Hacker News Reader

Comment by ______- | Hacker News Reader

> “Our goal is to make money, and not creating problems for society,” the DarkSide criminals wrote last week

> In a message posted to its victim shaming blog, DarkSide tried to say it was “apolitical” and that it didn’t wish to participate in geopolitics.

Yes but if destabilizing and disrupting a country's computer infra happens as a side-effect, you are still in the game of politics. Being 'apolitical' is paradoxically still being political, since if you are involved with large groups of people, you can't help but be political.

View on HN

> Imagine being the chief compliance officer at DarkSide. People constantly come to you with crimes, and you are commercial, you are like “sure go ahead do that crime,” but occasionally you have to stop them and say “no the reputational risk of that crime is too great, we can’t do it,” and the sales reps grumble that you are getting in the way of business. Just like at a bank!

https://www.bloomberg.com/opinion/articles/2021-05-11/crypto...

My understanding of organized crime in general is that this is more-or-less what it looks like. Sustainable organized crime finds a niche and stays in it. It ends up like any other large, long-lived business; optimized for its niche, vulnerable to niche disruption, and conservative about branching out because of the risk of compromise to its core competencies.

Definitely organize crime is just another business. We have this idea that hackers tend to be loose knit groups of people with more moral objectives. While that may have been true twenty years ago like all criminal markets eventually that stopped being the case.

I don't at all believe it's stopped being the case. The demographics of the hacker community have certainly changed, with a higher degree of polarization between corporate/fed white hats (e.g. people like Mudge) and criminal black hats, but you still have some grey hat vigilantes in the middle like Janit0r, who wrote BrickerBot that went around bricking open IoT devices so that they wouldn't fall prey to Mirai.

It was never like that. If you look at those peoples actions, high moral objective was super rare thing.

Case in point: I remember people glorifying veev making him sound like good guy and making his detractors sound like liers. Turned out differently.

This was a major plot point of the Godfather. Don Corleone wants to stay out of drugs to keep their reputation with police and politicians.

We can stop all ransomware by making it too expensive for reasonable people to do business by killing anyone we find creating the software anywhere in the world.

Fundamentally, DS doesn't want to break anything, they just want to scare people into paying their "tax".

They are a thief who just want money from people who can afford it.

It's still wrong and side-effect heavy, of course.

That's what they claim, how would we know it's true? It's the word of the extortionists, there is no reason we should just believe them.

Governments in certain countries obviously tolerate this sort of hacking, if not outright support it. If you wanted to destabilize the US without directly starting a war, wouldn't that be a good way to go about it?

I’m just guessing here but I imagine it’s like how certain groups in South America refrain from kidnapping/violence on large tourist destinations. These groups don’t exist to be evil they exist to make money and bringing the weight of powerful nation states (the US) on you is bad for business.

"In Russia, for example, authorities there generally will not initiate a cybercrime investigation against one of their own unless a company or individual within the country’s borders files an official complaint as a victim. Ensuring that no affiliates can produce victims in their own countries is the easiest way for these criminals to stay off the radar of domestic law enforcement agencies."

From the article. So I guess it is the same principle.

Additionally, you can presumably make more money by selling drugs to tourists in Cancún than by kidnapping them.

It is, but ... do you really think, China or Russia really want the US to be destabilized even further?

A US falling apart for real, would be bad for Russia as well as China. And vice versa. Because desperate people tend to do desperate actions - not a good thing with so many nukes involved.

So I also think, it is likely that at least some russian hacker groups have direct or indirect links to the FSB, and have to work for them occasionally - but most of them probably have indeed their own pocket as the main motivator.

> not a good thing with so many nukes involved.

We don't even need to go that far. A collapsing US would take down most of the world's financial system with it. In a place like Russia, where rich people with global financial holdings call the shots, that's not something they'd likely get behind.

> In a place like Russia, where rich people with global financial holdings call the shots

So, pretty much like any other place, then?

There's a good chance that you're failing to properly intuit their motivations. If it really is an organization that is out to make money, then it wouldn't want to destabilize a country like the US in the first place, any more than a dairy farmer wants to destabilize the health of a cow.

It might happen accidentally, as an unintentional side effect of efforts to extract a greater yield. (e.g, Colonial Pipeline.) But nobody wants to actually wreck the source of their livelihood.

And I don't think we have any reason to infer any other motive. This is certainly well outside my area of expertise, but their pattern of behavior doesn't really say, "state actor," to me.

> their pattern of behavior doesn't really say, "state actor," to me.

This is the fascinating thing about Russian hackers to me. Maybe sometimes political favors change hands, but ultimately they're autonomous, self-funding, self-training, completely deniable assets. IMO Russia's brilliant in how they've managed their offensive hacking assets.

The downside is that this approach seems to only be available to nation-states that aren't particularly governed by rule of law.

Wait, that was supposed to be a downside?

> ultimately they're autonomous, self-funding, self-training, completely deniable assets

You could say the same for Afghanistan 20 years ago, but plausible deniability will only go so far..

If these hackers eventually end up hurting a lot of people, then who knows what happens next?

Well, exactly. The gang in question rather publicly issued a mea culpa and said they will be taking steps to make sure that doesn't happen again specifically because they're worried about that. I doubt things would ever progress as far as Afghanistan, but I'm sure they're thinking that their government might not continue to let them do their thing if the specter of international sanctions should arise.

That may be the current goal. If I'm going to get into organized crime, I'm not going to start by walking into the local FBI building and try and buy off everyone.

You start small, learn, grow, expand, and after you've gained sufficient resources and the power that comes with that, then you get to do more.

> In Russia, for example, authorities there generally will not initiate a cybercrime investigation against one of their own unless a company or individual within the country’s borders files an official complaint as a victim.

Coincidence? Maybe at the start of organize technology crime, but not now.

Kaspersky (if you trust them) said this attack could have been a group within the CIA (known as UMBRAGE). My take is why not? With the lack luster response from the current administration and the convenient events that followed, Darkside disbanding, their servers and shitcoin seized, etc, would it be that big of a surprise it was one of our Alphabet Organizations, those same organizations that spy on the American Public.

> My take is why not?

Because of the `Russian Razor` principle:

    It wasn't Russia

    There's no way it was the Russians

    It was the Russians

It pains me how close this is to a haiku

"There's no way it was Russia" should do it.

No kireji, no kigo, not even close.

you think a US Federal institution would attack a major US Company and cause suffering to a large swarths of the population, just cause?

Not the parent, but yes, I do think they would, if they had a good enough reason. And that reason might not be readily apparent to us here.

I don't think that was the case here, but... yeah.

you are correct in as much as the reason isn't apparent

Idunno, thats a whole new level of tiger-teaming your own side. I don't think this kind of thing meets the whitehat community's ethical standards.

I think so. They sold 10's of millions of Cocaine to Americans to fund a War in Nicaragua.

>“Our goal is to make money, and not creating problems for society,”

I think the issue is people read that then add their own meaning to it, and then react to that instead of what was actually said. What they didn't say that people add of their own volition seems to be "and we're not evil", "and we're not criminals", "and we're the good guys". They didn't say those things. Their goal is to make money. That doesn't mean they think they're doing good in the world or innocent.

And 'apolitical' just means they're not choosing targets for political reasons, not that they're paragons of virtue or anything.

And to be clear, I'm not defending them, just observing the reactions to this. People seem desperate for there to be black and white morality decisions when everything is a shade of grey.

> >“Our goal is to make money, and not creating problems for society,”

> What they didn't say that people add of their own volition seems to be "and we're not evil", "and we're not criminals", "and we're the good guys". They didn't say those things. Their goal is to make money. That doesn't mean they think they're doing good in the world or innocent.

What's funny about their statement is that it's such an obvious lie. They make money by creating problems for society; that's what they demand ransom for, removing the problem they created.

Bit funny how people read all kinds of stuff into their statement, but nobody so far has pointed out this discrepancy in what it actually says.

Perhaps they didn't count on their target's profit motive being so strong that the pipeline owners were willing to cause fuel shortages and panic hoarding because they wouldn't be able to add the dollars and cents while sorting out their response.

Or they didn't understand the degree of consolidation in the industry. Its quite possible they hit the pipeline operators without understanding the level of service outage they would cause.

Antifragility advocates might say the occasional ransomware attack on infrastructure could be a good thing, in the long run, if it promotes a more resilient, less just-in-time based economy. Like Amazon's chaos monkey, but for whole economic sectors.

Just in time is good for the economy, however like everything else there are downsides that need to be managed.

Good comment about this very thing here: https://news.ycombinator.com/item?id=27099862

> It's just a variation of the Normalization of Deviance. See this[1] short talk by Richard Cook for a very good explanation of the mechanism that causes the transition from "robust" to "superfluous".

[1] https://www.youtube.com/watch?v=PGLYEDpNu60

The chaos monkey(1) originated at Netflix.

1. https://netflix.github.io/chaosmonkey/

Supposedly they paid it, but the provided decryption routine was so incredibly slow that they realized it was faster to restore from backup.

Not sure how that works, but is what I read.

That doesn't make much sense; if they had adequate backups and could restore from them without getting the decryption key or code, why would they pay?

(Caveat: I know absolutely nothing about this particular situation)

Paying would make sense because if there was a vulnerability uncovered by the initial exploit (that is, account information compromised by the initial phishing attempt) then it is perfectly possible that the restored version will be easily exploitable by the same group.

I remember this being the case back in SQL Slammer days -- you could restore from backup but your backup would be infected within minutes.

Two possibilities: They knew restoring from backups is slow, so they wanted a shortcut. They knew there was data (ie from the day of the attack) not in the backups. Take your pick - or not, I have no idea if the claim is even true.

Modern ransomware teams also threaten to leak your data onto the public internet unless you pay.

Free decryption, you mean ;)

I'm not 100% on this, but my understanding is that it was worthwhile due to the vast amount of money involved in the oil industry and the projected time to restore from backup.

What they mean, of course, is they don't want to poop in the same place they eat.

It's not geopolitics if the victim lacks the will or technical firepower to punish the offender, right? ;)

even if they only cyberlockered private individuals and/or small business they'd still be "creating problems for society".

Both you and this blog seems to be a pedantic unbundling of the choice of word "apolitical".

To me, the most important aspect of this article is that you can make people think you are a Russian hacker signed off by Putin himself by adding these Commonwealth of Independent State checks to your code.

> you can make people think you are a Russian hacker signed off by Putin himself by adding these Commonwealth of Independent State checks to your code.

Reminds me of:

> Uncle Milton Industries has been selling ant farms to children since 1956. Some years ago, I remember opening one up with a friend. There were no actual ants included in the box. Instead, there was a card that you filled in with your address, and the company would mail you some ants. My friend expressed surprise that you could get ants sent to you in the mail. I replied: "What's really interesting is that these people will send a tube of live ants to anyone you tell them to." -- https://www.schneier.com/blog/archives/2008/03/the_security_...

Reply on news.ycombinator.com