Hacker News Reader

Comment by jpalomaki | Hacker News Reader

Next step (unless it is already there) could be affiliate marketing (pay 25% of the ransom to people who distribute the malware). If people start getting smart with backups, the response could be to switch blackmailing (pay or we'll distribute your files).

I find this whole thing quite scary. We all know how difficult it is to protect yourself from a determined and skilled adversary. Now that there is clear business model and opportunity to make hundreds of millions[1] this thing will probably attract more and more people. Building botnets was a mass market operation. Ransomware could become more targeted, since the value of single infected machine can be much higher.

[1] http://thehackernews.com/2015/10/cryptowall-ransomware.html

View on HN

All the more reason to emphasize security over the latest in features and upgradability.

Why doesn't Microsoft get held accountable when a 0-day in Windows is exploited that results in loss of user funds? Without that, there's no incentive to build secure software in the first place.

How do we get society to have more of a security-first approach when it comes to things connected to the internet? A lot of these vulnerabilities are scary in a systemic way. Cyber warfare would likely be as damaging as dropping napalm on cities, and it's all preventable by having more security oriented infrastructure.

Another angle to this: Why does Apple get away with something like 2 year support windows for their OS? We now have a bunch of people on OS 10.6.8 who will stop getting updates, but even 10.9 will fall out of support before Win7

Though I suppose the best solution would be to get everyone on the upgrade treadmill

> Though I suppose the best solution would be to get everyone on the upgrade treadmill

No. The best solution would be to require Apple, Google and MS to split up their OSes into individual packages, that can be upgraded at will, and to unlink functionality from optics in all parts of the OS.

The reason is simple: most people, especially corp environments, don't upgrade their software because they see on friends' machines (or phones) that the look and feel has changed too much for them / that retraining time for employees is too expensive. A good example is the clusterfuck MS committed with Win8 by replacing the taskbar, the unremovable phone-home/unstoppable auto updater in Win10 or the various "design improvements" / "performance improvements" Apple did on OS X/iOS.

Oh, and with Apple there's the high risk of critical bugs or other incompatibilities with their newest OS. Software like the Adobe suite, music/video editor programs, and even office mainstream apps Lotus f..ing Notes and Cisco's programs tend to have boatloads of bugs each major OS X release. With MS, you can at least assume that you can run any old software that doesn't require drivers...

"microkernels"

I agree that it should be possible to upgrade the backend without having to upgrade the frontend (so to speak) of the OSes.

In my experience, though, even the backend for OS X is massively changing. Networking, in particular, seems to be changing every release.

> Why doesn't Microsoft get held accountable when a 0-day in Windows is exploited that results in loss of user funds? Without that, there's no incentive to build secure software in the first place.

There is nothing stopping you from entering into a contract with Microsoft that requires them to take on that liability. And there are some companies that have contracts like that with some software vendors -- presumably in aerospace and so on. And those companies pay $5000 or more for a piece of software that you would pay $10 for. If you asked a normal person to pay that much for every app in the store they would just laugh.

If you made developers liable for vulnerabilities, that's what would need to happen. Software would have to cost enough to cover the liability. If you sell ten million copies of some code and you have one vulnerability (down from 75 before this), that vulnerability may cost 1% of your customers $20,000 each and you're suddenly on the hook for billions of dollars. And you better hope none of your customers are large corporations that could potentially suffer even bigger losses, even though the software developer has no control over that at all.

A big part of the problem here is that we keep trying to shield the users from liability, but they're the ones who make the decisions. The user won't be willing to pay extra or suffer any inconvenience for better security if it's the credit card company or insurance company or software vendor that sustains the loss when they get hacked.

Security is terrible because the party who decides how much to prioritize security is the party we give half a dozen ways to get out of suffering from the consequences of poor security.

But what would also happen is that for the software vendor to stay competitive, he would spend a lot of time and effort to harden the software to reduce the insurance premium.

Very far away from Microsoft's "let's use consumers as beta testers" approach.

> But what would also happen is that for the software vendor to stay competitive, he would spend a lot of time and effort to harden the software to reduce the insurance premium.

That's not competitive though. When the user is at minimal risk the user wants the cheapest software, not the most secure software. In that situation you can't spend money improving security or buying insurance, that would make your software cost more than the competition.

The winning competitive strategy would be to minimize the consequences of declaring bankruptcy. Take on debt financing instead of issuing stock, to minimize net assets. Develop the software as many pieces each owned by an independent business entity so there is no deep pocket to attract claims and there is a smaller loss when an owner has to write one off.

Look at the costs of healthcare in the US compared to most other western countries. Liability and the related insurance is often listed as a big reason for the high costs.

So you're not going to improve software with this, you're going to make it incredibly expensive in the US. The only groups benefiting from this will be lawyers and insurance companies.

>If people start getting smart with backups, the response could be to switch blackmailing (pay or we'll distribute your files).

how does that work when most home connections have terrible upload? to make matters worse, if you upload at full speed, people will notice that their internet is getting sluggish and notice something is up.

You could probably get away with only uploading document-ish files. No one cares if you steal their windows operating system files.

You throttle the bandwidth or you upload at full speed when the bandwidth consumption is idle. Or if you're into blackmail you develop an algorithm that searches for nudity in pictures and upload only those. Or you extract the text from documents, zip it and then upload it. Obviously if you're into this you develop some patterns, you don't just upload everything because then you'd have to spend an eternity browsing through all those files. How many chances are there that the average user will have a file called finance or something similar in their documents folder? You could simply upload a text file with all the file names and then make selective uploads.

This might only be sort of related to what you're talking about, but reansomware as a service already exists. You delivery a premade executable and get a cut cut of the profits. You could install it in systems where you have physical access like your work or at a friends house or systems that you have remotely compromised.

Already there, that's how some ransomware is already operating.

Finally, a use-case for Ethereum! /s

Doesn't work. The moment someone exposes the game the affiliate marketer will have his affiliate account closed by whichever company or network they're trying to work with.

It won't be hard to set up a darknet-based affiliate service, e.g. one that upon retrieval of the Bitcoins sends 25% to the affiliate, 74% to the botnet herder and 1% to the affiliate service.

Perhaps an Ethereum program could do it, but then it might be a good idea to set up a second Ethereum network for anonymous use over darknets.

But at some point an actual company with an actual reputation on the line would have to be involved. Those are the people that would ban you.

How so? The darknet markets (e.g. Silk Road) seem to be doing great without "actual companies", but they do have an actual reputation.

You don't need an actual company to accept Bitcoins. You don't even need a PO box or a telephone number. Just a computer connected to the internet.

Weren't we talking about affiliate marketing? For affiliate marketing you need an actual company that is getting sales out of it. Most companies will immediately turn off affiliate marketers getting it sales by spreading malware/ransomware.

If you use the existing affiliate systems, yes. But building a darknet (or just distributed) affiliate program is not exactly rocket science.

Note: the point of the affiliate marketing is to make your an affiliate of /spreading the infection/ not pumping some third party product.

I'm completely lost. I work in affiliate marketing and I don't understand what you're saying.

Could you explain very slowly how this would work in your mind? Who is paying the money, and who is receiving the money?

In a simplified model, a legitimate set of actors for a legitimate product would be

a. publisher b. affiliate network c. person selling a product

You are saying that the affiliate network would block the publishers for distributing malware. Yes, that's true. But what is stopping someone from creating another affiliate network? That would replace the actors with the following:

a. malware distributor b. illicit affiliate network c. malware publisher selling key

In this case, the "product" is the key to decrypt the files. The network could be anyone. It could even be the same person who wrote the malware.

Ok, now I understand what you're saying.

I imagine that anyone who is willing and skilled enough to be a malware distributor would rather just do the whole thing himself, ie code the malware himself and collect himself.

It doesn't take a genius to spread malware. Install said malware on a USB stick and then drop it in a parking lot, or just go ahead and use it on a "friend's" computer etc. Using an existing affiliate network is much less effort than building one.

My point wasn't using an existing affiliate network versus bulding one. Was having the skills to spread malware and using an affiliate network to get the malware, versus having the skills to spread malware and coding your own malware. But ok I got your main idea.

Yes, the creators of the malware could also run the network. But they would spread wider by paying a bounty for each ransom, based on through whom the targeted system got infected.

The benefits are that the creators get more people to hero then spread their blackmail.

Call it affiliate, call it MLM, call it resellers, call it a distributed crime syndicate. Same thing.

You'd be surprised. Many of these illicit affiliate networks have been existing for years and continue to thrive. Especially with cryptocurrency nowadays, they have ways of safely cashing out.

At that point they're just cashing out bitcoins. And while I think that should be illegal (bitcoins can a priori be reasonably assumed to be the proceeds of either a) crime or b) "mining" i.e. being paid to run a network that's used primarily for crime, because those are the only use cases that makes sense), currently it doesn't seem to be seen that way.

There are a number of affiliate marketing companies who will "revoke" an account, but make no effort to keep bad actors from opening new accounts, make it as hard as possible to report affiliates using malicious tactics, etc. Once you start getting into the lowest tiers of banner sellers you start seeing a lot of real skeezy moves.

The OP meant affiliate marketing in a way separate from that of the traditional sense.

Reply on news.ycombinator.com