5 ms·

So will companies start holding bitcoin as insurance on these kinds of attacks?

viraptor 9y ago
No. Paying doesn't guarantee you recover your data or that you won't get hit again. If you're getting to the stage where you're dealing with contracts and money, implementing a backup system is likely a simpler solution. Also btc price is a bit unpredictable. Would you really risk buying it ahead of time, not knowing if you'll ever need it? What if the price goes down and you need to buy extra anyway? Apart from very specific situations it just isn't a great investment.
- mmalone 9y ago
  I'm sort of bearish on most things blockchain but this seems like one of a very small number of things that zero-trust auto-executing contracts could be useful for. Someone could probably work out a mathematical proof of "if you transfer this much etherium the private key will be decoded." Heh.
  - matthewbauer 9y ago
    That's a lot of work for little reward, I think. Most of the time the idea is that the hackers have every incentive to decrypt or else word will spread that it doesn't work even if you pay so people will stop paying.
    - devrandomguy 9y ago
      Brown hat hackers have an incentive to create non-functional ransomware, to spread FUD on the legitimate ransomware. If news spreads that some ransomware does not actually decrypt the files after payment, then potential victims would have a stronger incentive to secure their systems, and a weaker incentive to stockpile ransom funds (wt actual f!) Then, the onus would once again be on the legitimate ransomware developers to prove their ability to do business, and some sort of Ethereum based automated contract might be an ideal tool for that.
      - viraptor 9y ago
        If the context is widespread ransomware infection, provable decryption is unlikely to make a difference. Attackers are unlikely to make money from people who know what Ethereum, or a smart contract is. Even taking those who know the meaning, very few could actually verify the application. The attacks work on those who didn't have protection and lost valuable data. Just sticking a "decryption guaranteed by Ethereum contract" will likely have the same effect on them.
21 9y ago
Yes: Several of London’s largest banks are looking to stockpile bitcoins in order to pay off cyber criminals who threaten to bring down their critical IT systems. https://www.theguardian.com/technology/2016/oct/22/city-banks-plan-to-hoard-bitcoins-to-help-them-pay-cyber-ransoms https://www.theguardian.com/technology/2016/oct/22/city-bank...
- viraptor 9y ago
  Keep in mind this article makes... Little sense the way it was written. The DDoS attack at the time was done in a way that could be replicated by anybody. Multiple control networks gave jobs to IoT devices without real authentication. That means anybody known to pay off attackers would immediately get attacked by another group using the same sources. Maybe there's some stockpile of Bitcoin "just in case", but it would require a very special situation - not a common DDoS they talk about.
  - 21 9y ago
    I was just pointing out that according to the article some London banks ARE buying bitcoin so that the ransom payment option is on the table in case of an emergency, and in fact they notified senior police officers about this activity (to get their blessing? to avoid the bitcoin buying look suspicious if they stumbled upon it?)
    - viraptor 9y ago
      I understand. I'm just pointing out why the article smells like bs and is technically invalid in many ways. Including the fact that police will not help you with a DDoS and is largely irrelevant in the discussion (apart from post mortem / following up after the attack). Also banks are playing with cryptocurrencies for quite a while now. London banks have ideas of private blockchains as well. Nobody would think it's suspicious that they buy some. The may be some truth in there, but this is a popular tech post. I'd look for more details than the guardian provides.
      - 9y ago
dredmorbius 9y ago
You've just made me consider that this could be an attempt to inflate BTC. Create a demand. The wallet wouldn't even ever have to be tapped. $300 is small fry, but an overall inflation on a strongly-leveraged BTC investment could allow an disconnected cashout.

No. Paying doesn't guarantee you recover your data or that you won't get hit again. If you're getting to the stage where you're dealing with contracts and money, implementing a backup system is likely a simpler solution. Also btc price is a bit unpredictable. Would you really risk buying it ahead of time, not knowing if you'll ever need it? What if the price goes down and you need to buy extra anyway? Apart from very specific situations it just isn't a great investment.

mmalone 9y ago
I'm sort of bearish on most things blockchain but this seems like one of a very small number of things that zero-trust auto-executing contracts could be useful for. Someone could probably work out a mathematical proof of "if you transfer this much etherium the private key will be decoded." Heh.
- matthewbauer 9y ago
  That's a lot of work for little reward, I think. Most of the time the idea is that the hackers have every incentive to decrypt or else word will spread that it doesn't work even if you pay so people will stop paying.
  - devrandomguy 9y ago
    Brown hat hackers have an incentive to create non-functional ransomware, to spread FUD on the legitimate ransomware. If news spreads that some ransomware does not actually decrypt the files after payment, then potential victims would have a stronger incentive to secure their systems, and a weaker incentive to stockpile ransom funds (wt actual f!) Then, the onus would once again be on the legitimate ransomware developers to prove their ability to do business, and some sort of Ethereum based automated contract might be an ideal tool for that.
    - viraptor 9y ago
      If the context is widespread ransomware infection, provable decryption is unlikely to make a difference. Attackers are unlikely to make money from people who know what Ethereum, or a smart contract is. Even taking those who know the meaning, very few could actually verify the application. The attacks work on those who didn't have protection and lost valuable data. Just sticking a "decryption guaranteed by Ethereum contract" will likely have the same effect on them.

21 9y ago

Yes: Several of London’s largest banks are looking to stockpile bitcoins in order to pay off cyber criminals who threaten to bring down their critical IT systems. https://www.theguardian.com/technology/2016/oct/22/city-banks-plan-to-hoard-bitcoins-to-help-them-pay-cyber-ransoms https://www.theguardian.com/technology/2016/oct/22/city-bank...

viraptor 9y ago
Keep in mind this article makes... Little sense the way it was written. The DDoS attack at the time was done in a way that could be replicated by anybody. Multiple control networks gave jobs to IoT devices without real authentication. That means anybody known to pay off attackers would immediately get attacked by another group using the same sources. Maybe there's some stockpile of Bitcoin "just in case", but it would require a very special situation - not a common DDoS they talk about.
- 21 9y ago
  I was just pointing out that according to the article some London banks ARE buying bitcoin so that the ransom payment option is on the table in case of an emergency, and in fact they notified senior police officers about this activity (to get their blessing? to avoid the bitcoin buying look suspicious if they stumbled upon it?)
  - viraptor 9y ago
    I understand. I'm just pointing out why the article smells like bs and is technically invalid in many ways. Including the fact that police will not help you with a DDoS and is largely irrelevant in the discussion (apart from post mortem / following up after the attack). Also banks are playing with cryptocurrencies for quite a while now. London banks have ideas of private blockchains as well. Nobody would think it's suspicious that they buy some. The may be some truth in there, but this is a popular tech post. I'd look for more details than the guardian provides.
    - 9y ago

dredmorbius 9y ago

You've just made me consider that this could be an attempt to inflate BTC. Create a demand. The wallet wouldn't even ever have to be tapped. $300 is small fry, but an overall inflation on a strongly-leveraged BTC investment could allow an disconnected cashout.