Hacker News Reader

Comment by rocqua | Hacker News Reader

I thiink I can see why Revil added the backdoor. It's not to steal ransoms. It's to prevent too juicy a target.

There have been reports of crews stating "we won't hit hospitals in covid". With this backdoor, if your customers hit a hospital, you can hold your promise.

Even worse than hospitals (from their perspective) is agitating the American intelligence services. Hit too many pipelines, or similar high-news high-impact targets and 'national security threat' is your new name.

Worse than that still, imagine one of your affiliates is stupid enough to target inside Russia. You need to keep the Russians happy or all of a sudden trial or extradition become likely outcomes.

At the same time, once you have the opportunity, why not use back door for some more money.

Glad to see that they still aren't fully cooperating like legal businesses yet.

View on HN

> Worse than that still, imagine one of your affiliates is stupid enough to target inside Russia. You need to keep the Russians happy or all of a sudden trial or extradition become likely outcomes.

I read somewhere that a lot of these attacks are orchestrated by Russians because the Russian authorities will turn a blind eye as long as such attacks don't hit domestic targets.

There's indications that the Russian intelligence services are intertwined with organized crime. The oligarchs get help laundering money out of the state, the intelligence services get untraceable money that they can use to bribe foreign assets and the organized crime syndicates get paid for their money laundering services and get a free pass from the authorities as long as they don't inconvenience those in power too much. Seems like one of the most impressive rackets in history.

I think we can assume that all intelligence agencies are intertwined with organized crimes in some way. It’s not like spy activity is completely legal anyway.

In Russia the Oligarchs are mob bosses. It's really that simple. And who do they work with ? Putin who has access to 100% of all government capabilities. It's a big birthday cake and there are plenty slices to go around.

Wonder how much they make with ransom ware VS the Cia with drugs

It has been common knowledge for years that most malware and ransomware look for the presence of a Cyrillic keyboard and exit quietly if it’s found.

Lol, I don't believe that, but I like to entertain the thought that malware leaves me alone just because I have had a Russian layout installed ever since I can remember.

https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

Anything to support that? Seems like an easy step to protect yourself if true.

This is where I learned of this "trick": https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

Honestly, this looks like yet another Russian Hoax iteration. Also, made me to figure Brian Krebs is merely a journalist, while real infosec researcher is Chris Krebs.

They also talked to other people including the Founder and Chief Research Officers at Unit221B about whether workarounds e.g. adding an additional keyboard were effective.

So clearly it's well known that this is real and accurate just as most of the reporting is on Russia.

> is real and accurate just as most of the reporting is on Russia

Except when it turn out to be fake news as it usually happens. For instance, linked malware research paper doesn't mentions alleged keyboard layout probe and never reveal how this probe to be performed. So, bogus.

> workarounds e.g. adding an additional keyboard

Just as bogus as placing succulent plant to "protect from computer radiation"

This is really common, not just keyboards but time zone settings and even geo IP lookup.

The effort required to make your enterprise look like it’s in Russia is definitely not worth the effort given that this would only stop one slice of organized crime.

This implies there Russian Conspiracy members are actually caring about their domestic cybercrime which is clearly not true.

They do care. That's the point. Russian's largely have a free pass to attack international targets provided they do not hit domestic targets.

There is no evidence to back this claim.

Instead, there are stats indicating that The Mother Of All Hoaxes definitely ISN'T safe haven infosec-wise.

Additionally, Krebs completely forgot what there is war between Ukraine and Russia, so there are no reasons for such alleged protective measures any more.

That's my point. If your affiliates start targeting Russians, you want a way to distance yourself and keep the Russian authorities happy.

Without their protection, the ransomware crews are screwed.

They have a long history of turning a blind eye on criminal activities like drug trafficking as long as it's not sold in Russia. Then again, so do many other governments.

Anything that might interfere with the interests of western democracies is okay with the Russian authorities as long as it doesn't affect Russians finances.

No need for “orchestration”. Pretty straight forward, hackers gonna hack and if you don’t give them a legal outlet they will just attack domestic targets all the same. Works the same way here, the feds don’t coordinate with black hats to attack adversaries. Black hats can become some of the most patriotic fighters, it’s pretty interesting.

I love the downvotes from people who don't understand how this works.

Now, if I repeat what you told us, someone might say:

"My friend told he read somewhere that someone read somewhere that a lot of these attacks are orchestrated by Russians because the Russian authorities will turn a blind eye as long as such attacks don't hit domestic targets."

How rumors becomes "real"... :)

This isn't a rumour and I don't share information unless I'm either personally trained on the topic or have learn that information from a reputable news source. This feature in question even included interviews with some individuals who have ran ransomware attacks.

The only reason I said "somewhere" in my original post was because I cannot remember which network it was published on.

Not a rumor. This is very common. For instance, an example from a marketplace advert.

https://postimg.cc/hfQbS6bQ

PROHIBITED: a) UKR, RU, CIS - BAN

TBF, in the sense that it's widely discussed, this particular rumor is already "real"

Its OK as long as gossip fit "progressive" agenda and/or comes from renowned "progressive" newspaper Pravda. Otherwise it is a racis' conspiracy.

That WaPo Krebs article links malware analysis which goes into dire detail on how that ransomware probes for Volume Shadow Copy (via amateur WMI) yet... omits keyboard layout probe method(s) at all (there are at least 3 possible ways)

Depends on the method. You're safe from Russian hackers/malware if you're OS has the Russian keyboard added.

It's even a security precaution.

https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

Tldr: it's not hearsay

The Duesseldorf hospital was hit by ransomware and a patient died during the outage.

I'm not saying that all ransom gangs are coldhearted, but let's not frame them to have morals

I don't think it is about morals, but more about avoiding trouble.

And I also wouldn't find it too hard to believe that there must be at least some ransomware groups with morals. Not the same as yours, sure

When you hit a national security target, you get NSA and CIA after you. They have vast resources to make your life difficult wherever you are.

On the other hand, why shouldn't NSA and CIA be invested 100% in pushing back on these attacks already? The potential harm from this vector is obviously gigantic, so why wait for a really significant attack to happen?

Ransomware make private sector aware of security issues and resilient against attacks. It’s like developing antibodies to viruses.

NSA rather not to interfere, unless infrastructure is involved.

Interference from public sector may actually not be successful in the long run, as companies simply adjust to that, and keep ignoring security at a new equilibrium level.

Not suggesting you're doing this, but their existence should still not be framed as positive. They are malicious and sophisticated, and should be pursued accordingly. If they're willing to extort others by holding their data ransom, there's no telling what else they may be willing to do.

But yes, ransomware does lead to a hardening of network infrastructure, and reduces the likelihood of successful espionage operations, by alerting parties - via the ransomware attack - to security vulnerabilities.

> On the other hand, why shouldn't NSA and CIA be invested 100% in pushing back on these attacks already?

For the same reason that neither them, nor the Army doesn't serve drug warrants, or investigate tax evasion. Because policing is not their mandate. That's the job of either your local police department, or the FBI, or any one of a number of the other federal police forces.

If ransomware gangs are seen as a potential threat to national security, wouldn't preemptive action against these groups fall under the claimed remit of the NSA or CIA?

Tax evasion is a potential threat to national security, drugs are a potential threat to national security, protests are a potential threat to national security, q-anonsense is a potential threat to national security, especially when it culminates in an invasion of the Capitol.

You don't just get to sprinkle 'potential threat to national security' to turn criminal activity into a problem for the extra-judicial arms of your government. How about we let the police do their core competency - policing, and the military and the spooks to stick to their core competency - extra-judicial violence, and kidnapping random people to hold/torture without trial in Gitmo.

I'm not doing any such thing, hence the phrasing of my comment.

Your comment seems to imply you think the most/all of the remit of the CIA is or should be invalid. That position doesn't contradict my comment in any way.

That is a rather different claim than saying that premptively pursuing ransomware gangs in other countries is outside what the relevant decision makers view as the remit of the CIA. To me it seems to clearly fall in-line with their historic actions (as long as the cyber ransomers are outside of the country.)

The target was a different university, and when the scammers realized their mistake they handed over the encryption keys.

I wouldn't say morals play no role, since someone that is perfectly fine robbing a wealthy institution isn't automatically going to be OK with causing someone's death, but there absolutely is risk management at play since the hunt for someone that stole a few hundred thousand dollars is going to be much lower priority than a hunt for a killer.

An investgation later revealed that the patient's death was not caused by the ransomware attack, and the patient would've died regardless.

Not at all suggesting they have morals. I'm suggesting it makes business sense to avoid targeting hospitals. Because people will come after you much harder if you do that too often.

If the NSA starts deploying the TAO against ransomware crews, the crews are going to have a much MUCH harder time actually making money.

Surely any ransomware attack is coldhearted? It's only effective if you are threatening something the target really cares about.

Was robin hood coldhearted? I certainly don't mean to suggest any ransomware group has motivations that noble, but I don't think you can generally say that

A better question: was Robin Hood a real person whose behavior could serve as evidence?

does it matter if it's just used as a counterexample to make a point while speaking in general terms?

Absolutely. Theft is violence and it's morally wrong no matter the circumstances. It doesn't matter if you're stealing a piece of bread not to starve, if you're stealing the money to save the lives of orphans, to help the homeless or pay for hospitals. It doesn't matter if you're an individual, a dictator's army or a democratically elected government.

Theft is theft.

Doesn't mean it's morally wrong. Robin Hood was taking back and returning what was stolen from peasants by the Sheriff (and other nobles) by overtaxation and straight up "this is mine now" antics. These were people that had no right to what they were taking. If beat the crap out of the guy I ran down after he stole my garden gnome that's justice of a sort.

Are you arguing that stealing bread to not starve is cold-hearted? That attitude may not he illegal, but it is way more cold-hearted than stealing bread to prevent starvation.

As for the comparison to Robin Hood, that would only be apt if the ransomware only targeted exploitative companies and gave the money back to the victims of those companies.

>Worse than that still, imagine one of your affiliates is stupid enough to target inside Russia. You need to keep the Russians happy or all of a sudden trial or extradition become likely outcomes.

I heard (and it might be just people making stuff up) that if you had cyrilic anything in your PC some ransomware would avoid you entirely, now, that's probably false but I am interested in knowing how would they avoid infecting russian computers.

https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

Remember the amazing/terrible hacker movie Swordfish?

You just described it. Maybe now other world powers need their own domestic equivalents. Or if they already do, then something that’s a bit more overt.

FYI: Russia has no extraditions

Reply on news.ycombinator.com