Ransomware Victims That Pay Up Could Incur Steep Fines from Uncle Sam (krebsonsecurity.com) 51
Krebs on Security: Companies victimized by ransomware and firms that facilitate negotiations with ransomware extortionists could face steep fines from the U.S. federal government if the crooks who profit from the attack are already under economic sanctions, the Treasury Department warned today. In its advisory, the Treasury's Office of Foreign Assets Control (OFAC) said "companies that facilitate ransomware payments to cyber actors on behalf of victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, not only encourage future ransomware payment demands but also may risk violating OFAC regulations." As financial losses from cybercrime activity and ransomware attacks in particular have skyrocketed in recent years, the Treasury Department has imposed economic sanctions on several cybercriminals and cybercrime groups, effectively freezing all property and interests of these persons (subject to U.S. jurisdiction) and making it a crime to transact with them. A number of those sanctioned have been closely tied with ransomware and malware attacks, including the North Korean Lazarus Group; two Iranians thought to be tied to the SamSam ransomware attacks; Evgeniy Bogachev, the developer of Cryptolocker; and Evil Corp, a Russian cybercriminal syndicate that has used malware to extract more than $100 million from victim businesses.
What about the BANKS do they get fines for there! (Score:3)
What about the BANKS do they get fines for there parts?
Re: (Score:2)
Did you read TFA? It said financial institutions.
Re: (Score:1)
What about the alleged administration do you not understand? They are only threatening the banks, they won't actually follow through unless the banks do not cough up something to the alleged president.
Re: (Score:2)
Ah I see, you are an insane person who references words you never actually said.
Re: (Score:2)
What about the BANKS do they get fines for there parts?
It is clearly stated in the summary that banks are subject to fines. Banks are also frequently subject to regulatory orders, including cease and desists, if they have deficiencies with their Bank Secrecy Act / Anti-Money Laundering practices.
"companies that facilitate ransomware payments to cyber actors on behalf of victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, not only encourage future ransomware payment demands bu
Evil Corp (Score:2)
Re: (Score:2)
Re:How to manage ransomware finances. (Score:5, Insightful)
"Spend a portion of that money on insurance." FTFY.
And the insurance will require security (Score:2)
And the insurance will require that you spend some on security.
Which should be cheaper, ling term, than constantly dealing with malware and crap.
Re: (Score:2)
True, but if competition in that sector is normal, they will only require those measures which are determined necessary by their actuaries, as opposed to the voodoo-determined security procedures some companies currently suffer with. Certainly they will need to provide reasonable protection and training around malware and crap, e.g. phishing -- I was pretty much assuming that was already a baseline.
Re: (Score:3)
Spend it on backups.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Talk about a rock and a hard place! (Score:2)
So all your systems are unlocked, but if you pay the 100k ransom to fix it quickly you may face a much large fine later, and no real way to tell quickly if that will happen or not...
Man, at some point if you squeeze hard enough companies might actually start taking computer security seriously!
Nah.
Re: (Score:2)
Or companies just might move somewhere with less stupid laws.
Damned if you do damned if you don't (Score:5, Insightful)
Re: (Score:2)
I suspect that if Garmin spends five hundred thousand dollars worth of bitcoin on earwig repellent questions will be raised.
Re: (Score:2)
At this point the company is vulnerable to black mail for not reporting ransomware attack
Whistle blowers too stand to get a windfall. So once your company data is compromised by a ransomware attack, the company should be dead. All the C Suite compensation packages rendered null and void. The assets of the company divvied up among the other companies that actually had security.
Only when there is a chance CSuite will lose it all, there wi
Re:Damned if you do damned if you don't (Score:4, Interesting)
Most ransomware attacks are pretty hard to hide. If they don't disrupt the daily operation of the business there's no incentive to pay the ransom.
Re: (Score:2)
Re: (Score:1)
If they are publicly traded company or regulated, then not reporting would be criminal.
Shoot to win (Score:2)
Already Happening in the UK (Score:5, Interesting)
He earned his medical degree and completed the additional years of dentistry training at Glasgow University in Scotland, and about 3-4 years ago he was chatting with another dentist who had graduated in the same class (my friend is the one in the class all the others visit for the check-ups and work). He learned in the process that his friend's business had been hit by ransomware.
The business had been crippled, so this other dentist paid the ransom [after confirming that the crooks did actually provide unlock keys] and recovered his data. Because this guy was an honest citizen, he took all the details, including photographs of the ransom message, screen shots of the payment and recover process, to his local police station. The desk officer was fascinated as they hadn't come across anything like this being reported before.
Three days later the same officer turned up at the dental surgery with bad news. "I'm terribly, terribly sorry about this, Sir. I'm afraid I'm here to arrest you and take you to the station where I'm instructed to charge you under the "Proceeds of Crime Act", because you have voluntarily admitting providing funds to an identified criminal gang."
This other dentist was duly taken to the station, charged, released on police bail, then had to go through the considerable time, trouble and expense of hiring legal counsel. They decided to go to court to appeal the charge, lost, and the fine was [I cannot remember the amount now] eye-watering.
And that's the modern justice system for you: treat the victims like criminals.
Re: (Score:2)
Though I despise it, we must not only prevent crime, but punish those who contribute to it. It sucks that it happened, but this is a fairly new phenomenon and it will take a long time for all the rough edges to be cleaned out. I personally see it as a fine for not taking proper measures with your data. To allow someone to simply pay these ransoms opens up a few shenanigans of its own. For instance, you can write off losses relating to crime on your taxes in the US, it would be a major tax evasion loophole a
Re: (Score:2)
If you are mugged and the thief gets away with your purse/wallet are you also subject to arrest since you provided funds to a criminal gang/individual?
Re: (Score:3)
Re: (Score:1)
Re: (Score:2)
Unlike America we don't consider companies to be people.
Re: (Score:2)
This is factually wrong. The UK structure of a "Limited Company" is the legal equivalent to the US structure of an "Incorporated Company". What we would call "Inc" in the US is called "Ltd" in the UK.
Re: (Score:2)
So if you get mugged and willingly give up your wallet/purse instead of getting hit/shot before giving it up would THEN make you complacent in the crime? There is some data (e.g. medical data) that if encrypted by ransomware may also put your (or others) life in danger also.
Re: (Score:2)
Re: (Score:2)
Suppose the dentist had gone to the local police station and said, "A group of unknown criminals, who operate somewhere on the internet and who may not be UK nationals, have maliciously deployed malware on the computers that run my business such that I am not able to operate. Can you help me recover the key to unlock my data?"
The reply would have been "No." Not only because that would unlikely be within the remit of the local police, but because the police would only have jur
Re: (Score:2)
Normally I'm not ok with victims being treated like criminals.
If they were passive victims I'd take your point, however by coughing up the ransom and thereby making the crime profitable they are effectively making themselves accomplices in the same crime where they are the victim, as sad as it is.
Mind you the real bastards in the situation are the cyberterrorists taking the data hostage in the first place.
Re: (Score:2)
however by coughing up the ransom and thereby making the crime profitable they are effectively making themselves accomplices in the same crime where they are the victim, as sad as it is.
I wonder if you'd have the same stance if your daughter was kidnapped and held for ransom.
Re: (Score:3)
I see both sides on this one. In many regards, the dentist's situation is no different than if he had handed over his wallet during a mugging: his livelihood was being threatened, so he felt like he had no choice. On the other hand, if an entire nation practices "we don't negotiate with criminals", whether voluntarily or through enforcement actions such as these, it stops the cycle of crime and makes everyone in that nation significantly less attractive to criminals because they know they'll be unlikely to
Re: (Score:2)
There is also another element were he is at fault: You can be prepared for a ransomware attack and then you get up and running again from off-line backups, no payments involved. Any halfway professional IT operation is able to do that and it is not regarded as optional by any halfway professional IT staff. He chose to do this cheaply and insecurely. As to your wallet, you really need that and there is no sound alternative.
Re: (Score:3)
British justice is badly broken. Where is the public interest in victimising the unfortunate dentist further?
That is obviously to prevent others from doing what he did, namely making a crime profitable.
Re: (Score:2)
And that's the modern justice system for you: treat the victims like criminals.
It is nowhere as simple as that. For one thing, he contributed to the perpetuation of that type of crime. For another, he operated critical IT infrastructure (for him) without adequate security and disaster preparedness. In a very real sense, he generated the opportunity for the crime. And hence he _is_ part of the problem.
Re: (Score:2)
Punishing the victim (Score:4, Insightful)
Re:Punishing the victim (Score:4, Insightful)
Probably, right after they vacate Roe v Wade and require rape victims to give birth.
Why it is totally obvious (Score:3)
Because the best way to help a victim of injury is to pile more injury on top of it.
Re: (Score:2)
If the victim did it to themselves and is harming others in addition, yes. And that is pretty much what is going on here. Ransomware preparedness is non-optional in any halfway professional IT operation.
At least ban insurance cover (Score:2)
The worst aspect of these cases is when companies are more willing to pay out because their insurance covers some or all of the blackmail costs. Making it illegal for insurance companies to cover such payments would be a good start. It would make it harder for companies to pretend that insurance was a viable alternative to investing in security.
Under economic sanctions (Score:2)
Well then, I'll make damned sure that anyone blackmailing me presents proper identity credentials before I pay. So I can check them against Treasury and State Department sanction lists. Yes sir. There is no way I would just make payments blindly through anonymous e-mail services instead of insisting on a proper Taxpayer Identification Number so as to report the transfer on a 1099.
It's interesting that this is an OFAC [wikipedia.org] issue. Like there aren't a bunch of domestic organizations funding themselves by blackmail
Cyber Command (Score:2)
Re: (Score:3)
We had one, under Obama. Trump all but destroyed that, and rescinded several related orders, all because they were done by a black president.
Re: (Score:2)
Surely an arena of such huge commercial importance and affecting such a large number of people needs to be protected.
Wait till ransomware hits voting machines (Score:2)
https://twitter.com/i/status/1... [twitter.com]