Thread by @smdiehl

Continuing on with the public awareness raising about the tragic costs of bitcoin ... today we'll explore the bitcoin killer app: Extortion.

(1/) 🧵

Previously I covered why it's bad that we're using the equivalent power consumption of the whole country of Ireland to process 4 transactions/second for selling heroin and gambling on human gullibility futures. (2/)

https://twitter.com/smdiehl/status/1350869944888664064

While the primary use case of #Bitcoin is gambling, the secondary use case is crime. Largely a form of crime called ransomware which is an exploit in which hackers lock your phone or laptop and demand money in exchange for unlocking it. (3/)

In the UK we've all been victims of #Bitcoin when in 2018 our NHS was attacked. Hackers installed ransomware across 200k hospital computers to extort the public.

The attack drained £92m from NHS to recover from damages. All paid for by the taxpayer. (4/)
theguardian.com/society/2017/m…

Across the G7 we see year on year increase in ransomware attacks for a simple reason. It's *very* lucrative and anonymous hackers have little risk of being prosecuted.

The dirty secret of ransomware is most companies will pay up and cover up as a cost of doing business. (5/)

How does bitcoin fit in?

These attacks existed before, but hackers had no means to extort arbitrarily large sums of money internationally and anonymously. The "innovation" of #Bitcoin is there is now an unregulated global payment channel for illicit financing and crime. (6/)

Consider the same situation on top of the traditional system. Go to your local bank and try to wire transfer $200,000 to an anonymous stranger in Russia and see how that works out.

Modern ransomware could not exist without Bitcoin, it poured gasoline on the fire. (7/)

Yes, initial ransom payments are on a 'public ledger', however mixing and chain-hopping (via Monero, ZCash, etc) are used to launder payments to avoid tracing.

Even North Korea is quite adept at this technique as seen in the Justice Dept report. (8/)
justice.gov/opa/pr/united-…

Damages for ransomware in 2021 are predicted to be >$20 billion with attacks happening every 11 seconds.

Attacks are indiscriminate in their victims and leave a wake of destruction and financial loss across both the public and private sector. (9/)
natlawreview.com/article/ransom…

And the scale of damages is alarming. In 2018 the citizens of the city of Atlanta were forced to pay $17m to recover from ransomware. In 2019 the shipping company Maersk and FedEx were hit with $300 million losses from a bitcoin ransomware attack. (10/)

wired.com/story/notpetya…

In 2019 a disgusting attack on the University of California San Fran COVID-19 vaccine research lab locked servers in the epidemiology department. The university paid the hackers $1.14 million ransom, funds that could have gone into vaccine research. (11/)
bbc.com/news/technolog…

Talk to any software engineer and they'll tell you that the shiny illusion of technical modernity is held together with metaphorical duct tape, chewing gum, tons of sysadmins on call, and a lot of sleepless nights worrying about bugs. (12/)

Software is written by thousands of people who barely understand how the whole thing fits together, and things don't always fit together cleanly.

In these holes we find subtle software bugs that lead to security vulnerabilities. And software is only ever getting bigger. (13/)

In the coming years the vast impact of these zero-day vulnerabilities are going to be enormous, and the attacks are only ever going to increase. Cybersecurity problems in our phones and computers are a public concern just as much as lead in our water supply is. (14/)

Ransomware and its inexorable connection to bitcoin is an underreported topic by the media, you hear about it a little but it's just the tip of the iceberg. And the iceberg goes very very deep. (15/)

#Bitcoin is a persistent threat embedded within our financial system.

Cyber is the theatre of our era and we've accidentally enabled a new attack vector allowing malicious actors to wage endless escalating cyber guerrilla war against our private and public infrastructure. (16/)

Thesis of my recent writing is that technology is not morally neutral, and not "just a tool" as my industry likes to say. Guns are not "just a tool" either.

Somethings have such massive externalities they must be controlled because the societal cost of misuse is so high. (17/)

Simply put, #Bitcoin a technology where the negatives vastly outweigh the positives. (18/)

Any member of the G7 has the capacity to end this insanity *tomorrow* if we so choose.

Putting off-shore crypto exchanges on sanctioned entities lists and stopping exchange withdrawals to domestic bank accounts would massively stymie incentives for ransomware attacks. (19/)

We the voting public of these democracies have to ask a fundamental question about #Bitcoin ransomware.

Will we favour this anarcho-capitalist fantasy of speculative gambling profits for a tiny few over the shared societal costs of digital extortion to us all.

/fin