Slashdot Mirror
Hackers Find Bugs, Extort Ransom, Call It a Public Service (threatpost.com)
Reader msm1267 shares a report on ThreatPost about an ongoing security trend: Crooks breaking into enterprise networks are holding data they steal for ransom under the guise they are doing the company a favor by exposing a flaw. The criminal act is described as bug poaching and is becoming a growing new threat to businesses vulnerable to attacks.
Hackers are extorting companies for as much as $30,000 in exchange for details on how hackers broke into their network and stole data. Researchers say once the intruders steal the data, there's no explicit threat that they will break in again or release data if companies don't pay. Instead, attackers release a simple statement demanding payment in exchange for details on how to fix the vulnerability
Typical bug poaching incidents start with criminals breaking into a network and stealing as much sensitive data as they can. Next, they post the data to a third-party cloud storage service. Lastly, the attackers email the company links to the data as proof the information was stolen and ask for a wire transfer of money in exchange for how the data was stolen.
During the attack, victims are not threatened with the public release of their data, instead attackers simply send a message that reads: "Please rest assured that the data is safe with me. It was extracted for proof only. Honestly, I do this job for a living, not for fun."
Hackers are extorting companies for as much as $30,000 in exchange for details on how hackers broke into their network and stole data. Researchers say once the intruders steal the data, there's no explicit threat that they will break in again or release data if companies don't pay. Instead, attackers release a simple statement demanding payment in exchange for details on how to fix the vulnerability
Typical bug poaching incidents start with criminals breaking into a network and stealing as much sensitive data as they can. Next, they post the data to a third-party cloud storage service. Lastly, the attackers email the company links to the data as proof the information was stolen and ask for a wire transfer of money in exchange for how the data was stolen.
During the attack, victims are not threatened with the public release of their data, instead attackers simply send a message that reads: "Please rest assured that the data is safe with me. It was extracted for proof only. Honestly, I do this job for a living, not for fun."
... If someone ELSE broke in and found the information, and then released it to the public - but I wouldn't do such a thing. ... heheheh
Isn't this the way capitalism is supposed to work? Find a need and fill it?
It's all fun and games and your "living" until the FBI (or insert your country's equivalent here) breaks your door down at 3:00 AM. Try to convince a judge "I broke into his house and stole his cat and held it ransom because I wanted to let him know his windows are breakable."
Just because I can hook a shark from a boat, I do no offer to wrestle it in the water.
Bug bounty participants decide they want a raise.
The good Samaritans are being being treated like criminals anyway. This makes it worth the risk. We can blame the authorities for this turn of events. Treat people like criminals, you're gonna get criminals.
“He’s not deformed, he’s just drunk!”
>> Please rest assured that the data is safe with me. It was extracted for proof only. Honestly, I do this job for a living, not for fun
If that's true, then these enterprising young job creators are missing a viable revenue stream: also selling copies of the data. (In other words, anyone who says this is still full of it.)
Meanwhile corporations put profit over security. Some body calls them out for it and they claim terrorism. Fix your shit or get owned. Blaming somebody for walking in front door when you left the door unlocked is stupid. This is the real world. Not some fantasy place where your wish is everyone else's command. Self righteous spin will come back to haunt you.
Unless we know they usually do release the data they gathered (which apparently they don't) the company has the option of paying or not paying, depending on whether they consider the information valuable enough. It's no different than hiring a pentester, except that you already know in advance that you'll get a vulnerability fixed.
Extortion would be to threaten the company with releasing the data if they refuse to pay.
This is simply fishing for bug bounties from companies that don't already offer them. It might be illegal but its definitely not extortion.
There's also no reason they should disclose the vulnerabilities for free- that's providing penetration testing (a legitimate job) for free.
On the flip side, if the companies don't want to pay the hackers and choose not to, that's their own choice and also perfectly legitimate.
There should be an established legal way to perform this kind of work. Security vulnerabilities affect everyone, not just the companies that have them. If there were some sort of license which would allow you to perform this work without fear of legal repercussions while protecting the acquired data, we would see a lot more white hat hackers and maybe less black hat/malicious ones.
This is extortion.
Like seriously anyone can possibly be expected to believe that?
If the person is willing to break the law and hack into somebody else's computer without permission, why the heck would they have any compunction about lying about not releasing the data? They've already showed willingness to ignore what the law requires them to do (or not do), so there is no reason to believe that they would not release the data.
File under 'M' for 'Manic ranting'
... If someone ELSE broke in and found the information, and then released it to the public - but I wouldn't do such a thing. ... heheheh
According to TFA that is NOT what they are doing. Also, according to TFA, that is exactly what they are doing. When an article is written this incompetently, and contains contradictory statements, and zero actual examples, it is best not to draw conclusions from anything it says.
Technically, prosecutors can't charge blackmail because they haven't said your data will be exposed unless you pay. They are only asking to be paid for how to patch the security flaw. (White hacking + data extraction) Of course the idea is to add "incentive" with the data being in public, unauthorized space. But they haven't said it would be leaked unless payment is given (or only take it down on the same terms). Of course the victim could turn that around and say, "before we discuss the merit of your services, let's say you remove all files the files I own from your server, allow me access that I may be satisfied to the fact it is destroyed and no spare copies exist, you tell me how your broke into my system and how to patch it up and in exchange I don't send your name, and your communications to me to the cyber crimes division of the FBI, it's a bargain considering the alternative, and some free advice in return for your assistance...stop short of actually stealing files before asking for a fee for your proactive "good citizenry". Appreciate your efforts".
"Imagination is more important than knowledge" - Einstein
sounds like these blackhats just got their MBAs. ;)
Anons need not reply. Questions end with a question mark.
as they put a loaded gun to the head of these criminals:
I do this job for a living, not for fun.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
After decades of "We'll fix that as soon as possible (maybe 20 years)" or "How dare you threaten/embarrass us, you evil criminals!" as a response to disclosure of security vulnerabilities, I can sympathize with this course of action. After all, they're at about as much risk of legal action either way, in fact probably less this way.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
"Hacker" is a completely empty term by now. You could have written what you know, instead of stooping to empty words. But you didn't.
Keep it up, and I keep on not reading you. Why would I? You keep on telling me you don't know anything, anyway.
They're not threatening to release the data, so it's not a ransom. They're just not going to tell you how to do your job and secure your data. They're not going to get that service for free any where else...and at least this way they're not getting screwed by a real breach.
Not sure how cyber-security insurance works but this sounds like a bargain. What's needed to control this opportunistic capitalism, is 1) corporations treating IT infrastructure and maintenance as an asset, not an expense; 2) A forum/newsgroup for sharing solutions to known problems. Obviously the software/firmware vendor has the biggest incentive for offering such a forum/newsgroup.
Whether or not this is actually extortion depends on whether or not the hackers release the data if the company decides not to pay. If the company says no and that's the end of it I can't get too excited, though the act of breaking in is itself illegal in most places.
Even if you a small company and frivolously sued lawyers will tell you to settle for anything less then 30K. Why? Because that is how much it is going to cost you to win the case.
If I owned two million dollars worth of personal stuff and a thief robbed me then offered to return everything for 30K and tell me how he robbed me so I could fix the problem with my security.... I would think 30k for 2 million would be a bargain.
The public service here is that the company was lax in protecting their data and taking security for granted. You don't lock up your business with a $2 padlock and have a right to think it's secured and protected and that the police and the law will protect you. An insurance adjuster would laugh at you and give you an outrageous premium.
Computer security is serious business and you need to be spending at least $200,000 a year just on audits and penetration testing. Otherwise don't collect and hold the data, instead subcontract it to another company.
Just because you can skimp with a $2 padlock doesn't me you should. Pay the salaries for a good IT department and contract outside consultants. Stop being cheap asses just because you can. You are aiding and abetting a the id and credit fraud out there. The government should fine you more than 30K for each time your hacked... Does the government need to do your security auditing for you?
Since the companies will take white hat hackers to court over exposing vulnerabilities that the companies have refused to fix, taking data hostage to be used as leverage seems like the logical next step.
You try to extort the wrong "organization" and they come knocking at your door.
Dig a big big big fucking tomb.