In February of 2015, the south suburban Chicago police department of Midlothian, Illinois was faced with a difficult and embarrassing problem. One of the departments computers had become infected with a form of ransomware that encrypted the files on the computer’s hard drive. The hacker responsible demanded that the department pay $500 to obtain an encryption key to unlock and restore the computer’s files.
As reported by local media outlets, the department ultimately decided to pay the ransom amount and, according to instruction from the hacker, the virtual currency “Bitcoin” was used to facilitate the transfer of funds.
This particular police department is by no means alone in becoming a victim of hackers using cryptoware and/or ransomware, attacks of this nature have been ongoing and increasing since at least 1989, when the first such attack was reported. The fact that this most recent incident involved a law enforcement computer merely hints at the degree of boldness hackers have developed in this growing and profitable black hat activity. It also highlights two very big concerns that law enforcement and I.T. security professionals confront today in the rapidly developing world of cybercrime.
In this latest development, actors armed themselves with two formidable weapons. First was the use of an encryption code possessing embedded self-destruct capabilities. If a victim attempted to bypass or break the encryption, the virus would wipe the hard drive of the infected computer, destroying the files it contained. The second weapon used was virtual currency specifically designed to provide anonymity to users and, inadvertently, to thwart investigators attempting to identify the virtual extortionists and recover any ransom money paid.
The origins of virtual currency, or “cryptocurrency,” can be traced back at least two decades. Originally developed for gameplay, the sheer number of users involved in some online games led to out-of-game trading in the currency. Some gamers, not interested in having to work long to acquire virtual points in the form of play currency, offered to buy currency reserves from top players using real money. The idea that players could make money from the gameplay they enjoyed increased offsite trading of currency and played a significant role in development of independent virtual currencies that would facilitate trades with people from all over the world.
Gold & Silver Reserve, Inc. a company operating out of Melbourne, Florida launched one of the first independent virtual currencies in 1996. Funded by an oncologist and attorney who placed gold coins in a safe deposit box and backed the virtual currency with their value, the founders dubbed the new currency “E-gold” and allowed users to open accounts through their website and exchange currency for grams of gold and other precious metals, the value of which they could then instantly transfer to other accounts. By 2009, five million accounts were operating through E-gold and processing over US$2 billion a year in transfers.
It didn’t take long before nefarious characters recognized an opportunity to launder money through cryptocurrency trading, and in 2009, the U.S. government shut down E-gold, along with competitors who had opened other currency-trading sites. By that time however, users of the Internet who had participated in e-currency transfers were convinced of the need for some form of universally recognized virtual currency that would accelerate the growth of commerce on the Internet.
During this period, U.S. Internet-targeted legislation and law enforcement activity such as banning online gambling and crackdowns on certain P2P (Peer-To-Peer) file-sharing sites dampened development by Web entrepreneurs as venture capitalists became reluctant to invest in technology that could, for one reason or another, run afoul of government. Despite such reluctance, virtual currency used within the Internet gaming industry continued to rapidly grow, with values being assigned to some that could not escape notice. The fact that such currency was not backed by anything other than the perception and acceptance of value placed upon it by users was seemingly inconsequential. The value of the currency rose and fell in relation to the popularity of a particular game. Trading in such currencies was principally conducted on P2P sites which carried a significant degree of risk into each deal.
In 2008 Satoshi Nakamoto published his invention for a new type of payment system he called “Bitcoin.” One year later he released his invention as open-source software, effectively giving title of what some believe is the first “true” cryptocurrency to the entire world. While in the ensuing years, Nakamoto’s invention has brought both good and bad to the cyberworld, giving the individual applause or condemnation has proven as elusive as is tracing Bitcoin transactions themselves — Satoshi Nakamoto actually remains unidentified. Many online sleuths and journalists have spent considerable time trying to identify the individual or group who created Bitcoin and chose to hide behind the Japanese-sounding pseudonym. The best that we truly know about Nakamoto is that he, she or the group is highly intelligent and is either very wealthy or extremely determined to maintain anonymity: As of June, 2015, the value in Bitcoin contained in just the known wallets registered to and yet unclaimed by Satoshi Nakamoto was in excess of US$250 million.