Hacker News Reader

Comment by ookblah | Hacker News Reader

LOL that's some super heavy duty optics framing on what basically amounts to "we paid out a ransom but don't worry the bad guys assured us things were okay"

View on HN

They said “received digital confirmation of data destruction (shred logs)” - is this supposed to fool users into thinking the hackers didn’t keep any of the data?

The criminals did not share the logs of them making a copy of the data before shredding it; so obviously that didn't happen.

maybe they were using quantum computers the whole time https://eprint.iacr.org/2022/1178 /s

I thought it was illegal to pay ransom to hackers. I guess it is legal or maybe it isn't very clear? I thought that there were certain conditions that the company had to check together with law enforcement so that at least the ransom money doesn't go to a hacker group that is on a government payments sanctions list.

Also, does anyone know the root cause of the attack? I read a rumor online (but it's not really confirmed anywhere) that it may have had to do with the common pattern of ShinyHunters where they use a vulnerability in a Salesforce Experience Cloud site. What is confirmed for sure is that the vulnterability involved the feature of Canvas called "Free-For-Teacher accounts".

Not only is it not illegal, there are insurance policies set up to take care of this very scenario. It's almost always handled by a third party, not the company themselves, that would deal with any such concerns.

It is illegal to pay terrorists. As bad and annoying as hackers are, I'm not familiar with any government recognizing any hacking group as a terrorist group. If they did, would they be able to send in SEAL Team 6 to handle the hackers?

Search “cyber jihad” and “cyber islamic state” if you’re curious for answers.

If they were in Iran a drone would’ve paid a visit, based on current events. Most of them are in Russia or former Eastern Bloc like Belarus. USA and the west doesn’t want a direct conflict so the drones never pay them a visit.

Instead, they trick the hackers into going on a vacation in a country that will let them grab them.

The cyber terrorist groups North Korean Lazarus Group and Russian groups like APT28 (Fancy Bear) are on the US SDN list, among others.

> As bad and annoying as hackers are, I'm not familiar with any government recognizing any hacking group as a terrorist group.

If you’re sending a large sum of money to $anonymoushacker, how do you ensure they’re not on some OFAC list? Or do your AML checks? Or make sure you’re not on the wrong side of Foreign Corrupt Practices act? The third party probably turns a blind eye to that cuz there’s no way of really checking.

Cryptocurrency mitigates most of those concerns. That's why the flourishing of crypto payment systems has been an unalloyed blessing for cybercriminals.

It can at a technical level but not at a legal level.

Your BigCo accounting department is not going to be very understanding about acquiring cryptocurrency to send to ??? for a ransom.

Isn't this why in other comments people have said that companies use third parties to pay the ransom rather than paying directly?

That’s my theory too. Setting up payments to a new vendor is hard enough even for the most legitimate.

An org’s Net30 terms aren’t going to work here…

No it does not. It makes some things harder and some things easier. The public ledger means you can track where then money flowed - you might not know who had it but you know how it flows which is interesting. I don't know if it has happened, but I've heard of proposals to make any bitcoin the traces to some transaction illegal to have, and that means nobody who might get caught will have anything to do with those.

“Payment must be made in small, used bitcoins.”

the people who do "AML checks" are the ones processing the transaction.

i don't do that every time i want to send money. private individuals don't just "run checks" - it would make commerce untenable and possibly unconstitutional.

say you get a passport, an address, a photo, a signature, a phone call - how do you verify any of this is real?

Iran, Russia and North Korea are the biggest sources of ransomware.

A large percentage of hacking groups are state sponsored Russians. That seal response would be starting WW3 over some pii.

Protecting pii is important, but it's not that important

we started the pretext to WW3 over someone wanting to move the focus of attention, so it's really not that much of a stretch.

Man, I don’t remember Putin wanting to move the focus of attention that bad.

Aye, I meant more in the sense of "it would be a bad idea", than "that's definitely not going to happen".

Predictions are hard, especially about the future!

It often is illegal to pay them. They are often on sanctions lists, or indeed in embargoed countries. And it's just generally not allowed to pay unidentifiable parties for basic anti-money laundering reasons. And a lot of countries are bringing in new legislation to make paying illegal, starting with public sector organisations. I'm sure that will only expand.

Frankly, you pay a ransom at your peril. If it turns out it was North Korea you may well go to jail for it.

I don't know where you are getting your information from. For one, it's very often unknown, by virtue of how these groups operate, where they are from or who they are affiliated with in the first place. For two, as I stated, it is such common practice to pay ransoms that there are insurance policies specifically for doing so, it's very common to purchase these as part of a SOP of a company's security policy. A business is required, often by the board/shareholders, to maintain business continuity, which is why these exist.

For three, by the FBI's own source, they don't mention anything about it being illegal, they merely advise against doing so[0] -

> The FBI does not support paying a ransom in response to a ransomware attack. Paying a ransom doesn’t guarantee you or your organization will get any data back. It also encourages perpetrators to target more victims and offers an incentive for others to get involved in this type of illegal activity. If you are a victim of ransomware, contact your local FBI field office or file a report at ic3.gov.

I am not saying I support paying ransoms, or take any position here, I am just saying quite factually it is an extremely common practice to pay these, often via third parties that take care of any potential legality issues (which I am not aware of being super common at all, and if you are being targeted by a nation state on a sanctions list, you probably are well aware and have your own legal team/police liasons to deal with any such issues). Most ransomware attacks come from small, unknown groups.

[0] https://www.fbi.gov/how-we-can-help-you/scams-and-safety/com...

If the bad guys get paid and release the info anyway, they not only make it less likely they'll get paid in the future, they make it less likely anyone will get paid in the future.

Even other bad guys have an incentive to stop these bad guys from leaking the info after getting paid.

Why not wait a week and take the site down and ransom them again?

Because why would anyone pay anyone if they were going to do what they threatened you with anyway?

The deal becomes a subscription not indifferent from any other cost of doing business. Great for the hacker. Bad for the IT team incapable of anticipating these attack vectors.

for the same reasons?

Reply on news.ycombinator.com