Pizzerias Receiving Extortion Letters Demanding Bitcoin | Hacker News Reader

Pizzerias Receiving Extortion Letters Demanding Bitcoin

grubstreet.com

72 pointsldayley51 comments

Apparently they've never worked in pizza. I could just see them sending it to my dad.

First off, What's a bitcoin?

Negative Online review...what's an Online review.

Harrassing telephone calls...you mean a friday night?

Farudulant delivery orders...10 all the way pizzas with anchovies...sure we'll make those right up and deliver them...ya right...

Illegal drug sales...don't be primising illegal drugs to the delivery drivers unless your going to follow through.

Health department -- they visit every six months anyway.

BBB...I once watched a customer complain and get an attitute about his pizza ...he took his pizza and threw it in the trash handed him his money back and said dominos is down around the corner.

I used to try to talk him into advertising too get more customers and he'd always tell me he didn't want anymore customers.

He used to keep a saw'd shotgun behind the counter because the gangs that live in the apartment complex behind us were talking about robbing us. There's still a hole on the floor from where one the employees got shot 'cause they just wanted to shoot someone.

Would you mind doing us all a favour and building a database of every pizza place like this on the planet? It sounds like my (our?) kind of place.

It's simple find the most run down looking place you can find that's over 5 years old. You know if they're still in business it's not because if the atmosphere and the service, it's because of the food. Also, as for hacking it's hard to hack an order pad and a pen.

An alternate theory would be the whole thing is a submarine: a way of advertising Bitcoin to pizza owners, under the pretense of a threat.

What could make them take Bitcoin more seriously than the threat of them being harmed by it? It wouldn't be surprising if the whole thing was orchestrated by a Bitcoin startup. And its an easy trick to pull too. You stuff printed letters in a mailbox and they find their way out there. How could anyone prove who did it?

Frankly it's impressive :) After a whole day on HN nobody brought up this possibility. There's also a lesson of strategy here. When you are not making progress being direct about something, try doing its opposite.

What I'm more curious about is how they'll follow up without making it too obvious that they are advertising. How will the make the now worried pizza owner casually bump into a promising Bitcoin company that protects them from extortion and all bad Bitcoin things? Run an ad in the paper or local TV?

If I were a pizza parlor owner, I would frame this letter and hang it in my restaurant.

Some quick digging around: not much to be found on the wallet addresses on the extortion letters. One wallet was tied to a 0.001 transaction on 6/27.

wallet: 17gt1BancvtnnJwy4BA41VBUH3pfbUvzE block: 308079

Can't coinbase just ban whatever id was presented in the letter?

See also "joe job", "reputation attack", and "denial of service".

Even if money goes in, you can't be assured someone didn't just deposit it for the lolz, or if it was the perpetrators just moving their own coin around.

It's cheaper for the Pizza company to eat some of the fraudulent orders than pay the $600 extortion fee.

That's if the extortionists even bother carrying through with their threat. It's pretty cheap to print up a thousand letters and mail them to pizzerias all over the country; if even a couple cough up the money, that's probably money and effort spent well enough. The deadline is far enough in the future that it's not really worth it to prove that punitive measures will be taken.

I guess I assumed these were coming from out of the country. Do we know that they are being mailed in the US? If that is the case the postal service almost certainly knows which post office these were mailed out of.

How useful is that? Someone could drive an hour, dump them all in a mailbox anonymously...

Could be useful if triangulated with other information.

And it's always possible that whatever mailbox they dumped them in was in view of a video camera or perhaps their car passed video surveillance (or walked by). Or maybe used an ATM nearby. Or paid a toll. People slip up. For that matter what about all that stuff about embedding things in printers (micro traces or whatever they are called).

Otoh, I constantly get all sorts of scams from overseas wanting to charge me ridiculous amounts of money for trademark registries (approx. $2000 USD iirc) of zero value. They have been pretty consistent over the years and I'm guessing that even with the cost of foreign postage they are a net win for the perps. Otherwise I can't imagine they would keep sending them.

My girlfriend's father had a hacker break into their network drive, encrypt all their files, and extort the company for $500 of Bitcoin in exchange for the password...

That's some cheap-ass pentesting. Here you go buddy! (j/k)

To explain the joke... companies spend tens of thousands doing "pentesting" to stave off vectors for concerted attacks. In this case, they would be spending tens of thousands to prevent the...$500 being extorted. My joke is that it is just as easy to pay the guy $500 for finding the errors. It's just a joke, though. You shouldn't pay extortionists a dime. (Even if that's all they ask for.)

There is some logic of burying wallet.dat files in various places in your systems and monitoring them. If/when they go missing, you know you have a problem.

Possibly set-up a periodic cycling system that drives the intruder to move them now, before they get cycled and might lose their bounty forever.

Your girlfriend's father opened an email attachment he shouldn't have, you mean?

edit: C'mon, folks. Cryptolocker isn't a bunch of hackers targeting individual network drives. It's spread via email. http://en.wikipedia.org/wiki/CryptoLocker

Well, he had to tell his wife something...

Sure, and stupid people deserve to be taken advantage of, right?

Cos' that's what I see you saying.

No, I'm saying awareness of the actual causes of computer issues like Cryptolocker can be very helpful in preventing such infections.

No one in the general public is going to know how to protect against "hackers". "Don't open attachments if you aren't expecting them from someone" is actionable advice.

The problem is, before your edit, you just made a sarcastic response whose sole function, as far as I can tell, is to belittle the person you were responding to for their lack of awareness of issues like Cryptolocker without attempting to inform them.

This may not be a correct interpretation of your post but it is how it reads to me, above the edit.

Email attachments today, browser 0-days tomorrow.

See http://en.wikipedia.org/wiki/Ransomware … or far more entertainingly, http://en.wikipedia.org/wiki/Reamde (read the novel, not the Wikipedia page)

I wonder if my disk is already encrypted (full disk encryption), can they put another encryption on top of that?

Yes... the malware replaces each file with an encrypted version. It works on an individual file level.

Page has a pop-up with autoplay video ad. No thanks.

Adblock/Flashblock/Ghostery seem to have blocked it for me.

They might as well be asking for plutonium or stolen Picassos... pizzerias don't have bitcoins, and generally-speaking have no idea how to get them.

Seriously. Should have included two pages instructing them how to acquire the things...

I hope they reported that to the police!

actually, my local hole-in-the-wall takes bitcoin.

This would be a great way for the Fed to push back on their competition.

The Fed is in the pizza business?

The address doesn't seem to be a valid BTC address.

I came here to upvote anything stephenson - reamde and for pizzerias, snowcrash.

Obviously the victim isn't the local pizzera its Coinbase. Someone just spent "not very much money" to make them look incredibly bad.

Should be fairly easy to track them down, just analyze the pattern of yellow dots on the color laser print to figure out the make, model, and serial number of the printer making the extortion letters, then contact whichever of coinbase's competitors made those letters and ...

Now if I was thinking a little more clearly I'd figure out how to track them down myself, and let it be known to coinbase's competitor that I'd keep these facts quiet if I was too busy eating pizza bought by, say, 5000 BTC from whichever coinbase competitor made the letters.

It's likely coinbase was chosen simply because it's the easiest way for their victims to buy coins. There is a vulnerability with Pizza businesses in that they trust the caller is making a legit order, and don't ask for pre-payment before delivery thus leaving them open to fraud. Whoever is doing this is clearly bluffing and hoping just a handful of businesses pay the extortion and likely flooded the mail system with these letters. I bet the payment address is the same for each extortion letter meaning they have no way of knowing if a company pays or not.

Read your username as "Nakatomi Pizza".

This extortion attempt could create a new startup: Nakatomi Pizza that processes calls to check for fingerprints of fraud, and to verify orders. "Now I have a machine learning caller-ID with advanced heuristics ho, ho ho"

Yeah you guys are probably right, after all.

If it demanded cash and suggested visiting your local Citibank Branch or Citibank In Network ATM that clearly would also be an equally random and meaningless data point, totally not trying to make Citibank look bad or anything.

If "cash" was a random form of currency that the pizza parlor had statistically never heard of and had literally no idea on how to acquire, then providing an address for a specific ATM would be pretty random and meaningless, yes. Would you expect an extortion letter to say "If you don't pay me one bitcoin, I'm gonna screw with your business. I'd tell you where you can find a bitcoin, but I don't want this extortionary attempt to slander the name of legitimate businesses who are trying to increase the adoption rate and accessibility of this exciting new crypto-currency"?

/boggle. The pizzeria is indisputably the victim of extortion here.

Will be super easy as long as they had the foresight to buy the printer on a credit card and the pizzeria's police force is actually CSI.

Seriously, the police are not going to analyze dots on laser printer to track down an extortion for $500, just like they don't swab for prints / DNA on a B&E. Real life is not CSI.

If the extortionist is making threats across state lines, it stops being a $500 matter for the local LEOs and starts being a matter for the FBI.

Even if they bought the printer with a check and wrote "FOR CRIMINAL EXTORTION" in the memo field, the fact that the letter was created with an HP printer probably still does not remove enough bits of anonymity to find them.

I had an attempted break-in and the police (UK) did indeed dust for fingerprints - and they caught the guy.

Printer tracking dots aren't some super high-tech CSI stuff.

https://www.eff.org/pages/list-printers-which-do-or-do-not-d...

"What the heck is a BitCoin??"

I bet there is no actual extortion going on, but kind of a "let's educate the business owners into the new digital economy, and, if necessary, by force".

The pranksters probably estimate, once the business owners find out what is the idea of Bitcoin, they will say, hey, let's offer this to our customers.

Um, no, that's a pretty clear cut example of extortion.

Whether they follow through with the threats or not is irrelevant. The act of extortion has already been committed.

So your theory is that, having been introduced to a new idea by gut-churning fear and anger, business owners will immediately think "Hey, this is pretty cool! We should use it!"

Have you met many humans?

Replying because I don't think your post deserves all the downvotes, even though I think your argument is stupid.

TBH, my first thought when I saw the "notice of extortion" letter was that it was a joke. Not a particularly funny one for the restaurateurs, but perhaps someone's lame idea of a prank that got a bit out of hand.

However, as others have pointed out already, it is most definitely a clear-cut case of extortion whether or not they have any intent of following through on the threats. Just as robbery with an unloaded gun is still robbery and threatening with a deadly weapon: nobody knows whether it's loaded, so they have to assume it is. In that case the induce fear and panic is quite real. People have been known to have heart attacks in such situations. In that case the the perpetrator has committed a homicide, regardless of intent.

It's also not a very good way of winning hearts and minds if education is the goal.

Reply on news.ycombinator.com