Hacker News Reader

Comment by mullingitover | Hacker News Reader

The wild thing is that the ransomware operations are making so much money that they can afford to buy multi-million dollar zero day vulns that at one point were only available to nation states or fortune 500 companies. Every successful round of extortion just gives them more ammunition to purchase more of them, hire more engineers, etc.

This kind of illicit capital flow totally makes a mockery of AML regulations. All the rules that were created after 9/11 are out the window - this time it's money to pay for zero days, but it's not a huge leap for this kind of illicit capital flow to end up paying for a huge terror op, paramilitary coup, etc. We'll be reading the next blue ribbon commission's retrospective findings for some horrific event in a few years and it'll be obvious what we failed at.

View on HN

AML works against the small time criminals but when the sums get large they have access to much larger infrastructure and good old creative accounting. By infrastructure, I mean states.

That said, every once in a while a larger fish is caught. Right now a huge topic in Turkey is about a local businessman laundering about $1B of a US Mormon sect that stole the money from the US by faking business activity and receiving subsidies.

In this case, the Americans are in prison and the Turkish guy is in Austria, awaiting extradition.

Shortly before things got sour, the guy had access to the highest Turkish officials and was the darling of the media.

On the US side of the things, apparently the criminals were partnering with a high ranking CIA official to pull this off.

Here is a video on the topic: https://youtu.be/BPZIX5oBrUc

It’s already out of date as more money and connections were revealed since then but if you Google the names, more juicy stuff comes out. Sezgin Baran Korkmaz is the name of the Turkish guy allegedly laundered their money, now under arrest in Austria. Erdogan scrambled to remove his photos with the guy from the internet.

It has been revealed that they bought old Turkish companies that were under financial troubles and used these to move the money.

Why Turkey? Because Turkey is in economic turmoil and to motivate people bring money in the country they passed a law so the state doesn’t ask the origin of the money and politicians facilitate the bureaucratic process(allegedly for a substantial commission).

Pretty straightforward laundromat.

Once the money is in the Turkish system, they have access to EU, USA and pretty much everywhere because according to the paperwork the money is coming from legit companies, some a century old.

I bet you, Turkey is not the only rough agent here.

It's already obvious where we failed. Companies that don't care about sales won't sell, companies that don't care about R&D won't stay up to date, and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure.

"...and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure..."

...but won't see any particular repercussions until they get hit with a few million dollars ransom and some short-term bad PR.

> and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure.

So glad to not be at that job anymore , this is 100% the approach my previous employer took ( who had 99 out of the fortune 100 companies as customers ).

This is a significantly false generalization about the TTPs for rware operators.

Vast majority of these attacks don't work with 0days. They work with malformed IAM policies, social engineering/phishing, and poor asset registries and cloud vis.

Keseya being a 0day is an outlier in many ways.

It is an outlier today.

Do you think it will be an outlier in a year? In two years?

If a zero-day can gain you millions, tens of millions, maybe a hundred million dollars? Do you think we can keep operating the way we have been up until now?

I don't think you work in infosec?

> Do you think it will be an outlier in a year? In two years?

I think it will remain a outlier until that becomes the easier/more economical way for them to do business. Right now there is so much low hanging fruit that I'd see no reason to invest in a bucket truck to get at the stuff further up the tree. I'd say your prediction is at least a few decades away.

I thought this vulnerability had already been reported to Kaseya (privately), and they were working on it. Does that still qualify as a zero-day?

Just curious, do we have recorded cases where a paramilitary coup or terror operation happened through funds obtained by hacking? Also any evidence that post-9/11 KYC measures have prevented anything bad from happening would be interesting.

This is kind of a political question, and another thread got touchy about politics.

But with Manafort’s pardon, we might not see Deutsch Bank’s full culpability in failing to kyc. So, if Manafort’s pardon was inevitable, then would you consider the big players in laundering to be sufficiently protected by a political movement/coup inside a major party?

> The wild thing is that the ransomware operations are making so much money that they can afford to buy multi-million dollar zero day vulns that at one point were only available to nation states or fortune 500 companies.

Is it a wild thing that if you permit a safe mechanism of extortion a sprawling economy quickly develops around it, dunno.

This is really highly interesting.

For me to visualize the problem, I came up with this here: honeypot.

In this sense, Kesaya or any other Managed Service Provider is some kind of honeypot. Let 100+ companies gather and share the same problem and exploit it.

This comparison did not occur to me for Microsoft and their Zero Day exploits. Because you did not attack Microsoft to spread the damage. You still have to find your victims.

I'd much rather keep FSU hackers in Southeast Asian hookers and blow than leave those vulnerabilities unpatched for Big Brother to pwn all the dissidents.

We all gotta do our part.

My favored analogy is piracy and privateering in the 17th, 18th centuries. Sure, the spoils of one attack enable the next.

An end to privateering comes with powerful institutional enforcement via the suppression of movement and committed retribution (an eventual monopoly on the exercise of force). I can only imagine what the analogy looks like - it's arguably more difficult than traditional privateers operating on the open seas if the actors in this case are safe on sovereign soil.

Perhaps the analogy to the open seas is the Internet itself. If the solution to privateering was denying bad actors the freedom to operate, the same applied solution on the Internet would be dramatic restriction of who can communicate on it.

Problem is, the supply chain attacks in this analogy are more akin to sailing under false colors. In this case sailing under false certificates. What do you do when a pirate captures a ship of your fleet, has your flag, your signal flags, and has your latest challenge/response codes? In the age of sail, it would probably mean accepting the loss of the incident, then ruthlessly hunting down the perpetrator directly with the goal of eliminating all actors capable of such sophisticated engagements - basically reducing the talent pool to near zero. If you aren't allowed in this day and age to address the actor directly, you probably have to deny the host nation itself the freedom of movement until they commit to delivering heads on plates. What does that mean? Cutting Russia off the Internet? Is that even doable these days? You could embargo the Internet for your own country like China tries to do - sad that we're having to consider that. I struggle to imagine other half-way realistic options. Kinetic war and assassination seem imprudent/impractical, to say the least.

I certainly don't think the answer is to "eliminate crypto", the equivalent to thinking "banish gold coins" in the age of sail would stop piracy. I also don't think the answer is to demand all companies "do better at security". While everyone needs to do security better, it will always be insufficient. A merchant ship in the age of sail was never expected to have the armaments of a national navy. Their solution was to convoy up and if lucky have state actors protect those convoys - a herd defense at worst. The equivalent to "convoying up" in this age would be some sort of massive crowd validation process before updates are released, slowing everything down to an impractical rate. So I struggle to see what's left other than a good offense, as much as I hate to think of what that means for the dream of the open Internet.

The merchants demanded their host nation deliver a safe operating environment, at a pretty steep collective cost.

> I certainly don't think the answer is to "eliminate crypto", the equivalent to thinking "banish gold coins" in the age of sail would stop piracy.

You don't need to eliminate crypto, just heavily scrutinize/regulate/license exchanges like any other bank. Generally treat anonymous crypto the same way you'd treat someone who pulls up to a regular bank with a U-Haul full of cash and tries to make a deposit. If a wallet has ever interacted with a mixer (and generally treat mixers the same way you'd treat money launderers), blacklist the wallet. Blacklist any wallet that is linked in any way to a mixer or to wallets involved in extortion. Revoke the license of any bank that accepts funds linked to an unregulated crypto exchange.

A ransom payment, while a HUGE incentive, is not the only incentive for these attacks. Like any piracy, there are gains to be had from captured assets and an owner's ransom is only one avenue to monetize those assets.

So you apply a Thor's hammer solution limited to cooperative countries. Who is going to disproportionately pay that penalty? And what does "just heavily regulate" a decentralized currency even imply when applied globally? Will Russia be cooperative/respectful of this regulation? I'm not sure this would be as effective as you think, but certainly comes with some downsides to gen pop if we imagine how regulating crypto would be done effectively across friendly nations.

I must say that I also think having anonymous currency (cash, crypto, etc) is fundamentally healthy for society on the balance. So am biased against solutions that would further it's knee-capping. It seems more structurally sound/scalable/proportionate to punish the agents rather than the mechanisms, to the degree possible. In a gray-filled and nuanced way, I'm happy that ransomware attacks are still possible (encryption works, anonymous payments work), but disapprove of their application in this way and believe a penalty should be paid by the actors for what they choose to do with tools that also have legitimate purposes.

> Will Russia be cooperative/respectful of this regulation?

I'd be fine with Russia and any other rogue financial state actors being cut out of the global financial system entirely if they're going to value relatively small-time money laundering over legitimate business. No loss there.

> I must say that I also think having anonymous currency (cash, crypto, etc) is fundamentally healthy for society on the balance. So am biased against solutions that would further it's knee-capping.

I'm honestly not seeing it. Crypto has been around for long enough to take an clear-eyed appraisal of its utility, and what I've seen has been primarily speculation (a worthless drag on society), with a smaller but hugely significant factor in enabling highly scalable criminal activity (more drag on society), and various other negatives. It has enabled a plethora of scams, shielded bad actors, and to the average person it has created pretty much zero utility.

There could be some good uses! I look at crypto like roads - yeah, it'd be great if we could all just drive anything we like, anywhere we like, at any speed, without regard for anyone else. However, to make roads a safe place for everyone and minimize negative externalities, we have traffic controls, licensing, emissions controls, and safety standards. Right now the crypto world is the equivalent of a small number of people driving around in tanks, occasionally running over a crowd of people, with no highway patrols able to do anything about it.

It should be pretty obvious that as long as ransomware is this profitable, we are absolutely fucked when it comes to computer security. The economical incentives are so completely and utterly skewed, there is no way for society to function.

This is all because of cryptocurrencies. They are the one single factor that enables this economical fiasco. They need to be banned, now, or this will just get worse from here on out.

Banning isn’t enough. They must somehow be destroyed or rendered useless, perhaps through a mass 51% attack or something.

Couldn't someone DDoS the major mining pools?

This is aggressively myopic. Banning a cryptocurrency is akin to banning HTTP to prevent the attacker's connection for their shell.

All ccs are just a protocol which can send verifiably discrete packet w/o a central server verifying the discreteness, and with some fancy branding on the packet type. It's as if people felt very tribal about POP3 vs. IMAP, and the IMAP foundation put out branding and POP3 was a FOSS project. Protocols in that sense can't really be ever banned. It's like banning a math proof.

CCs play a role, but they are not the single factor that enables rware, by any means. For instance, it's a lot harder to pop a meat processing plant or coastal pipeline if they didn't hook up IoT to anything and everything OT-related, and ICS was awful at integrating vis b/t IT and OT networks in their plants. Or, for instance, if cyber insurance companies are forbidden from paying ransom, then the economic pot is suddenly dry. And so on...

You don't need to ban a protocol. You're free to play around with protocols all day, nobody cares.

What is absolutely crucial is to cut the link between that protocol and the financial system. And that is very, very simple. There are a few very centralised points where that happens, and those have to follow laws.

They are starting to get cut off already, and these kinds of catastrophes are going to drive the effort to make that happen even quicker.

Are you familiar with DeFi/Dexs. Short of banning and tracking networking and compute at a fairly unheard of scale short of child exploitation, it’s significantly more complex than banning Coinbase. Your suggestion, going back to the HTTP simile, is like saying banning Google bans HTTP, banning Pirate Bay will ban torrenting.

Very. Absolutely all of it is built on top of a few financial gateways, that are going to be closed.

> It should be pretty obvious that as long as ransomware is this profitable, we are absolutely fucked when it comes to computer security.

Maybe we should turn the tables on the ransomware orgs. I'm sure they're getting big enough that they can't keep tabs on everyone in the org. So why not start offering million dollar prizes for people inside the org to sell out their co-conspirators? I have to imagine that if you're unscrupulous enough to be in the operation, you'd have no problems doing some entrepreneurial activity on the side.

Reply on news.ycombinator.com