Hacker News Reader

Comment by hnthrowaway0315 | Hacker News Reader

I wouldn't be surprised if some ransomeware gangs are frontends of national (in)security agencies. They don't care about profits. Sure it's good to have some.

View on HN

It's an open secret that FSB et all work with ransomware gangs. As long as they don't target Russian companies they don't care what they do otherwise. So it's not so much they're a front as they're in a sort of quasi officially sanctioned middle ground.

Digital privateers

https://en.wikipedia.org/wiki/Letter_of_marque

Yeah. I'm also thinking about ways to "promote" malware without getting impacted.

Let's say some three digit agencies create sort of malware distribution forums in the darknet. They make sure to only broadcast to people who wants to play with malwares so the net catches the "bad guys" mostly, except for a few curious researchers or journalists maybe. Then they start to share recent generarion malwares they created. They don't need to distribute them by themselves because they already have the CCC servers. Some malware gangs would eventually be the frontend and start the distribution.

In this way you not only distribute the malwares without getting impacted, you also get to know the gangs so whenever you want to catch a few fishes you just pull the net.

Once the darknet forum dies out or they need to wipe the records, they would just leave and create a new one.

Just my wild thought.

As an example, the DarkSide malware (the one used against the Colonial Pipeline) explicitly checks if it's running on a computer in the CIS (Russia+countries nostalgic of the Soviet Union / without a better choice) and exits.

Oh interesting, I'd not heard that. Thanks.

Well, this doesn't mean they work for FSB but rather they want to stay away from them.

If I was based in a country I would not want to target those that can more easily get me into jail and/or kill me.

I have no idea if FSB work for them, this is more speculation than open secret, but they certainly do tolerate them and see them in a good eye as long as they target western companies and agencies. The enemy of my enemies is my friend.

privateers

Well, every time Boeing tried to bribe a country, someone leaked emails and audio recordings from their secret meetings.

Usually we blame the Chinese, but in this case I think its a toss between CIA and NSA.

(I think I'm on some kind of list now)

Edit: I am an idiot. I was thinking of Airbus, see @perihelions comment below

Which incident are you referring to? The NSA took credit for hacking Airbus, but that's Boeing's foreign competitor—not Boeing.

https://www.economist.com/special-report/2003/06/12/airbuss-...

- "According to a European Parliament report, published in 2001, America's National Security Agency (NSA) intercepted faxes and phone calls between Airbus, Saudi Arabian Airlines and the Saudi government in early 1994. The NSA found that Airbus agents were offering bribes to a Saudi official to secure a lion's share for Airbus in modernising Saudi Arabian Airlines' fleet. The planes were in a $6 billion deal that Edouard Balladur, France's then prime minister, had hoped to clinch on a visit to see King Fahd in January 1994. He went home empty-handed."

- "James Woolsey, then director of the Central Intelligence Agency, recounted in a newspaper article in 2000 how the American government typically reacted to intelligence of this sort. “When we have caught you [Europeans]...we go to the government you're bribing and tell its officials that we don't take kindly to such corruption,” he wrote. Apparently this (and a direct sales pitch from Bill Clinton to King Fahd) swung the aircraft part of the deal Boeing's and McDonnell Douglas's way."

You are correct. I think my brain was on a break while I was writing that :)

I imagine at least some (probably many) of the engineers who work for Boeing have a basically lawful-good/lawful-neutral temperament and are just disgusted by things like bribery. Maybe one of the parties in the conversation leaked it, no intelligence agencies needed.

Why exactly would the CIA or NSA want to do that? Boeing works so closely with the security apparatus they're practically an unofficial member so I don't understand what the motivation would be.

It doesn't hurt to hack into any corporation. You never know what kind of intelligence you might get out. There are also considerations of different factions I guess.

But we're not talking about getting information and keeping it but actually making it public. One doesn't get much leverage that way so the only real aim would seem to be damaging the target.

> How North Korea’s Hacker Army Stole $3 Billion in Crypto, Funding Nuclear Program

https://www.wsj.com/articles/how-north-koreas-hacker-army-st...

> They don't care about profits.

This isn't really true in general: intelligence agencies often want access to funds with less/no oversight from (or to skirt controls enacted by) other parts of the government. As an example, that was the dynamic at the basis of the Iran-Contra affair in the US.

For North Korea sure quite believable. Some links existing also sound likely for the Russian gangs.

Reply on news.ycombinator.com