Baltimore Held Hostage in Cyber Attack

[SydneyCarton 48191]

I didn't see this posted anywhere else, so if this is covered elsewhere, I apologize. But a friend of mind posted this and I found it super interesting. 

https://www.vox.com/recode/2019/5/21/18634505/baltimore-ransom-robbinhood-mayor-jack-young-hackers

 

In another thread, I got mocked that Bitcoin transactions are indeed traceable. But that gets the question, if this is the case, why would these obviously somewhat sophisticated Hackers be requesting Bitcoin? Sadly, the notion of weak technical infrastructure being this vulnerable is extremely easy to believe. Curious what others think about this. It's safe to assume we'll be seeing more and more of these things take place over time here in America and elsewhere. 

Thoughts?

[Blotto 23579]

Quote

And such attacks can be expensive, perhaps especially if targets say they won’t pay. In 2018, hackers demanded that Atlanta pay about $50,000 in bitcoins as part of a ransomware attack. The city refused, and according to a report obtained by the Atlanta Journal-Constitution and Channel 2 Action News, the attack wound up costing the city $17 million to fix.

I get that there's a risk associated with paying the ransom, but that's a tough tradeoff to swallow. It will get interesting when they start holding infrastructure control systems hostage (water treatment, electric, etc...). You'd be surprised how incompetent some of the control system engineers are in smaller municipalities. A lot of 55-65 year old lifers that haven't exactly stayed current with emerging technologies. 

[Guest Lobo]

But dem cybercorners, yo

[Trey3216 15359]

27 minutes ago, SydneyCarton said:

. But a friend of mind posted this and I found it super interesting. 

 

Thoughts?

Is he a friend over matter as well?  

[RDCanecutter 26474]

I think it's the ex-mayor's doing. She was like, "Fine. Don't wanna buy my childrens' book? I'll have my nephew in IT shut the city down."

[phdhorn 6224]

Breaking news:  Baltimore sucks.  Film at 11.  Never mind, it doesn't work.

[SydneyCarton 48191]

28 minutes ago, Blotto said:

I get that there's a risk associated with paying the ransom, but that's a tough tradeoff to swallow. It will get interesting when they start holding infrastructure control systems hostage (water treatment, electric, etc...). You'd be surprised how incompetent some of the control system engineers are in smaller municipalities. A lot of 55-65 year old lifers that haven't exactly stayed current with emerging technologies. 

I kind of agree. What I'd personally like to see is America start to take this shit seriously, and to really work on our digital (and physical) infrastructure. But that's almost certainly a pipe dream. You can'd just make an ATM to pay terrorists, but fuck.

[clapclapclap 9000]

Quote

The Baltimore hackers’ ransom note, obtained by the Baltimore Sun, demanded payment of three bitcoins per system to be unlocked, which amounts to 13 bitcoins to unlock all the seized systems.

4.33 systems, or Vox math?

[Parliament 14325]

[El Diablo 4232]

I heard a discussion on this last night. Apparently in some cases the hackers aren't as skilled in debugging the computers as they are at initially hacking into them. Once the victim has paid up, they can't get the thing reset to its precorrupted configuration. I mean, it's admirable that, from what I heard, they typically do restore the computer. The expert said that there have even been cases where the perps have refunded some of the BTC when they couldn't fulfill their promise of restoration.

Fuck Maryland.

[Prepuce of Doom 21104]

Edited May 22, 2019 by Prepuce of Doom

[crash_davis 23115]

dammit betty.  for the last fucking time, quit clicking links on phishing emails.

putin and the russians are laughing.  if we ever go to war with the russians, they'll disable everything with a few keyboard strokes and mouse clicks.  we'll go back to wacking off to the bra section in the montgomery wards' catalog.

Edited May 22, 2019 by crash_davis

[El Diablo 4232]

1 minute ago, crash_davis said:

dammit betty.  for the last fucking time, quit clicking links on phishing emails.

putin and the russians are laughing.  if we ever go to war with the russians, they'll disable everything with a few keyboard strokes and mouse clicks.  we'll go back to wacking off to the bra section in the montgomery wards' catalog.

We could never do the same to the Russians, too many clicks.

[LonghornJones 837]

1 hour ago, phdhorn said:

Breaking news:  Baltimore sucks.  Film at 11.  Never mind, it doesn't work.

Didn't hackers demand bitcoin from one of our surly members or else D pics, etc. would be sent to all of his contacts?

[crash_davis 23115]

1 minute ago, LonghornJones said:

Didn't hackers demand bitcoin from one of our surly members or else D pics, etc. would be sent to all of his contacts?

we all pitched in to pay the ransom because no one wanted to know in detail his abnormal porn fetish.

[Homercles 10206]

Here’s a coupon for free Starbucks!

StarbucksCoupon.pdf.exe

[RamjetFDO 10578]

[po elvis 2077]

Do we ever find the people that do these attacks? Are the mostly out of the country? If we find them, are the penalties stiff? Like life in prison stiff?

[dirtonia 269]

If ya come at da king, ya best not miss.

[Cheeseweasel 26438]

3 minutes ago, dirtonia said:

If ya come at da king, ya best not miss.

Baltimore is the Jester. Take your best shot. 

[Orange&White 5539]

24 minutes ago, crash_davis said:

dammit betty.  for the last fucking time, quit clicking links on phishing emails.

Jesus Fucksticks if this ain't the truth.

Every. Fucking. Day.

End users are dumb. 

We spend a shitload of money on multiple, hourly, redundantly stored, secure, back ups for this exact reason.

 

[ztejas 43540]

17 minutes ago, po elvis said:

Do we ever find the people that do these attacks? Are the mostly out of the country? If we find them, are the penalties stiff? Like life in prison stiff?

No it's generally a couple defensive driving classes and some light community service. 

[elfenix 34332]

Anyone check for Myanmar Muslims?

[Beau Vine 54434]

[Beau Vine 54434]

37 minutes ago, LonghornJones said:

Didn't hackers demand bitcoin from one of our surly members or else D pics, etc. would be sent to all of his contacts?

I got one of those.  It said they had hijacked my camera on my computer and caught me "soloing," and would be sending the pics to all my contacts.   

"Soloing."  That still cracks me up.  

[Blotto 23579]

33 minutes ago, LonghornJones said:

Didn't hackers demand bitcoin from one of our surly members or else D pics, etc. would be sent to all of his contacts?

You could probably start a business where a dude provides the numbers of a few gals he wouldn't mind hooking up with, and those numbers get a spoof text with pics of a ridiculously large cock. The guy can claim his phone was hacked, apologize but hey, what are ya gonna do. Sorry you had to see my elephant gun, I'm terribly embarassed.

[LonghornJones 837]

<narrator voice>...and just like that, he became a millionaire.<narrator voice>

Edited May 22, 2019 by LonghornJones

[phdhorn 6224]

1 hour ago, LonghornJones said:

Didn't hackers demand bitcoin from one of our surly members or else D pics, etc. would be sent to all of his contacts?

Yes, still in heated negotiations.

[phdhorn 6224]

1 hour ago, crash_davis said:

we all pitched in to pay the ransom because no one wanted to know in detail his abnormal porn fetish.

Yes, I wanted to thank Surly for a dick ring that looks like a wreath.

[LonghornJones 837]

I did the end pieces with the little tassels.

[RDCanecutter 26474]

So everybody thinks dogs are cute, and dogs all walk around with they little dicks hangin out.

So wouldn't it be fairly innocent for somebody to send dog dick pics to his female friends? Asking for @phdhorn.

[El Diablo 4232]

2 hours ago, RDCanecutter said:

So everybody thinks dogs are cute, and dogs all walk around with they little dicks hangin out.

So wouldn't it be fairly innocent for somebody to send dog dick pics to his female friends? Asking for @phdhorn.

If you can put them in brackets Surly will pick a Grand Champion.

Edited May 22, 2019 by El Diablo

[Don Johnson 4757]

1 hour ago, po elvis said:

Do we ever find the people that do these attacks? Are the mostly out of the country? If we find them, are the penalties stiff? Like life in prison stiff?

When we catch them, they end up working for us.

[SquishMitten 10440]

2 hours ago, El Diablo said:

The expert said that there have even been cases where the perps have refunded some of the BTC when they couldn't fulfill their promise of restoration.

This is the word of honor hacker 

[Fuck Tim Beck 3834]

39 minutes ago, RDCanecutter said:

So everybody thinks dogs are cute, and dogs all walk around with they little dicks hangin out.

So wouldn't it be fairly innocent for somebody to send dog dick pics to his female friends? Asking for @phdhorn.

 

19 minutes ago, El Diablo said:

If you can put them in brackts Surly will pick a Grand Champion.

I can think of nothing the surl is more qualified to judge than dog dicks. 

[Pig Bellmont 8739]

25 minutes ago, SquishMitten said:

This is the word of honor hacker 

Well honestly why would anyone pay if the ransom ware can’t be undone? If they have any hope of extortion, it’s in their interest to follow through. 

[El Diablo 4232]

26 minutes ago, Pig Bellmont said:

Well honestly why would anyone pay if the ransom ware can’t be undone? If they have any hope of extortion, it’s in their interest to follow through. 

In the case of Baltimore if the city doesn't pay and everything crumbles would anyone know the difference?

Baltimore - 1, Hackers - 0.

[Pato del Muerto 52608]

In regards to the Atlanta example, if they are asking for 50k for something that costs 17 million to otherwise fix, then that 17 million figure should be a tightly kept secret, or the next time the ask will be more like 15 million. Idiots just informed the hacking community of fair value. 

[staboner 4988]

9 hours ago, Blotto said:

I get that there's a risk associated with paying the ransom, but that's a tough tradeoff to swallow. It will get interesting when they start holding infrastructure control systems hostage (water treatment, electric, etc...). You'd be surprised how incompetent some of the control system engineers are in smaller municipalities. A lot of 55-65 year old lifers that haven't exactly stayed current with emerging technologies. 

I can see it coming in about 5 years, maybe 10 at the most. The hacking talent is out there and growing fast. All they need is protected cover (hi Russia) to do shit and voila you have a criminal network in operation. Just like school shootings, there will be a big one and then it will become the norm. I can see water utilities, traffic systems, the grid, and anything that has been semi-modernized being vulnerable. The true IoT revolution will actually finally take off in the face of this threat. It will have to.

If I was a betting man I would say this is the cause of the next great world conflict (of nations). Some places will be a haven for this type of activity and the only way to crush it will be state power. And one state will have had enough and you will have war on your hands. Thats not even to mention state-sponsored cyber terrorism (hi China). 

[atomheartbevo 89808]

At least we don't have to worry about them hacking into Austin's voting machines - there can't be that many OS/2 or Windows 3.1 hackers floating around.

[atomheartbevo 89808]

3 minutes ago, staboner said:

If I was a betting man I would say this is the cause of the next great world conflict (of nations). Some places will be a haven for this type of activity and the only way to crush it will be state power. And one state will have had enough and you will have war on your hands. Thats not even to mention state-sponsored cyber terrorism (hi China). 

Any states openly harboring this shit will find themselves easily cut off from the rest of the internet.  Not many dictators of third-world shitholes want to lose access to porn and Amazon.

[Blotto 23579]

1 hour ago, staboner said:

I can see it coming in about 5 years, maybe 10 at the most. The hacking talent is out there and growing fast. All they need is protected cover (hi Russia) to do shit and voila you have a criminal network in operation. Just like school shootings, there will be a big one and then it will become the norm. I can see water utilities, traffic systems, the grid, and anything that has been semi-modernized being vulnerable. The true IoT revolution will actually finally take off in the face of this threat. It will have to.

If I was a betting man I would say this is the cause of the next great world conflict (of nations). Some places will be a haven for this type of activity and the only way to crush it will be state power. And one state will have had enough and you will have war on your hands. Thats not even to mention state-sponsored cyber terrorism (hi China). 

I would be surprised if it doesnt happen in 1-2 years. There are a ton of outdated control systems or even modern control systems managed by lazy or incompetent staff that are very vulnerable to phishing exploits. The ability to remotely log into your SCADA application to respond  to system alarms is great for the plant engineer at home at 10 PM, but it also allows access to the system to others if the system isnt hardened, patched etc...

I'm actually shocked it hasn't happened already to be honest. I probably get 1 phishing email a week that makes it through our corporate email filters that appear to be from our domain. The request will be to access a file for payroll issues, collaborate on a project folder etc... and they look legit. But if you inspect the file properties, you quickly realize that things arent as they appear. You have to figure some non-neglible percent of your coworkers just click on that shit because they are just going through the motions at 4:45 on a friday.

Edited May 23, 2019 by Blotto

[F250 28823]

1 hour ago, Blotto said:

I would be surprised if it doesnt happen in 1-2 years. There are a ton of outdated control systems or even modern control systems managed by lazy or incompetent staff that are very vulnerable to phishing exploits. The ability to remotely log into your SCADA application to respond  to system alarms is great for the plant engineer at home at 10 PM, but it also allows access to the system to others if the system isnt hardened, patched etc...

I'm actually shocked it hasn't happened already to be honest.

It's been happening for awhile now. It's not commonly known because the Feds get involved and NDA's are issued.

 

[staboner 4988]

yeah its been happening for some time. 

just waiting on the big one.  

 

 

[ImissWallyPryor 9046]

Call me whatever you want, but I’ve often wondered if some things are best controlled by humans (even with computers) instead of almost entirely by computers. 

[LonghornJones 837]

Hell, when i was a kid my best friend was a stick named Nacho. We got in to all sorts of mischief. Times were simpler then.

[housious 468]

22 hours ago, SydneyCarton said:

I didn't see this posted anywhere else, so if this is covered elsewhere, I apologize. But a friend of mind posted this and I found it super interesting. 

https://www.vox.com/recode/2019/5/21/18634505/baltimore-ransom-robbinhood-mayor-jack-young-hackers

 

In another thread, I got mocked that Bitcoin transactions are indeed traceable. But that gets the question, if this is the case, why would these obviously somewhat sophisticated Hackers be requesting Bitcoin? Sadly, the notion of weak technical infrastructure being this vulnerable is extremely easy to believe. Curious what others think about this. It's safe to assume we'll be seeing more and more of these things take place over time here in America and elsewhere. 

Thoughts?

Can’t bitcoin just be traded for monero or some other privacy coin? At that point it’s virtually untraceable, right?

[Fudge Nuggets 19225]

On 5/23/2019 at 3:29 AM, Blotto said:

ou have to figure some non-neglible percent of your coworkers just click on that shit because they are just going through the motions at 4:45 on a friday.

This is why I leave no later than 3:00 on Fridays; doing my part for IT security.