Hacker News Reader

Comment by tacLog | Hacker News Reader

I feel like this is a bold claim. I understand this to mean that you assume without crypto there would be less of a way to get payed for attacks like these?

Or am I missing something here. Also, Do you have an evidence to support the argument: Crypto has increased cyber crime? (I hope that is an acceptable parse of your sentiment)

View on HN

That's an accurate interpretation of what I'm saying. I don't think it's particularly bold.

I don't have any hard evidence but I'm sure you could find some. I certainly don't remember ransomware attacks being very prevalent prior to last decade. They all seem to request cryptocurrencies (I can tell you're a coin head because you refer to them simply as crypto).

Without cryptocurrencies ransomeware would largely go away. Sure there'd still be cybercrime, hacking, data breeches etc...

Extortion have been around for ages. There have been many payment methods used for it on the Internet. Prepaid credit cards, expensive phone numbers, gift cards, mobile refills, cash to private post boxes, bank accounts in sketchy countries and so on. But sure, cryptocurrencies makes it easier.

We paid a ransom with something you could buy from Walmart, I think they were called green cards or something (not to be confused with work permits). That was before crypto got huge but I think Bitcoin was around just not big yet. The cards at Walmart were preferred because at the time they were as good as anonymous cash and very easy for businesses to access.

I remember that Walmart or the govt or both made some change where these didn’t work the same way and lost their shine for ransom payments.

Thin on details but the as I recall the options for paying ransoms easily prior to crypto were tightening up.

That said, I’m 100% against the idea of fighting crypto to solve this problem. The liberty of humanity needs anonymous cash despite the risks that come with it. Better to address these problems on the data security and resiliency front.

I have never been called a coin head before. It feels interesting, because on one hand I see what people are trying to accomplish with crypto, but generally I am against the current solutions because of the massive climate impact of proof of work algorithms.

Judge me how you will, however, I do think I see your point that crypto might be contributing to this new form of extorsion. I was only trying to get more detail. Which has now been provided.

Intoxication with crypto makes people too blind to see the simple things in simple ways. They go hyper-technical and philosophical and forget the fact that crypto encourages and forms the basis for payments in ALL ransomware attacks in recent times. How hard is it to see that banning crypto would help reduce the crime?

Time to wake up, ban cryptocurrencies so this never happens again, then go back to sleep!

These attacks didn't exist before crypto.

No, they typically sold stolen information on private/underground/invite forums or IRC.

Instead of crypto-randomware, it would be an all out worm or booter that would crush a service who would have to acquiesce to demands. Luckily, there weren't too many good services in existence, Cloudflare didnt exist, c10k was a mind blower, webdev was AJAX, XMLRPC, and CGI. The term TLS hadn't been coined, it was still called SSL, and nobody used it.

Instead of a money orders, they would trade trade calling cards, NEXON codes, gift cards, other stolen data like "fulls" or exploits or accounts for compromised infrastructure.

People would operate DDoS botnets for cash, spam you with V1@GRA ads from cracked boxes or hijacked relays, and the evergreen scam of fake RMAs. Let me know if "LOAD A PALLET OF CATALYST CHASSIS ONTO A BOAT OR ELSE ILL RELEASE YOUR SERIAL NUMBER DATABASE AND ALGORITHM ON MYSPACE" sounds scary or not.

The real difference is now we're 28 years into "Eternal September"[0], the whole planet is participating more or less. Cryptocurrency is possibly an enabler, but if it weren't that it would be Apple or Google Play codes. Just straight up exfil and sell.

In conclusion, these attacks didn't happen before Apple store or Google Play.

[0] - https://en.wikipedia.org/wiki/Eternal_September

> it would be Apple or Google Play codes

I don't think Apple or Google credits would be effective for large-scale ransomware. Not anonymous, could be stopped by a slightly-motivated central authority. It works for preying on individuals, however, because they don't have enough clout to force the issue.

No, of course not. However, they could easily be used to exchange for access to data exfiltrated in the post exploitation phase. Or just money orders held in escrow a'la 1990's Ebay.

The workflow is:

Target->Crack->Retrieve->Store->Sell on hackforums

Maybe there is a way to automate this old school method, but nobody developed it because why bother.

How practical is it to transfer a million USD in gift cards to a criminal in another country on the other side of the globe? What kind of logistics would be involved?

Another way to look at it is that cryptocurrency has been around for what, ten years? And it seems in the past six months or so there’s been more ransomware attacks, certainly more high-profile ones, than there has been in the previous 9.5 years. So clearly there’s more to it than just the existence of cryptocurrency.

I recall they provided multiple payment options back when crypto was too hard for victims to obtain / figure out.

e.g. this 2013 article from a quick web search, where the payment method dropdown contains Bitcoin and MoneyPak payment cards: https://arstechnica.com/information-technology/2013/10/youre...

That’s demonstrably not true.

The argument by people who understand how banking systems work is that cryptocurrencies facilitate anonymous transfers of large amounts of money with zero risk to the criminals.

https://www.stephendiehl.com/blog/ransomware.html

Reply on news.ycombinator.com