Ransom-where? A new crowdsourced Bitcoin payment tracker spotlights attackers 

Jack Cable recently noticed a gap in the public’s understanding of ransomware: there was no publicly available database tracking ransomware payments.

“Knowing that Bitcoin is public and trackable, that kind of got me thinking whether anyone was doing this,” says Cable, a senior at Stanford University and security architect at the cybersecurity firm Krebs Stamos Group. When he saw that “no one really was,” he started building a platform called Ransomwhere.

Cable, who has also worked for the Cybersecurity and Infrastructure Security Agency and the Defense Digital Service for the U.S. government, released the new “open, crowdsourced, ransomware payment tracker” in July. 

Ransomwhere currently features a website with a form for submitting Bitcoin addresses that are known to have been used by ransomware attackers. The form also asks for a record of the amount that was demanded in the attack and the ransomware family (if known), and prompts the contributor to upload the ransom note or a screenshot of the payment page as proof that the attack was real.  

Visitors to Ransomwhere’s website can also view statistics including the total tracked ransomware payments within the last year (more than $92 million) and how much certain known groups have earned from ransomware payments.

Most of the information on the site is crowdsourced, but Cable said some of the data, particularly on the NetWalker ransomware, came from McAfee Labs. According to the website, the data “is made freely available to interested individuals and organizations.” Anyone who wants to download the data, however, must first submit an application. 

Retrospective ransomware data: what is it good for?

Policymakers and law enforcement officials are eager to deter and stop ransomware attacks, which have been growing in scale and impact. But how does tracking payments help? Doesn't the fact that these payments took place mean the attack already worked? 

It's not just about prevention. Publicly available ransomware tracking data can help responders in ransomware negotiations, says Matt Durrin, the senior security consultant at the Montana-based cybersecurity firm LMG Security. 

Ransomware responders need to know key details about their adversary, Durrin says, such as their average ransom payment request, whether the adversary returns data after reaching an agreement, and if the adversary returns additional extortions. 

If the data on Ransomwhere is accurate, is updated consistently, and maintains a high sample size, then Durrin sees it as “being very beneficial” and would “love to add it to our threat research tools.”

Says Cable: “I think there's a recognition among the community and companies that this problem is only going to get better if we have further data sharing and collaboration, so I'd say it was a good thing that people want to collaborate to make this area better." 

He acknowledges that crowdsourcing ransomware payment information isn’t perfect, as it opens the door to spammers and malicious entities putting bad data into the Ransomwhere system. He says he’s planning on adding features such as flagging suspicious ransomware reports and a voting system so that the ransomware report verification process can be crowdsourced to ameliorate that risk. 

Another issue is that any ransomware tracking tool will likely be incomplete because victims are often reluctant to disclose that they’ve been attacked, and there’s no real pressure or incentive for this kind of disclosure, says Elias Bou-Harb, a cybersecurity researcher at the University of Texas at San Antonio.

Cable says that despite its shortcomings, crowdsourced ransomware payment tracking allows ransomware data to flow beyond the information silos inside companies and laboratories.  

David O’Brien, an assistant research director for privacy and security at Harvard University’s Berkman Klein Center, agrees. “I have seen a variety of estimates about the size of ransomware payouts based on tracking of known bitcoin addresses, but that's based on privately collected data and analysis,” said O’Brien “I see a different value in having a public tool of this kind.”

An initiative from the U.S. Department of Justice and other federal agencies have attempted to address the national ransomware problem with StopRansomware.gov, a site compiling federal ransomware information and a place to report ransomware attacks to the FBI. However, it’s unclear when such information will be available to the public.

Besides ransomware negotiations, crowdsourced ransomware payment data can help augment public understanding of the ransomware ecosystem.

For instance, the frequency at which ransomware attacks occur, the types of demands made, and how often they’re paid out is not well known in the United States, says O’Brien. Such information has remained unreported or, if reported, contained within cyber forensic firms or other private companies.

While it seems that the information on Ransomwhere is primarily based in the U.S., it can be used to compare and contrast ransomware activity occurring in other countries to provide a clearer picture of the global ransomware problem, says Bou-Harb. 

If ransomware is big enough in the U.S., companies may be able to justify a bigger budget for cyber defense, says O’Brien. And with enough information gathered over time, people can follow trend lines to see if ransomware is getting worse or not, which could urge various legislative or law enforcement efforts. 

“My hunch is that in the future we will probably see legislation that requires similar types of reporting, either at the federal or state level,” O’Brien says. “So it's also great to sort out the kinks now with a voluntary database.”