4 ms·

I wonder why no one is looking at the obvious solution - discredit the ransomware folks. I.e. create ransomware that doesn't free your files even after you pay

I wonder why no one is looking at the obvious solution - discredit the ransomware folks. I.e. create ransomware that doesn't free your files even after you pay the ransom. As soon as word gets around that there are ransomwares like that their whole business model will collapse. Sure, this will not be nice to the (small number of) people who get screwed over but it definitely solves the larger problem.

ThrustVectoring 10y ago
An alternative solution is to make it illegal to pay ransomware.
- gipp 10y ago
  Yeah that's all well and good until major corporate/governmental networks are infected, which has already happened on small scales.
  - ThrustVectoring 10y ago
    Major corporate and government networks are better able to handle it, so long as you have top-down buy-in. Just publish a policy that anyone caught paying a ransom will be fired, and throw a bit of money into PR puff pieces talking about your tough-on-ransomware policies. Ransomware makers won't try to target your network, since they'll won't get money from the CEO and will have a real hard time negotiating with people from other layers. Any incidental damage will get dealt with by various mitigation policies (backups, etc).
- maverick_iceman 10y ago
  That'll just make criminals out of ordinary people.
  - ThrustVectoring 10y ago
    Are you saying that it'll convince literally zero people to not pay the ransom? Every ransom that does not get paid is money that doesn't contribute to the "distributing ransomware is a viable way to make money" problem.
connor4312 10y ago
Ransomware already has a less-than-stellar reputation as far as that goes[1], but many people are willing to make that gamble in order have a chance at retrieving their data. Not to mention that making the dysfunctional ransomware would be illegal, and authors (who therefore must be in it for profit) have motivation to avoid tarnishing their 'reputation', to extract the most payment. [1] https://www.google.com/search?q=does+paying+ransomware+work https://www.google.com/search?q=does+paying+ransomware+work

ThrustVectoring 10y ago

An alternative solution is to make it illegal to pay ransomware.

gipp 10y ago
Yeah that's all well and good until major corporate/governmental networks are infected, which has already happened on small scales.
- ThrustVectoring 10y ago
  Major corporate and government networks are better able to handle it, so long as you have top-down buy-in. Just publish a policy that anyone caught paying a ransom will be fired, and throw a bit of money into PR puff pieces talking about your tough-on-ransomware policies. Ransomware makers won't try to target your network, since they'll won't get money from the CEO and will have a real hard time negotiating with people from other layers. Any incidental damage will get dealt with by various mitigation policies (backups, etc).
maverick_iceman 10y ago
That'll just make criminals out of ordinary people.
- ThrustVectoring 10y ago
  Are you saying that it'll convince literally zero people to not pay the ransom? Every ransom that does not get paid is money that doesn't contribute to the "distributing ransomware is a viable way to make money" problem.

connor4312 10y ago

Ransomware already has a less-than-stellar reputation as far as that goes[1], but many people are willing to make that gamble in order have a chance at retrieving their data. Not to mention that making the dysfunctional ransomware would be illegal, and authors (who therefore must be in it for profit) have motivation to avoid tarnishing their 'reputation', to extract the most payment. [1] https://www.google.com/search?q=does+paying+ransomware+work https://www.google.com/search?q=does+paying+ransomware+work