Buying Ransomware Is Easier Than You Think

TL;DR

Ransomware can be easily purchased on the dark web.

Transcript

Ransomware is everywhere. It's happening to the biggest companies. The cyber weapon NotPetya started in Ukraine in June of 2017. It quickly spread, paralyzing major companies and causing more than $10 billion in damage. Government computers in 22 Texas towns are being held hostage by ransomware. But it's also happening at super low levels, where yo... Read More

Key Insights

• Ransomware attacks are becoming increasingly common, affecting both large corporations and individual users, causing significant financial damage worldwide.
• Ransomware as a Service (RaaS) is a growing trend, allowing individuals to purchase ransomware similar to how they would buy software like Salesforce.
• The ease of access to ransomware means that even individuals with limited technical skills can potentially launch attacks, posing a significant cybersecurity threat.
• The dark web hosts numerous forums and marketplaces where various forms of malware, including ransomware, are bought and sold, often under the guise of anonymity.
• Legal concerns surrounding the possession and use of ransomware are significant, but intent plays a crucial role in determining legality.
• The quality and sophistication of ransomware available on the dark web vary greatly, with some being unreliable or scams, while others are highly advanced.
• Ransomware providers often operate in teams with specialized skills, sometimes using geofencing to avoid certain jurisdictions like Russia and Ukraine.
• Despite the technological challenges and risks, the experiment highlighted the proximity of potential cyber threats lurking on the internet.

Questions & Answers

Q: What is Ransomware as a Service (RaaS)?

Ransomware as a Service (RaaS) is a model where individuals can purchase ransomware from providers on the dark web, similar to buying software like Salesforce. This model allows even those with limited technical skills to deploy ransomware attacks, increasing the prevalence and accessibility of cyber threats.

Q: How did Bloomberg conduct their ransomware experiment?

Bloomberg's Drake Bennett purchased ransomware from the dark web to test its accessibility and ease of use. He used encrypted email and a Bitcoin wallet to make the purchase, then attempted to deploy the ransomware on a colleague's computer, highlighting the potential ease of launching such attacks.

Q: What legal concerns arise from purchasing ransomware?

Purchasing ransomware raises significant legal concerns, primarily related to the intent to use it for malicious purposes. In Bloomberg's case, the experiment was deemed legal because the intended victim was complicit in the scheme, and there was no intent to harm an unwitting victim.

Q: What challenges did Bloomberg face in their ransomware experiment?

Bloomberg faced several challenges, including the unreliability and potential scams associated with dark web transactions. The ransomware they purchased was not sophisticated, and there was concern about being conned into paying more money for better functionality.

Q: What insights were gained about the dark web's role in cybercrime?

The experiment revealed that the dark web hosts numerous forums where malware is traded, often under the guise of anonymity. These forums vary in reliability and sophistication, with some products being scams, while others are highly advanced and capable of significant damage.

Q: How does the quality of ransomware vary on the dark web?

The quality of ransomware on the dark web varies greatly, with some being unreliable or scams, while others are highly sophisticated. This variation is reflected in the price range and the level of expertise required to deploy the ransomware effectively.

Q: What does the experiment say about the accessibility of cybercrime tools?

The experiment highlights the alarming accessibility of cybercrime tools, with ransomware being easily purchasable by individuals with limited technical skills. This ease of access poses a significant threat to cybersecurity, as it lowers the barrier to entry for potential attackers.

Q: What precautions were taken during the ransomware experiment?

Precautions included using burner laptops to avoid compromising Bloomberg's network, consulting with lawyers to ensure legal compliance, and ensuring the intended victim was complicit in the scheme to avoid legal repercussions. These measures helped mitigate the risks associated with the experiment.

Summary & Key Takeaways

• Ransomware is a prevalent cyber threat affecting both major corporations and individuals, with damages running into billions of dollars globally. The concept of Ransomware as a Service (RaaS) is emerging, making it possible for almost anyone to purchase and deploy ransomware with minimal technical knowledge.

• Bloomberg's investigation involved purchasing ransomware from the dark web to demonstrate how accessible and easy it is to launch a cyberattack. The process revealed the existence of numerous dark web forums where malware is traded, and highlighted the varying quality and reliability of these products.

• The experiment underscored the legal and ethical challenges of dealing with ransomware, emphasizing the importance of intent in legal considerations. It also revealed the sophistication of some ransomware providers, who often work in teams and use advanced techniques to avoid detection and legal repercussions.