The vast majority of the competent people got DOGE’d. CISA lost like 40% of their staff including much of their red team specialty. 18F was completely eliminated (“Deleted” as Musk put it). If some specialist in the FBI who could have helped prevent the hack happened to have been assigned to work on the Classified Docs case, they were also fired because the most corrupt, incompetent group of morons is running things in DC for the next few years.
Government service pays far less than the private sector, particularly for software engineers. If you’re paying 2nd decile prices, you’re going to get 2nd decile performance.
In one of Sean Carroll's AMA's, he once said something along the lines of "entropy favors the attacker over the defender."
That really stuck with me. My internal thought was "it's easier to kick over a sand castle than to build one." It seems to ring true for infosec and kinetic cases. Is this just a base truth?
Well, I don't want to get on the capital E engineering tangent. But yeah, 100% agreed.
However, entropy favors the attacker even in the case of a building certified by codes and a Structural PE stamp on the plans. Just leave it alone for a while with no maintenance, it will fall.
That's kind of the definition of life tho, a system that fights, or "exports" entropy. Built in to our very code. Even the sand castle kickers are doing it for many years just just to be able get to the point to kick.
"Software architecture" and engineering quality overall has had questionable quality at best. I don't see how vibe coding big new systems will make it better. I predict vibe coding will make for an even more golden age of hacking and a large increase in ransomware and breaking into systems. Today's giant hodgepodge of glued together software products could actually be better than vibing up something new.
I'd also expect the offensive side of hacking into systems will greatly benefit from LLMs finding an almost endless series of new vulnerabilities in even crappier llm software. I'm just so cynical.
In the physical sense, entropy favors the attacker because destroying something is just helping it along the path it wants to take. Everything wants to turn into dust, all the time. It takes energy to prevent it from happening. The attacker can use significantly less energy to get it moving.
Consider the energy requirements to construct a skyscraper compared to the energy requirements to demolish one.
With our current technology, that's true, but there were hundreds of years where fortifications were pretty well impregnable showing that human technological capacity is bounded well before the laws of entropy come into play.
Digital Operational Resilience Act (DORA) and Cyber Resilience Act (CRA) which enforce mandatory governance and processes like resilience testing and cybersecurity lifecycle requirements.
GDPR & Data Protection frameworks which requires architecture to support CRUD operations on all PII, data minimization, customer-managed encryption architectures and so forth.
...and the anti-vibe code framework aka the EU AI Act, which requires human oversight and data quality controls.
This is completely aside from any industry specific engineering codes like in Finance where you have to adhere to things like ISO 20022 or iXBRL/ESEF standards, user accessibility mandates, and PCI Compliance mandates for things like Security Architecture over and above the CRA.
Indeed, except when you get into the critical software realm. Firmware for pacemakers, avionics etc. There are respective ISO's and enforcement bodies.
I wonder if that ever expands to traditional software when the stakes of malfunction/blast radius increase significantly with time.
> In one of Sean Carroll's AMA's, he once said something along the lines of "entropy favors the attacker over the defender."
Eh, kinda. The defenders have the advantage of playing on the home turf. They know their infrastructure, can have sensors and traps everywhere. The bad guys are stumbling in the dark. They have no idea what's real and what's a honeypot, what signals you're collecting and monitoring, etc.
The problem is that almost no one takes this advantage seriously. If you're not watching, yeah, you're gonna get owned.
Yeah but you know there trade offs like free society, freedom of movement, privacy and stuff that you need to sacrifice to take advantage of home turf. And you need to do this everywhere. Attacker can pick his targets on his own schedule, you need to defend always.
It just goes to show how pro-peace and stability humans are in general. It's so easy to cause death and destruction, and we most often do not choose to do that. We had certainly been progressing in that direction, hadn't we?
It is not a base truth. It is just that complete negligence is currently standard, legal, and expected in most industries. Kind of like before basic sanitation was legally mandated at hospitals preventable deaths dramatically higher.
I have designed and audited systems for dozens of orgs that protect hundreds of billions in value and regular transaction volume. HSMs, remote attestation, quorum controlled servers with custom and fully audited operating systems, and in some cases a geodistributed network of underground bank vaults, NSA tempest spec zero emissions chambers, and security down to the laws of physics.
Security can be assured with high confidence for the right price, but very few are willing to pay for it and fewer still experienced enough to offer it. 15-200k a week is common depending on reputation, but I know at least one that claims to bill 1m/w.
Personally I do not believe hoarding effective security tactics for private audiences is ethical, and thus I insist any security work and research resulting from my work for employers, clients, and my own companies must all be freely licensed open source. No exceptions for any amount of money.
Security will be normalized when it as open, cheap, and too easy to justify not doing.
When you operate in an environment where every "good boy" can be wiped by a single "oh shit", statistics are against you. That is a base truth. The failure can rest on negligence but negligence isn't a necessary component for failure. For attackers their failures are wiped by a single success, for defenders their successes are wiped by a single failure.
In a different life I worked on designing and implementing similar systems to the ones you described, except with even more money going through them. They can can still be hacked, at incredible expense. And the hackers could even make a huge profit with the treasure trove they have access to. But getting away with it is orders of magnitude more difficult than the hack. The money involved to make the hack profitable is impossible to hide on the world stage. It takes a lot of political capital and military to be able to steal billions+++ and get away with it (nation state attackers, not just a group of hackers). So hackers go for lower risk jobs where the payout can even be similar just because of the lower cost to succeed.
Yeah no, it is literally negligence and ignorance. Most servers are maintained by people who have never compiled a linux kernel in their lives, let alone hardened one.
When I interview production engineers I expect them to know Linux down to the system calls. 9/10 fail, including the ones with decades of paper experience who are mostly coming from major companies. Of those that pass, I find out with little surprise, almost all use Linux as a daily driver, and have backgrounds in projects like buildroot, gentoo, and yocto. Most of the 9/10 that fail are full time MacOS users, so they never stood a chance to develop the required low level Linux skillsets.
If you configure a system properly, with a purpose built kernel and OS for the job with hypervisor sandboxed remotely attestable workloads the only way it is getting compromised is with a novel CPU flaw or hypervisor escape. Vulns of that class are VERY valuable, very rare, and blackhats will not waste them casually. If an attacker does not stand to make tens of millions, they will not risk exposing such a vuln. If that kind of value IS on the table, then you need to hire 3+ engineers that specialize in airgapped computing and hardware security modules. Factor in a 4-5m/y+ budget just for a small highly skilled security team. Most companies cannot or will not stomach that kind of cost, so they hire anyone willing to work for a typical engineer salart with a macbook who pinky swears they can run debian in production with high security even though literally no one alive can do that.
Is this true in the digital realm though? Constructing an exploit chain is not as easy as knocking over a sandcastle and can be even more complex than the software it is attacking.
Working in the IR space I’ve had a lot of opportunities to work with negotiators before. Most of them are extremely professional and worth their weight in gold for what they provide to their clients.
Ridiculous that scumbags like this are tarnishing that space.
No honestly, most of the time it’s very formulaic. You can usually tell how it’s going to go once you know who has your data.
For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.
Other actors though have a reputation to uphold to get paid and they know it.
An example of the process is something like:
1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.
2. Negotiators notified.
3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.
Ransom negotiators are all scumbags. Their actions perpetuate further criminality and place others at greater risk. Paying a ransom should always be a criminal offense, even if not paying means that people die and businesses are destroyed.
Huh? You'd rather criminals make a little less money than hospitals getting taken offline and people dying? Or power utilities. Very cringe to care more about how much pieces of paper a criminal has than your community member's lives. I definately do not want you as my neighbor.
Yes, I would absolutely rather have that. Preventing criminals from receiving additional money prevents them from having the resources to attack others in the future. Unlike you, I actually care about my community and think deeply about the consequences.
Alternately they may not believe starving out the criminals will actually work and so foresee different consequences. Like when Google penalized SEO, and so spammers used their networks for extortion instead of spam. Similarly if we killed ransomware, the machinery built to conduct these attacks would not just lie fallow. It's capital that will continue to be leveraged to generate returns. We may not like the next business model they come up with.
It's not a contest, we all can care and think deeply and still come to different conclusions.
This is a very narrow framing, and that is what I am trying to get at. Obviously it would be absurd to deliberately provide welfare to criminal enterprises. But our adversaries get a vote in what happens. There is a level of risk at which you are forced to pay the ransom.
If we don't get trapped in this false binary we might consider other options. I think the takeaway from my comment should be, if you want to make it illegal to pay a ransom to these groups, then you will also need to dismantle their infrastructure and organization. Otherwise you're just putting the ball in their court and hoping they'll fumble it. It's not that we're "scared," it's that that isn't a strategy.
Even if it was a loved one of yours who was in danger? You would rather your children, parents, or spouse die, instead of paying the kidnappers a ransom?
It sounds like you don’t understand the problem very well. Forgive me if that’s an incorrect interpretation.
One way to prevent this type of crime is to ensure that it is never profitable. The downside is that there will be losses until the message is thoroughly communicated.
Who cares if criminals have nice things, Id rather innocent people dont die. Most criminals tend to find ways to ruin their own lives at some point anyways. Peoples lives > pieces of paper.
Its like you're proposing a trolly problem where you choose the 5 people on a track to die because you don't want the single guy on a track to have nice clothes.
"Criminals having vacations and nice things" wasn't a great framing, "criminal enterprises continue to have revenue to reinvest in more crimes" is the better one.
Even before the current administration, federal law enforcement's leaks of suspects, especially in high-profile crimes, have been highly unreliable and have ruined lives. See Wen Ho Lee, Richard Jewell, etc.
“The statement said CyberSteward and Cypfer are separate companies with no officers, directors or employees in common, and that Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. In 2020, Aon aquired Cytelligence, a security consulting firm where Mr. Tobok was founder and CEO and Mr. Dubrovsky was a managing partner”
Jason Hogg, father of David Hogg survivor of the Parkland high school shooting, gun control activist, and former (‘25) DNC co-chair
Yeah it feels like this guy is probably innocent and refused to be an informant of some kind. He probably was approached to help entrap them, stayed out of it and now the FBI is ruining his life for it.
I wouldnt really trust them under any admin, but yeah this current regime is definately will to play fast and loose with people's lives to make themselves seem competent.
Did everyone in this comment section just miss the fact that the contents of the article are primarily Krebs’ research? The feds haven’t actually said anything publicly. Krebs cites someone close to the investigation, but that’s it.
What kind of incentive structure do most ransomware negotiation firms use that would actually cause them to benefit from coordination with the ransomware groups, as happened in this case? Do ransomware negotiators get paid more if they negotiate a lower price?
I believe the incentive is that they help establish a reputable connection between the ransomware group and the victim.
From what I have read in the past is that victims have no reason to trust ransomware groups and pay because what is stopping them from just demanding more money or hacking the company again. So from what I read is that ransomware companies depend on building a trust that after payment you will get your data back and he left alone.
So I believe that by working with a ransomware negotiator, a company that assumingly is a legitimate lawful business, the victim and hacker both benefit with the trust that this middleman is legit and the working history established has shown that those who pay do end up getting their data back.
TLDR: why believe a hacker that if you pay they will actually leave you alone. But a legitimate middleman with a history of dealing with these things and a proven track record can establish immediately confidence that paying will result in data recovery. So it's not about a lower price but rather a confidence you won't get screwed after paying.
Depending on where you are, it is arguably illegal (money laundering, dealing with proceeds of crime, maybe contravening sanctions depending on the gang) but I’m not aware of this being tested.
If I understand your question correctly, it's actually the opposite:
> some firms charge a flat retainer fee, while those that specialize in helping companies negotiate a ransom payment tend to charge a percentage of the total ransom amount paid.
Having a good relation with the ransomware group means that the group can ask for more knowing that the negotiation firm won't object too much and that the ransomware firm stands to gain more. Other than the victim, everybody wins.
> Dutch police reportedly used flash-bang grenades in an effort to stun and apprehend Van der Stap as he was logged in to various online accounts.
Holy moly, this is the first time I hear about this tactic. I remember more benign distraction tactics used previously with Ross Ulbricht and the other guy in Thailand running another darknet marketplace.
And flash-bang grenades are not without health risks. They can cause permanent hearing damage, and earlier this month a teenager lost their hand to a stun granade in protests near Paris (conflicting accounts, either an unlucky direct hit or he picked it up to throw it back). I really don't see how a flash-bang grenade is justified against a person sitting in front of a computer, doing non-violent crimes. Non-violent options exist, as was successfully demonstrated in the cases you mention
Giving the police better non-lethal weapons is always easy to justify by citing all the cases where they can replace more lethal weapons or directly lead to better outcomes. But given a couple years time they always end up being used for more and more mundane situations where the harm clearly outweighs any gain. Same story with pepper spray, tear gas grenades, tasers, even anti-riot water cannons.
> I really don't see how a flash-bang grenade is justified against a person sitting in front of a computer, doing non-violent crimes.
People who pretend that nonviolent crimes are some kind of special thing always confuse and annoy me. Coups can be nonviolent, should we avoid flashbangs against a group trying to undermine a democracy?
We are talking about an organization ruining people’s livelihoods. Dozens and dozens of lives wrecked. Millions stolen.
Yes, less-lethal force is very obviously justified.
Wait so people take "Ransomware Negotiation Firms" as a legitimate business? Isn't it incredibly plainly in site that they are all in on it? Seriously WTF why have they been allowed to exist and operate when they are de facto collaborators?
101 comments
[ 0.14 ms ] story [ 34.3 ms ] threadThe OPM breach was 11 years ago and apparently the incompetence still reigns.
18F -> https://ndstudio.gov
As seen credited on recent publications like real realfood.gov.
Although I personally wouldn't lift a finger for the corrupt Christ clowns that run America these days.
That really stuck with me. My internal thought was "it's easier to kick over a sand castle than to build one." It seems to ring true for infosec and kinetic cases. Is this just a base truth?
Try kicking over a building sometime. (Or don't - you'll stub your toe).
However, entropy favors the attacker even in the case of a building certified by codes and a Structural PE stamp on the plans. Just leave it alone for a while with no maintenance, it will fall.
I'd also expect the offensive side of hacking into systems will greatly benefit from LLMs finding an almost endless series of new vulnerabilities in even crappier llm software. I'm just so cynical.
Consider the energy requirements to construct a skyscraper compared to the energy requirements to demolish one.
Digital Operational Resilience Act (DORA) and Cyber Resilience Act (CRA) which enforce mandatory governance and processes like resilience testing and cybersecurity lifecycle requirements.
GDPR & Data Protection frameworks which requires architecture to support CRUD operations on all PII, data minimization, customer-managed encryption architectures and so forth.
...and the anti-vibe code framework aka the EU AI Act, which requires human oversight and data quality controls.
This is completely aside from any industry specific engineering codes like in Finance where you have to adhere to things like ISO 20022 or iXBRL/ESEF standards, user accessibility mandates, and PCI Compliance mandates for things like Security Architecture over and above the CRA.
required codes and standards may raise one (difficulty of removal) or both (difficulty of removal + difficulty of construction) in varying proportion.
I wonder if that ever expands to traditional software when the stakes of malfunction/blast radius increase significantly with time.
On the other hand, "You wouldn't download a wrecking ball?"
Eh, kinda. The defenders have the advantage of playing on the home turf. They know their infrastructure, can have sensors and traps everywhere. The bad guys are stumbling in the dark. They have no idea what's real and what's a honeypot, what signals you're collecting and monitoring, etc.
The problem is that almost no one takes this advantage seriously. If you're not watching, yeah, you're gonna get owned.
They can have, but they’re sufficiently tied up with other corporate busy work that they don’t.
I have designed and audited systems for dozens of orgs that protect hundreds of billions in value and regular transaction volume. HSMs, remote attestation, quorum controlled servers with custom and fully audited operating systems, and in some cases a geodistributed network of underground bank vaults, NSA tempest spec zero emissions chambers, and security down to the laws of physics.
Security can be assured with high confidence for the right price, but very few are willing to pay for it and fewer still experienced enough to offer it. 15-200k a week is common depending on reputation, but I know at least one that claims to bill 1m/w.
Personally I do not believe hoarding effective security tactics for private audiences is ethical, and thus I insist any security work and research resulting from my work for employers, clients, and my own companies must all be freely licensed open source. No exceptions for any amount of money.
Security will be normalized when it as open, cheap, and too easy to justify not doing.
Shameless plug, this is why I co-founded Caution.
When you operate in an environment where every "good boy" can be wiped by a single "oh shit", statistics are against you. That is a base truth. The failure can rest on negligence but negligence isn't a necessary component for failure. For attackers their failures are wiped by a single success, for defenders their successes are wiped by a single failure.
In a different life I worked on designing and implementing similar systems to the ones you described, except with even more money going through them. They can can still be hacked, at incredible expense. And the hackers could even make a huge profit with the treasure trove they have access to. But getting away with it is orders of magnitude more difficult than the hack. The money involved to make the hack profitable is impossible to hide on the world stage. It takes a lot of political capital and military to be able to steal billions+++ and get away with it (nation state attackers, not just a group of hackers). So hackers go for lower risk jobs where the payout can even be similar just because of the lower cost to succeed.
https://www.washingtonpost.com/politics/2026/03/10/social-se...
When I interview production engineers I expect them to know Linux down to the system calls. 9/10 fail, including the ones with decades of paper experience who are mostly coming from major companies. Of those that pass, I find out with little surprise, almost all use Linux as a daily driver, and have backgrounds in projects like buildroot, gentoo, and yocto. Most of the 9/10 that fail are full time MacOS users, so they never stood a chance to develop the required low level Linux skillsets.
If you configure a system properly, with a purpose built kernel and OS for the job with hypervisor sandboxed remotely attestable workloads the only way it is getting compromised is with a novel CPU flaw or hypervisor escape. Vulns of that class are VERY valuable, very rare, and blackhats will not waste them casually. If an attacker does not stand to make tens of millions, they will not risk exposing such a vuln. If that kind of value IS on the table, then you need to hire 3+ engineers that specialize in airgapped computing and hardware security modules. Factor in a 4-5m/y+ budget just for a small highly skilled security team. Most companies cannot or will not stomach that kind of cost, so they hire anyone willing to work for a typical engineer salart with a macbook who pinky swears they can run debian in production with high security even though literally no one alive can do that.
It's much harder to have perfect opsec and never be caught for the wrongdoing. The other side only needs patience.
The whole “you don’t have to outswim the shark, just the guy next to you.”
https://m.xkcd.com/932/
Ridiculous that scumbags like this are tarnishing that space.
Thanks!
For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.
Other actors though have a reputation to uphold to get paid and they know it.
An example of the process is something like:
1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.
2. Negotiators notified.
3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.
https://en.wikipedia.org/wiki/The_Com
https://www.bleepingcomputer.com/news/security/ransomware-re...
https://complexdiscovery.com/a-48-month-federal-benchmark-re...
It's not a contest, we all can care and think deeply and still come to different conclusions.
Deliberately letting ransomware go on, because you are scared that evil people may do something worse is quite absurd.
Deliberate welfare for criminals is in fact bad.
If we don't get trapped in this false binary we might consider other options. I think the takeaway from my comment should be, if you want to make it illegal to pay a ransom to these groups, then you will also need to dismantle their infrastructure and organization. Otherwise you're just putting the ball in their court and hoping they'll fumble it. It's not that we're "scared," it's that that isn't a strategy.
One way to prevent this type of crime is to ensure that it is never profitable. The downside is that there will be losses until the message is thoroughly communicated.
Who cares if criminals have nice things, Id rather innocent people dont die. Most criminals tend to find ways to ruin their own lives at some point anyways. Peoples lives > pieces of paper.
Its like you're proposing a trolly problem where you choose the 5 people on a track to die because you don't want the single guy on a track to have nice clothes.
that is one of reasons why ransomware should be being eliminated
Jason Hogg, father of David Hogg survivor of the Parkland high school shooting, gun control activist, and former (‘25) DNC co-chair
How about that!
https://en.wikipedia.org/wiki/David_Hogg
I wouldnt really trust them under any admin, but yeah this current regime is definately will to play fast and loose with people's lives to make themselves seem competent.
[0]: FBI arrests Canadian cybersecurity expert in ShinyHunters hacking case (6 points, 8 days ago) https://news.ycombinator.com/item?id=50066759
From what I have read in the past is that victims have no reason to trust ransomware groups and pay because what is stopping them from just demanding more money or hacking the company again. So from what I read is that ransomware companies depend on building a trust that after payment you will get your data back and he left alone.
So I believe that by working with a ransomware negotiator, a company that assumingly is a legitimate lawful business, the victim and hacker both benefit with the trust that this middleman is legit and the working history established has shown that those who pay do end up getting their data back.
TLDR: why believe a hacker that if you pay they will actually leave you alone. But a legitimate middleman with a history of dealing with these things and a proven track record can establish immediately confidence that paying will result in data recovery. So it's not about a lower price but rather a confidence you won't get screwed after paying.
> some firms charge a flat retainer fee, while those that specialize in helping companies negotiate a ransom payment tend to charge a percentage of the total ransom amount paid.
Having a good relation with the ransomware group means that the group can ask for more knowing that the negotiation firm won't object too much and that the ransomware firm stands to gain more. Other than the victim, everybody wins.
–Chris Rock
Holy moly, this is the first time I hear about this tactic. I remember more benign distraction tactics used previously with Ross Ulbricht and the other guy in Thailand running another darknet marketplace.
Giving the police better non-lethal weapons is always easy to justify by citing all the cases where they can replace more lethal weapons or directly lead to better outcomes. But given a couple years time they always end up being used for more and more mundane situations where the harm clearly outweighs any gain. Same story with pepper spray, tear gas grenades, tasers, even anti-riot water cannons.
https://www.nbcnews.com/news/us-news/ex-georgia-deputy-acqui...
People who pretend that nonviolent crimes are some kind of special thing always confuse and annoy me. Coups can be nonviolent, should we avoid flashbangs against a group trying to undermine a democracy?
We are talking about an organization ruining people’s livelihoods. Dozens and dozens of lives wrecked. Millions stolen.
Yes, less-lethal force is very obviously justified.