9 ms·

So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/hktxrml0e933lw/iuogsulv5ns4/20161024123233.jpg https://d1

So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/hktxrml0e933lw/iuogsulv5ns4/20161024123233.jpg https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/... Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them. I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. There is no negotiation with a script. What I've also heard is that you can trust the script because these guys want a good reputation. If it gets out that you paid and you didn't get unlocked then no one would pay. If you don't want to pay on the backend then you have to back up on the front end. You should do that already. You should be able to take a sledge hammer to your laptop, buy another and not miss a beat. If you could do that then you could just reformat and reinstall. Prevention is worth it. Protection is worth it. Paying? Well if you did the first two you wouldn't be asking that question. But .65880 Bitcoin equals about 463.97 USD. So you might want to get on the prevention+protection train. Prevention will help you against viruses, keyloggers, etc that can cause a lot more economic harm. Protection, backing up, will also help you in the case of theft or dropping your MPB out of its sleeve when you get out the car. Done both.

adzm 10y ago
This happens quite often at medical offices. Five and even six digit ransoms are not unheard of. On the plus side, it helps encourage Windows updates and IT responsibility.
- nom 10y ago
  Now i'm really curious if they calculate the prices based on the files they encrypt. Do you know if it was some kind of spear phishing attack or just a regular ransomware variant? Any sources? thx!
  - ocdtrekkie 10y ago
    My guess is it's pretty easy for them to report back the infected computer is part of a domain, for example, which most businesses using Windows would be on.
  - Bartweiss 10y ago
    I've heard of some non-scripted ransomware that "phones home". If it points you to an email exchange with the scammer, there's room for a person to sound you out, maybe google you or work off your email address and information reported by the ransomware.
dsacco 10y ago
Good comment. I've interacted with ransomware scammers on several occasions. Each time I couldn't help but be impressed by their operations. In one case, the scammers provided an email address for customer support once the victim paid the ransom. They were courteous, helpful and professional - more so than many customer response teams I've had to interact with in legitimate companies. To be clear, I also don't recommend paying the ransom, but the work is often impressive.
- notahacker 10y ago
  To be fair, I think legitimate companies' customer support might be a bit more courteous and attentive if they personally stood to gain $500 from each dissatisfied person contacting them...
  - dsacco 10y ago
    Oh yes, of course. Without question the superior customer support is a selfish incentive. But I still find it incredibly interesting.
    - cpayne 10y ago
      I agree. There has to be an MBA case study in there somewhere. As others have said, they clearly is it as a profit centre (not cost centre).
  - bigiain 10y ago
    Hmmm, thinks back to some of the support contracts I've been involved with (or heard about from trusted friends) with "big 4 consulting firms" or "enterprise IT partners". Nope, doesn't check out.
    - TeMPOraL 10y ago
      It does. Regular customer support is on wage/salary, and otherwise have zero economical interest in helping people. Also, they're considered cost centre, which doesn't help. Think of criminals doing ransomware as if it was a small startup, for which profits are strongly dependent on reputation, and where your "customer support" is actually handled by the founders themselves. They have every reason to help, because it literally keeps their business model alive.
nom 10y ago
The ransomware scheme only works because the users actually get their files back and the prices are pretty reasonable for many victims. The perpetrators spend a lot of time on the ransomware and its backend. The better it works works, the more people will pay. They rely on people like us to spread the word that it's not a scam, it's real and it works. Now that I think about it: It would really damage the whole ransomware scheme if there were fake / rogue versions that won't decrypt, wouldn't it?
- TeMPOraL 10y ago
  > It would really damage the whole ransomware scheme if there were fake / rogue versions that won't decrypt, wouldn't it? Or a single fake story about how ransom doesn't give your data back, published in a high-profile newspaper. Come to think of it, our news sources write bigger lies every day, here they could actually do some good without any risk to their own reputation.
  - throwaway2048 10y ago
    This wouldn't really help, because much like spam, the costs are extraordinarily asymmetric, it costs essentially nothing to infect somebody and they need 1 payout in 100000 to make it worth it.
  - dspillett 10y ago
    > Come to think of it, our news sources write bigger lies every day Unfortunately they are also cut throat with regard to each other. The first paper that does this risks the rest of them running stories about that source scare mongering and deliberately spreading panic on behalf of [insert conspiracy theory and/or unpopular agency here].
    - firethief 10y ago
      Sounds like a good thing to me. The watchmen watch the other watchmen.
      - 10y ago
pmoriarty 10y ago
"If it gets out that you paid and you didn't get unlocked then no one would pay." Sounds like an easy way to get rid of ransomware. Just spread rumors that you didn't get your files back even though you paid. Somehow I have a feeling that wouldn't work, though. Many people would still pay.
- notgood 10y ago
  Another way then: create a script that sends hundreds of emails to the victim from different addresses (wallets) and different amounts; the victim cannot identify which email is from the actual scammer, therefore he will pay none and the scam chances of success would reduce, and with it -eventually- the number of scammers.
  - mcintyre1994 10y ago
    Do they really communicate by email after encrypting? Wouldn't it make more sense to communicate via a file on the owned desktop?
    - notgood 10y ago
      Forgot about that, yep, they leave a big message on your screen.
- Houshalter 10y ago
  How will that get rid of ransomware? It might reduce their profits, but as long as even 1℅ of people pay up, they make enough to keep doing it.
Houshalter 10y ago
That's great until the ransomware gets clever and encrypts your backups too. I'm extremely skeptical of the people that say ransomware is good for the economy or whatever. Broken window fallacy. Sure it creates an incentive to protect against hackers. But isn't that a bit circular? Hackers are good because they create inventive to protect against hackers? Ransomware is by far the most economically damaging kind (and personally damaging, for all the people that lose their family photos...) Theres a lot of blame to go around for this situation. Shitty anti virus companies that sell a false sense of security and barely work. The broken security model of windows and most software. How inconvenient and expensive it is to actually do backups, so because of most basic human psychology most people put it off... If they are even technically minded enough to know they should, and most people aren't. Programs that pollute my home folder and documents with garbage that increases the space necessary to backup (OK that's just my personal issue.)
- digler999 10y ago
  > Ransomware is by far the most economically damaging kind is it though, compared to malware ? Consider an elderly person who gets infected with malware/spyware, making his user experience frustrating and confusing. 2 or 3 trips to the Geek Squad for $150 a visit and you're at the same financial loss as paying a ransom. I'm sure there are also people who just dont use their computers due to infections. Plus, malware has got to be much more prevalent, at least for a long time it was, not sure what the state of it is now. So in total, I would wager that many more dollars have been spent for techs to remove it than have been spent on ransomware.
- Confusion 10y ago
  I saved my dad from ransomware using the Crashplan backups I set up. Ransomware can't retroactively encrypt remote (incremental) backups (unless they hack the service). Admittedly, I now realize they could have deleted them, so I need to enable the password protection in the app, so nothing can be changed without the password. However, I don't think it's worth it for the builders to invest in that: the number of people that could rescue themselves in such a way is probably negligible.
  - 10y ago
sliverstorm 10y ago
You should be able to take a sledge hammer to your laptop, buy another and not miss a beat. For most I think that's the wrong target. Establishing & maintaining totally seamless, push-button rolling restore costs a lot of effort & money. In the event of failure (which is not guaranteed), you burn a day or three getting things back to normal. So long as failures are rare, this can be cheaper (though availability suffers)
daveheq 10y ago
What if the ransomware runs every month on a random day after it's installed until it gets paid?

adzm 10y ago

This happens quite often at medical offices. Five and even six digit ransoms are not unheard of. On the plus side, it helps encourage Windows updates and IT responsibility.

nom 10y ago
Now i'm really curious if they calculate the prices based on the files they encrypt. Do you know if it was some kind of spear phishing attack or just a regular ransomware variant? Any sources? thx!
- ocdtrekkie 10y ago
  My guess is it's pretty easy for them to report back the infected computer is part of a domain, for example, which most businesses using Windows would be on.
- Bartweiss 10y ago
  I've heard of some non-scripted ransomware that "phones home". If it points you to an email exchange with the scammer, there's room for a person to sound you out, maybe google you or work off your email address and information reported by the ransomware.

dsacco 10y ago

Good comment. I've interacted with ransomware scammers on several occasions. Each time I couldn't help but be impressed by their operations. In one case, the scammers provided an email address for customer support once the victim paid the ransom. They were courteous, helpful and professional - more so than many customer response teams I've had to interact with in legitimate companies. To be clear, I also don't recommend paying the ransom, but the work is often impressive.

notahacker 10y ago
To be fair, I think legitimate companies' customer support might be a bit more courteous and attentive if they personally stood to gain $500 from each dissatisfied person contacting them...
- dsacco 10y ago
  Oh yes, of course. Without question the superior customer support is a selfish incentive. But I still find it incredibly interesting.
  - cpayne 10y ago
    I agree. There has to be an MBA case study in there somewhere. As others have said, they clearly is it as a profit centre (not cost centre).
- bigiain 10y ago
  Hmmm, thinks back to some of the support contracts I've been involved with (or heard about from trusted friends) with "big 4 consulting firms" or "enterprise IT partners". Nope, doesn't check out.
  - TeMPOraL 10y ago
    It does. Regular customer support is on wage/salary, and otherwise have zero economical interest in helping people. Also, they're considered cost centre, which doesn't help. Think of criminals doing ransomware as if it was a small startup, for which profits are strongly dependent on reputation, and where your "customer support" is actually handled by the founders themselves. They have every reason to help, because it literally keeps their business model alive.

nom 10y ago

The ransomware scheme only works because the users actually get their files back and the prices are pretty reasonable for many victims. The perpetrators spend a lot of time on the ransomware and its backend. The better it works works, the more people will pay. They rely on people like us to spread the word that it's not a scam, it's real and it works. Now that I think about it: It would really damage the whole ransomware scheme if there were fake / rogue versions that won't decrypt, wouldn't it?

TeMPOraL 10y ago
> It would really damage the whole ransomware scheme if there were fake / rogue versions that won't decrypt, wouldn't it? Or a single fake story about how ransom doesn't give your data back, published in a high-profile newspaper. Come to think of it, our news sources write bigger lies every day, here they could actually do some good without any risk to their own reputation.
- throwaway2048 10y ago
  This wouldn't really help, because much like spam, the costs are extraordinarily asymmetric, it costs essentially nothing to infect somebody and they need 1 payout in 100000 to make it worth it.
- dspillett 10y ago
  > Come to think of it, our news sources write bigger lies every day Unfortunately they are also cut throat with regard to each other. The first paper that does this risks the rest of them running stories about that source scare mongering and deliberately spreading panic on behalf of [insert conspiracy theory and/or unpopular agency here].
  - firethief 10y ago
    Sounds like a good thing to me. The watchmen watch the other watchmen.
    - 10y ago

pmoriarty 10y ago

"If it gets out that you paid and you didn't get unlocked then no one would pay." Sounds like an easy way to get rid of ransomware. Just spread rumors that you didn't get your files back even though you paid. Somehow I have a feeling that wouldn't work, though. Many people would still pay.

notgood 10y ago
Another way then: create a script that sends hundreds of emails to the victim from different addresses (wallets) and different amounts; the victim cannot identify which email is from the actual scammer, therefore he will pay none and the scam chances of success would reduce, and with it -eventually- the number of scammers.
- mcintyre1994 10y ago
  Do they really communicate by email after encrypting? Wouldn't it make more sense to communicate via a file on the owned desktop?
  - notgood 10y ago
    Forgot about that, yep, they leave a big message on your screen.
Houshalter 10y ago
How will that get rid of ransomware? It might reduce their profits, but as long as even 1℅ of people pay up, they make enough to keep doing it.

Houshalter 10y ago

That's great until the ransomware gets clever and encrypts your backups too. I'm extremely skeptical of the people that say ransomware is good for the economy or whatever. Broken window fallacy. Sure it creates an incentive to protect against hackers. But isn't that a bit circular? Hackers are good because they create inventive to protect against hackers? Ransomware is by far the most economically damaging kind (and personally damaging, for all the people that lose their family photos...) Theres a lot of blame to go around for this situation. Shitty anti virus companies that sell a false sense of security and barely work. The broken security model of windows and most software. How inconvenient and expensive it is to actually do backups, so because of most basic human psychology most people put it off... If they are even technically minded enough to know they should, and most people aren't. Programs that pollute my home folder and documents with garbage that increases the space necessary to backup (OK that's just my personal issue.)

digler999 10y ago
> Ransomware is by far the most economically damaging kind is it though, compared to malware ? Consider an elderly person who gets infected with malware/spyware, making his user experience frustrating and confusing. 2 or 3 trips to the Geek Squad for $150 a visit and you're at the same financial loss as paying a ransom. I'm sure there are also people who just dont use their computers due to infections. Plus, malware has got to be much more prevalent, at least for a long time it was, not sure what the state of it is now. So in total, I would wager that many more dollars have been spent for techs to remove it than have been spent on ransomware.
Confusion 10y ago
I saved my dad from ransomware using the Crashplan backups I set up. Ransomware can't retroactively encrypt remote (incremental) backups (unless they hack the service). Admittedly, I now realize they could have deleted them, so I need to enable the password protection in the app, so nothing can be changed without the password. However, I don't think it's worth it for the builders to invest in that: the number of people that could rescue themselves in such a way is probably negligible.
- 10y ago

sliverstorm 10y ago

You should be able to take a sledge hammer to your laptop, buy another and not miss a beat. For most I think that's the wrong target. Establishing & maintaining totally seamless, push-button rolling restore costs a lot of effort & money. In the event of failure (which is not guaranteed), you burn a day or three getting things back to normal. So long as failures are rare, this can be cheaper (though availability suffers)

daveheq 10y ago

What if the ransomware runs every month on a random day after it's installed until it gets paid?