Slashdot Mirror
WanaDecrypt0r Ransomware Earns Just $26,000 In Ransom Payments (krebsonsecurity.com)
An anonymous reader quotes Krebs On Security:
As thousands of organizations work to contain and clean up the mess from this week's devastating Wana ransomware attack, the fraudsters responsible for releasing the digital contagion are no doubt counting their earnings and congratulating themselves on a job well done. But according to a review of the Bitcoin addresses hard-coded into Wana, it appears the perpetrators of what's being called the worst ransomware outbreak ever have made little more than USD $26,000 so far from the scam...
It's worth noting that the ransom note Wana popped up on victim screens (see screenshot above) included a "Contact Us" feature that may have been used by some victims to communicate directly with the fraudsters... I find it depressing to think of the massive financial damage likely wrought by this ransom campaign in exchange for such a comparatively small reward.
It's worth noting that the ransom note Wana popped up on victim screens (see screenshot above) included a "Contact Us" feature that may have been used by some victims to communicate directly with the fraudsters... I find it depressing to think of the massive financial damage likely wrought by this ransom campaign in exchange for such a comparatively small reward.
Hopefully if it becomes the norm that people don't make any money from these things, it won't be worth the effort to do....
Sendmail is like emacs: A nice operating system, but missing an editor and a MTA.
Without knowing how much time and money they put into creating, disseminating, and maintaining it we won't know the RIO. If it was an evenings work, and nothing more than a side job, then $26K could be worthwhile.
about ~14.5 BTC at the current exchange rate.
"However, I find it depressing to think of the massive financial damage likely wrought by this ransom campaign in exchange for such a comparatively small reward. "
This is the most idiotic statement I've ever seen him make. It is a good thing if there was little reward, and his implication that he is disappointed that they didn't get more is just mind boggling.
This is why we should ever pay ransomware.
1) There is a big chance they are not going to unlock your data, anyway.
2) You don't know if they have also stolen all the data and can then do other things to harm you in other ways. Or left residuals in your computer.
3) By paying, you are a "mark" so they might go after you again.
4) Paying absolutely encourages them to continue this behavior and incentivizes others to joint them.
We need to educate everyone: Backup your data redundantly and check it regularly, and don't pay ransomware.
Until you factor in trying to hide from the FBI/Interpol for the rest of your life. Are you sure those transactions are completely untraceable? Yeah, sure, keep telling your self that. Sleep well...
The real question is why isn't the NSA getting its feet nailed to the floor for this? They discovered (or engineered) a critical weakness in a major operating system, and rather than report it to make sure we are actually safe from this threat, they used it to make malicious software which then got released into the wild and is being used against the world.
This is the largest breach of trust of any US government agency that I know of, and yet people are just ignoring that aspect of it.
the ransom was around 300$ and more than 75000 computers infected.. ... That's a total fiasco lol,
That's mean less than 0.1% paid for description
Not if this was hacked up by someone without a job or on spare time, using existing resources. Any non-zero profit would then be a win.
People in hospitals did not get care due to this. There was at least one critical stroke response unit that had shut down complete. Medical equipment also relies on computers, some of which were vulnerable. You want to blame the "victims" for un-patched systems? Sure, all systems should be up to date, but that's a bit like blaming the victim of a stray bullet from a gun fight for not wearing combat armor when he went out for a sandwich that day.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
I find it depressing to think of the massive financial damage likely wrought by this ransom campaign in exchange for such a comparatively small reward
Yeah, as clever as they were they deserved more money?!
Just think, because it made so little money, this may be the last time we see such a wide scale attack, how sad... /sarcasm
Ken
I'm not so sure you can really draw that conclusion, although it's certainly a possibility it was just a "hobbyist", there's no reason why an organized criminal gang wouldn't just launch a malware campaign and let it drift where it would either, and either way they didn't really do so bad on that front, even allowing for the "killswitch" domain registration. As for the $300, yeah, it's low, but that's kind of the point - it's a much more affordable amount that might just tempt a few more people to think it's worth paying vs. trying to recover from whatever viable backups they may have, and much easier to reduce your exposure.
Financially, ~100k random victims paying $300 is still a few times better than a single nation state or major corporation paying several million, especially since it's much less likely to provoke the kind of robust response from law enforcement that a large scale targetted attack will prompt, let alone a ransom demand to a head of state. Of course, if your ~100k random victims also happens to result in major distruption to government organizations and major corporations like this did, you're pretty much guaranteed to get some serious law enforcement attention too, not to mention being made an example of if you get caught. In that light, I suspect the perpetrators - regardless of whether they are a hobbyist or an organized gang - will be sweating buckets over just how well they hid their tracks right now, and might even consider claiming their paid ransoms too much of a risk, and that's also a key point here.
While I agree that things are likely to get a greal deal worse, with a little luck the blowback from this is going to give those behind such attacks some serious pause for thought over the risk vs. reward they have, and should hopefully push that point back a fair way. It's just thrown the whole "spray and pray" approach of such campaigns into stark relief; you have almost zero control over who might get impacted by your campaign, and there's a very real chance you are going to hit some people with the connections to make law enforcement make a real effort to track you down, and all for a few $10k split however many ways? I suspect a lot of hobbyists, and probably a few organized gangs too, are going to be asking themselves whether that is *really* worth the risk of messing up the rest of your life for over the next few days, and will be doing so again if the perpetrators actually get caught.
UNIX? They're not even circumcised! Savages!
"Contact Us" feature that may have been used by some victims to communicate directly with the fraudsters...
So the agencies that supposedly can backdoor any electronics and trace all movements of data can't penetrate thise fragile Bitcoin exchanges or trace phone calls to the perps?
The good thing here is that people have apparently gotten the message to not ever pay these people. Given that they will be completely destroyed if ever caught and that there is a lot of incentive to catch them, I hope this problem will just vanish over time.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
A rough estimation would be between $100M and $1B at this time. That should be plenty of incentive to catch these people.
But that so few payed is actually a good thing, because it means this type of crime does not pay in comparison to the risk the perpetrators take. Hence it kind of _is_ the point.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Not if you did about 10'000 ... 100'000 of that in damage and have a lot of angry people after you. And they have not even got that money yet, because one point where they could get caught is when they try to get that money out of the BC valet. BC is not really anonymous, despite what the press likes to claim.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Criminal enterprises of some sophistication that have been around for a while want one thing most: To stay in the shadows and quietly do their thing. It is good criminal practice to stay under the radar by being not more than an annoyance. This attack has none of the characteristics attractive to such an enterprise or rational single criminals. When the evil scum that did this (definition of evil used: accept huge damage to somebody else for a moderate personal gain) get caught, we will see this is one or a very small group of losers.
And I think this time, they will get caught if at all possible. They did huge damage and disabled critical infrastructure on a scale that terrorists can only dream of.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Comment removed based on user account deletion
there's lots and lots of engineers in China, India & Eastern Europe without much to lose. Their economies have little to no safety net, meaning if you trip up you crash hard. This is one of those consequences of abandoning a good chunk of your population to the forces of nature and the whims of capitalism. There's talk about the US slashing aid to poor middle eastern countries and of Isis et al looking forward to it so they can move on and radicalize the desperate. On a more local scale stuff like this is why we have WIC, so we don't have millions of babies with mental and physical disorders from their developing years.
I know, I know, I'm politicizing. But the thing is like it or not politics affects everything we do. It's scary how far it's embedded in our lives and nobody likes to acknowledge it...
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I think history is gonna show us that we were responsible for the Wana attack. It didn't cross my mind until I heard on NPR that Russia was the county that suffered from the attack the most- even getting into government computers. The Shadow Brokers released this trove of hacking tools a little while ago. This meant the door on using this exploit was going to start closing slowly. We also knew that hackers would take advantage of this exploit. So why wouldn't the US Govt, under the guise of a random hacker, use this exploit to garner as much info as possible on Russia while it was still possible? Remember that Obama told Russia that we would get them back, at the time and date of our choosing. And this would explain why the built in shutdown was hidden in the code- I wouldn't be surprised if that 20 something year old security researcher wasn't tipped off to register that domain name once we'd gotten access to some of Russia's infrastructure, to mitigate collateral damage to the innocent bystanders. That would explain why they "only" got $26k, if their M.O. was to make money there would have been zero reason to include a kill switch in the code.
It shows the bean counters the cost of not keeping systems up to date.
In the form of a Hellfire missile...
It's like those criminals who do $100K damage to some expensive electrical equipment just so they can scrounge a few hundred dollars worth of copper. They simply don't care how much damage they do to other people as long as they get a few bucks in their pocket.
Have you considered that the message "there are no winners here not even the criminals" would be written in exactly the same way?
I think your shoot the messenger attitude is from not considering the context.
A bit odd calling NTFS "modern" when the filesystem on VMS had that feature.
ZFS is a much better and more user friendly example in the way it handles snapshots.
I hate to extinguish your fantasy but script-kiddie shit is invariably shit so it's quite likely that the first person with a clue to take a really good look at the malware could find a hole.
If your fantasy was correct somebody "connected" would be the one tipped off to claim the glory.
Bitcoin ... the currency of criminals.
The problem in nearly every system that was affected by an attack comes down to greed (and not just on the malware maker's part). Hospitals are either businesses, expected to make ever greater profits, or government entities expected to save tax dollars (or some combination). They balance the good they do against the money it costs and unfortunately, sick people tend to be on the losing end.
Medical equipment manufacturers are almost universally corporations. If the money is there, they'll keep upgrading equipment forever, but it's usually more profitable to sell something new.
The people responsible for the equipment knew that it was old and out of date. They decided that the money they had should go elsewhere. You're not blaming the victim when someone deliberately stops maintaining his car and gets killed when his brakes fail, even if he didn't have the money to fix them. In fact, I'd say that he's responsible for any injuries to the people in the other car.
There comes a point where hacking has to be considered a force of nature, and the wind does not respect a fool.
> This ransomware here will encrypt attached devices - such as
> external usb drives - and any network share you may have access to.
>
> So even if you have backups, you can still get burned.
That's *NOT* how to backup. Three principles of successful backups...
1) Do *NOT* let the PC have write access to the backup system. Do not trust it to not f*** up external backups. Instead have the desktop PC share out directories (read-only access) so they can be copied by an external machine running linux/bsd/whatever.
2) Do *NOT* overwrite your backups. Use a proper versioning system. If a file is unchanged, don't make another copy. If it is changed *CREATE A SEPARATE COPY*. If you're running low on space, give read only access to the user and ask them to confirm that the latest file version is not screwed up. Then and only then have the backup machine delete older versions.
3) Set up random "tripwire files" that look like ordinary Word and Excel files... and tell the user *NOT* to touch them. Have the backup machine (with read only access) check the "tripwire files" every hour or so. If any of the files change, have the back up machine send an urgent email to IT to look into it *NOW*!
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
1) Is it possible to trace the bitcoin recipients? To their real IP address? To their home address?
2) Other attacks are often followed by "those who know" telling us that the attack occurred in Russia, or China, or...wherever. Since it is easily possible to spoof the sending IP address of an attack, how are these attackers identified? Won't all the routing information also be compromised? In fact, the only IP address that is accurate is the recipient. Any help?
--
As usual, I am confused.
I've just checked those Bitcoin addresses and they have made a little bit over 20 bitcoins >> $34k >> so they're still making money and will continue as time goes by.
All BTC transactions are recorded in the block chain, in terms of wallet IDs (the three addresses) - it is easy to track transfers in and out. (The trick part is tying a wallet ID to a person, assuming that the person took steps to hide his activities.)