8 ms·
The No More Ransom Project
- aaron695 9y ago"Unfortunately, in many cases, once the ransomware has been released into your device there is little you can do unless you have a backup or security software in place." No, you can pay the ransom and get your data back. I know of little cases were it hasn't work (In fact the only one is the MongoDB issue where multiple actors overwrote previous actors, the original actors would have restored it in fact). I know many case studies where it has worked. Liers annoy me. (And I am fully aware they are lying to create an anti-tragedy of the commons strategy)
- Asdfbla 9y agoHow common is it that paying the ransom doesn't work? Seems bad for the business model of ransomware, though I guess competing malware writers don't necessarily feel compelled to keep the market intact if they can squeeze out a bit more for themselves without the effort of writing a functional decryption routine.
- rplnt 9y agoI think there were instances where the "service" went down after intervention (banned domains, etc). So no one to pay, no one to get keys from.
- croon 9y agoI believe the common rule is that paying works, as per the business reasons you mention. The issue is the victims on aggregate would rather not support the viability of that business. If no one has to pay, the business dies out. Perhaps a pipe dream, but less money at least means fewer actors in the space.
- mnw21cam 9y agoIt works if the good guys haven't shut down the C&C servers used to get the decryption key to the victim.
- LeifCarrotson 9y agoThis is why the phrase "We do not negotiate terrorists" makes sense as a general policy to advocate. It's weakened when we ignore it in individual cases.
- geofft 9y agoLike the prisoner's dilemma, it's a superrational strategy—it yields the best outcomes if you genuinely believe that everyone else is being superrational too. If you don't believe that, the rational thing to do is defect and protect your own interests as best as you can. In the case of superpowers and terrorists, there are usually few superpowers, and (usually) they believe each other to be smart and to have stability of the status quo in mind. In the case of individual ransomware victims, you have no such expectations.
- crdoconnor 9y agoThe good friday agreement was essentially brokered by ignoring it. That seemed preferable to me to the decades of sustained bombings. It seems to me that no government can make a fully plausible promise that they won't yield under pressure and, in any case, terrorism is extremely ill defined.
- alextheparrot 9y agoI believe the phrase is rational for and applied to ransom situations - just generally pursuing peace with opposing parties is not encapsulated in that phrase, to my understanding.
- geofft 9y agoWhat distinguishes an opposing party from a terrorist? (My answer would be, the success of their terrorism. If you are mostly unsuccessful, nobody needs to negotiate with you.)
- 21 9y agoThe Iraq journalist kidnapings from a decade ago showed that all governments negotiate with, and pay terrorists.
- mtmail 9y agoNotPetya/Petya/Netya are also known as 'wipers' because after reverse engineering it turned out the boot sector gets deleted rather than encrypted, so nobody can write a recovery routine. "Affected users are advised to refrain from paying the ransom as that would by no means help them decrypt their data. This advice is particularly true for the NotPetya incident, as the attackers have no means to restore victims’ data." http://www.securityweek.com/notpetya-destructive-wiper-disguised-ransomware http://www.securityweek.com/notpetya-destructive-wiper-disgu...
- deleted 9y ago[deleted]
- LeonM 9y agoThe ransom is usually quite small (i.e. <1k), so it might be considered a 'cheap' lesson to learn that you should keep your software up-to-date and secure your network. (With the exception of 0-days, but you can't blame anyone falling victim to that) My point is, the ransomware is just 'prove' that your computer is insecure. If criminals can encrypt your files, they can also steal it (i.e. upload it somewhere). So in some sense, the ransomware creators expose vulnerabilities that would have otherwise gone unnoticed.
- sarreph 9y agoI'm not sure if you're trying to say that the ("cheap lesson to learn") should be paid or not; ≈$1,000 is a lot of money for most people. I think the shock of having to pay it is enough to have the same effect — those affected can then hopefully use the decryption tool without having to directly fund criminals.
- geofft 9y agoThe target market of ransomware is supposedly businesses, not individual people—partly because businesses can afford the ransom and have clear incentives to get their data back reliably. I guess I have no idea who it targets in practice. Are there lots of individual home users who fall victim to ransomware?
- yeukhon 9y agoYes. WannaCry is one such. Randsomware is pretty common to home users in the past, at least. Back then it was quite easy to convince someone to click on “Warning! Your computer maybe infected! Try our software” pop-up. Then if your computer gets locked up, the screen will say “call tech support!” There was a claim against Kaspersky [1]. I don’t know if it is really true, but I personally believe that the AV industry does shady things out there, pay some blackhat to spread virus/malware, so consumers can rely on AV. [1]: https://www.reuters.com/article/us-kaspersky-rivals/exclusive-ex-employees-russian-antivirus-firm-faked-malware-to-harm-rivals-idUSKCN0QJ1CR20150814 https://www.reuters.com/article/us-kaspersky-rivals/exclusiv...
- campuscodi 9y agoAlso check out: https://id-ransomware.malwarehunterteam.com/ https://id-ransomware.malwarehunterteam.com/
- nukeop 9y agoWhat if there was a rapidly spreading ransomware that would not decrypt the user's files after ransom is paid? Ransomwares paradoxically require a certain level of trust in the attacker, that's why they often have their own tech support people and actively answer victims' questions. If there was a deceitful ransomware in the wild, it could help reduce trust in future attackers, reducing the chance of future victims paying up, and helping to make ransomware a thing of the past.
- omginternets 9y agoIncentives matter, as the saying goes. Why would you refuse to decrypt and risk the news spreading that XYZ-Ransomeware doesn't follow through on its promise to decrypt? What is there to be gained?
- gtsteve 9y agoThis has already happened - NotPetya claimed to be ransomware but the instructions given weren't usable. It actually turned out to be a wiper. https://www.kaspersky.com/blog/expetr-for-b2b/17343/ https://www.kaspersky.com/blog/expetr-for-b2b/17343/ https://www.theregister.co.uk/2017/06/28/petya_notpetya_ransomware/ https://www.theregister.co.uk/2017/06/28/petya_notpetya_rans...
- bunderbunder 9y agoConsider 419 scams. They have nearly zero credibility, and also lack the kind of leverage you can get out of threatening that someone will never see their kid's baby photos again. Yet even they are still profitable enough that many people think they're a worthwhile operation to run. Ransomware might have a higher bottom line, owing to the greater technical skill involved in operating such a racket, but still, in a world where 419 scams persist, it's hard for me to believe that you can damage ransomware's credibility to the point where it's no longer profitable. More likely, such an endeavor would end up destroying more people's data than it saves.
- kome 9y agoFor those interested, there are also commercial alternatives to help with ransomware decryption: https://products.drweb.com/decryption_from_ransomware/ https://products.drweb.com/decryption_from_ransomware/ But I have no idea about the cost.
- chrisaycock 9y agoA repo of decryption keys is very useful because it obsoletes specific attacks without relying on the user to patch his computer ahead of time. Additionally, ransomware encryption can be stopped at the file-system level: https://www.cryptodrop.org https://www.cryptodrop.org
- b3lvedere 9y agoHeh.. weird coincedence. I'm currently busy restoring customer backup files, because a funny little program decided to transform everything in to ...johntrudl.com].java files.
- stablemap 9y agoLots of discussion last time; quite a while ago, though: https://news.ycombinator.com/item?id=12831430 https://news.ycombinator.com/item?id=12831430
- brndnmtthws 9y agoI would just dispose of my computer if were hacked. All my valuables are backed up anyway. If my machine becomes compromised, why on earth would I want to continue using that machine?
- skygazer 9y agoBecause you're clever enough to restore from a clean backup, and double check you're patched up and not running untrusted code. You're on HN, after all.
- brndnmtthws 9y agoFiguratively dispose (i.e., reinstall the OS).
- tgb 9y agoI just want to know one thing: is Dropbox a sufficient backup strategy to prevent this problem? Obviously it's enough to prevent a naive ransomeware. Can they get around Dropbox's automatic 30 day version history by some means? They can presumably have total control over my account.
- derekp7 9y agoThe only protection I would trust, is a separate system makes inbound connections to my computer to pull a backup. Or push a backup to another computer, through a login ID that lets me write a backup but not delete / alter previous ones.
- tgb 9y agoYes, that sounds like what I'd like. But where can I find something like that accessible to consumers? Are there roll-your-own methods using AWS or similar that have reasonable costs?
- sekh60 9y agoWhat I do is a little complex, but works fairly well. I store my data in CephFS, mount that read-only (CephX permission also allow only read access) on a Linux box with a ZFS array which uses borg to copy from the mount to the array. The backup box also runs crashplan to back up from the mount.