5 ms·

What if there was a rapidly spreading ransomware that would not decrypt the user's files after ransom is paid? Ransomwares paradoxically require a certain level

by nukeop 9y ago

What if there was a rapidly spreading ransomware that would not decrypt the user's files after ransom is paid? Ransomwares paradoxically require a certain level of trust in the attacker, that's why they often have their own tech support people and actively answer victims' questions. If there was a deceitful ransomware in the wild, it could help reduce trust in future attackers, reducing the chance of future victims paying up, and helping to make ransomware a thing of the past.

omginternets 9y ago
Incentives matter, as the saying goes. Why would you refuse to decrypt and risk the news spreading that XYZ-Ransomeware doesn't follow through on its promise to decrypt? What is there to be gained?
- schoen 9y ago
  It's a proposal for ransomware that deliberately sabotages the credibility of other ransomware.
  - yorwba 9y ago
    I'm not sure that would work, though. "Credible" randomware could pretty easily demonstrate that they do decrypt after payment, because someone will always try paying.
gtsteve 9y ago
This has already happened - NotPetya claimed to be ransomware but the instructions given weren't usable. It actually turned out to be a wiper. https://www.kaspersky.com/blog/expetr-for-b2b/17343/ https://www.kaspersky.com/blog/expetr-for-b2b/17343/ https://www.theregister.co.uk/2017/06/28/petya_notpetya_ransomware/ https://www.theregister.co.uk/2017/06/28/petya_notpetya_rans...
bunderbunder 9y ago
Consider 419 scams. They have nearly zero credibility, and also lack the kind of leverage you can get out of threatening that someone will never see their kid's baby photos again. Yet even they are still profitable enough that many people think they're a worthwhile operation to run. Ransomware might have a higher bottom line, owing to the greater technical skill involved in operating such a racket, but still, in a world where 419 scams persist, it's hard for me to believe that you can damage ransomware's credibility to the point where it's no longer profitable. More likely, such an endeavor would end up destroying more people's data than it saves.
- Fnoord 9y ago
  The reason 419 scams have near zero credibility (with grammar errors, terrible English, etc) is to increase the signal to noise ratio for the scammers. The less intelligent people who fall for it and are scammable won't be put off since the red flags and bells are ringing. So if they reply, the scammer knows he's got bait. Bots make clever use of this M.O. as well; they tend to behave a bit clumsy, fitting the character of a replier, and get away with it.

by nukeop 9y ago

omginternets 9y ago

Incentives matter, as the saying goes. Why would you refuse to decrypt and risk the news spreading that XYZ-Ransomeware doesn't follow through on its promise to decrypt? What is there to be gained?

schoen 9y ago
It's a proposal for ransomware that deliberately sabotages the credibility of other ransomware.
- yorwba 9y ago
  I'm not sure that would work, though. "Credible" randomware could pretty easily demonstrate that they do decrypt after payment, because someone will always try paying.

gtsteve 9y ago

This has already happened - NotPetya claimed to be ransomware but the instructions given weren't usable. It actually turned out to be a wiper. https://www.kaspersky.com/blog/expetr-for-b2b/17343/ https://www.kaspersky.com/blog/expetr-for-b2b/17343/ https://www.theregister.co.uk/2017/06/28/petya_notpetya_ransomware/ https://www.theregister.co.uk/2017/06/28/petya_notpetya_rans...

bunderbunder 9y ago

Consider 419 scams. They have nearly zero credibility, and also lack the kind of leverage you can get out of threatening that someone will never see their kid's baby photos again. Yet even they are still profitable enough that many people think they're a worthwhile operation to run. Ransomware might have a higher bottom line, owing to the greater technical skill involved in operating such a racket, but still, in a world where 419 scams persist, it's hard for me to believe that you can damage ransomware's credibility to the point where it's no longer profitable. More likely, such an endeavor would end up destroying more people's data than it saves.

Fnoord 9y ago
The reason 419 scams have near zero credibility (with grammar errors, terrible English, etc) is to increase the signal to noise ratio for the scammers. The less intelligent people who fall for it and are scammable won't be put off since the red flags and bells are ringing. So if they reply, the scammer knows he's got bait. Bots make clever use of this M.O. as well; they tend to behave a bit clumsy, fitting the character of a replier, and get away with it.