zlacker

Checkout.com hacked, refuses ransom payment, donates to security labs

submitted by Strang+(OP) on 2025-11-13 09:23:30 | 622 points 265 comments
[view article] [source] [go to bottom]

NOTE: showing posts with links only show all posts
◧◩◪◨
35. berkes+zc[view] [source] [discussion] 2025-11-13 11:08:39
>>sunaoo+Q6
I always presume the "We are sorry" opens up to financial compensation, whereas the "we regret that you are worried" does not.

In my country, this debate is being held WRT the atrocities my country committed in its (former) colonies, and towards enslaved humans¹. Our king and prime minister never truly "apologized". Because, I kid you not, the government fears that this opens up possibilities for financial reparation or compensation and the government doesn't want to pay this. They basically searched for the words that sound as close to apologies as possible, but aren't words that require one to act on the apologies.

¹ I'm talking about The Netherlands. Where such atrocities were committed as close as one and a half generations ago still (1949) (https://www.maastrichtuniversity.nl/blog/2022/10/how-do-dutc...) but mostly during what is still called "The Golden Age".

◧◩
57. blitza+Ki[view] [source] [discussion] 2025-11-13 11:58:04
>>lexlam+65
They should have watched Ransom (1996).

https://www.youtube.com/watch?v=xllIU0lPgqs

◧◩◪◨⬒⬓
81. wallet+xo[view] [source] [discussion] 2025-11-13 12:43:21
>>weird-+Vi
There are best practices for this, you normally hire a third party to handle the negotiations, payment process and the necessary due diligence.

For example the UK government publishes guidelines on how to do this and which mitigating circumstances they consider if you do end up making a payment to a sanctioned entity anyway https://www.gov.uk/government/publications/financial-sanctio...

They directly state as follows:

> An investigation by the NCA is very unlikely to be commenced into a ransomware victim, or those involved in the facilitation of the victim’s payment, who have proactively engaged with the relevant bodies as set out in the mitigating factors above

i.e you’re not even going to be investigated unless you try to cover things up.

This is a solved problem, big companies with big legal departments make large ransomware payments every day. Big incident response companies have teams of negotiators to work through the process of paying, and to get the best possible price.

◧◩◪◨
84. bostik+3p[view] [source] [discussion] 2025-11-13 12:46:34
>>global+Li
If you are dealing with financial services (and payment provider most certainly would), you will be forced to interface with infuriating vendor vetting and onboarding questionnaire processes. The kinds that would make Franz Kafka blush, and CIA take notice for their enhanced interrogation techniques.

The sheer amount of effectively useless bingo sheets with highly detailed business (and process) information boggles the mind.

Some time ago I alluded to existence and proliferation of these questionnaires in another context: https://bostik.iki.fi/aivoituksia/random/crowdstrike-outage-...

91. antony+8q[view] [source] 2025-11-13 12:52:53
>>Strang+(OP)
I don't think they meant OXCIS, that seems to be a centre for Islamic Studies https://en.wikipedia.org/wiki/Oxford_Centre_for_Islamic_Stud...

I can't quite work out who they donated to - it seems there are a number of Oxford Uni cybersec/infosec units. Any idea which one?

103. joshmn+6t[view] [source] 2025-11-13 13:11:12
>>Strang+(OP)
It’s notable that there were ShinyHunters members arrested by the FBI a few years ago. I was in prison with Sebastian Raoult, one of them. We talked quite a bit.

The level of persistence these guys went through to phish at scale is astounding—which is how they gained most of their access. They’d otherwise look up API endpoints on GitHub and see if there were any leaked keys (he wasn’t fond of GitHub's automated scanner).

https://www.justice.gov/usao-wdwa/pr/member-notorious-intern...

◧◩◪◨⬒
116. ceejay+Uy[view] [source] [discussion] 2025-11-13 13:48:20
>>miohta+tx
Meta once misconfigured the web servers and exposed the source. https://techcrunch.com/2007/08/11/facebook-source-code-leake...
◧◩◪◨⬒
118. sigmoi+nz[view] [source] [discussion] 2025-11-13 13:50:43
>>miohta+tx
The relevant difference here is that these companies have actual security standards on the level that you would only find in the FAA or similar organisations were lives are in danger. For every incident in Google cloud for example, they don't just apologise, but they state exactly what happened and how they responded (down to the minute) and you can read up exactly how they plan to prevent this from happening again: https://status.cloud.google.com/incidents/ow5i3PPK96RduMcb1S...

This is what incident handling by a trustworthy provider looks like.

◧◩◪◨⬒
120. dragon+Kz[view] [source] [discussion] 2025-11-13 13:53:23
>>miohta+tx
Google just got hacked in June:

https://cloud.google.com/blog/topics/threat-intelligence/voi...

https://www.forbes.com/sites/daveywinder/2025/08/09/google-c...

◧◩
127. saberi+WB[view] [source] [discussion] 2025-11-13 14:09:32
>>antony+8q
I guess it just means this: https://www.cybersecurity.ox.ac.uk/

"Cyber Security Oxford is a community of researchers and experts working under the umbrella of the University of Oxford’s Academic Centre of Excellence in Cyber Security Research (ACE-CSR)."

◧◩◪
132. antony+hE[view] [source] [discussion] 2025-11-13 14:20:23
>>saberi+WB
Probably, I'm not sure it's not https://gcscc.ox.ac.uk/

I don't think it's https://www.infosec.ox.ac.uk/

There's also this AI security research lab, https://lasr.plexal.com/

It looks like Oxford are quite busy in this space.

◧◩◪◨⬒
163. Thorre+q11[view] [source] [discussion] 2025-11-13 16:11:24
>>miohta+tx
Facebook was hacked in 2013. Attacker used a Java browser exploit to take over employees' computers:

https://www.reuters.com/article/technology/exclusive-apple-m...

Facebook was also hacked in 2018. A vulnerability in the website allowed attackers to steal the API keys for 50 million accounts:

>>18094823

◧◩◪◨⬒⬓
167. Thorre+R21[view] [source] [discussion] 2025-11-13 16:17:57
>>red-ir+6S
Do you have a source that the Google hack was related to David Petraeus? This page doesn't mention it[1]. Does the timeline line up? Google was hacked in 2009[2]. The Petraeus stuff seems to have happened later.

Disclosure: I work at Google but have no internal knowledge about whether Petraeus was related to Operation Aurora.

[1] https://en.wikipedia.org/wiki/Petraeus_scandal

[2] https://en.wikipedia.org/wiki/Operation_Aurora

◧◩◪◨⬒⬓
199. aetern+3V1[view] [source] [discussion] 2025-11-13 20:28:20
>>wholin+7R1
This is the closest I've seen (pretty new): https://github.com/WICG/email-verification-protocol
◧◩◪
243. wallet+fe3[view] [source] [discussion] 2025-11-14 08:50:05
>>yreg+ok
https://news.risky.biz/risky-bulletin-us-indicts-two-rogue-c...

US indicts two rogue cybersecurity employees for ransomware attacks

◧◩◪◨⬒
250. Sophir+4C3[view] [source] [discussion] 2025-11-14 13:38:16
>>theweb+BJ1
About 10 years ago, I got an email from Microsoft of all people(!) which to any reasonably security-trained person would look entirely like a phishing email:[0]

1. It said "Dear User" instead of a name/username;

2. It talked about how they were upgrading their forum software and as such would require me to re-login;

3. It gave me a link to click in the email without any stated alternative;

4. It warned me that if I didn't do this, I would no longer be able to access the forum;

5. The domain of the URL that the link went to was not microsoft.com, but a different domain that had "microsoft" in it.

It was a textbook example for how a phishing email would look, and yet it was actually a legitimate email from Microsoft!

I haven't had any others like it since, but that was an eye-opener for sure.

[0] https://reddit.com/r/facepalm/comments/32ou4z/microsoft_what...

[Edit: Fixed a detail I misremembered.]

[go to top]