4 ms·

Why openly announce that you're paying the ransom? Here's some major disadvantages that I can think of: 1. Announces to world that you have poor security/back

by desdiv 10y ago

Why openly announce that you're paying the ransom? Here's some major disadvantages that I can think of: 1. Announces to world that you have poor security/backup practices which encourages more attacks against you 2. Announces to world that making and distributing ransomware is good business which encourages more attacks against everyone I understand that public institutions needs financial transparency in order to be accountable to the public. But the nature of this isn't any different from, for example, a basement flooded due to poor design and required $20,000 to fix. Someone screwed up, and it cost the university $20,000. Let's just pay the money, fix the problem, and take steps to make sure it doesn't happen again. No need to call up the local paper about it and make it a story.

wisechengyi 10y ago
Raise public awareness?
- mtgx 10y ago
  That can do some good in the long term. It will eventually get operating system vendors to enforce much stricter security measures by default that perhaps they wouldn't have considered otherwise or anytime soon, because they would "break legacy code" or whatever. It's also good that this is coming at a time before the rise of self-driving cars. Because the vast majority of car makers seem to know nothing about security, yet are eagerly jumping head first into always-connected, self-updating and digital-first self-driving cars. I'm guessing people are going to raise hell when ransomware arrives for their cars. And I think the car makers will be "shocked" (shocked, I tell you), that this will be happening, and will say something dumb like "Nobody could have ever predicted this! - it's why we never implemented good security in the first place." However, because the OS/hardware vendors are only going to be dragged kicking and screaming into implementing stricter security measures, it's going to be a while before stricter security arrives. In the meantime, beyond alerting criminals that ransomware is big business, it will probably also be used as an excuse to pass more CISA-like surveillance laws (which will do absolutely nothing to stop the rise of ransomware). It could also be used as yet another excuse to end strong crypto (because obviously ransomware uses crypo). But of course, it's not like the Russian or Chinese criminals doing this are going to care that the US has a ban on strong crypto. So yet again a solution that does nothing to stop the rise of ransomware, but would still make it much worse for all of us, and it could even be a step back in the fight against ransomware.
  - csydas 10y ago
    >In the meantime, beyond alerting criminals that ransomware is big business, it will probably also be used as an excuse to pass more CISA-like surveillance laws (which will do absolutely nothing to stop the rise of ransomware). See, I actually don't think that this will change the level of deployment for ransomware. Ransomware has proven its effectiveness from the very first time it hit the web; it's a low cost high return form of malware due to the nature of its operations. Whereas other forms like scareware and annoying malware can often be dealt with, albeit at the cost of time and sometimes money, ransomware has a very clear and tangible cost to the user: their data. For home users, it's somewhat easier to suggest that while the loss of an entire photo directory is tragic, it's not worth the $400. But when you start getting to actual important data, for example, student records, accounting records, large business projects, asking users to take a stand on principle becomes a lot more difficult, especially since in some cases they have a legal obligation to try to remedy the situation. Ransomware is a low risk venture for ne'er-do-wells because it's shooting fish in a barrel. Point your spambot at any major institution and you're bound to get a hit on something that has essential data to that institution. Combine this with the fact that even after decades of home computer hard drive failure and nearly a decade of cloud storage being common place, people are still really bad at backing up their important things. Our reliance on data and our poor (often inability) to mitigate the damage done by dataloss is what will keep ransomware firing, regardless of how many institutions are able to take a public stand against the extortion. The barrier of entry is so low that a failure to collect from victims is virtually meaningless. The attackers are out virtually nothing, and can attack ad-nauseum because they know sooner or later they'll get a hit where the cost of the dataloss far exceeds the cost of the decryption key; and as long as the attackers occasionally make good on the sale of the decryption key, there's always going to be the hope from users that "maybe if we pay we can fix this". A principled stand isn't what is going to be necessary to fix ransonware; major changes in how the public handles its data and in how OSes work with/detect ransomware is going to have to happen first. Until then, anyone who refuses is pretty much just getting a pyrrhic victory; the attackers might not get their payout, but the cost to the victim is far greater.
cantrevealname 10y ago
> Why openly announce that you're paying the ransom? An effective thing they could have done is to announce that they paid the ransom, but that the decryption did not work (even though it did). That has the advantage of discouraging other people from paying up, and therefore reduces the incentive to create more ransomware attacks. Hell, the government could step in and recruit people and companies to falsely claim that they were ransomware victims who paid up, but never got decryption keys and were screwed over. That could put a damper on ransomware psychology. Thinking about it further however, this will probably lead to better "customer service" by the ransomware makers. They'll adapt their software to selectively decrypt part of your data for free, so they can offer you proof that that they can and will give your working keys once you pay up.
- deciplex 10y ago
  > Hell, the government could step in and recruit people and companies to falsely claim that they were ransomware victims who paid up, but never got decryption keys and were screwed over. That could put a damper on ransomware psychology. This actually did happen to me. Paid the money, got the key, couldn't unlock my files. Damn shame.
  - cantrevealname 10y ago
    I'm sorry to hear that. Being Hacker News I think we'd all be very interested if you are able to share some details such as: - how your system got compromised? - did you have backups? (and did the backups get encrypted?) - how much did you pay and by what method? - why do you think the key didn't work? EDIT: It now occurs to me that you're following my suggestion about falsely claiming to be a ransomware victim to discourage ransom payments. Whoosh!
    - jstanley 10y ago
      > you're following my suggestion about falsely claiming to be a ransomware victim effective, isn't it!
  - simonh 10y ago
mrb 10y ago
The school’s vice-president of finance and services said why they openly disclosed it: As for why the U of C admitted it paid the ransom, as well as releasing the cost, Dalgetty said it’s an effort to be transparent. “We’re a public sector organization and we pride ourselves on our openness,” she said. Source: http://calgaryherald.com/news/local-news/university-of-calgary-pays-hackers-20000-after-ransomware-attack http://calgaryherald.com/news/local-news/university-of-calga... Personally, I am glad they disclosed it. For example this incident raises the awareness that having a solid backup policy is important. Maybe this very story will help IT staff from other universities convince upper management to invest funds into developing a more solid backup policy.
csydas 10y ago
I'm not really sure these threat scenarios apply when it comes to ransomware. Often ransomware attacks are not targeted but instead just the result of your standard drive-by attack or the classic shotgun e-mail approach, since usually university email listings are pretty easily scrape-able, especially if they're a Google Apps for Education (GAFE) university, as GAFE has pretty generous in-domain sending policies on email and there's an implicit trust in most people when they get something from an in-domain email. So the initial point, while it may be true to some extent, is not really the common method of attack; the truth is that for the most part there is no need to really "craft" an attack against most users within a large enough organization. Just compromising one or two accounts or using one of many means to impersonate an official sounding account is often enough to get access to a few in-domain accounts. Once you have that, you can easily get past the majority of people's mistrust and get them to run just about anything you send them. When I did support for a small private university in the US, our GAFE accounts were constantly plagued by phishing and spam emails, and despite our best efforts to educate our user base, people just kept on clicking and giving out information. The entire process was basically automated from the attacker's side, as when we compared notes with other universities suffering the same issue, the emails sent out were verbatim copies, save that the university names were swapped out and a different logo.jpg was added to the emails for authenticity. Attacking a major organization really doesn't require a careful eye and dedication, just changing a few entries in some program and starting the process. As for why to disclose? There's probably some degree of a necessary public accountability - I actually doubt that the university itself called up a paper and said "man have we got a story for you" so much as someone at the publication got wind of the information and plugged the university for a brief interview. Honestly, reading through the article, it's incredibly terse as far as actual details from the University as to what happened. Since it's a Canadian University, I'm not sure on their responsible disclosure requirements, but if it was in the US, I believe they have a timeframe in which they have to admit that student data has potentially been leaked. Really, these sorts of impersonal attacks do need a lot more attention, since as recently as just a year ago, I found myself talking with somewhat major institutions around the US who had no real good idea how to deal with ransomware, (spear) phishing emails, and so on within their organization. Creating effective user awareness is really tough, since rather frustratingly, getting "phished" seems to be one of those lessons everyone wants to learn the hard way, or arrogantly thinks will never happen to them. We used a Twitter account in combination with a threat blog to try to notify our users, as well as warnings on our log-in page, but even after doing that for 4ish years we still had people giving out their information, and we had an okay-ish following on both. I'm not saying that it was "good" of them to release that they decided to pay, but I also do question, given how easy ransomware is to deploy, whether or not more discretion would actually have a larger impact. Schools in particular are kind of over a barrel if/when they get hit by ransomware, and a lot of it has to do with poor data retention practices by both the University IT and by offices across the organization. Often times it's not just a mild inconvenience if someone's computer gets locked up by ransomware, you can potentially be irreparably damaging hundreds or more students' academic careers. Should this data be in a position that it can happen like this? Absolutely not, but that doesn't change the fact that it often is.

by desdiv 10y ago

wisechengyi 10y ago

Raise public awareness?

mtgx 10y ago
That can do some good in the long term. It will eventually get operating system vendors to enforce much stricter security measures by default that perhaps they wouldn't have considered otherwise or anytime soon, because they would "break legacy code" or whatever. It's also good that this is coming at a time before the rise of self-driving cars. Because the vast majority of car makers seem to know nothing about security, yet are eagerly jumping head first into always-connected, self-updating and digital-first self-driving cars. I'm guessing people are going to raise hell when ransomware arrives for their cars. And I think the car makers will be "shocked" (shocked, I tell you), that this will be happening, and will say something dumb like "Nobody could have ever predicted this! - it's why we never implemented good security in the first place." However, because the OS/hardware vendors are only going to be dragged kicking and screaming into implementing stricter security measures, it's going to be a while before stricter security arrives. In the meantime, beyond alerting criminals that ransomware is big business, it will probably also be used as an excuse to pass more CISA-like surveillance laws (which will do absolutely nothing to stop the rise of ransomware). It could also be used as yet another excuse to end strong crypto (because obviously ransomware uses crypo). But of course, it's not like the Russian or Chinese criminals doing this are going to care that the US has a ban on strong crypto. So yet again a solution that does nothing to stop the rise of ransomware, but would still make it much worse for all of us, and it could even be a step back in the fight against ransomware.
- csydas 10y ago
  >In the meantime, beyond alerting criminals that ransomware is big business, it will probably also be used as an excuse to pass more CISA-like surveillance laws (which will do absolutely nothing to stop the rise of ransomware). See, I actually don't think that this will change the level of deployment for ransomware. Ransomware has proven its effectiveness from the very first time it hit the web; it's a low cost high return form of malware due to the nature of its operations. Whereas other forms like scareware and annoying malware can often be dealt with, albeit at the cost of time and sometimes money, ransomware has a very clear and tangible cost to the user: their data. For home users, it's somewhat easier to suggest that while the loss of an entire photo directory is tragic, it's not worth the $400. But when you start getting to actual important data, for example, student records, accounting records, large business projects, asking users to take a stand on principle becomes a lot more difficult, especially since in some cases they have a legal obligation to try to remedy the situation. Ransomware is a low risk venture for ne'er-do-wells because it's shooting fish in a barrel. Point your spambot at any major institution and you're bound to get a hit on something that has essential data to that institution. Combine this with the fact that even after decades of home computer hard drive failure and nearly a decade of cloud storage being common place, people are still really bad at backing up their important things. Our reliance on data and our poor (often inability) to mitigate the damage done by dataloss is what will keep ransomware firing, regardless of how many institutions are able to take a public stand against the extortion. The barrier of entry is so low that a failure to collect from victims is virtually meaningless. The attackers are out virtually nothing, and can attack ad-nauseum because they know sooner or later they'll get a hit where the cost of the dataloss far exceeds the cost of the decryption key; and as long as the attackers occasionally make good on the sale of the decryption key, there's always going to be the hope from users that "maybe if we pay we can fix this". A principled stand isn't what is going to be necessary to fix ransonware; major changes in how the public handles its data and in how OSes work with/detect ransomware is going to have to happen first. Until then, anyone who refuses is pretty much just getting a pyrrhic victory; the attackers might not get their payout, but the cost to the victim is far greater.

cantrevealname 10y ago

> Why openly announce that you're paying the ransom? An effective thing they could have done is to announce that they paid the ransom, but that the decryption did not work (even though it did). That has the advantage of discouraging other people from paying up, and therefore reduces the incentive to create more ransomware attacks. Hell, the government could step in and recruit people and companies to falsely claim that they were ransomware victims who paid up, but never got decryption keys and were screwed over. That could put a damper on ransomware psychology. Thinking about it further however, this will probably lead to better "customer service" by the ransomware makers. They'll adapt their software to selectively decrypt part of your data for free, so they can offer you proof that that they can and will give your working keys once you pay up.

deciplex 10y ago
> Hell, the government could step in and recruit people and companies to falsely claim that they were ransomware victims who paid up, but never got decryption keys and were screwed over. That could put a damper on ransomware psychology. This actually did happen to me. Paid the money, got the key, couldn't unlock my files. Damn shame.
- cantrevealname 10y ago
  I'm sorry to hear that. Being Hacker News I think we'd all be very interested if you are able to share some details such as: - how your system got compromised? - did you have backups? (and did the backups get encrypted?) - how much did you pay and by what method? - why do you think the key didn't work? EDIT: It now occurs to me that you're following my suggestion about falsely claiming to be a ransomware victim to discourage ransom payments. Whoosh!
  - jstanley 10y ago
    > you're following my suggestion about falsely claiming to be a ransomware victim effective, isn't it!
- simonh 10y ago

mrb 10y ago

The school’s vice-president of finance and services said why they openly disclosed it: As for why the U of C admitted it paid the ransom, as well as releasing the cost, Dalgetty said it’s an effort to be transparent. “We’re a public sector organization and we pride ourselves on our openness,” she said. Source: http://calgaryherald.com/news/local-news/university-of-calgary-pays-hackers-20000-after-ransomware-attack http://calgaryherald.com/news/local-news/university-of-calga... Personally, I am glad they disclosed it. For example this incident raises the awareness that having a solid backup policy is important. Maybe this very story will help IT staff from other universities convince upper management to invest funds into developing a more solid backup policy.

csydas 10y ago

I'm not really sure these threat scenarios apply when it comes to ransomware. Often ransomware attacks are not targeted but instead just the result of your standard drive-by attack or the classic shotgun e-mail approach, since usually university email listings are pretty easily scrape-able, especially if they're a Google Apps for Education (GAFE) university, as GAFE has pretty generous in-domain sending policies on email and there's an implicit trust in most people when they get something from an in-domain email. So the initial point, while it may be true to some extent, is not really the common method of attack; the truth is that for the most part there is no need to really "craft" an attack against most users within a large enough organization. Just compromising one or two accounts or using one of many means to impersonate an official sounding account is often enough to get access to a few in-domain accounts. Once you have that, you can easily get past the majority of people's mistrust and get them to run just about anything you send them. When I did support for a small private university in the US, our GAFE accounts were constantly plagued by phishing and spam emails, and despite our best efforts to educate our user base, people just kept on clicking and giving out information. The entire process was basically automated from the attacker's side, as when we compared notes with other universities suffering the same issue, the emails sent out were verbatim copies, save that the university names were swapped out and a different logo.jpg was added to the emails for authenticity. Attacking a major organization really doesn't require a careful eye and dedication, just changing a few entries in some program and starting the process. As for why to disclose? There's probably some degree of a necessary public accountability - I actually doubt that the university itself called up a paper and said "man have we got a story for you" so much as someone at the publication got wind of the information and plugged the university for a brief interview. Honestly, reading through the article, it's incredibly terse as far as actual details from the University as to what happened. Since it's a Canadian University, I'm not sure on their responsible disclosure requirements, but if it was in the US, I believe they have a timeframe in which they have to admit that student data has potentially been leaked. Really, these sorts of impersonal attacks do need a lot more attention, since as recently as just a year ago, I found myself talking with somewhat major institutions around the US who had no real good idea how to deal with ransomware, (spear) phishing emails, and so on within their organization. Creating effective user awareness is really tough, since rather frustratingly, getting "phished" seems to be one of those lessons everyone wants to learn the hard way, or arrogantly thinks will never happen to them. We used a Twitter account in combination with a threat blog to try to notify our users, as well as warnings on our log-in page, but even after doing that for 4ish years we still had people giving out their information, and we had an okay-ish following on both. I'm not saying that it was "good" of them to release that they decided to pay, but I also do question, given how easy ransomware is to deploy, whether or not more discretion would actually have a larger impact. Schools in particular are kind of over a barrel if/when they get hit by ransomware, and a lot of it has to do with poor data retention practices by both the University IT and by offices across the organization. Often times it's not just a mild inconvenience if someone's computer gets locked up by ransomware, you can potentially be irreparably damaging hundreds or more students' academic careers. Should this data be in a position that it can happen like this? Absolutely not, but that doesn't change the fact that it often is.