5 ms·
It's always seemed like the best way to end ransomware is to launch hundreds of variants that demand money but don't actually decrypt anything. Unethical, to be
by sillysaurus3 9y ago
It's always seemed like the best way to end ransomware is to launch hundreds of variants that demand money but don't actually decrypt anything. Unethical, to be sure, but eventually people would learn not to give them money.
All the competent ransomware authors are probably quite unhappy whenever a defective ransomware strain pops up.
- comboy 9y agoIf it gets big enough then people just hear from each other if paying unlocks the data or not. The best way to end ransomware is to get serious about security. In many cases, being attacked by a ransomware, is paying a low price compared to if it was a targeted attack. edit: Also, I imagine it gets easier after you wrote one i.e. many ransomewares come from the same author. So he could gain a reputation by signing messages saying that yes, this is our ransomware, we always unlock after receiving the payment.
- notgood 9y ago>If it gets big enough then people just hear from each other if paying unlocks the data or not. The idea would be to create "fake" ransomware that looks exactly like the real one >The best way to end ransomware is to get serious about security No matter how serious you get there always gonna be bugs, there isn't a single piece of mass distributed software in human history without bugs. That said, we should try to improve security of software but expecting it to be THE solution is wrong. >Also, I imagine it gets easier after you wrote one i.e. many ransomewares come from the same author. So he could gain a reputation by signing messages saying that yes, this is our ransomware, we always unlock after receiving the payment. Forging a signature is not that hard.
- comboy 9y agoIf forging digital signature is not that hard, then you can release some great scientific paper moving crypto decades ahead, or alternatively you can make billions.
- notgood 9y agoI was talking about pixel-made signatures; you know, the one the user actually sees when the computer its already infected; not cryptography between public/private keys; otherwise its a chicken and egg problem; how do you know what signature its the "real"; you google it and hope nobody added its own search results? Go to the official website of the ransomware developer?
- comboy 9y agoThe ransomware can present the key fingerprint for example. But even without it, there are so many options, e.g. timestamp signed message on the blockchain before the release. After just one confirmed message you don't care about pretenders because people can check if the signature matches with the previous message.
- bcjordan 9y agoIs it not cryptographically possible to create a transparent provably-operational decryptor on top of something like ethereum?
- MichaelGG 9y agoIt's a marketing issue. People likely to get hit with ransomware are incredibly unlikely to understand what that means. Hell, even main devs have trouble writing contracts, so even if a user knew there was a smart contract, verifying it would be another thing. So it'd get reduced to "guys on Twitter said this one works". I like the idea though.
- rodarmor 9y agoSince you can't store the private key needed to decrypt the files in ethereum, I can't think of how to do this. All blockchain state is public, since it needs to be calculated by and verified by all nodes, so there's nowhere to stash a private key without revealing it.
- dzhiurgis 9y agoIt's like saying best way to fight heroin addicts is to supply market with poisoned heroin. No heroin users - no problems!
- drhodes 9y agoThe US government did this with alcohol during prohibition, > by the time Prohibition ended in 1933, the federal poisoning program, by some estimates, had killed at least 10,000 people. http://www.slate.com/articles/health_and_science/medical_examiner/2010/02/the_chemists_war.html http://www.slate.com/articles/health_and_science/medical_exa...
- rickycook 9y agoexcept that getting malware isn't addictive...
- dzhiurgis 9y agoYour information is tho
- notgood 9y agoA non-strawman analogy would be to sell fake heroin that looks exactly like heroin but does nothing at all. This analogy is more exact because the resource you are wasting its the same: money (not lives as in yours)
- mwilcox 9y agoIt's a lot more likely that the attackers make money via the markets than via a direct ransom.
- deleted 9y ago[deleted]