TSMC faces $70M ransom demand following lockbit cyberattack
thefinalhop.com
thefinalhop.com
> We are apolitical, we do not participate in geopolitics, do not need to tie us with a defined government and look for other our motives.
> Our goal is to make money and not creating problems for society.
> From today, we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.
This one isn't causing immediate disruptions to regular people in the US, but it's still geopolitical-level meddling. If you want to run around mugging people, it's best to avoid robbing the police chief's best friend.
[0] https://www.state.gov/darkside-ransomware-as-a-service-raas/
[1] https://www.theverge.com/2021/5/10/22428996/colonial-pipelin...
"I don't know who you are. I don't know what you want. If you are looking for ransom I can tell you I don't have money, but what I do have are a very particular set of skills. Skills I have acquired over a very long career. Skills that make me a nightmare for people like you. If you let my daughter go now that'll be the end of it. I will not look for you, I will not pursue you, but if you don't, I will look for you, I will find you and I will kill you." - Liam Neeson, Taken.
https://en.wikipedia.org/wiki/Taken_(film)#Controversy
> In 2011, a self-proclaimed counter-terrorism expert was convicted of wire fraud after claiming the film was based on a real-life incident in which his daughter was killed. William G. Hillar, who pretended to be a retired Green Beret colonel, claimed to have spent more than 12 years lecturing US government agencies such as the Federal Bureau of Investigation on security issues. However, records revealed he had actually been a radar operator in the Coast Guard Reserve between 1962 and 1970, and had never been in the US Army. Nevertheless, his website claimed Taken was based on events involving him and his family. Hillar, who admitted the charges, was sentenced to 500 hours of community service at Maryland State Veteran Cemeteries. He also agreed to repay $171,000 in speaking fees that he had received from various organizations to which he had presented himself as an expert in terrorism and human trafficking.[29]
If one set out to do it without much bureaucracy, it is honestly fairly simple given the resources.
This would be unbelievably risky... The mercenary might get caught afterwards, before, or just be a Russian double agent from the start. And if any of that happens, you'd give Putin a massive refueling on his bonfire of anti-western propaganda.
If you're going to make things up, it might be an entirely successful poisoning done by the girlfriend of the head of the gang, days after her mom's bills for cancer treatment were entirely paid off. Then, a rumor goes around that she killed him to get to a secret account, and the evidence is that her mom's bills were paid off mysteriously. Days later, she's found dead in an alley; people assume that she was a victim of another member of the gang - even the other members of the gang assume it, although no one is talking. Meanwhile, it was an agent that had been placed as a clerk at a local tax office, on his lunch break.
If we're making things up.
These are cash-motivated criminals not ideological or patriotic fanatics. I imagine the interrogation would be like "You know why we captured you, right? Yes. Login and disable your entire network and live or we brutalize you until you do and then kill you. Ok."
Especially if this was at a government level (ie, not private "loss prevention") you'd be able to tap the intel network for local criminals and things to hold over their heads to motivate them.
You tell them half payment before and half after? Then they leave with half and don’t do shit.
You say well I’m going to pay you all after job is done. Well they say fuck you, pay half now or we are not lifting a finger you want something from us not that we want anything from you.
Oh how do you track them down and beat them up if they are gone with your half payment? You hire next batch that do the same?
I mean, bully is an emotionally weighted term; but that is precisely the situation. They're the hegemon/sole superpower. It's what nations in that position have done since time immemorial.
On the flipside, Pax Americana has been undeniably the most peaceful time in recorded human history. Conquest is nigh nonexistant, most empires are dead and war, poverty and sickness are at an all-time low. With many of the geopolitical and technological advances that led to that directly attributable to the United States and it's allies. The question isn't whether they are "bullies" or not, it's whether or not you think they're abusing that status and that the other options are nicer bullies. Empires fall throughout history, them losing superpower status would just be a footnote for those people's "gotcha"; so they better be sure the alternative is an improvement.
> That Russia invaded Ukraine isn't unnoticed by these countries but that doesn't give the US a free pass to do whatever it wants, wherever it wants.
Clearly it does. Unless/until someone wants to dismantle their position. Are they playing with fire by overutilizing that position? Certainly. But they're willing to risk that when it is particularly beneficial for them/their allies. What is Cuba, North Korea, Iran, Mexico, etc going to do about it?
> Lots of countries would like to see the US embarrassed for its continued overreach and bullying of smaller countries.
Lots of countries would like to see them embarrassed even if they did absolutely nothing. Again, that's the risk of being hegemon.
US efforts elsewhere are ... not great? While the US involvement in the 1949 coup in Syria is not clear, it's certainly sus how quickly the president approved a pipeline. Then there was Iran shortly after with Mossadegh (https://www.npr.org/2019/01/31/690363402/how-the-cia-overthr...) etc
Central and Southern America , well , can we even name a country where they haven't intervened for the worse?
Hating them is worth nothing, if the replacement (and it's geopolitical aura) is worse; beyond a "gotcha murricans" that would fade in a decade. Few would argue for the world being better if the Soviet Union "won" the Cold War and the US collapsed, especially given the current situation.
That all being said, we could easily take this offline and have a direct conversation on Latin America and how there are hundreds of ways it was positively affected by Pax Americana (even in a net positive, for most), despite the terrible things it's done. And how all of the other regional powers were acting in the exact same manner (worse, in many cases), but receive far less attention in the shadow of the US. My degree/education is in precisely that field, after all.
those hollywood stories about mercs acting as in cia/jason-bourne movie in reality won't fly in Russia
Black OPs are not necessary, and would likely be too messy, what is more effective is flooding weapons into a border nation (like Ukraine) currently at conflict with Russia and then tapping into the local dissenting populace (aptly justified) and allowing them to infiltrate a porous border.
While I'm not stupid enough to think that the CIA aren't above such things, the truth is just like with Cuba/Castro they cannot resort to such tactics anymore: land invasions end up like Afghanistan and Iraq, Stuxnet leads to further instability for almost no gain (blame Israel/Mossad) and this seems more like what they did in the Iran-contra situation mixed in with operation fast and furious. This allows for nearly absolute plausible deniability, while also letting Russia know it's not beyond the West's touch.
The Pentagon/DoD supplying the weapons is just the right amount of overt message that gets the pint across.
Geopolitics and War are absolutely disgusting, but at least their is a logic behind it instead of Red scare BS they were once so headlong to follow; what I ultimately fear is the path these psychopaths are likely to lead us as a Species down if this doesn't end soon.
Hollywood fantasies not withstanding, partisans have been operational in Russia and Belarus since at least the war began. In fact the counter offensive heavily relies on the use of Partisan [0] for sabotage, intel, and counter intelligence and likely will remain until the War ends, and possibly longer.
I think this will end in the end o the greater Russian Federation, last weekend it got close to showing what it will take: there too many warring factions with oligarchs, personal interest and access to private paramilitaries/mercenaries (Wagner being the most obvious) will not allow their standing as the effective ruling class be let go because they no longer support Putin and will back anyone who keeps them in their lofty positions--the collapse of the Soviet Union proved that many times over.
In short, a corrupt Mafia petrol-state has many enemies in and out of it's borders; to think their aren't people ready and willing to kill for vengeance is the real sense of fiction here. Hell, throughout the war their have been many examples of these 'Bourne' types, before the rounding up of fighting age men during the mobilization last year that led to millions of men fleeing Russia, recruitment centers were set ablaze in defiance to the war.
What gets me is if everyone knows this is the inevitable outcome, wouldn't the most logical thing to do is to back Nadya from Pussy riot or Alexi's forced escape and subsequent political aspirations or campaign. (I don't personally care who governs what will likely be a smaller Russia so long as they're contained, and their nuclear weapons are static).
ps no offence and I don't expect you to change your opinion or how you view the world
>> Just by typing this out it reveals ignorance regarding this topic. The people who actually know how it's settled in Moscow and D.C. don't write replies on HN.
Funny, I was is in Ukraine in the Fall of '21 and I felt and knew Russia was going to invade by November, which was when Belarus and Poland were in a proxy war and I had to return into the EU during that debacle and saw how Hungary was locking it's borders.
By contrast no one was mentioning the possibility of Russia invading at that time, despite having put 75k troops in the Spring on the Ukrainian border in Belarus being a major contributor, with any real seriousness.
I'm well aware of what I don't know on these matters, but unlike most of you I have been involved in this matter since the Maidan Revolution. The creation of Uniterd24 was the manifestation of the technology WE in the Bitcoin community built, while you FAANG lackeys patted yourself on the back in creating a digital panopticon.
Let me remind you: we are not the same thing, so I'm not offended. I'm just aghast of how little you people grasp of the World and what is possible with allocating human capital to more noble causes. But since it isn't lucrative or even looked down as it is here (see my post history for examples of this laughable arrogance), if this weren't the case then maybe your opinion would have some value to me.
Just to be clear: I'm not a shot-caller, nor do I consider myself one as I'm an anarchist for a reason and detest the nature of politics/geopolitics to my very core; however, it's clear that COVID and this war has shown the horrendous nature of sleeping with despots these last 3 decades has and is mired with long term consequences for short term (but lucrative gains) for corporations and politicians.
Until you know what it feels like to see Fukushima and then seeing these moronic mobiks digging up trenches in Chernobyl and living in dread as they start shelling Zaporizhzhia while living on mainland Europe I will just never see any value in your opinions either.
Are you talking about https://u24.gov.ua/ ? Not a trace of crypto... (obviously since all crypto is a scam.)
E.g. move from sanctioning and charging the leaders to sanctioning and charging everyone in the whole operation, so they and their families can't leave Russia without facing arrest.
Don't link everything to one ongoing conflict. Business interests continue unabated even in the darkest of times.
https://www.bleepingcomputer.com/news/security/tsmc-denies-l...
The bit about security is ironic.
When this is your selection bias, do the results surprise you?
Or by how nice the ties they wear are
Surely, given the size of the demand, it is beyond the authority of TSMC to pay up, even _if_ they wanted to?
I imagine governments and authorities with any sort of stake in what could possibly be done with such a sum of money (it's unlikely to be used for Good, right?) would have an oversized say in whether or not they are allowed to pay it?
Is there recent precedent for ransoms of this size being paid?
What kind of data could they actually have "stolen" that's worth TSMC paying up $70M, rather than just writing it off?
Most of it probably isn't even on paper but in the minds of their top employees.
Note that TSMC depends on other companies for various parts. Without those they need even more money and time to duplicate it all. There is nothing they are doing that you can't hire engineers to duplicate. They figured it out, so anyone could. However it isn't easy, we could be talking about hundreds of billions of dollars.
TSMC does not have secrets that put them ahead. It’s all about the culture of operations efficiency and just being first to invest in actually implementing cutting edge tech.
ASML is the only company that sells certain equipment needed for photolithography. These machines are physically large and sell for hundreds of millions of dollars. Their export is regulated by multiple governments and international treaties. There are intelligence agencies tracking every single one of those machines and ensuring they don't fall into the wrong hands.
This is just one fatal flaw with the plan.
What, not even ASML that literally sells them that tech?:) No need to over dramatize.
It's not even 12 hours revenue for TSMC.
It is modern equivalent of "rocket science" decades ago
TSMC is amazing but they didn’t invent nor build the EUV lithography machines that enable their processes.
I tend to write this about whole semico, but this time I went just with TSMC, but it isnt fully correct
Think again. Companies try to hide it really well but million-dollar ransoms are paid all. The. Time.
Likewise with insurance payouts for kidnapping ransoms
https://www.theverge.com/2020/8/4/21353842/garmin-ransomware...
A single iOS or Android full chain still goes for between, 2-2.5 million USD.
https://zerodium.com/images/zerodium_prices_mobiles.png
https://zerodium.com/images/zerodium_prices.png
if someone was skilled they could easily live in a HCOL area making 1-1.25 million USD a year.
Depends if you're publicly selling via Zerodium as much, but if you sell privately it might be worth more.
> beyond the reach of one person
It's going to be difficult but I don't think its beyond one person, but even if it was you could easily just go for a less difficult tier to make less money more often.
The real problem would be how lumpy the payments would be, you'd effectively get nothing until you found something and most people cannot afford to that.
Even a perfect backup system is easy to beat. You just infiltrate the running system and encrypt the dataflow into the backup system after you get in, do that for a few months, then strike; now they have to restore from multiple month old backups which is basically just as good.
Before you say that infiltrating for multiple months is unrealistic, that is actually industry average. It usually takes a few months to years to detect a active infiltration that is actively siphoning all data out of your systems as fast as it is being generated. That is not even a largely quiescent system like the backup encrypter, that is actual high bandwidth egress remaining undetected for months.
This is a non-sequitr. Yes there was a cyberattack, but you presented no evidence as to how this could affect chip production besides giving a bunch of anecdotes to what a disruption would do. The rest of the article is informative but I just didn't understand this part.
How valuable can this be?
I'm not sure what you mean by "in control", but they have their foot in the door of Taiwanese politics, and share a lot of common culture. They also live next door.
They have 0 control in Taiwanese politics unless you consider interference having their foot in the door.
North Korea on the other hand use ransomware as one of their main ways of getting foreign currency.
What remains to be seen if the response (if any) to this. You tread a fine line when you threaten the worlds chip supply.
Crypto is a necessary component. And then many ransomware implants will also refuse to run on systems with RUS locale, for instance. The understanding seems to be that groups can avoid attention of local law enforcement as long as they do not make any waves locally.
Has there been any Ransomware Attacks that don't involve Windows machines?
"Risks Associated with Cyber Attacks
Even though TSMC has established a comprehensive internet and computing security network, it cannot guarantee that the Company’s computing systems which control or maintain vital corporate functions ,such as its manufacturing operations and enterprise accounting, would be completely immune to crippling cyber attacks by any third party to gain unauthorized access to its internal network systems, to sabotage its operations and goodwill or otherwise. In the event of a serious cyber attack, TSMC’s systems may lose important corporate data and its production lines may be shutdown indefinitely pending the resolution of such attack. While TSMC also seeks to annually review and assess its cybersecurity policies and procedures to ensure their adequacy and effectiveness, it cannot guarantee that the Company will not be susceptible to new and emerging risks and attacks in the evolving landscape of cybersecurity threats. These cyber attacks may also attempt to steal TSMC’s trade secrets and other intellectual properties and other sensitive information, such as proprietary information of the Company’s customers and other stakeholders and personal information of the Company’s employees. Malicious hackers may also try to introduce computer viruses, corrupted software or ransomware into the Company’s network systems to disrupt its operations, blackmail it for regaining control of its computing systems or spy for sensitive information. These attacks may result in TSMC having to pay damages for its delayed or disrupted orders or incur significant expenses in implementing remedial and improvement measures to enhance the Company’s cybersecurity network, and may also expose the Company to significant legal liabilities arising from or related to legal proceedings or regulatory investigations associated with, among other things, leakage of customer or third party information which TSMC has an obligation to keep confidential. During 2017 and as of the date of this Annual Report, the Company had not been aware of any material cyber attacks or incidents that had or would expected to have a material adverse effect on its business and operations, nor had it been involved in any legal proceedings or regulatory investigations related thereof.
In addition, the Company employs certain third party service providers for TSMC and its affiliates worldwide with whom the Company needs to share highly sensitive and confidential information to enable them to provide the relevant services. Despite that TSMC requires the third party service providers to comply with the confidentiality and/or Internet security requirements in its service agreements with them, there is no assurance that each of them will strictly fulfill such obligations, or at all. The on-site network systems of and the off-site cloud computing networks such as servers maintained by such service provider and/or its contractors are also subject to risks associated with cyber attacks. If TSMC or its service providers are not able to timely resolve the respective technical difficulties caused by such cyber attacks, or ensure the integrity and availability of its data (and data belonging to its customers and other third parties) or control of its or its service providers’ computing systems, the Company’s commitments to its customers and other stakeholders may be materially impaired and its results of operations, financial condition, prospects and reputation may also be materially and adversely affected as a result." - https://investor.tsmc.com/static/annualReports/2017/english/...
The biggest reason it's mostly Windows is not just worse security posture due to complexity but also that Windows is so popular in business, causing it to be the most aggressively attacked platform.
I suspect a secondary reason is that the way windows credentials and file shares are set up, you can really build one-size-fits-all malware that goes after creds and hashes in a fairly generic way.
Out of the box on many distros it's not particularly that safe, it's widespread usage in servers rather than desktops means it's more the sensible firewalling and lack of user installed apps that's giving it the appearance of security.
Edit: the guide, first link is their rationale - https://madaidans-insecurities.github.io/guides/linux-harden...
Yep, ransomware does nothing more than encrypting files users have read/write access to. The OS is not the limiting factor here. The access scope of users does. It really comes down to company IT and how they scope access (and lock down accounts with broader access like they are supposed to).
At least Lockbit seems to have samples floating around for macOS [1].
> At least three of their Annual Reports indicates they knew of the risk of attack.
That's a pretty standard statement these days, it's legalese to prevent shareholders suing for improper statements/risk assessment after an attack.
[1] https://t3n.de/news/macos-version-ransomware-lockbit-1547612...
Incidentally, the dev team (mix of Windows, Linux, Mac) was completely unaffected because we did not have any open shares, remote access was done with SSH. We used a backup system that ran as a pull, where the machine being backed up could not directly access the backup store, so safe.
So yeah, Windows involved, but the damage was more about what infected machine had write access to on the network.
It just takes one.
https://airbus-seclab.github.io/ilo/BHUSA2021-Slides-hpe_ilo...