ShinyHunters tells The Reg: We hacked the FBI to 'protect our business'

ShinyHunters, the data theft and extortion crew that has stolen sensitive information belonging to millions of cancer patients, university and K-12 students, and Carnival cruisers, wanted to preserve their reputation and keep their “business” afloat. So it hacked the FBI to make a statement, the group told The Register. “It’s a …

[Yet Another Anonymous coward]

Obvious next steps

Privatizing the FBI. Perhaps the hackers could advise the Private Equity firms?

[Philo T Farnsworth]

Re: Obvious next steps

Given the FBI's history in breaching civil rights and doxxing people (Martin Luther King, Jr¹ is just one of many egregious examples), pulling the whole mess down and starting over might be a better idea.

As far as ShinyHunters go, I'm not sure that there's a lot of difference between them and the AI companies hacking one another, not to mention friendly governments. At least they're up front about being crooks.

______________

¹ Time: The FBI's Surveillance of Martin Luther King, Jr. Was Relentless. But Its Findings Paint a Fuller Picture for Historians

[Yet Another Anonymous coward]

Re: Obvious next steps

The CIA's mission is overthrowing governments, staging coups, arming rebel groups and funding arms sales by selling drugs - but is not allowed to operate in the USA

The FBI is the domestic equivalent

[Philo T Farnsworth]

Re: Obvious next steps

Not "allowed," yes.

Sometimes for small values of not¹.

_______________

¹ Wikipedia: MKUltra

[Philo T Farnsworth]

Re: Obvious next steps

I'm both amused and bemused by the down votes.

Are there readers of this forum who are actually for egregious violations of civil and privacy rights and condone bizarre experimentation on unwitting, not to mention nonconsenting, human subjects?

Gotta wonder.

[collinsl]

Re: Obvious next steps

Given the FBI's history in breaching civil rights and doxxing people (Martin Luther King, Jr1 is just one of many egregious examples), pulling the whole mess down and starting over might be a better idea.

I'd just extend that to the whole of the USA personally. Let's put in a temporary government run by Canada, get their electoral system sorted out, re-do the whole "state" nonsense then let them elect a new Government and go from there.

[VicMortimer]

The ONLY way ransomware will ever stop is banning paying ransom

As they said, they're only interested in corporations paying them.

If it's a crime for corporations to pay ransom and the CEO will go to prison if they do, the money will dry up very, very quickly.

It's time to stop ransomware. And the only way to do that is to stop the money. The feds can't find and can't stop the gangs in countries that don't care and will never extradite. But they CAN find CEOs, they CAN arrest CEOs, and they CAN lock up CEOs.

[Anonymous Coward]

Re: The ONLY way ransomware will ever stop is banning paying ransom

>If it's a crime for corporations to pay ransom

Your line of thought is interesting. What happens when the insurance company finds out that restoring the system costs $10 million, and paying a ransom costs $1million? And the insurance company than hires “negotiators” from a third party country, with a budget, to “solve” the issue.

[Richard Boyce]

Re: The ONLY way ransomware will ever stop is banning paying ransom

Fine the insurer or stop it doing business in the country? However, maybe the reason these measures have not already been taken is that the insurance industry is paying politicians not to do that.

[DS999]

Re: The ONLY way ransomware will ever stop is banning paying ransom

If a US based company pays ransom or has a business relationship with any company that pays ransom on their behalf, they are held liable and subject to fine.

Paying the ransom may cost $1 million but what happens when you don't get your data back for that $1 million, or you do but the bad guys keep a copy and ask for $20 million or it will be publicly released (if it contains proof of criminal conduct, would subject them to liability under HIPAA, could cause them to lose future government contracts for lack of operational security, etc.)

You act as though it is a simple transaction, pay $1 million and everything is hunky dory. That's often not the case at all, it is just the beginning of your troubles not the end of them.

[Anonymous Coward]

Re: The ONLY way ransomware will ever stop is banning paying ransom

>pay $1 million and everything is hunky dory

Lawyers and their contracts may disagree. They hired a company to solve the issue, without liabilities, with a budget of $1million. The contract explicitly forbids paying a ransom. The ball now is in a third country. Law can be tricky.

[Brewster's Angle Grinder]

Re: The ONLY way ransomware will ever stop is banning paying ransom

But did you do due diligence on them? How did you expect them to "solve" the issue except paying the ransom? What's their track record? Have they, in every other case, located the individuals and had them arrested by local law enforcement? Or do they have a history of paying up?

You can't simply disclaim away responsibility. A model here would be data protection: a contractor might break a contract but, nevertheless, you can still end up on the hook for it - precisely to prevent these nudge-nudge wink-wink contracts. (Although you can, then, sue the contractor to recover fines.)

[Anonymous Coward]

Re: The ONLY way ransomware will ever stop is banning paying ransom

>You can't simply disclaim away responsibility

Are you sure?

To disclaim responsibility in a contract, you must write a clear, specific, and conspicuous limitation of liability or exclusion clause that defines what risks, damages, or duties you are refusing to cover. (from LawInsider)

[VicMortimer]

Re: The ONLY way ransomware will ever stop is banning paying ransom

Then you lock up the CEOs of both companies.

It should be a strict liability crime, failing to do due diligence to be sure the ransom won't be paid by an insurance company should also be a crime. Treat it just like funneling money to designated terrorist organizations, because that's often exactly what happens.

[M.V. Lipvig]

Re: The ONLY way ransomware will ever stop is banning paying ransom

Almost, but not quite. What you do is hold CEOs criminally liable for the breach itself with large personal fines, no protected assets and prison time measured in decades. If a CEO knows a data breach means his shiny tight ass is going to be the target of a weekly game of butt-darts at the local pokey (ahem) then he'll stop looking at security as an expense and start looking at it as a necessity. That also means corporate data will no longer be traveling the internet, it will be on dedicated lines, and will no longer be leaving the nation for some third world call center. If it's just a fine on the company, that's just the cost of doing business paid for by the customers that got fucked over.

[Rattus]

Re: The ONLY way ransomware will ever stop is banning paying ransom

"corporate data will no longer be traveling the internet, it will be on dedicated lines,"

hummm. dedicated lines you say....

so a private fibe network for each and every company?

each company digs up and installs their own fibre between each of their buildings? what about working from home are you going to install a fibre between employees and the office?

what about offices in multiple countries? hell what about offices on the east and west coast - are you really proposing we should lay a dedicated fibre (and repeater stations)?

Ahh so instead you are proposing we allow shared physical access to be provided by a telco? take data between multiple offices in one city and multiplex it onto a single fibre between cities to share the cost of the inter city routing.

Now we could do that - its called switched circuit leased lines and looks remarkably like the old (pre 1980's) telephone network.

Further more you need to invest in many leased lines to cope with circuit failure,, with diverse routing so that if one node in your web of leased lines goes down then you can re-route your traffic around the problem.

But all that time where the circuit is idle is costing you money. I know lets co-operate with other companies - let them send traffic across your spare network capacity in exchange for them doing the same for you. This is called an intra-network network or internet for short....

[big_D]

Re: The ONLY way ransomware will ever stop is banning paying ransom

The CEO is already liabe, here in Germany. If there is a breach and it can be shown that the company was negligent in its security, the CEO can face personal fines, banned from running a compnay or face a prison sentence.

E.g. if the IT department say they need more resources to manage threats and they are refused, the CEO is liable. If the company provided the budget and everything was correctly configured, or in the process of being configured, users trained etc. and the data still got exfiltrated through a zero day or a user falling for a phishing attack despite training, then the CEO is off the hook. You just need to add paying the ransom, although they can be charged with support a criminal enterprise, and if the ransomeware company is, say, from Russia or North Korea, it would definitely be illegal to pay the ransome.

[Sherrie Ludwig]

Re: The ONLY way ransomware will ever stop is banning paying ransom

Then you lock up the CEOs of both companies.

So, then, in the course of time ALL the CEOs will be locked up? Well, that's a solution......

[Anonymous Coward]

Re: The ONLY way ransomware will ever stop is banning paying ransom

It's a nice idea but impracticable in our capitalist world.

The simple equation of is it going to cost us more to fix than pay will always take precedent.

What we could do though is regulation to ensure corporate systems are secure and have fines large enough to make it so the cost of not doing it is lower than the cost of doing it. We would also need regulators (none of that self reporting crap) to go into businesses and check they are following regulation. We do this with banks and also businesses that handle card payments so why can't we do it with everyone?

[Anonymous Coward]

Re: The ONLY way ransomware will ever stop is banning paying ransom

They CAN do that, but ultimately we all know they won't.

[gosand]

who is the CEO in this case?

So how would this work in this case, where the FBI was hacked?

The US CEO has been convicted of 34 felony counts of falsifying business records, among various other civil convictions. He's still quite gainfully employed.

While I can understand the sentiment on this, if anyone can get out of accountability it's CEOs.

[druck]

Re: The ONLY way ransomware will ever stop is banning paying ransom

Ban the means of paying - crypo - and the entire business model of ransomware and many other online scams becomes non-viable.

[EricB123]

Re: The ONLY way ransomware will ever stop is banning paying ransom

And go back to two guys in trench coats exchanging briefcases under a bridge on a dark and stormy night. Sounds cool to me.

[martinusher]

Due Process? What's that?

The FBI is part of the DoJ, an arm of the US Federal government. This is a government that's taken to blowing up small boats (complete with occupants) it doesn't like the look of and using the military to arrest people who they don't like. They also have a rather large intelligence gathering organization -- several in fact.

Being a criminal hacking group is one thing, its not the only network known to (or that's even part of) the government. You might be tolerated if you just carry on your business quietly, just hitting the Little People. By hitting the FBI you're not only being a bit cheeky but also throwing down a direct challenge. This sort of thing can get you a visit from Special Forces, a free Hellfire or something even worse. (Due Process? Rights? Do me a favor....)

[Anonymous Coward]

Re: Due Process? What's that?

Yeah, great way to "protect" your business: kick the lion in his balls. /sarcasm.

[nobody who matters]

I suspect that any person (or group of people) who display such a degree of breathtaking arrogance as they show here, will not give a toss about having their collars felt (or worse), because:

a). They think they are invincible,

and

b), they are almost certainly in a country where US enforcement agencies would find it difficult (or impossible) to operate.

[M.V. Lipvig]

"b), they are almost certainly in a country where US enforcement agencies would find it difficult (or impossible) to operate."

That would actually be a plus for the US. A small team could be sent in once the location is determined for a little defenestration. Nothing even needs to be announced either. "Hey, know who we've not heard from in a while? Those ShinyHunter guys. I wonder what ever happened to them?"

[Brewster's Angle Grinder]

1. There is zero chance of this administration keeping their gobs shut. They'd brag about it from here to eternity.

2. Keeping schtum removes the deterrence value. You want people to know there is a risk of getting their collar felt - or worse.

[LybsterRoy]

Simples - just make sure there is one (and only one) survivor.

[Anonymous Coward]

"Those ShinyHunter Guys. I Wonder What Ever Happened to Them?"

Answer: "Death by misadventure. They fell down an open elevator shaft ... on top of forty-three bullets."

[parlei]

I suspect that the US has a hard time running wet work teams inside e.g Russia or North Korea. Also, this is a global problem: even if the US manged to make it unprofitable to attack US corporations then the Eu, Japan, S. Korea, etc would be the primary targets.

[Anonymous Coward]

Re: I suspect that the US has a hard time running wet work teams inside e.g Russia or North Korea

North Korea, yes. Russia, absolutely no problem at all.

Not that they would even bother when they could easily pay the Ukrainian's to do it for them?

[Cubbie Roo]

When's the IPO?

[Anonymous Coward]

There is no IPO.

This is a foreign espionage operation disguised as a cybercrime syndicate.

[Cubbie Roo]

Re: There is no IPO.

The joke didn't land then obvsly lol

[Fruit and Nutcase]

When's the IPO?

When's the feature film?

May be they can get Carly Simon to sing the theme tune

https://en.wikipedia.org/wiki/Nobody_Does_It_Better

icon: at the end of the film when FBI break into to snatch the gang

[BoHu]

Most troubling

Just last week we learn that, finally, after decades of intensive and strenuous lobbying efforts, arguing, counter-arguing, pushing the envelope, and whathaveyou, at long last then, folks who've been regularly engaging in bestiality are now allowed to apply for well-paying jobs at the FBI, no more hassling about it -- a great victory! And then what, bummer ... ShinyHunters pawns the apply.fbijobs.gov web portal ("remains down" TFA link)!!!

Life is so unfair ... ;(

[Christoph]

Re: Most troubling

That data breach apparently includes information on human spouses - but does it also include the sheep?

[Anonymous Coward]

Re: Most troubling

Sure, they can apply.

Succeed? I don't think so.

[ComicalEngineer]

Catch a tiger by the tail...

You've just provoked a massive organisation with a reputation for not playing by the rules and a supply of guns. What could possibly go wrong?

I have laid in supplies of beer and Pringles (other snacks are available) to sit and watch this one.

[Anonymous Coward]

If they want a juicy target

A certain N.Farage of Reform Villas, Clacton has loads of money they might want to take a look at.

[Tron]

Donald Trump, GAFA and ShinyHunters: Promoting Resilience.

Either you get your data and as much of your computing as you can off any system connected to the internet, or you will learn the hard way, courtesy of geopolitics, US overreach, Big Tech or hackers.

So learn the easy way and do the sensible thing. Your data, infrastructure and intranets have to be disconnected from the net. Just have a disposable system/network/presence using thin clients, terminals or anything cheap for internet interaction.

Otherwise, one or other of them will screw you over. Not 'if' but 'when'.

[Jonathan Richards 1]

Re: Donald Trump, GAFA and ShinyHunters: Promoting Resilience.

Regrettably a valid point of view and strategy. This Is Why We Cannot Have Nice Things.

[Pulled Tea]

It's kind of funny how, even including the braggadocio, ShinyHunters' comms sound almost exactly like what a SV startup would sound like.

It's as if they found the perfect language to encapsulate their, hem hem, “business model”.

[Anonymous Coward]

>It's as if they found the perfect language

It is called “ euphemism”