On Friday 12th May the world paused and drew breath
as cybercriminals launched WannaCryptor (popularly known as WannaCry), a
ransomware attack that dominated news and conversations around the
globe. Companies shut down technology that they rely on to trade, to treat
patients and to communicate with customers. The results for many of the
affected companies and their customers were devastating.
Security experts everywhere were called into action
to combat the ransomware that was unleashed as companies and organizations
attempted to return to normal trading and practice. The vulnerability used as
an entry point to infect machines was in Microsoft’s Windows. The National
Security Agency apparently knew about it, then someone leaked the details and
the cybercriminal took advantage of the situation.
“As with all new innovative
technology, it takes time for regulators and governments to catch up.”
We may never know what motivated the cybercriminal
to unleash WannaCryptor but we do know that there was financial gain. The
ransomware encrypted files, with an offer to decrypt them of $300, payable by
bitcoin.
I am sure many of you, like me, have watched crime
dramas where the law enforcement dudes say ‘follow the money’ as the method to
find the real criminal behind a crime. Can you follow the money flow for
WannaCryptor? Apparently not.
If you’ve attempted to open a bank account or
applied for a credit card then you know the financial services industry has
strict regulations requiring the identification of the person opening the
account. The regulations extend to businesses and staff opening accounts or
applying for a credit card terminal; the people responsible go through a
process of being identified so they can be held responsible. The regulations
are there to combat fraud and money laundering — in other words, to stop crime
in the financial system.
Why does the criminal behind WannaCryptor
only accept payment with bitcoin?
Bitcoin’s message on their website states that
“bitcoin is open-source; its design is public, nobody owns or controls bitcoin
and everyone can take part” and goes on to state: “Bitcoin allows exciting
uses that could not be covered by any previous payment system.”
The concept of a virtual currency is potentially a
good one: exchange rate free and accepted globally — there would seem to be
benefits for businesses and consumers. How do I join the bitcoin community and
reap the benefits of this virtual currency? To start with, I need a wallet to
hold my virtual cash.
There are several wallet vendors, just like the
physical world. With some offering additional privacy by rotating addresses and
others offering services that remove the need to validate payments.
Once I’ve selected my wallet I can generate an
address, a virtual location to receive funds; the recommendation is a different
address for every transaction to enhance my privacy. The messages of rotating
addresses and using a new address for every transaction start to give me the
confidence that I am going to be able to remain hidden, private and anonymous.
Ok, my wallet is full, how do I get the
money?
My wallet, which is an account, is bursting at the
seams and I want to withdraw my funds. There are two methods: register with an
exchange, or in person. Registering with an exchange will require positive
identification, uploading utility bills and stuff that we are used to doing at
normal banks. Alternatively, you can trade directly with another person, meet
them, exchange a QR code for cash and walk away.
The ‘in person’ method of cashing out means another
unidentified person now holds the virtual money in his wallet and I remain
completely anonymous. Needing to move the funds on may not be essential though
— holding on to them as an investment or anonymously trading for services could
be alternatives.
Bitcoin is often regarded as an anonymous currency
because it is possible to send and receive bitcoins without giving any personal
identifying information. True anonymity may be impossible, as the cashing out
process could require a physical meeting, but it is probably reasonable to say
it’s pseudonymous.
Financial institutions around the world have
sophisticated systems to detect money laundering, such as large sums moving
from account to account. If you have ever sold a property and had the funds
deposited in an account, you may have had to go through the experience of
explaining where the funds came from.
In the virtual currency world there seem to be no –
or very limited – requirements to track the flow of money, making it an ideal
solution for criminals, fraudsters and terrorists to use for storing and moving
their funds. A secret currency.
“As with all new innovative
technology, it takes time for regulators and governments to catch up.”
As with all new innovative technology, it takes
time for regulators and governments to catch up. Now would seem an opportune
moment, though, for the same requirements imposed on financial organizations to
be migrated to the new world of virtual currency, making “follow the money” a
reality again. Taking action now by cutting off the ability to have an
anonymously traded currency could stop the next major cyberattack.
For more on the WannaCryptor, aka WannaCry,
ransomware attack, check out the following: