4 ms·

The headline could also be "University willingly supports criminals with $20.000" - and it would be more honest. That's really something that bothers me with t

by hannob 10y ago

The headline could also be "University willingly supports criminals with $20.000" - and it would be more honest. That's really something that bothers me with the whole ransomware thing: People seem to be completely ignorant to the fact that by paying they're not only getting back their data - they're paying the bills for the people who will launch more attacks against other people. And thus they're themselve guilty of supporting the same crime that just hit them.

mapt 10y ago
... under duress. That's why it's termed 'ransom'. Because people who don't pay, have things taken from them. You don't really get to condemn ransom payers on ethical grounds without being an asshole.
- kwhitefoot 10y ago
  Of course one does! Paying a ransom encourages the criminal behaviour; it therefore negatively affects all potential victims by making them more likely to become actual victims. Also, in some jurisdictions paying a ransom is actually a criminal offence so one could end up causing further negative consequences for your family, friend, colleagues, or the institution you work for.
Bromskloss 10y ago
That's how every type of ransom works.
csydas 10y ago
But with how easy it is to deploy ransomware and how frequently you can get a major hit, it's a pretty pyrrhic victory to not pay. Right now there's no reason to not keep on shooting out ransomware - it's an impersonal, easy to deploy, low cost, scalable form of malware which has a very high and noticeable impact on end-users, who often have little to no recourse or means of mitigating the damage. It's of virtually no risk to the persons deploying the ransomware to deploy the software or collect the money. With other ransom scenarios, the cost and risk to the attacker is far greater for every part of the ransom act; refusal to pay has a greater cost to the attacker in every which way. There is no such cost with ransomware at the moment, aside from the initial financial venture to get/make the software. Knowing that the ransomware folk are just going to keep on spamming their software against institution after institution, is it really worth the potential cost of the lost data? If it's student data, is it worth ruining students' academic careers over a principled stand? Is it worth losing a novel you've been working on for 8+ years? Is it worth losing business documents that could cripple your business? It's not as clear cut with ransomware as it is with other forms of ransom and extortion just because of how stinking' easy it is to do ransomware.

by hannob 10y ago

mapt 10y ago

... under duress. That's why it's termed 'ransom'. Because people who don't pay, have things taken from them. You don't really get to condemn ransom payers on ethical grounds without being an asshole.

kwhitefoot 10y ago
Of course one does! Paying a ransom encourages the criminal behaviour; it therefore negatively affects all potential victims by making them more likely to become actual victims. Also, in some jurisdictions paying a ransom is actually a criminal offence so one could end up causing further negative consequences for your family, friend, colleagues, or the institution you work for.

Bromskloss 10y ago

That's how every type of ransom works.

csydas 10y ago

But with how easy it is to deploy ransomware and how frequently you can get a major hit, it's a pretty pyrrhic victory to not pay. Right now there's no reason to not keep on shooting out ransomware - it's an impersonal, easy to deploy, low cost, scalable form of malware which has a very high and noticeable impact on end-users, who often have little to no recourse or means of mitigating the damage. It's of virtually no risk to the persons deploying the ransomware to deploy the software or collect the money. With other ransom scenarios, the cost and risk to the attacker is far greater for every part of the ransom act; refusal to pay has a greater cost to the attacker in every which way. There is no such cost with ransomware at the moment, aside from the initial financial venture to get/make the software. Knowing that the ransomware folk are just going to keep on spamming their software against institution after institution, is it really worth the potential cost of the lost data? If it's student data, is it worth ruining students' academic careers over a principled stand? Is it worth losing a novel you've been working on for 8+ years? Is it worth losing business documents that could cripple your business? It's not as clear cut with ransomware as it is with other forms of ransom and extortion just because of how stinking' easy it is to do ransomware.