The surprising relationship between Bitcoin and ransomware is explored at the White House summit

Bitcoin has brought many advantages: accessibility, liquidity, anonymity, independence from central authority, high return potential.

All of which are a boon to cybercriminals, especially those who work across national borders.

“As Bitcoin became more widely used, we saw a huge jump in ransomware as it was the way to move money across borders,” said a spokesperson identified only as a senior government official at a press conference ahead of an international cybersecurity summit in Washington. week.

“It is a borderless threat and we have to deal with it in a limitless way,” the official said. Especially when it comes to illicit use of crypto, “the threat has clearly evolved.”

To coordinate and strengthen partnerships and more effectively counter ransomware threats to critical infrastructure, the Biden administration this week brought together leaders from 36 countries and the European Union.

“As we know, ransomware is a problem that knows no borders, affecting every one of the countries of the Counter Ransomware Initiative — our businesses, our critical infrastructure and our citizens — and it’s only getting more challenging,” the senior government official said. White House.

Share progress, invite private sector

The White House launched the Counter Ransomware Initiative (CRI) last year at a virtual global summit to “gather allies and partners to counter the shared threat of ransomware,” the senior government official said. The initiative has five working groups.

With this year’s event, the aim was to get together to discuss what these working groups have achieved throughout the year.

CRI partners focused on the five themes of the working groups and also heard from US government leaders, including FBI Director Chris Wray; Deputy Treasury Secretary Wally Adeyemo on Countering Illegal Use of Cryptocurrency; Deputy Secretary of State Wendy Sherman; and National Security Advisor Jake Sullivan.

Officials received a detailed threat briefing from ODNI, FBI and CISA. This included a chart showing 4,000 cyber-attacks over the past 18 months outside the US

The summit also invited 13 private sector companies from around the world. Those companies focused on three questions:

• What should governments do?
• What should the private sector do?
• What can they do together?

“This is just a first round of getting the perspectives from companies to make sure we don’t do this in the traditional government way, which is only government to government,” the senior government official said. “We are pulling into the private sector for their unique visibility, capabilities and insights into it.

How organizations can protect themselves until there is a solution

Business leaders who attended the summit praised collective governments in tackling the problem, while also emphasizing the importance of organizations proactively protecting themselves.

“Ransomware has become a serious problem on a global scale, so it’s no surprise that so many countries continue to work together to address the threat,” said Erich Kron, security awareness advocate at KnowBe4.

With ransomware gangs targeting sectors such as hospitals, which can lead to loss of life, “the urgency to find a solution to the problem is only growing,” he said.

Until there is one, he said, organizations should focus on educating employees to quickly and accurately identify and report phishing attacks and to secure remote access portals with multi-factor authentication (MFA). They also need to ensure that software vulnerabilities are patched and networks are segmented, while implementing robust Data Loss Prevention (DLP) checks.

Also, increasing numbers of zero-day attacks and common vulnerabilities and exposures (CVEs) should be at the forefront, said Jeff Williams, co-founder and CTO at Contrast protection.

As he explained, ransomware is usually the result of a malicious actor exploiting known CVEs. As such, entire classes of vulnerabilities must be eliminated by improving software defenses and using technologies such as runtime application self-protection (RASP).

“In addition, we need to push the industry back as it tries to obscure view of weak security practices and technologies with claims that it compromises intellectual property (it won’t) or makes it easier for attackers (it doesn’t),” Willems said.

Strong public-private partnerships are important for cybersecurity transparency, he said, particularly in software development and supply chain processes.

“We need a lot more insight into how the software we trust is secured with the most important things in our lives,” Williams says.

As he pointed out, there’s very little an attacker can’t do after a successful breach: steal and sell data, interrupt service, damage records, and more.

“We need to better prevent attackers from taking control of our digital infrastructure,” Williams said.

National actors must be stopped – and punished

Other business leaders underlined the importance of addressing and preventing nation-state actors, such as Russian-speaking cartels with a Pax Mafiosa with the Russian regime.

“They not only offset economic sanctions, but act as cyber militias against Western targets in times of geopolitical tensions,” said Tom Kellermann, CISM and SVP of cyber strategy at Contrast protection.

Forfeiture laws need to be expanded to allow for larger seizures of assets owned by cybercriminals, including Bitcoin and other cryptocurrencies, said Kellermann, who also served on the Commission on Cybersecurity for President Barack Obama’s administration.

And any exchange that does not embrace the Financial Action Task Force (FATF) tenants and is “openly involved” in laundering the proceeds of cybercrime must be shut down through cyber means, he said. Their assets must be seized and used to protect critical infrastructure.

Finally, insurers should be banned from making ransomware payments because they violate sanctions imposed on Russia and North Korea, Kellermann said.

Duplication of work, systematization of information sharing

Progress has been made worldwide in the past year, the senior government official said.

Notably, the CRI’s Resilience Working Group conducted two threat exercises in 2021 to ensure that CRI members, regardless of time zone, could participate and learn from each other in implementing best practices to counter an attack.

The official also recognized India and Lithuania for resilience, Australia for disruption. Singapore and the UK for virtual currencies, Spain for public-private partnerships and Germany for diplomacy.

Meanwhile, the Treasury has organized workshops to help countries track down illegal uses of Bitcoin and other cryptocurrencies. The Treasury also leads the FATF, which aims to introduce “Know Your Customer” rules for cryptocurrency exchanges and the various parts of the crypto infrastructure.

CRI is building a new information-sharing platform for each country to ask if others have seen certain ransomware attacks. Countries can then share information about what they learned and how they countered the attack, the official explained.

“We really want to double down on our work, deepen the partnership – as it’s a borderless problem, so basically no country can handle it alone – and come up with ways to systematize information sharing,” the official said.