6 ms·

FBI’s Advice on Ransomware? Just Pay the Ransom

72 points by rubikscube 11y ago

deleted 11y ago
[deleted]
devit 11y ago
Looks like free enterprise has introduced a tax on people who fail to secure their systems against untargeted attacks and fail to make backups. One also wonders what's the point of all NSA's "SIGINT" efforts if they can't or won't use it to catch such usually foreign actors, so maybe they also introduced an argument against mass surveillance.
- benevol 11y ago
  Just like the Brits could have used the cracked Enigma code to stop each and every German operation during the War, they refrained from doing so and used it only for very specific situations (in order to avoid their cover being blown). Expect the same behavior from the NSA. They will use their power first and foremost whenever it benefits themselves, not to protect all citizens or corporations.
  - spacehome 11y ago
    Um, what? The Brits acted sparingly using the cracked Enigma code precisely because they were trying to protect as many citizens as they could -- if they acted every time, the Germans would have figured out the code was compromised and switched to a stronger code.
  - adrusi 11y ago
    Except now everyone knows a lot about the capabilities of the NSA, and every serious criminal is already using the strongest encryption available and doesn't have any course of action for when the NSA is onto them. It would be like if the British "blew their cover" and the Germans could only respond by completely ceasing all encrypted communication. Not the best possible outcome if they do, but still a positive outcome. It's an even better outcome for cybercrime, since ceasing all communications would mean ceasing everything. If the NSA did this, the criminal would probably just stop operating, which means they might not be brought to justice, but at least the attacks would stop.
  - hwstar 11y ago
    American government agencies put one thing above all else: Self preservation. If a duty to society involves risk which could make them be seen in a bad light, they will avoid it, or try to state it isn't their problem.
- jrochkind1 11y ago
  Heck, with the NSA's budget, maybe they should be working on developing 'cures' for it.
- deleted 11y ago
  [deleted]
- pdkl95 11y ago
  The NSA isn't interested in defensive work these days. As Dan Geer explained[1]: I suggest that the cybersecurity tool-set favors offense these days. Chris Inglis, recently retired NSA Deputy Director, remarked that if we were to score cyber the way we score soccer, the tally would be 462-456 twenty minutes into the game, i.e., all offense. I will take his comment as confirming at the highest level not only the dual use nature of cybersecurity but also confirming that offense is where the innovations that only States can afford is going on. This is a serious problem, not only from the problems intelligence angies with many powers and poor oversight; ignoring defense is going to bite a lot of people in bad ways. We are already seeing the beginnings of this with the escalating impact computer-based attacks are having on their victims. I also recommend considering Jacob Appelbaum's response to this question[2] from the audience - from someone currently working for the NSA. The summary is that we need people doing NSA-style work, but on the defense side, and we need it now. If the NSA isn't doing that, then maybe people that want to actually protect their country should find somewhere else to work that is actually working on defense. [1] https://www.youtube.com/watch?v=nT-TGvYOBpI#t=478 https://www.youtube.com/watch?v=nT-TGvYOBpI#t=478 [2] https://www.youtube.com/watch?v=n9Xw3z-8oP4#t=4027 https://www.youtube.com/watch?v=n9Xw3z-8oP4#t=4027
  - vermontdevil 11y ago
    Exactly my thoughts. NSA was supposed to provide measures to protect the network of the government. But see the OPM's breach as one example. Seems NSA is obsessed with penetrating everywhere using 'terrorism' as a means to ensure continued funding. Thus the 'defense' nature is quite boring and sadly ignored.
  - newjersey 11y ago
    I assume part of the problem is that it is hard to quantify successes or wins in defense. What is a good way to protect against ransomware? Symantec buries the lede with the answers (possibly because of conflicting business interests) which are 1. Limit end user access to mapped drives 2. Deploy and maintain a comprehensive backup solution http://www.symantec.com/connect/blogs/ransomware-dos-and-donts-protecting-critical-data http://www.symantec.com/connect/blogs/ransomware-dos-and-don... But really, how do we justify spending thousands of dollars on hardware? I hate myself for saying this but there are real risks of doing too much as well. We could have our own mini tyrannical regime of secure computing a la the TSA security theater. Effective user education is challenging. Even developers are prone to use elevated user permissions where none is strictly required just for the sake of convenience. I know I've found myself right-clicking visual studio and clicking "Run as administrator" reflexively after just a few months of working on ASP.NET and IIS. This is a little off-topic but I imagine the whole funding offense vs defense might be a little more "natural" than we like to admit. Imagine you're a defense manager and there's this other guy who is an offense manager. Just as a football analogy, how do you justify your team's worth when the other team says that there is no good way to quantify the worth of the work you're doing and there is a good way to quantify their team's work? I guess what I'm asking is how do we put a dollar and cent value to defensive cyber security? Can we just ask "How much does the business stand to lose if we lost all our data to ransom ware or worse to a competitor?" or would business think that is overreaching?
- logicallee 11y ago
  This is precisely exactly like saying that if in xyzland rape with impunity becomes rampant, "Looks like free enterprise has just introduced a rape tax on not having brothers." To be blunt, if you think like this and make legal arguments like this, you don't understand western civilization and should go and think for a while about all of society. Unless of course you're kidding and being cynical. It's 2015: computing is part of society, and computing free from attacks is little different from walking about in public unharmed. It takes massive contortions of perception to feel otherwise. Everyone is online! (Just as everyone goes out now and then.) Ransomware is almost literally still just ransom.
- dpierce9 11y ago
  Free enterprise? This is an embarrassing extension of the idea of enterprise (Since when can enterprises tax anyhow?). This is racketeering 101 plain and simple. I will burn your business down unless you pay me to protect your business. It is a new application of a very old concept. Can you imagine the FBI saying, just pay the mafia?
- jhayward 11y ago
  I believe free enterprise requires that all parties to a transaction be free to participate, or decline, according to their own judgement and resources. Clearly absconding with and holding another's property for ransom is not free enterprise. I hesitate to say something so pedantic, but with the number of people who attribute crazy properties to the concept of "free markets", etc. I think we should just be clear on this one.
- devonkim 11y ago
  The government is already accused of being in bed with commerce all the time ala fascism comparisons, NSA helping companies directly like this could be viewed as favoritism for big companies and politically dangerous. Also, NSA's offensive mission is historically to attack nation-states aligned to the federal government's needs rather than to attack commercially motivated hackers. This is blurring with national security issues like espionage and economic terrorism coming into play, but this again raises the question of where the dividing line between helping private enterprise with tax dollars should go compared to doing something for everyone's benefit. There is also a defensive side to NSA's mission that is defense-oriented (IAD), but the most recognizable contributions that most of the HN crowd may be familiar with are SELinux and perhaps a modest body of research involving how to secure your systems (the defense side is much more open than the offensive side). The problems I see there is that these measures are all very much aimed at large corporations, not start-ups (seriously, I can count the number of start-ups outside the intelligence / DoD space I've ever heard of that use SELinux or follow NSA hardening guidelines on two fingers) and there is clearly a huge gap between how much big businesses take security seriously compared to start-ups from both a cultural and business driven set of motivations. The number of start-ups derailed / completely wiped out by extortion attempts is rather small compared to the number that actually exist but the legions of security consulting companies around the DC beltway wants everyone to think that it's really terrible and that everyone's a target. The truth is that everyone needs to be secure "enough" to not be as vulnerable as the really stupid guys and that while it might sting a lot to be down for a few hours or so and lose revenue / trust from users, diverting your company's resources towards hardening so much is quite costly for smaller companies and it's just more practical to have really fast re-provisioning set as a priority for your devops / ops engineers (most start-ups can do this far better than larger companies).
pdkl95 11y ago
And that is called paying the Dane-geld; But we've proved it again and again, That if once you have paid him the Dane-geld You never get rid of the Dane. http://www.poetryloverspage.com/poets/kipling/dane_geld.html http://www.poetryloverspage.com/poets/kipling/dane_geld.html Paying ransom merely teaches the criminal that you're an easy mark that they should demand more ransom from in the future.
- icebraining 11y ago
  But are the criminals in this case targeting specific individuals? You can't teach them you're a good target if they're just firing at random anyway.
  - cbd1984 11y ago
    Even firing at random is a better strategy in a target-rich environment compared to an environment where your targets either don't pay out or attempt to fight back.
  - tobltobs 11y ago
    As soon as you pay you will be a specific target for the future.
  - mannykannot 11y ago
    The 'you' in this case is all of us, collectively. Unfortunately, for the individual victim, paying is usually the best of a set of bad options, even though it is not the best one for us, collectively.
    - iamsohungry 11y ago
      > Unfortunately, for the individual victim, paying is usually the best of a set of bad options Is it? From the perspective of the hacker, the hacker's best move is to take the money and simply demand more. There's zero incentive for the hacker to return the victim's data. This becomes a probablistic situation: the approach I'd take if I were a victim would be to borrow an analogy from poker for the problem of deciding whether to call in order to possibly win a pot. First, I'd determine how much the data is worth to me, and use that to determine my "pot odds": pot_odds = ransom / value_of_data I'd then try to figure out how often hackers actually return the data on a ransom: odds_of_data_being_returned ~= times_data_has_been_returned_after_ransom_paid / times_ransom_has_been_paid At this point, we can decide whether it's a rational choice to pay the ransom: if pot_odds < odds_of_data_being_returned: pay_the_ransom() Areas for research: this is a pretty unsophisticated way of determining the odds of the data being returned. I don't have data on how often hackers return data upon being paid the ransom, but I suspect if we gathered data we could get a better probability. For example, one could use linguistic patterns in the hacker's communication to fingerprint different ransomware hackers, and use that to get a probability for each individual hacker. It's likely that some hackers never return the data, and some hackers always return the data, and each of these probabilities has drastically different effects on the outcome of our decision algorithm.
joosters 11y ago
It's probably good advice for any individual person / company who gets infected. Unfortunately, it's terrible advice for society in general, because the blackmailers profit from their crime and will go on to target more people. I'd guess that the malware users are being quite clever in keeping the ransom demands (relatively) small, to make it easy to choose to pay. They then profit in scale because targetting thousands of people is simple. Since the ransom payments are in Bit-coin, it's possible to track the payments and work out how much money the scammers are making. Some estimates put it as high as $325 million: http://www.coindesk.com/cryptowall-325-million-bitcoin-ransom/ http://www.coindesk.com/cryptowall-325-million-bitcoin-ranso...
- icebraining 11y ago
  It's irrelevant advice for society in general, because just like with spam, the costs of producing this are so low that even if the FBI had convinced 99% of people not to pay, it'd still be worth it for the scammers.
jvdh 11y ago
Note that this is not an official statement, this is something that an agent at a conference: https://nakedsecurity.sophos.com/2015/10/28/did-the-fbi-really-say-pay-up-for-ransomware-heres-what-to-do/ https://nakedsecurity.sophos.com/2015/10/28/did-the-fbi-real... has the official statement: The FBI doesn't make recommendations to companies; instead, the Bureau explains what the options are for businesses that are affected and how it's up to individual companies to decide for themselves the best way to proceed. That is, either revert to back up systems, contact a security professional, or pay.
speakeron 11y ago
Surely more sensible advice would have been: make sure you have offline backups; but if you don't, pay the ransom.
- vezzy-fnord 11y ago
  Still, the Boston head of cyber said that organizations that have procedures in place for regularly backing up their data can avoid paying a ransom at all, by simply restoring the infected system to a state prior to the infection.
tim333 11y ago
I guess the ransomware will stop unless they throw a few of the crooks in to jail. I presume the NSA or someone like that could probably figure who they are but they are probably in Russia or similar where the courts won't do much. Hence a fix might be to do a deal with Putin or some such? - We'll drop some sanctions if you throw a couple of dozen cybercrooks in jail say.
- vbezhenar 11y ago
  I presume they are probably in US. Hence a fix might be to do a deal with Obama? really? If you have any evidence about authors, you can report to local police who will contact with Interpol and then Russia's police. Russia has all necessary laws to punish cyber criminals.
  - tim333 11y ago
    From some googling: "..FBI’s most wanted list of cybercriminals: Russian hacker Evgeniy Bogachev. Bogachev, the authorities believe, was responsible for operating both viruses... GameOver Zeus and CryptoLocker" http://www.slate.com/articles/technology/technology/2014/06/evgeniy_bogachev_gameover_zeus_cryptolocker_how_the_fbi_shut_down_two_viruses.html http://www.slate.com/articles/technology/technology/2014/06/... "still appears to be at large in Russia, where officials have shown little interest in helping the FBI"..."What a talented guy," said Mikhail, 23, who recognised Bogachev's FBI photo as the man he would see in the lobby with his wife and nine-year-old daughter. "Sitting at his computer at home, he broke into our enemies' camp, but did not harm his fellow Russians." http://www.telegraph.co.uk/news/worldnews/europe/russia/10883333/Russian-hacker-wanted-by-US-hailed-as-hero-at-home.html http://www.telegraph.co.uk/news/worldnews/europe/russia/1088... "His alleged bank heists topped $100 million"..."Bogachev, 30, who lives luxuriously in Anapa, Russia, a beautiful seaside resort town of 60,000 on the northern coast of the Black Sea, and often sails his yacht to various Black Sea ports, remains a fugitive." http://www.usatoday.com/story/news/nation/2014/06/03/fbi-busts-russian-hacked-created-zeus-cryptolocker/9919985/ http://www.usatoday.com/story/news/nation/2014/06/03/fbi-bus... Guess the authorities can't find him because yachts are pretty tricky to spot.
blisterpeanuts 11y ago
The FBI should always advise companies never to pay ransoms. It's the only way to stop it. The Bureau doesn't care if a company or individual loses data. They do care about crime, and the only logical way to stop a class of crime is to remove all financial incentive. Whoever is advising people to "just pay the ransom" is a fool.
- tptacek 11y ago
  No matter what the FBI says, ransomware is going to continue until vendors ship systems that are secure enough to prevent ransomware by default. Meanwhile, "don't pay the ransom" is not an honest answer to "what's the best thing for me to do now that I'm infected".
  - vonklaus 11y ago
    is it possible for vendors to ship a system like this that would also allow for users to encrypt their entire hard drives? Maybe it would be something like OS X firmware lockdown, but that is less convenient and takes away a lot of the options for the user. Is this an either/or scenario?
    - tedunangst 11y ago
      Lots of vendors ship encrypted hard drives. Some of them are even almost secure. Or are you asking can a vendor prevent a compromised user account from installing pgp and encrypting everything? Probably not very well.
  - blisterpeanuts 11y ago
    "Don't pay the ransom" is just the first sentence. The rest of the paragraph would be: "Restore your data from backups, and have an IT professional come in and remove the malware if it's also on the backup." Just telling people to pay the ransom is idiotic. It actually leaves the malware in place, and what guarantee is there that they won't be blackmailed again the next day?
- mtgx 11y ago
dogma1138 11y ago
The sad part is that quite a few of the ransomware cases aren't actually recoverable, as the malware could be just dumb AES implementation which doesn't send the key to some C&C server some where, in some cases the key is hardcoded into the malware or is just generated at random so even if you pay the ransom you might not get your data back. The other important thing to consider is that you data is already tainted so the cost of the ransom are meaningless compared to the cost of re-evaluating all the data once you manage to decrypt it, as well as the cost of the decryption it self it's not like you'll get an easy tool do it. But considering that recovering data from backups also costs a small fortune it might be a reasonable gamble after all.
marze 11y ago
Um, isn't the reason we have an FBI is to shut down operations such as these? Can't they track payments and have the ransomware operators apprehended, with cooperation from authorities in other countries? Maybe we should defund the FBI if this is the best advice they can think of.
xxdesmus 11y ago
This is 100% BS. The FBI has already confirmed this "just pay the ransom" was completely misquoted and taken out of context. Stop spreading this clickbait FUD.
xdinomode 11y ago
Has anyone heard of the ransomware that encrypts your whole hard drive and makes you pay to unencrypt it? LOL.
Bjorkbat 11y ago
So much for not negotiating with terrorists.
spdustin 11y ago
For the record, it's the FBI's advice on cryptowall, cryptolocker and their ilk that it's easier to pay the ransom because it's largely automated to the point that no human is directly involved in processing your ransom and returning the keys to your files - the web site you're directed to even gives you one single file recovered for free. Isn't technology grand? Aren't the disenfranchised youth of Eastern Europe (the primary agents responsible for crypto-ransomware) generous? So unless you had backups from before you were infected, pay the automated system its Bitcoin. It's a shame that so many people have this as their introduction to cryptocurrency.

72 points by rubikscube 11y ago

deleted 11y ago

[deleted]

devit 11y ago

Looks like free enterprise has introduced a tax on people who fail to secure their systems against untargeted attacks and fail to make backups. One also wonders what's the point of all NSA's "SIGINT" efforts if they can't or won't use it to catch such usually foreign actors, so maybe they also introduced an argument against mass surveillance.

benevol 11y ago
Just like the Brits could have used the cracked Enigma code to stop each and every German operation during the War, they refrained from doing so and used it only for very specific situations (in order to avoid their cover being blown). Expect the same behavior from the NSA. They will use their power first and foremost whenever it benefits themselves, not to protect all citizens or corporations.
- spacehome 11y ago
  Um, what? The Brits acted sparingly using the cracked Enigma code precisely because they were trying to protect as many citizens as they could -- if they acted every time, the Germans would have figured out the code was compromised and switched to a stronger code.
- adrusi 11y ago
  Except now everyone knows a lot about the capabilities of the NSA, and every serious criminal is already using the strongest encryption available and doesn't have any course of action for when the NSA is onto them. It would be like if the British "blew their cover" and the Germans could only respond by completely ceasing all encrypted communication. Not the best possible outcome if they do, but still a positive outcome. It's an even better outcome for cybercrime, since ceasing all communications would mean ceasing everything. If the NSA did this, the criminal would probably just stop operating, which means they might not be brought to justice, but at least the attacks would stop.
- hwstar 11y ago
  American government agencies put one thing above all else: Self preservation. If a duty to society involves risk which could make them be seen in a bad light, they will avoid it, or try to state it isn't their problem.
jrochkind1 11y ago
Heck, with the NSA's budget, maybe they should be working on developing 'cures' for it.
deleted 11y ago
[deleted]
pdkl95 11y ago
The NSA isn't interested in defensive work these days. As Dan Geer explained[1]: I suggest that the cybersecurity tool-set favors offense these days. Chris Inglis, recently retired NSA Deputy Director, remarked that if we were to score cyber the way we score soccer, the tally would be 462-456 twenty minutes into the game, i.e., all offense. I will take his comment as confirming at the highest level not only the dual use nature of cybersecurity but also confirming that offense is where the innovations that only States can afford is going on. This is a serious problem, not only from the problems intelligence angies with many powers and poor oversight; ignoring defense is going to bite a lot of people in bad ways. We are already seeing the beginnings of this with the escalating impact computer-based attacks are having on their victims. I also recommend considering Jacob Appelbaum's response to this question[2] from the audience - from someone currently working for the NSA. The summary is that we need people doing NSA-style work, but on the defense side, and we need it now. If the NSA isn't doing that, then maybe people that want to actually protect their country should find somewhere else to work that is actually working on defense. [1] https://www.youtube.com/watch?v=nT-TGvYOBpI#t=478 https://www.youtube.com/watch?v=nT-TGvYOBpI#t=478 [2] https://www.youtube.com/watch?v=n9Xw3z-8oP4#t=4027 https://www.youtube.com/watch?v=n9Xw3z-8oP4#t=4027
- vermontdevil 11y ago
  Exactly my thoughts. NSA was supposed to provide measures to protect the network of the government. But see the OPM's breach as one example. Seems NSA is obsessed with penetrating everywhere using 'terrorism' as a means to ensure continued funding. Thus the 'defense' nature is quite boring and sadly ignored.
- newjersey 11y ago
  I assume part of the problem is that it is hard to quantify successes or wins in defense. What is a good way to protect against ransomware? Symantec buries the lede with the answers (possibly because of conflicting business interests) which are 1. Limit end user access to mapped drives 2. Deploy and maintain a comprehensive backup solution http://www.symantec.com/connect/blogs/ransomware-dos-and-donts-protecting-critical-data http://www.symantec.com/connect/blogs/ransomware-dos-and-don... But really, how do we justify spending thousands of dollars on hardware? I hate myself for saying this but there are real risks of doing too much as well. We could have our own mini tyrannical regime of secure computing a la the TSA security theater. Effective user education is challenging. Even developers are prone to use elevated user permissions where none is strictly required just for the sake of convenience. I know I've found myself right-clicking visual studio and clicking "Run as administrator" reflexively after just a few months of working on ASP.NET and IIS. This is a little off-topic but I imagine the whole funding offense vs defense might be a little more "natural" than we like to admit. Imagine you're a defense manager and there's this other guy who is an offense manager. Just as a football analogy, how do you justify your team's worth when the other team says that there is no good way to quantify the worth of the work you're doing and there is a good way to quantify their team's work? I guess what I'm asking is how do we put a dollar and cent value to defensive cyber security? Can we just ask "How much does the business stand to lose if we lost all our data to ransom ware or worse to a competitor?" or would business think that is overreaching?
logicallee 11y ago
This is precisely exactly like saying that if in xyzland rape with impunity becomes rampant, "Looks like free enterprise has just introduced a rape tax on not having brothers." To be blunt, if you think like this and make legal arguments like this, you don't understand western civilization and should go and think for a while about all of society. Unless of course you're kidding and being cynical. It's 2015: computing is part of society, and computing free from attacks is little different from walking about in public unharmed. It takes massive contortions of perception to feel otherwise. Everyone is online! (Just as everyone goes out now and then.) Ransomware is almost literally still just ransom.
dpierce9 11y ago
Free enterprise? This is an embarrassing extension of the idea of enterprise (Since when can enterprises tax anyhow?). This is racketeering 101 plain and simple. I will burn your business down unless you pay me to protect your business. It is a new application of a very old concept. Can you imagine the FBI saying, just pay the mafia?
jhayward 11y ago
I believe free enterprise requires that all parties to a transaction be free to participate, or decline, according to their own judgement and resources. Clearly absconding with and holding another's property for ransom is not free enterprise. I hesitate to say something so pedantic, but with the number of people who attribute crazy properties to the concept of "free markets", etc. I think we should just be clear on this one.
devonkim 11y ago
The government is already accused of being in bed with commerce all the time ala fascism comparisons, NSA helping companies directly like this could be viewed as favoritism for big companies and politically dangerous. Also, NSA's offensive mission is historically to attack nation-states aligned to the federal government's needs rather than to attack commercially motivated hackers. This is blurring with national security issues like espionage and economic terrorism coming into play, but this again raises the question of where the dividing line between helping private enterprise with tax dollars should go compared to doing something for everyone's benefit. There is also a defensive side to NSA's mission that is defense-oriented (IAD), but the most recognizable contributions that most of the HN crowd may be familiar with are SELinux and perhaps a modest body of research involving how to secure your systems (the defense side is much more open than the offensive side). The problems I see there is that these measures are all very much aimed at large corporations, not start-ups (seriously, I can count the number of start-ups outside the intelligence / DoD space I've ever heard of that use SELinux or follow NSA hardening guidelines on two fingers) and there is clearly a huge gap between how much big businesses take security seriously compared to start-ups from both a cultural and business driven set of motivations. The number of start-ups derailed / completely wiped out by extortion attempts is rather small compared to the number that actually exist but the legions of security consulting companies around the DC beltway wants everyone to think that it's really terrible and that everyone's a target. The truth is that everyone needs to be secure "enough" to not be as vulnerable as the really stupid guys and that while it might sting a lot to be down for a few hours or so and lose revenue / trust from users, diverting your company's resources towards hardening so much is quite costly for smaller companies and it's just more practical to have really fast re-provisioning set as a priority for your devops / ops engineers (most start-ups can do this far better than larger companies).

pdkl95 11y ago

And that is called paying the Dane-geld; But we've proved it again and again, That if once you have paid him the Dane-geld You never get rid of the Dane. http://www.poetryloverspage.com/poets/kipling/dane_geld.html http://www.poetryloverspage.com/poets/kipling/dane_geld.html Paying ransom merely teaches the criminal that you're an easy mark that they should demand more ransom from in the future.

icebraining 11y ago
But are the criminals in this case targeting specific individuals? You can't teach them you're a good target if they're just firing at random anyway.
- cbd1984 11y ago
  Even firing at random is a better strategy in a target-rich environment compared to an environment where your targets either don't pay out or attempt to fight back.
- tobltobs 11y ago
  As soon as you pay you will be a specific target for the future.
- mannykannot 11y ago
  The 'you' in this case is all of us, collectively. Unfortunately, for the individual victim, paying is usually the best of a set of bad options, even though it is not the best one for us, collectively.
  - iamsohungry 11y ago
    > Unfortunately, for the individual victim, paying is usually the best of a set of bad options Is it? From the perspective of the hacker, the hacker's best move is to take the money and simply demand more. There's zero incentive for the hacker to return the victim's data. This becomes a probablistic situation: the approach I'd take if I were a victim would be to borrow an analogy from poker for the problem of deciding whether to call in order to possibly win a pot. First, I'd determine how much the data is worth to me, and use that to determine my "pot odds": pot_odds = ransom / value_of_data I'd then try to figure out how often hackers actually return the data on a ransom: odds_of_data_being_returned ~= times_data_has_been_returned_after_ransom_paid / times_ransom_has_been_paid At this point, we can decide whether it's a rational choice to pay the ransom: if pot_odds < odds_of_data_being_returned: pay_the_ransom() Areas for research: this is a pretty unsophisticated way of determining the odds of the data being returned. I don't have data on how often hackers return data upon being paid the ransom, but I suspect if we gathered data we could get a better probability. For example, one could use linguistic patterns in the hacker's communication to fingerprint different ransomware hackers, and use that to get a probability for each individual hacker. It's likely that some hackers never return the data, and some hackers always return the data, and each of these probabilities has drastically different effects on the outcome of our decision algorithm.

joosters 11y ago

It's probably good advice for any individual person / company who gets infected. Unfortunately, it's terrible advice for society in general, because the blackmailers profit from their crime and will go on to target more people. I'd guess that the malware users are being quite clever in keeping the ransom demands (relatively) small, to make it easy to choose to pay. They then profit in scale because targetting thousands of people is simple. Since the ransom payments are in Bit-coin, it's possible to track the payments and work out how much money the scammers are making. Some estimates put it as high as $325 million: http://www.coindesk.com/cryptowall-325-million-bitcoin-ransom/ http://www.coindesk.com/cryptowall-325-million-bitcoin-ranso...

icebraining 11y ago
It's irrelevant advice for society in general, because just like with spam, the costs of producing this are so low that even if the FBI had convinced 99% of people not to pay, it'd still be worth it for the scammers.

jvdh 11y ago

Note that this is not an official statement, this is something that an agent at a conference: https://nakedsecurity.sophos.com/2015/10/28/did-the-fbi-really-say-pay-up-for-ransomware-heres-what-to-do/ https://nakedsecurity.sophos.com/2015/10/28/did-the-fbi-real... has the official statement: The FBI doesn't make recommendations to companies; instead, the Bureau explains what the options are for businesses that are affected and how it's up to individual companies to decide for themselves the best way to proceed. That is, either revert to back up systems, contact a security professional, or pay.

speakeron 11y ago

Surely more sensible advice would have been: make sure you have offline backups; but if you don't, pay the ransom.

vezzy-fnord 11y ago
Still, the Boston head of cyber said that organizations that have procedures in place for regularly backing up their data can avoid paying a ransom at all, by simply restoring the infected system to a state prior to the infection.

tim333 11y ago

I guess the ransomware will stop unless they throw a few of the crooks in to jail. I presume the NSA or someone like that could probably figure who they are but they are probably in Russia or similar where the courts won't do much. Hence a fix might be to do a deal with Putin or some such? - We'll drop some sanctions if you throw a couple of dozen cybercrooks in jail say.

vbezhenar 11y ago
I presume they are probably in US. Hence a fix might be to do a deal with Obama? really? If you have any evidence about authors, you can report to local police who will contact with Interpol and then Russia's police. Russia has all necessary laws to punish cyber criminals.
- tim333 11y ago
  From some googling: "..FBI’s most wanted list of cybercriminals: Russian hacker Evgeniy Bogachev. Bogachev, the authorities believe, was responsible for operating both viruses... GameOver Zeus and CryptoLocker" http://www.slate.com/articles/technology/technology/2014/06/evgeniy_bogachev_gameover_zeus_cryptolocker_how_the_fbi_shut_down_two_viruses.html http://www.slate.com/articles/technology/technology/2014/06/... "still appears to be at large in Russia, where officials have shown little interest in helping the FBI"..."What a talented guy," said Mikhail, 23, who recognised Bogachev's FBI photo as the man he would see in the lobby with his wife and nine-year-old daughter. "Sitting at his computer at home, he broke into our enemies' camp, but did not harm his fellow Russians." http://www.telegraph.co.uk/news/worldnews/europe/russia/10883333/Russian-hacker-wanted-by-US-hailed-as-hero-at-home.html http://www.telegraph.co.uk/news/worldnews/europe/russia/1088... "His alleged bank heists topped $100 million"..."Bogachev, 30, who lives luxuriously in Anapa, Russia, a beautiful seaside resort town of 60,000 on the northern coast of the Black Sea, and often sails his yacht to various Black Sea ports, remains a fugitive." http://www.usatoday.com/story/news/nation/2014/06/03/fbi-busts-russian-hacked-created-zeus-cryptolocker/9919985/ http://www.usatoday.com/story/news/nation/2014/06/03/fbi-bus... Guess the authorities can't find him because yachts are pretty tricky to spot.

blisterpeanuts 11y ago

The FBI should always advise companies never to pay ransoms. It's the only way to stop it. The Bureau doesn't care if a company or individual loses data. They do care about crime, and the only logical way to stop a class of crime is to remove all financial incentive. Whoever is advising people to "just pay the ransom" is a fool.

tptacek 11y ago
No matter what the FBI says, ransomware is going to continue until vendors ship systems that are secure enough to prevent ransomware by default. Meanwhile, "don't pay the ransom" is not an honest answer to "what's the best thing for me to do now that I'm infected".
- vonklaus 11y ago
  is it possible for vendors to ship a system like this that would also allow for users to encrypt their entire hard drives? Maybe it would be something like OS X firmware lockdown, but that is less convenient and takes away a lot of the options for the user. Is this an either/or scenario?
  - tedunangst 11y ago
    Lots of vendors ship encrypted hard drives. Some of them are even almost secure. Or are you asking can a vendor prevent a compromised user account from installing pgp and encrypting everything? Probably not very well.
- blisterpeanuts 11y ago
  "Don't pay the ransom" is just the first sentence. The rest of the paragraph would be: "Restore your data from backups, and have an IT professional come in and remove the malware if it's also on the backup." Just telling people to pay the ransom is idiotic. It actually leaves the malware in place, and what guarantee is there that they won't be blackmailed again the next day?
mtgx 11y ago

dogma1138 11y ago

The sad part is that quite a few of the ransomware cases aren't actually recoverable, as the malware could be just dumb AES implementation which doesn't send the key to some C&C server some where, in some cases the key is hardcoded into the malware or is just generated at random so even if you pay the ransom you might not get your data back. The other important thing to consider is that you data is already tainted so the cost of the ransom are meaningless compared to the cost of re-evaluating all the data once you manage to decrypt it, as well as the cost of the decryption it self it's not like you'll get an easy tool do it. But considering that recovering data from backups also costs a small fortune it might be a reasonable gamble after all.

marze 11y ago

Um, isn't the reason we have an FBI is to shut down operations such as these? Can't they track payments and have the ransomware operators apprehended, with cooperation from authorities in other countries? Maybe we should defund the FBI if this is the best advice they can think of.

xxdesmus 11y ago

This is 100% BS. The FBI has already confirmed this "just pay the ransom" was completely misquoted and taken out of context. Stop spreading this clickbait FUD.

xdinomode 11y ago

Has anyone heard of the ransomware that encrypts your whole hard drive and makes you pay to unencrypt it? LOL.

Bjorkbat 11y ago

So much for not negotiating with terrorists.

spdustin 11y ago

For the record, it's the FBI's advice on cryptowall, cryptolocker and their ilk that it's easier to pay the ransom because it's largely automated to the point that no human is directly involved in processing your ransom and returning the keys to your files - the web site you're directed to even gives you one single file recovered for free. Isn't technology grand? Aren't the disenfranchised youth of Eastern Europe (the primary agents responsible for crypto-ransomware) generous? So unless you had backups from before you were infected, pay the automated system its Bitcoin. It's a shame that so many people have this as their introduction to cryptocurrency.