 80 to 90 percent of the time during a ransomware attack.

When easy money's in front of you and there are no deterrents, the sole thing holding you back is your ethics, and given a large enough number of people, some are going to have very little in the way of ethics.

They're so brazen that many don't even care much about privacy. If there are no possible repercussions, why bother trying to conceal yourself?

>During our initial conversations, we shared what we believed to be Aleks’ identity and location based on our own research, which he confirmed.

>If you're in the US or UK or France or many other places and want to start a lucrative ransomware operation, there's a high chance you'll eventually get caught, so the risk of long-term imprisonment is enough to deter you even if easy millions may tempt you. If you have no moral qualms, great incentives, and nothing to deter you, the possibilities are limitless.

easy? hardly. you only hear about the successful ransomware. The twitter btc giveaway scam is way more profitable, harder to detect, and easier than trying to code ransomware. People make 1 btc/day undetectable with giveaway scam

Yeah, I shouldn't have said easy, but easier to make millions that way than trying to create a legitimate startup or something.

And you're right, there are certain kinds of scams that are possibly more lucrative for way less effort. A lot of these ransomware gangs started years ago when such scams weren't quite so lucrative. I wouldn't be surprised if many are pivoting into cryptocurrency-related scams and heists.

If you're ignoring effort, though, that one Twitter hack with the BTC-doubling scam made about $100k over a few hours, and that was with access to the top accounts on the platform.

According to a random Google search, a ransomware operator makes an average of $300k per company-ransoming. If you're getting 5 companies to pay you an average of that much per week, it's probably more lucrative than any giveaway scam, even if it takes a lot more effort and skill. And if you're getting more than 5 companies per week, it might be more lucrative than almost any kind of scam.

I’m concerned about this. America has shown since Vietnam that we don’t win in unorthodox wars. The Taliban beat us.

The only analogy I can think of is if a smaller power constantly harasses a larger powers trade routes. Eventually America gets exhausted because we only know how to win a direct war.

They will exhaust us with this over time and continue building leverage. What are we seriously going to do? Goto war with Russia or China?

I don't think anyone wants to go to war over something like this. I definitely don't. There aren't a lot of options, though. You definitely can't do "extraordinary rendition" / kidnapping, for example.

One is sanctions against specific individuals, which the US does do. So at least it's harder for them to participate in the international banking system.

And from my understanding, US law enforcement will often try to trick these cybercriminals to travel to a seemingly more neutral country (sometimes areas that are common vacation choices for Russians), where they'll get arrested after arriving. Some of them have gotten nabbed this way - notoriously Alexander Vinnik, the owner of BTC-e and launderer behind the Mt. Gox hack [1], though I'm not sure if he was lured there or just happened to be there. But as long as someone is smart enough to never leave the country, I think they're pretty much untouchable.

General geopolitical pressure and sanctions is probably the only viable option. Keep collecting evidence of the Russian government's permissive stance and bring it to the negotiating table. If enough pressure is exerted, they might eventually relent and actually start cracking down on the big actors.

If they could pressure Russia to permit extradition to the US for serious crimes, that deterrence would probably stop a lot of operations overnight. I doubt that'll ever happen under Putin, though. (And it'd probably be unpopular enough in Russia that I doubt it'll happen under Putin's successors, either.)

[1] https://www.justice.gov/usao-ndca/pr/russian-national-and-bi...

I guess the question is, what does Russia want from the leverage gained from facilitating chaos?

The leverage. One wants the leverage for the leverage. Then you can use it for all kinds of other things, including things you didn't think of before. Like money, save it up and spend on whatever you want at the right time.

Something like 70% of the Russian population say Stalin was a great leader in surveys. Stalin killed by his orders more Russians then World War 2 did, far more people total then the Holocaust.

Russian's in general are pushed towards this idea that they want to be a "great power" on the international stage again, that this will fix their problems - it's certainly how Putin actively thinks. Of course it's never made any sense: Russia is huge. Domestically there's nothing it needs internationally to be a wealthy prosperous nation, and all it's problems are internal.

Hence the chaos: to Russian strategic thinking (that 70% isn't just "the people" its far more concentrated amongst the leadership), one way to be a great power is to knock America and the EU down and chaos suits just fine for achieving that.

There are somethings it needs, and it's actively pursuing them

Warm weather ports is one example

Go after the financial links. If the only way the ransom can be paid is traveling to Russia with gold bars you’ll see a lot fewer ransoms paid. And before you say cryptocurrency there’s lots of ways Western governments could intervene if they got serious.

>Go after the financial links. If the only way the ransom can be paid is traveling to Russia with gold bars you’ll see a lot fewer ransoms paid.

>And before you say cryptocurrency there’s lots of ways Western governments could intervene if they got serious.

I was definitely gonna say "cryptocurrency". I see absolutely no feasible way that any government could enforce things such that the only way a ransom could be paid would be traveling to Russia and paying the ransomers with gold bars.

I severely doubt any Western government is going to try to ban any cryptocurrency - even Monero. And if they try, enforcement will be extremely difficult.

No matter how hard they make it for a victim to pay a ransom or obtain the assets needed to pay a ransom, a sufficiently desperate victim and a sufficiently greedy ransomer will find a way to make it work.

Perhaps it could realistically help a bit if they threatened victims with prison time for paying ransoms, but in my opinion this would be pretty draconian and wrong - like threatening to imprison someone whose child is kidnapped by a cartel if they pay a ransom to prevent the child from being killed.

Sometimes the victims can be blamed for major negligence, but not always. And even when they are negligent, I don't think they should be punished or prevented from recovering their business in such an extreme way.

I agree that directly threatening victims, even corporate victims, is a bad look. But you need financial intermediaries—-brokers, platforms, exchanges, and these institutions upstream banks, brokers, clearinghouses, and so on. These are exactly the type of institutions that governments can exert a lot of pressure on but so far have mostly declined to do so.

> If you read the whole article

That would be lovely, but I don't subscribe to The Economist.

Yeah, don't blame you or anyone else for clicking the link, seeing the paywall, and immediately closing the tab. It's what I did, as well.

Some commenters posted non-paywalled links below. Not sure of the legality, but I wish HN would/could automatically replace paywalled article links.

As well, no idea about the legality, but this particular article is readable with Javascript disabled, JFYI.

Let me guess: You are from the US of America.

How do I know? Because the Russia is evil mentality. This comes from media in the US and lack of knowledge of History and geopolitics.

Let's take some History lessons:

Who sank the USS Maine? It was probably a false flag operation or the ship sank itself because of gas leak.We know it was not Spain, but it was used as an excuse to enter a war against Spain for taking Cuba and Philippines from them and committing genocide of at least a million people in the Philippines.

Who killed Rasputin? The British Government. Why? Because Rasputin was very influential in making sure Russia did not enter the WWI. Because they wanted Russia to enter they propagated all kinds of lies against him that even today remain and eventually killed him.

Who supported the Volsevisk revolution in Russia? The German Govertment so Russia would abandon WWI as they did after the Lenin coup.

Governments have always supported crimes when they benefited from those crimes, and that has not stopped in modern times.

I asked Reverte, an old war news reported who killed his friends and colleagues: https://en.wikipedia.org/wiki/Arturo_P%C3%A9rez-Reverte

He told me:"Half Russian secret services, half the US secret services"

In today's world, the US Government is behind way more crimes than Russia, because they are 10x or 20x more influential,specially after Berlin Wall's fall. Russia has the GDP of Spain.

The second biggest criminal is China, for the same reason. But US media loves China though.

Now when African activist that oppose a US multinational because gas or oil gets killed. Who do you believe is behind,Russia?

Who do you believe is behind when people is killed protecting the Amazon Jungle against the people that want to plant soy so Chinese pigs(and Chine that eat pigs) could be fed?

Who is behind all the chaos that is in north of Africa today. Who supported the war in Libia that made the Libyan army to infiltrate in all the Sahel.

Who supported the war in Syria? Afghanistan, Iraq.

How is that all those new weapons magically appear out of nothing?

This isn't about Russia or the US or politics or anything else you're talking about. It's about the Russian government's particular stance on cybercrime perpetrated against other countries. Unlike most other countries in the world, they explicitly choose to permit it as long as Russian citizens aren't targeted by it.

That's the only thing I'm referring to, here; not anything else their current or past governments or any other country's governments have done or are doing.