Jump to content

Baltimore Held Hostage in Cyber Attack


SydneyCarton

Recommended Posts

I didn't see this posted anywhere else, so if this is covered elsewhere, I apologize. But a friend of mind posted this and I found it super interesting. 

https://www.vox.com/recode/2019/5/21/18634505/baltimore-ransom-robbinhood-mayor-jack-young-hackers

 

In another thread, I got mocked that Bitcoin transactions are indeed traceable. But that gets the question, if this is the case, why would these obviously somewhat sophisticated Hackers be requesting Bitcoin? Sadly, the notion of weak technical infrastructure being this vulnerable is extremely easy to believe. Curious what others think about this. It's safe to assume we'll be seeing more and more of these things take place over time here in America and elsewhere. 

Thoughts?

Link to comment
Share on other sites

Quote

And such attacks can be expensive, perhaps especially if targets say they won’t pay. In 2018, hackers demanded that Atlanta pay about $50,000 in bitcoins as part of a ransomware attack. The city refused, and according to a report obtained by the Atlanta Journal-Constitution and Channel 2 Action News, the attack wound up costing the city $17 million to fix.

I get that there's a risk associated with paying the ransom, but that's a tough tradeoff to swallow. It will get interesting when they start holding infrastructure control systems hostage (water treatment, electric, etc...). You'd be surprised how incompetent some of the control system engineers are in smaller municipalities. A lot of 55-65 year old lifers that haven't exactly stayed current with emerging technologies. 

Link to comment
Share on other sites

28 minutes ago, Blotto said:

I get that there's a risk associated with paying the ransom, but that's a tough tradeoff to swallow. It will get interesting when they start holding infrastructure control systems hostage (water treatment, electric, etc...). You'd be surprised how incompetent some of the control system engineers are in smaller municipalities. A lot of 55-65 year old lifers that haven't exactly stayed current with emerging technologies. 

I kind of agree. What I'd personally like to see is America start to take this shit seriously, and to really work on our digital (and physical) infrastructure. But that's almost certainly a pipe dream. You can'd just make an ATM to pay terrorists, but fuck.

  • Like 1
Link to comment
Share on other sites

I heard a discussion on this last night. Apparently in some cases the hackers aren't as skilled in debugging the computers as they are at initially hacking into them. Once the victim has paid up, they can't get the thing reset to its precorrupted configuration. I mean, it's admirable that, from what I heard, they typically do restore the computer. The expert said that there have even been cases where the perps have refunded some of the BTC when they couldn't fulfill their promise of restoration.

Fuck Maryland.

Link to comment
Share on other sites

dammit betty.  for the last fucking time, quit clicking links on phishing emails.

putin and the russians are laughing.  if we ever go to war with the russians, they'll disable everything with a few keyboard strokes and mouse clicks.  we'll go back to wacking off to the bra section in the montgomery wards' catalog.

Edited by crash_davis
  • Haha 1
Link to comment
Share on other sites

1 minute ago, crash_davis said:

dammit betty.  for the last fucking time, quit clicking links on phishing emails.

putin and the russians are laughing.  if we ever go to war with the russians, they'll disable everything with a few keyboard strokes and mouse clicks.  we'll go back to wacking off to the bra section in the montgomery wards' catalog.

We could never do the same to the Russians, too many clicks.

Link to comment
Share on other sites

24 minutes ago, crash_davis said:

dammit betty.  for the last fucking time, quit clicking links on phishing emails.

Jesus Fucksticks if this ain't the truth.

Every. Fucking. Day.

End users are dumb. 

We spend a shitload of money on multiple, hourly, redundantly stored, secure, back ups for this exact reason.

 

Link to comment
Share on other sites

17 minutes ago, po elvis said:

Do we ever find the people that do these attacks? Are the mostly out of the country? If we find them, are the penalties stiff? Like life in prison stiff?

No it's generally a couple defensive driving classes and some light community service. 

Link to comment
Share on other sites

37 minutes ago, LonghornJones said:

Didn't hackers demand bitcoin from one of our surly members or else D pics, etc. would be sent to all of his contacts?

I got one of those.  It said they had hijacked my camera on my computer and caught me "soloing," and would be sending the pics to all my contacts.   

"Soloing."  That still cracks me up.  

Link to comment
Share on other sites

33 minutes ago, LonghornJones said:

Didn't hackers demand bitcoin from one of our surly members or else D pics, etc. would be sent to all of his contacts?

You could probably start a business where a dude provides the numbers of a few gals he wouldn't mind hooking up with, and those numbers get a spoof text with pics of a ridiculously large cock. The guy can claim his phone was hacked, apologize but hey, what are ya gonna do. Sorry you had to see my elephant gun, I'm terribly embarassed.

Link to comment
Share on other sites

2 hours ago, RDCanecutter said:

So everybody thinks dogs are cute, and dogs all walk around with they little dicks hangin out.

So wouldn't it be fairly innocent for somebody to send dog dick pics to his female friends? Asking for @phdhorn.

If you can put them in brackets Surly will pick a Grand Champion.

Edited by El Diablo
  • Haha 1
Link to comment
Share on other sites

39 minutes ago, RDCanecutter said:

So everybody thinks dogs are cute, and dogs all walk around with they little dicks hangin out.

So wouldn't it be fairly innocent for somebody to send dog dick pics to his female friends? Asking for @phdhorn.

 

19 minutes ago, El Diablo said:

If you can put them in brackts Surly will pick a Grand Champion.

I can think of nothing the surl is more qualified to judge than dog dicks. 

  • Like 2
Link to comment
Share on other sites

26 minutes ago, Pig Bellmont said:

Well honestly why would anyone pay if the ransom ware can’t be undone? If they have any hope of extortion, it’s in their interest to follow through. 

In the case of Baltimore if the city doesn't pay and everything crumbles would anyone know the difference?

Baltimore - 1, Hackers - 0.

Link to comment
Share on other sites

In regards to the Atlanta example, if they are asking for 50k for something that costs 17 million to otherwise fix, then that 17 million figure should be a tightly kept secret, or the next time the ask will be more like 15 million. Idiots just informed the hacking community of fair value. 

Link to comment
Share on other sites

9 hours ago, Blotto said:

I get that there's a risk associated with paying the ransom, but that's a tough tradeoff to swallow. It will get interesting when they start holding infrastructure control systems hostage (water treatment, electric, etc...). You'd be surprised how incompetent some of the control system engineers are in smaller municipalities. A lot of 55-65 year old lifers that haven't exactly stayed current with emerging technologies. 

I can see it coming in about 5 years, maybe 10 at the most. The hacking talent is out there and growing fast. All they need is protected cover (hi Russia) to do shit and voila you have a criminal network in operation. Just like school shootings, there will be a big one and then it will become the norm. I can see water utilities, traffic systems, the grid, and anything that has been semi-modernized being vulnerable. The true IoT revolution will actually finally take off in the face of this threat. It will have to.

If I was a betting man I would say this is the cause of the next great world conflict (of nations). Some places will be a haven for this type of activity and the only way to crush it will be state power. And one state will have had enough and you will have war on your hands. Thats not even to mention state-sponsored cyber terrorism (hi China). 

Link to comment
Share on other sites

3 minutes ago, staboner said:

If I was a betting man I would say this is the cause of the next great world conflict (of nations). Some places will be a haven for this type of activity and the only way to crush it will be state power. And one state will have had enough and you will have war on your hands. Thats not even to mention state-sponsored cyber terrorism (hi China). 

Any states openly harboring this shit will find themselves easily cut off from the rest of the internet.  Not many dictators of third-world shitholes want to lose access to porn and Amazon.

Link to comment
Share on other sites

1 hour ago, staboner said:

I can see it coming in about 5 years, maybe 10 at the most. The hacking talent is out there and growing fast. All they need is protected cover (hi Russia) to do shit and voila you have a criminal network in operation. Just like school shootings, there will be a big one and then it will become the norm. I can see water utilities, traffic systems, the grid, and anything that has been semi-modernized being vulnerable. The true IoT revolution will actually finally take off in the face of this threat. It will have to.

If I was a betting man I would say this is the cause of the next great world conflict (of nations). Some places will be a haven for this type of activity and the only way to crush it will be state power. And one state will have had enough and you will have war on your hands. Thats not even to mention state-sponsored cyber terrorism (hi China). 

I would be surprised if it doesnt happen in 1-2 years. There are a ton of outdated control systems or even modern control systems managed by lazy or incompetent staff that are very vulnerable to phishing exploits. The ability to remotely log into your SCADA application to respond  to system alarms is great for the plant engineer at home at 10 PM, but it also allows access to the system to others if the system isnt hardened, patched etc...

I'm actually shocked it hasn't happened already to be honest. I probably get 1 phishing email a week that makes it through our corporate email filters that appear to be from our domain. The request will be to access a file for payroll issues, collaborate on a project folder etc... and they look legit. But if you inspect the file properties, you quickly realize that things arent as they appear. You have to figure some non-neglible percent of your coworkers just click on that shit because they are just going through the motions at 4:45 on a friday.

Edited by Blotto
  • Like 2
Link to comment
Share on other sites

1 hour ago, Blotto said:

I would be surprised if it doesnt happen in 1-2 years. There are a ton of outdated control systems or even modern control systems managed by lazy or incompetent staff that are very vulnerable to phishing exploits. The ability to remotely log into your SCADA application to respond  to system alarms is great for the plant engineer at home at 10 PM, but it also allows access to the system to others if the system isnt hardened, patched etc...

I'm actually shocked it hasn't happened already to be honest.

It's been happening for awhile now. It's not commonly known because the Feds get involved and NDA's are issued.

 

  • Like 1
Link to comment
Share on other sites

22 hours ago, SydneyCarton said:

I didn't see this posted anywhere else, so if this is covered elsewhere, I apologize. But a friend of mind posted this and I found it super interesting. 

https://www.vox.com/recode/2019/5/21/18634505/baltimore-ransom-robbinhood-mayor-jack-young-hackers

 

In another thread, I got mocked that Bitcoin transactions are indeed traceable. But that gets the question, if this is the case, why would these obviously somewhat sophisticated Hackers be requesting Bitcoin? Sadly, the notion of weak technical infrastructure being this vulnerable is extremely easy to believe. Curious what others think about this. It's safe to assume we'll be seeing more and more of these things take place over time here in America and elsewhere. 

Thoughts?

Can’t bitcoin just be traded for monero or some other privacy coin? At that point it’s virtually untraceable, right?

Link to comment
Share on other sites

On 5/23/2019 at 3:29 AM, Blotto said:

ou have to figure some non-neglible percent of your coworkers just click on that shit because they are just going through the motions at 4:45 on a friday.

This is why I leave no later than 3:00 on Fridays; doing my part for IT security.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...