The PayPal-owned Venmo service will let users buy, sell, and hold bitcoin and other cryptocurrencies within the Venmo app, the company announced today. “Customers will have the ability to buy and sell cryptocurrency using funds from their balance with Venmo, or a linked bank account or debit card,” the announcement said.
Users will be able to buy or sell bitcoin, ether, litecoin, and bitcoin cash. The feature is rolling out to some users today and “will be available for all customers directly in the Venmo app within the next few weeks.”
When it becomes available, users can get started “by clicking on ‘Crypto’ in the Venmo menu at the top right in the app,” the announcement said. Crypto purchases can be made for as little as $1, but each purchase has a minimum fee of 50¢. Each user is limited to $20,000 in cryptocurrency purchases each week and $50,000 during each 12-month period.
The Venmo announcement did not say anything about paying for goods or services with cryptocurrency, but that ability could come to Venmo later. As CoinDesk wrote today, “PayPal opened trading on select cryptocurrencies to US customers last November and began allowing users to pay with crypto in March.” PayPal says that when users pay with cryptocurrency on PayPal, the service “automatically convert[s] it into USD or other currency at no additional fee.”
No peer-to-peer crypto transactions
At least for now, Venmo does not support peer-to-peer crypto trades or the ability to transfer cryptocurrency from one account to another. “Venmo only supports the purchase and sale of cryptocurrency using your Venmo account,” a Venmo FAQ says. “To complete P2P transactions with Venmo, all crypto assets held with Venmo must be sold and thus converted into USD.”
The ability to hold cryptocurrency in one’s Venmo account only applies to cryptocurrency purchased on Venmo, meaning you can’t transfer bitcoins or other cryptocurrency from other sources into Venmo.
The PayPal and Venmo crypto systems use the Paxos crypto brokerage service. “PayPal was also granted a first-of-its-kind conditional BitLicense by the New York State Department of Financial Services (NYDFS), allowing PayPal and Venmo to offer its customers the ability to buy, sell, and hold cryptocurrency,” PayPal said.
Like PayPal, Venmo is enabling cryptocurrency purchases and sales throughout most of the US but not Hawaii, where the market has some regulatory restrictions. Venmo notes that “buying, selling, and holding cryptocurrencies is not regulated in many states, including the State of California.”
Crypto traders must verify identity
Venmo is not supporting cryptocurrency transactions for business profiles, limiting the ability to individual users. While anonymity is often seen as a key benefit of using cryptocurrency, Venmo notes that its crypto service is only available to US customers “who have verified their identity with Venmo.”
Venmo also pointed out that trading cryptocurrency “may result in significant losses.”
“Venmo will not cover losses from cryptocurrency price fluctuations and we recommend that customers make sure purchasing crypto is right for their individual financial situations,” the Venmo FAQ said. “Since crypto purchases and sales aren’t reversible, Venmo urges customers to do their research and make decisions carefully.” Venmo does promise that “cryptocurrency purchases are protected in the event unauthorized activity takes place.”
Venmo says its fees on crypto transactions generally range from 1.5 percent to 2.3 percent; fees are 1.5 percent on purchases or sales above $1,000; 1.8 percent on transactions between $200.01 and $1,000; 2.0 percent on transactions between $100.01 and $200; and 2.3 percent on transactions between $25 and $100. A 50¢ minimum fee is applied to transactions between $1 and $24.99.
Nearly a week after a ransomware attack led Colonial Pipeline to halt fuel distribution on the East Coast, reports emerged on Friday that the company paid a 75 bitcoin ransom—worth as much as $5 million, depending on the time of payment—in an attempt to restore service more quickly. And while the company was able to restart operations Wednesday night, the decision to give in to hackers’ demands will only embolden other groups going forward. Real progress against the ransomware epidemic, experts say, will require more companies to say no.
Not to say that doing so is easy. The FBI and other law enforcement groups have long discouraged ransomware victims from paying digital extortion fees, but in practice many organizations resort to paying. They either don’t have the backups and other infrastructure necessary to recover otherwise, can’t or don’t want to take the time to recover on their own, or decide that it’s cheaper to just quietly pay the ransom and move on. Ransomware groups increasingly vet their victims’ financials before springing their traps, allowing them to set the highest possible price that their victims can still potentially afford.
In the case of Colonial Pipeline, the DarkSide ransomware group attacked the company’s business network rather than the more sensitive operational technology networks that control the pipeline. But Colonial took down its OT network as well in an attempt to contain the damage, increasing the pressure to resolve the issue and resume the flow of fuel along the East Coast. Another potential factor in the decision, first reported by Zero Day, was that the company’s billing system had been infected with ransomware, so it had no way to track fuel distribution and bill customers.
Advocates of zero tolerance for ransom payments hoped that Colonial Pipeline’s proactive shutdown was a sign that the company would refuse to pay. Reports on Wednesday indicated that the company had a plan to hold out, but numerous subsequent reports on Thursday, led by Bloomberg, confirmed that the 75 bitcoin ransom had been paid. Colonial Pipeline did not return a request for comment from WIRED about the payment. It is still unclear whether the company paid the ransom soon after the attack or days later, as fuel prices rose and lines at gas stations grew.
“I can’t say I’m surprised, but it’s certainly disappointing,” says Brett Callow, a threat analyst at antivirus company Emsisoft. “Unfortunately, it’ll help keep United States critical infrastructure providers in the crosshairs. If a sector proves to be profitable, they’ll keep on hitting it.”
In a briefing on Thursday, White House press secretary Jen Pskai emphasized in general that the US government encourages victims not to pay. Others in the administration struck a more measured note. “Colonial is a private company and we’ll defer information regarding their decision on paying a ransom to them,” said Anne Neuberger, deputy national security adviser for cyber and emerging technologies, in a press briefing on Monday. She added that ransomware victims “face a very difficult situation and they [often] have to just balance the cost-benefit when they have no choice with regards to paying a ransom.”
Researchers and policymakers have struggled to produce comprehensive guidance about ransom payments. If every victim in the world suddenly stopped paying ransoms and held firm, the attacks would quickly stop, because there would be no incentive for criminals to continue. But coordinating a mandatory boycott seems impractical, researchers say, and likely would result in more payments happening in secret. When the ransomware gang Evil Corp attacked Garmin last summer, the company paid the ransom through an intermediary. It’s not unusual for large companies to use a middleman for payment, but Garmin’s situation was particularly noteworthy because Evil Corp had been sanctioned by the US government.
“For some organizations, their business could be completely destroyed if they don’t pay the ransom,” says Katie Nickels, director of intelligence at the security firm Red Canary. “If payments aren’t allowed you’ll just see people being quieter about making the payments.”
Prolonged shutdowns of hospitals, critical infrastructure, and municipal services also threaten more than just finances. When lives are literally at stake, a principled stand against hackers quickly drops off of the priorities list. Nickels herself recently participated in a public-private effort to establish comprehensive United States–based ransomware recommendations; the group could not agree on definitive guidance about if and when to pay.
“The Ransomware Task Force discussed this extensively,” she says. “There were a lot of important things that the group came to a consensus on and payment was one where there was no consensus.”
As part of a cybersecurity Executive Order signed by President Joseph Biden on Wednesday, the Department of Homeland Security will create a Cyber Safety Review Board to investigate and debrief “significant” cyberattacks. That could at least help more payments be made in the open, giving the general public a fuller sense of the scale of the ransomware problem. But while the board has incentives to entice private organizations to participate, it may still need expanded authority from Congress to demand total transparency. Meanwhile, the payments will continue, and so will the attacks.
“You shouldn’t pay, but if you don’t have a choice and you’ll be out of business forever, you’re gonna pay,” says Adam Meyers, vice president of intelligence at the security firm CrowdStrike. “In my mind, the only thing that’s going to really drive change is organizations not getting got in the first place. When the money disappears, these guys will find some other way to make money. And then we’ll have to deal with that.”
For now, though, ransomware remains an inveterate threat. And Colonial Pipeline’s $5 million payment will only egg on cybercriminals.
Join Transform 2021 this July 12-16. Register for the AI event of the year.
Even as enterprise leaders tout the importance of data, 36% of business leaders don’t rely on it for making critical decisions, according to a survey by Talend, an open source data integration platform. The same survey found that 78% of business executives face challenges effectively working with data to make decisions.
Above: 40% of business leaders still rely on gut decisions, not data.
Image Credit: Talend
Our relationship with data is not healthy. Talend’s survey found only 40% of executives always trust the data they work with. For decades, managing and using data for analysis was focused on the mechanics: the collecting, cleaning, storing, and cataloging of as much data as possible, then figuring out how to use it later. Companies don’t know what data they have, where it is, or who is using it, and, critically, no way to measure their data health.
Data health is Talend’s vision of a comprehensive system for ensuring the well-being and return of corporate information. Data health offers proactive treatments, quantifiable measures, and preventive steps to identify and correct issues, ensuring that corporate data is clean, complete, and uncompromised.
Data health is a complex journey of unique requirements, regulations, and risk tolerance. It will take substantial market collaboration and research to align on appropriate standards for different companies. Eventually, data health solutions will help create a universal set of metrics to evaluate the health of corporate data and establish it as an essential indicator of the strength of a business. Talend’s initial framework imagines four primary focus areas to establish data health: reliability, visibility, understanding and value. We believe that data health will become a key, if not the most important, performance framework used within and across organizations to monitor and evaluate the health of the company. With this new data health first approach, and new standards, leaders can level the employee playing field and drive a data-charged cultural change.
From March 24th to April 8th, 2021, Talend led a survey via Qualtrics among a base of 529 independent respondents worldwide. (57% North America, 26% Asia-Pacific, 17% Europe). The respondents are all executives — with titles ranging from director to the C-suite — from medium and large companies making more than $10 million in annual revenue.
Read Talend’s full report Data Health Survey.
VentureBeat’s mission is to be a digital town square for technical decision-makers to gain knowledge about transformative technology and transact.
Our site delivers essential information on data technologies and strategies to guide you as you lead your organizations. We invite you to become a member of our community, to access:
up-to-date information on the subjects of interest to you
gated thought-leader content and discounted access to our prized events, such as Transform 2021: Learn More
Darkside—the ransomware group that disrupted gasoline distribution across a wide swath of the US this week—has gone dark, leaving it unclear if the group is ceasing, suspending, or altering its operations or is simply orchestrating an exit scam.
On Thursday, all eight of the dark web sites Darkside used to communicate with the public went down, and they remain down as of publication time. Overnight, a post attributed to Darkside claimed, without providing any evidence, that the group’s website and content distribution infrastructure had been seized by law enforcement, along with the cryptocurrency it had received from victims.
The dog ate our funds
“At the moment, these servers cannot be accessed via SSH, and the hosting panels have been blocked,” the post stated, according to a translation of the Russian-language post published Friday by security firm Intel471. “The hosting support service doesn’t provide any information except ‘at the request of law enforcement authorities.’ In addition, a couple of hours after the seizure, funds from the payment server (belonging to us and our clients) were withdrawn to an unknown account.”
The post went on to claim that Darkside would distribute a decryptor free of charge to all victims who have yet to pay a ransom. So far, there are no reports of the group delivering on that promise.
If true, the seizures would represent a big coup for law enforcement. According to newly released figures from cryptocurrency tracking firm Chainalysis, Darkside netted at least $60 million in its first seven months, with $46 million of it coming in the first three months of this year.
Identifying a Tor hidden service would also be a huge score, since it likely would mean that either the group made a major configuration error in setting the service up or law enforcement knows of a serious vulnerability in the way the dark web works. (Intel471 analysts say that some of Darkside’s infrastructure is public-facing—meaning the regular Internet—so malware can connect to it.)
But so far, there’s no evidence to publicly corroborate these extraordinary claims. Typically, when law enforcement from the US and Western European countries seize a website, they post a notice on the site’s front page that discloses the seizure. Below is an example of what people saw after trying to visit the site for the Netwalker group after the site was taken down:
So far, none of the Darkside sites display such a notice. Instead, most of them time out or show blank screens.
What’s even more doubtful is the claim that the group’s considerable cryptocurrency holdings have been taken. People who are experienced in using digital currency know not to store it in “hot wallets,” which are digital vaults connected to the Internet. Because hot wallets contain the private keys needed to transfer funds to new accounts, they’re vulnerable to hacks and the types of seizures claimed in the post.
For law enforcement to confiscate the digital currency, Darkside operators likely would have had to store it in a hot wallet, and the currency exchange used by Darkside would have had to cooperate with the law enforcement agency or been hacked.
I very much doubt that a ransomware group keeps its profits in a hot wallet on a cryptocurrency exchange that would cooperate with the law enforcement. They go to shady exchanges only when they need to launder the money. Even then, blocking would be more believable than transfer.
It’s also feasible that close tracking by an organization like Chainalysis identified wallets that received funds from Darkside, and law enforcement subsequently confiscated the holdings. Indeed, Elliptic, a separate blockchain analytics company, reported finding a Bitcoin wallet used by DarkSide to receive payments from its victims. On Thursday, Elliptic reported, it was emptied of $5 million.
At the moment, it’s not known if that transfer was initiated by the FBI or another law enforcement group, or by Darkside itself. Either way, Elliptic said the wallet—which since early March had received 57 payments from 21 different wallets—provided important clues for investigators to follow.
“What we find is that 18% of the Bitcoin was sent to a small group of exchanges,” Elliptic Co-founder and Chief Scientist Tom Robinson wrote. “This information will provide law enforcement with critical leads to identify the perpetrators of these attacks.”
Nonsense, hype, and noise
Darkside’s post came as a prominent criminal underground forum called XSS announced that it was banning all ransomware activities, a major about-face from the past. The site was previously a significant resource for the ransomware groups REvil, Babuk, Darkside, LockBit, and Nefilim to recruit affiliates, who use the malware to infect victims and in exchange share a cut of the revenue generated. A few hours later, all Darkside posts made to XSS had come down.
In a Friday morning post, security firm Flashpoint wrote:
According to the administrator of XSS, the decision is partially based on ideological differences between the forum and ransomware operators. Furthermore, the media attention from high-profile incidents has resulted in a “critical mass of nonsense, hype, and noise.” The XSS statement offers some reasons for its decision, particularly that ransomware collectives and their accompanying attacks are generating “too much PR” and heightening the geopolitical and law enforcement risks to a “hazard[ous] level.”
The admin of XSS also claimed that when “Peskov [the Press Secretary for the President of Russia, Vladimir Putin] is forced to make excuses in front of our overseas ‘friends’—this is a bit too much.” They hyperlinked an article on the Russian News website Kommersant entitled “Russia has nothing to do with hacking attacks on a pipeline in the United States” as the basis for these claims.
Within hours, two other underground forums—Exploit and Raid Forums—had also banned ransomware-related posts, according to images circulating on Twitter.
REvil, meanwhile, said it was banning the use of its software against health care, educational, and governmental organizations, The Record reported.
Ransomware at a crossroads
The moves by XSS and REvil pose a major short-term disruption of the ransomware ecosystem since they remove a key recruiting tool and source of revenue. Long-term effects are less clear.
“In the long run, it’s hard to believe the ransomware ecosystem will completely fade out, given that operators are financially motivated and the schemes employed have been effective,” Intel471 analysts said in an email. They said it was more likely that ransomware groups will “go private,” meaning they will no longer publicly recruit affiliates on public forums, or will unwind their current operations and rebrand under a new name.
Ransomware groups could also alter their current practice of encrypting data so it’s unusable by the victim while also downloading the data and threatening to make it public. This double-extortion method aims to increase the pressure on victims to pay. The Babuk ransomware group recently started phasing out its use of malware that encrypts data while maintaining its blog that names and shames victims and publishes their data.
“This approach allows the ransomware operators to reap the benefits of a blackmail extortion event without having to deal with the public fallout of disrupting the business continuity of a hospital or critical infrastructure,” the Intel471 analysts wrote in the email.
For now, the only evidence that Darkside’s infrastructure and cryptocurrency have been seized is the words of admitted criminals, hardly enough to consider confirmation.
“I could be wrong, but I suspect this is simply an exit scam,” Brett Callow, a threat analyst with security firm Emsisoft told Ars. “Darkside get to sail off into the sunset—or, more likely rebrand—without needing to share the ill-gotten gains with their partners in crime.”