Colonial Pipeline partial ransom recovered?

Hang 4

Hang 4

Pattern Altitude
Joined
Aug 18, 2017
Messages
2,330
Display Name
Display name:
Hang 4
Ransom paid in bitcoin. Feds were able to recover 2.3 million worth of bitcoin of about 4 million in ransom paid. I thought bitcoin was untraceable.

Any idea how it was done?
 
Hang 4 said:
Ransom paid in bitcoin. Feds were able to recover 2.3 million worth of bitcoin of about 4 million in ransom paid. I thought bitcoin was untraceable.

Any idea how it was done?
Click to expand...
Not remotely untraceable. All transfers are public. So, if you know where the money was originally transferred to, you can track the money from there.

https://www.justice.gov/opa/pr/depa...rrency-paid-ransomware-extortionists-darkside

As alleged in the supporting affidavit, by reviewing the Bitcoin public ledger, law enforcement was able to track multiple transfers of bitcoin and identify that approximately 63.7 bitcoins, representing the proceeds of the victim’s ransom payment, had been transferred to a specific address, for which the FBI has the “private key,” or the rough equivalent of a password needed to access assets accessible from the specific Bitcoin address. This bitcoin represents proceeds traceable to a computer intrusion and property involved in money laundering and may be seized pursuant to criminal and civil forfeiture statutes.
​
So, some of the money was sent to an account they already had the key to, from there it's a simple matter to transfer it back out.
 
Either that, or they just made it up to dissuade more hacking. No work on their part, and all the effect. And what's a few mil they give to CP. Everyone's happy and gets what they want. Except, of course, for the people. But what do they matter?
 
It was reported the bad guys suffered an attack that shut them down and stole their loot.
 
Why the F would the hackers transfer the funds to an account for which the FBI held the private key?
 
DaleB said:
I’d love to believe that. Sadly, at this point I believe almost nothing at all that I don’t personally witness, and only a portion of that.
Click to expand...

Dad used to say, "don't believe nothing you hear and only half of what you see." Sadly these days those numbers are increasing ... :eek:
 
DaleB said:
I’d love to believe that. Sadly, at this point I believe almost nothing at all that I don’t personally witness, and only a portion of that.
Click to expand...
That is what the bad guy’s public statement said last week.
 
DaleB said:
I’d love to believe that. Sadly, at this point I believe almost nothing at all that I don’t personally witness, and only a portion of that.
Click to expand...
You and me both!
 
Hang 4 said:
Ransom paid in bitcoin. Feds were able to recover 2.3 million worth of bitcoin of about 4 million in ransom paid. I thought bitcoin was untraceable.

Any idea how it was done?
Click to expand...
chartbundle said:
So, some of the money was sent to an account they already had the key to, from there it's a simple matter to transfer it back out.
Click to expand...

Not untraceable but unseizable given the proper implementation. It had to have been a side channel attack of some sort. Or perhaps some good old social engineering.
 
There's definitely more to this story. Because it doesn't make sense.

Likely some incredible stupidity was involved.

Itll be a while before a detailed account that may or may not be true is out.

Probably longer than the typical NTSB report.

Secrets and lies.

The one given is governments don't like cryptocurrency but they have gotten pretty good at injecting themselves into the typical distribution methods.

Even funnier in a way crypto is far worse than good old cash for hiding it. And they truly despise cash.
 
Cryptocurrency is actually much easier to trace than almost anything else. The ledgers are public, and anyone can download a copy.
The cryptography in cryptocurrency is not to make you anonymous, but to make it so the coins cannot be copied. This only protects the holder until it is placed in a known account or you spend/exchange it.

In this case all the FBI had to do was know the starting point for which coins, and follow the transactions in the public ledger. When the coins were traded at an exchange that the FBI has the legal reach to seize, game over.

Tim

Sent from my HD1907 using Tapatalk
 
dans2992 said:
Why the F would the hackers transfer the funds to an account for which the FBI held the private key?
Click to expand...

Because they didn't know. The folks in the investigative chain were smart enough to keep their mouths shut and to keep classified stuff classified.

denverpilot said:
There's definitely more to this story. Because it doesn't make sense.
Click to expand...

I am quite convinced of that.

Likely some incredible stupidity was involved.
Click to expand...

Maybe or maybe not. At least not "stupid" in the normal sense, but "stupid" in the sense of trusting too much in encryption.

Itll be a while before a detailed account that may or may not be true is out.

Probably longer than the typical NTSB report.

Secrets and lies.

The one given is governments don't like cryptocurrency but they have gotten pretty good at injecting themselves into the typical distribution methods.

Even funnier in a way crypto is far worse than good old cash for hiding it. And they truly despise cash.
Click to expand...

Actually, I think that the news today about ANOM may hold some of the clues. And they had to act RIGHT NOW because once it got out that they had the private key they knew that their sources and methods were compromised.

https://www.thetimes.co.uk/article/...ndreds-of-criminals-in-global-sting-3znlgks6z
 
Indee
tspear said:
That is awesome.

Tim

Sent from my HD1907 using Tapatalk
Click to expand...
Indeed. Absolutely just freaking awesome. And i hope it keeps happening. But now…. Nobody knows.

:D
 
OK, this bugs me: " *MOST* of the ransom was recovered."

To me *MOST* means "nearly all", not just "a little more than half" in valuation. I understand the cryptocoin value declined, that it was originally 75 coins and they recovered 63 ...
 
The FBI is as corrupt as any government bureaucracy can be. The have systematically falsified evidence, provided perjured testimony and manufactured evidence. Why would anyone believe anything they said?
 
danhagan said:
OK, this bugs me: " *MOST* of the ransom was recovered."

To me *MOST* means "nearly all", not just "a little more than half" in valuation. I understand the cryptocoin value declined, that it was originally 75 coins and they recovered 63 ...
Click to expand...
Doesn't anything above 50% qualify for "most"?
 
LesGawlik said:
The FBI is as corrupt as any government bureaucracy can be. The have systematically falsified evidence, provided perjured testimony and manufactured evidence. Why would anyone believe anything they said?
Click to expand...


b67.gif
 
So - all those libertarian types touting Bitcoin, etc... it's not like y'all's "money" is *really* secure now, is it?

All they gotta do is cut off your electricity or internet access for a bit and hack into your wallet.
 
SoonerAviator said:
Doesn't anything above 50% qualify for "most"?
Click to expand...

I'd say technically probably yes, as one of the definitions of "most" is "the majority".

However, I'd say in common usage, at least for me, "most" implies a much greater amount than 51% of whatever. For me, maybe like 75%. To me, "most" really means "almost all".

I mean, if I loan you $100, and you pay me back $51, I'm not going to consider that I got "most" of it back.
 
Hang 4 said:
Ransom paid in bitcoin. Feds were able to recover 2.3 million worth of bitcoin of about 4 million in ransom paid. I thought bitcoin was untraceable.

Any idea how it was done?
Click to expand...

Some thieves are stupid, like the bank robber who went hitch hiking with his loot, or the FBI's most wanted who turned himself in to claim the reward.
 
RyanShort1 said:
So - all those libertarian types touting Bitcoin, etc... it's not like y'all's "money" is *really* secure now, is it?
Click to expand...
Security is what you make of it. You can have the toughest most hardened vault in the world, but it isn't really secure if you leave the combination on a sticky note pasted to the door.
All they gotta do is cut off your electricity or internet access for a bit and hack into your wallet.
Click to expand...
From what I gather at this point in time, that isn't what happened.
 
asicer said:
Security is what you make of it. You can have the toughest most hardened vault in the world, but it isn't really secure if you leave the combination on a sticky note pasted to the door.
Click to expand...

Yep. I still remember well giving a tour of a new robotic compound screening facility to a new CIO at a major pharma company. The room was impressive by anyone's standards, an amazing collection of automation, whizzing microtiter plates around at dizzying speed. One could have spent hours explaining it all to an interested person. But the CIO walked in, immediately spotted a password on a post-it on a monitor, and that became nearly the only topic for the lab staff for the duration of the visit.

He was right, but it was disappointing that we didn't get to show off the cool stuff.
 
GaryM said:
Yep. I still remember well giving a tour of a new robotic compound screening facility to a new CIO at a major pharma company. The room was impressive by anyone's standards, an amazing collection of automation, whizzing microtiter plates around at dizzying speed. One could have spent hours explaining it all to an interested person. But the CIO walked in, immediately spotted a password on a post-it on a monitor, and that became nearly the only topic for the lab staff for the duration of the visit.

He was right, but it was disappointing that we didn't get to show off the cool stuff.
Click to expand...
Was that before the company required passwords to be something that no human could remember?
 
MauleSkinner said:
Was that before the company required passwords to be something that no human could remember?
Click to expand...

Well, the password requirements were probably simpler then.
Using the first letter of each word from a memorable (but not too common) phrase is still a pretty good simple approach, now with required capitalization, numbers, and symbols interspersed.
Pilots have it comparatively easy, with a seemingly endless array of airport, navaid, and intersection IDs, frequencies, and so forth that can be combined in endless ways that are easy for a pilot to remember, but hard to crack.
 
GaryM said:
Pilots have it comparatively easy, with a seemingly endless array of airport, navaid, and intersection IDs, frequencies, and so forth that can be combined in endless ways that are easy for a pilot to remember, but hard to crack.
Click to expand...
I can see it now… social engineering extended to data mining Flight Aware tracks.
 
GaryM said:
Well, the password requirements were probably simpler then.
Using the first letter of each word from a memorable (but not too common) phrase is still a pretty good simple approach, now with required capitalization, numbers, and symbols interspersed.
Pilots have it comparatively easy, with a seemingly endless array of airport, navaid, and intersection IDs, frequencies, and so forth that can be combined in endless ways that are easy for a pilot to remember, but hard to crack.
Click to expand...
“Come up with a password right now, and none of the other ones you use will even remotely work.”

somewhere, on a federal government server, it’s waiting for me to enter the password “****1ngID10ts”
 
DaleB said:
I’d love to believe that. Sadly, at this point I believe almost nothing at all that I don’t personally witness, and only a portion of that.
Click to expand...

I agree, I mean there are people that think the election was rigged! That's crazy!
 
danhagan said:
OK, this bugs me: " *MOST* of the ransom was recovered."

To me *MOST* means "nearly all", not just "a little more than half" in valuation. I understand the cryptocoin value declined, that it was originally 75 coins and they recovered 63 ...
Click to expand...
Could be the plan all along.

Keeping a few million while letting the powers that be brag they got a bunch back so the pressure is off them, is a tried and true strategy really.

Pretends to lower risk, everybody gets a cut...

Sounds like wall street daily.

Drug cartels always know a percentage of the mules get caught.
 
asicer said:
Security is what you make of it. You can have the toughest most hardened vault in the world, but it isn't really secure if you leave the combination on a sticky note pasted to the door.

From what I gather at this point in time, that isn't what happened.
Click to expand...
No, but I'm pointing out that there are all kinds of ways to make crypto useless.
 
I’m convinced 70% of “criminals” on the dark web are FBI undercover, and a good portion of Tor exit nodes are NSA owned.
 
Rushie said:
I’m convinced 70% of “criminals” on the dark web are FBI undercover, and a good portion of Tor exit nodes are NSA owned.
Click to expand...
If YOU ran one if those agencies and had budgetary control, wouldn’t YOU make sure of it? I sure would.
 
You must log in or register to reply here.
Back
Top