Hacker News Reader

Comment by humps | Hacker News Reader

My first question was: "Why on earth would anyone target Fastmail?" And to answer my own question, it seems a lot of email providers are in the firing line at the moment - https://therecord.media/ddos-attacks-hit-multiple-email-prov...

View on HN

This bit is interesting:

"Victims were targeted with a DDoS attack, and an email was later sent to the organizations, asking for a 0.06 BTC (~$4,000) ransom demand."

Four thousand dollars. I guess they were trying to shoot low in hopes of a quick payment?

Also, Runbox posted a copy of the ransom email: https://blog.runbox.com/2021/10/runbox-is-under-attack-by-ex...

Test their response?

Warm them up to the idea of capitulation?

This week:

"Give me $50 or I break the windows in this place!"

Next week:

"Give me $75 or I break the windows in this place!"

"Bitcoin is not used for ransomware and other cyber crime, it's traceable" - some crypto fans on social media

To be fair, you could trace these transactions, and any from the address that receives them. It seems much better to use Monero or something if you intend to be nefarious. This is probably just ill thought out.

edit: not a crypto fan personally.

Bitcoin is easier for anyone to pay. Afterwards, you can wash this with Monero or other networks.

You have successfully proved that some crypto fans say things that are wrong.

There has been malware that gave people addresses to mail cash to.

The exception confirms the rule

Ransomware has been around since (at least) the 80s, long before bitcoin. https://www.knowbe4.com/aids-trojan

Completely ignoring that all of them now use Bitcoin as payment method.

Bitcoin makes it easier.

This expression makes my skin crawl everytime. It simply makes no sense.

(nothing personal, plenty of people use it but it is so illogical that it wild be unethical not to protest)

Usually, bitcoin is demanded because it's easy for a target to acquire, then it is swapped for Monero to wash it before cashing out.

This is not true. Crooks do not bother with Monero or even hiding their traces.

https://capitalgram.com/posts/how-to-money-launder-bitcoin/

For example, the REVil author is known

https://threatpost.com/revil-ransomware-core-member/175863/

It is all about geopolitics, privateering and for Russia and China to see incompetent Western companies to suffer.

Would you get rid of your iPhone if you found out criminals used Apple gift cards?

That analogy doesn’t even fit his question.

But would you download a car?

I'm going to need a bigger printer, but yeah, I would.

I don't understand how this works from the ransom email given. Anyone could send that email. It is because it is the first email? Otherwise why doesn't absolutely everyone send their own bitcoin address to any entity that seems to be having some sort of problem?

"I will start 1-2 hours attack on your site."

So it's sent prior to the attack.

It's becoming a pattern in the last few weeks. Fastmail manages my business email which is causing quite the annoyance.

According to the article, this is targeting multiple "privacy and security-centric email services". What are the odds this is a coordinated attempt to drive folks to less secure, or bigger corporate services?

Are there any small (i.e. vulnerable to DDoS) service providers that aren't privacy and security centric?

school districts perhaps

I run my own mail and haven't seen any of this.

I can't think of any reason any intelligence agency in the world would want others using small, "privacy and security centric" (whatever that means? If your email is at any point unencrypted, it's not secure nor private) providers.

Cloud email providers were a dream come true to the world's intelligence agencies and law enforcement.

Interesting, my email provider (not fastmail) was down this morning. First time it ever happened (or first time I noticed). It is up now.

I could be wrong/naive but aren't most DDOS attackers using a bunch of cheap VMs on the cloud to create a distributed network to attack ? Can these providers not do a better job of identifying the culprits and shutting them down ? I doubt it is easy to create Distributed-DOS if access to cheap VMs are restricted.

They don't use cloud providers, they use botnets of compromised computers/IoT devices.

What's the most common malware those computers are infected with, and most common way they got infected to begin with?

My educated guess: The most common way to get infected is via email.

IoT devices get infected because they usually use common software stacks that go un patched. There's crawlers always doing their thing and looking to pop these.

Most sophisticated ones uses bots on residential devices. Ie malware infected, or visiting a site with abusive code.

Reply on news.ycombinator.com