Cyber Chiefs' Stormy Relationship With Crypto — WSJ
By Angus LotenCorporate cybersecurity leaders are having a schadenfreude moment after Binance, the world's largest cryptocurrency exchange, lost billions of dollars this week to hackers.Cryptocurrencies, like bitcoin, Ethereum and hundreds of others, have become the financial engine for ransomware attacks. By offering cybercriminals both speed and anonymity for collecting ransom payments, digital currencies have helped make ransomware into a booming underworld industry — and a major headache for chief information security officers."Let's just say it probably hasn't made many CISO Christmas card lists," said Robert Coles, senior cybersecurity engineer at cybersecurity firm Black Duck. "There's some irony in seeing a major cryptocurrency platform on the receiving end of a massive cyberattack," Coles said.On Thursday, Binance suspended transactions after hackers broke into the exchange's platform and took off with more than $6 billion, marking the biggest cyber heist in history. The company said it is currently investigating the attack, which appears to have accessed systems through a worker's laptop."When the biggest crypto exchange gets taken by the same endpoint compromise everyone else fights, the urge to say 'welcome to our world' seems like a befitting reply," said Mayuresh Dani, security research manager at cloud-based security platform Qualys.Ransomware attackers typically break into a company's network and hold data hostage, or threaten to release it, if a ransom isn't paid. Jason Soroko, a senior fellow at Sectigo, a digital certificates management firm, said CISOs resent crypto because it solves the hardest part of extortion: getting the money.Before the widespread adoption of digital currencies, hackers typically relied on postal money orders, P.O. boxes, Western Union transfers and other physical ransom payment methods that risked leaving a paper trail. "The first known ransomware, in 1989, told victims to mail $189 to a post office box in Panama," Soroko said.Fueled by crypto, ransomware attacks are now a leading cybersecurity threat. Between July and September, cybersecurity firm Nord Security tracked a total of 2,894 ransomware attacks worldwide, an 8.6% increase over the previous quarter and up 50% from the same period last year.Over the summer, roughly a quarter of more than 100 ransomware cases handled by cybersecurity firm Veeam paid off their ransomware attackers, the company said. The average payment was just over $1 million — all of it in cryptocurrency, said Raymond Umerley, the firm's Field CISO.At best, CISOs and other cyber defenders have a love-hate relationship with crypto, said Jake Williams, a faculty member at IANS, a cyber-risk consulting firm. "Many CISOs I know have made money in the crypto markets, especially as early adopters," Williams said. "But even they will acknowledge that ransomware wouldn't exist in its current form without crypto."To be sure, crypto isn't the only factor behind the rise of the ransomware market. Among other issues, increasingly sophisticated phishing campaigns, new and wide-scale security vulnerabilities exposed by artificial intelligence and mounting geopolitical tensions have all played a role, cybersecurity experts say."Crypto is typically the payment rail, not the cause," said Carlos Pignataro, program director at the Conference Board's CISO Council, a cyber industry group. While it makes online extortion significantly easier, he said, hackers rely on weak identity safeguards, flat networks and slow recovery times to make ransomware a profitable business.Jason Baker, threat intelligence practice lead at GuidePoint Security, a cybersecurity services and incident response firm that helps companies negotiate with ransomware hackers, said crypto is a convenient scapegoat for beleaguered security chiefs."You don't blame cars if they're the getaway vehicle for a bank robbery," Baker said. And just as banning cars wouldn't prevent bank robberies, he said, shutting down crypto platforms won't stop hackers. "Threat actors adapt, and while this is a tool they're used to, I think they'd adapt further away from cryptocurrency if they had to," Baker said.Whatever the target, security chiefs aren't about to cheer on cybercriminals, Coles said."At the end of the day, the attackers still found a way in and moved an enormous amount of money," he said. "That part of the story is all too familiar."Write to Angus Loten at [email protected]