6 ms·

Don't the hackers almost always just take you money and demand more without actually decrypting anything?

deleted 8y ago
[deleted]
SolarNet 8y ago
No, that is counter to their making money. The way to make money through ransoming something on a regular basis is to always ensure you follow through. There are actual cases in history of ransomers attacking fellow ransomers who don't follow through for hurting the shared business model.
- billpg 8y ago
  I think that time has passed. I've heard of too many cases of "ransomware" that just wipes your disks and asks for money that I wouldn't pay up. "True" ransomware requires a key management infrastructure with a capacity for delivering a service. Setting up a bitcoin recipient takes next to no resources. If you were criminally minded, what would you do? It would harm the ransomware-maker's reputation? Just pick a new name every week.
  - kkarakk 8y ago
    you're assuming the knowledge on how to make a ransomware business is freely disseminated. it's not, there are very particular darknet websites and societies that keep each other updated on the latest techniques and likely targets for attack. It is trivial for them to hear about an attack where the person didn't follow through on the unlock and at that point they just freeze the offender out of their "club". It is that way in the ransomware/game cracking/early piracy(before release) "scene"
    - billpg 8y ago
      I am an ordinary software engineer and I could build "ransomware" that does nothing but wipe the victim's disks and demands money be paid to a hard-coded bitcoin address in a convincing looking way. I don't need criminal contacts to do that.
      - kkarakk 7y ago
        sure you'd succeed...once. then how do you find another target that would also work with your delivery system? what companies have data sensitive enough for a ransom attack to work? Making a living off ransomware isn't easy if you're a lone wolf
        billpg 7y ago
        In this hypothetical, I'm not delivering actual ransomware, but something that just demands money and will never actually release the files. But this is my original point. Someone hit by an attack has no way of knowing what type of attacker they are facing. Will the attacker return my files if I pay up? They might, but there's a very reasonable possibility they can't or won't. Remember, they just want your money. They have no reputation to maintain because they're already criminals.
        kkarakk 7y ago
        No, the reputation they have to maintain is of following through on their threats ie maintain their aura of fear. If i KNOW a ransomware attack means an instant loss of data it takes away the sting - it just becomes the same as if the harddrive containing the data went poof. However if there is a chance for me to get the data back you better believe i will try as hard as i can to get the password from the datajackers.
  - dmurray 8y ago
    At least one ransomware program gives you the option to pick one file to decrypt for free, to prove that the files can be recovered.
    - billpg 8y ago
      Fine, I won't really delete the files, but move them all into a hidden ZIP file. When the user picks the one file to rescue, the code will pull that file out then delete the ZIP. You've got an hour to make your choice before the ZIP gets deleted anyway. Remember, ransomware-makers aren't providing a service anyone wants. They have inserted themselves into the system and only care about getting their victim's money.
    - qwerty456127 7y ago
      I'd expect them to increase the price for decrypting this particular file you've chosen rather than actually decrypting it then.
  - qwerty456127 7y ago
    > Just pick a new name every week. Can't a bitcoin (or whatever a cryptocurrency) recipient ID be used as a brand name?
- wpietri 8y ago
  That's only true if you have an established brand that is hard to forge. Or if enforcement of the shared brand is reliable enough to deter exploiters. But the whole point of ransomware attacks is that they're hard to trace and are being performed by people who are insensitive to enforcement. So my expectation is that it's a crapshoot and always will be.
- asdff 8y ago
  Sounds like you wouldn't need clout in the ransomeware community if you snagged a big enough cow to keep milking. Whats to stop you from just not following through? It's a file system and you are a completely anonymous hacker located anywhere on earth, not a physical hostage that the CIA could extract and shoot you in the head in the process. There's no incentive at all to follow through, you can lock it again and disappear into thin air if you wanted.
teekert 8y ago
That would be an insta-kill of their business-model. In reality they are very helpful and are known to even accept post-deadline payments etc.
- cyphar 8y ago
  Who are their returning customers? It's strange to refer to literal extortion as a "business model".
  - jacobush 8y ago
    People saving on education and best practices.
  - LeftTurnSignal 8y ago
    In a previous life, I supported a local govt and I had a judge get a different variant of the cryptowall virus 6 times before I took his "work" PC away. His real work PC was controlled by the state and not me, hence the quotes. That's the type of person who is a repeat offender. He could never tell me how he got the virus, but some recon between email and internet history showed otherwise. He loved clicking on EVERYTHING while "researching" cases. I get the research, but a lot of court cases probably aren't on page 20 of google on some shady half English sites either. Lots of fun in local government. /also I just restored from backups each time but they were ready to pay to have "all their data restored."
    - shearskill 7y ago
      Reminds me of doing tech support for my father in law the lawyer. Clicked on everything, including tons of porn malware. I fixed and added what security and regular backups I could and never said a word about it. Several re-installs later he put me in his will, worked out well for everyone.
sudhirj 8y ago
Yes and no. One offs that are personally targeted at you or anonymous scams, it makes sense to just keep asking for more money. But when ransomware has a name, it needs a “good” reputation to be successful. Just paying must be a well known and publicised way to get your files back - that’s what makes it easier to everyone to just pay. If the ransomware gains a reputation for not holding up their end, no one will pay.
- asdff 8y ago
  Why does a ransomware need a name and reputation? The results should speak for themselves if the program works. If the files are critical, people will pay as much as they possibly can.
  - sudhirj 7y ago
    People will not pay unless they believe the files will be unlocked, which they will do en mass only if they have some publicity with positive indications it’ll work or at least a lack of negative indications that it won’t. If ransomware gets a reputation of not unlocking on payment, then it degenerates into a virus and you’ll have mainstream news media telling people not to bother paying.
cbzoiav 8y ago
That might actually be where these companies are useful. They can do that to you because there is no benefit to them to decrypting (and a cost/risk that these actions aid in them getting caught). If a single company handles hundreds of ransoms then not decrypting for them removes a lot of future revenue potential.

deleted 8y ago

[deleted]

No, that is counter to their making money. The way to make money through ransoming something on a regular basis is to always ensure you follow through. There are actual cases in history of ransomers attacking fellow ransomers who don't follow through for hurting the shared business model.

billpg 8y ago
I think that time has passed. I've heard of too many cases of "ransomware" that just wipes your disks and asks for money that I wouldn't pay up. "True" ransomware requires a key management infrastructure with a capacity for delivering a service. Setting up a bitcoin recipient takes next to no resources. If you were criminally minded, what would you do? It would harm the ransomware-maker's reputation? Just pick a new name every week.
- kkarakk 8y ago
  you're assuming the knowledge on how to make a ransomware business is freely disseminated. it's not, there are very particular darknet websites and societies that keep each other updated on the latest techniques and likely targets for attack. It is trivial for them to hear about an attack where the person didn't follow through on the unlock and at that point they just freeze the offender out of their "club". It is that way in the ransomware/game cracking/early piracy(before release) "scene"
  - billpg 8y ago
    I am an ordinary software engineer and I could build "ransomware" that does nothing but wipe the victim's disks and demands money be paid to a hard-coded bitcoin address in a convincing looking way. I don't need criminal contacts to do that.
    - kkarakk 7y ago
      sure you'd succeed...once. then how do you find another target that would also work with your delivery system? what companies have data sensitive enough for a ransom attack to work? Making a living off ransomware isn't easy if you're a lone wolf
      - billpg 7y ago
        In this hypothetical, I'm not delivering actual ransomware, but something that just demands money and will never actually release the files. But this is my original point. Someone hit by an attack has no way of knowing what type of attacker they are facing. Will the attacker return my files if I pay up? They might, but there's a very reasonable possibility they can't or won't. Remember, they just want your money. They have no reputation to maintain because they're already criminals.
        kkarakk 7y ago
        No, the reputation they have to maintain is of following through on their threats ie maintain their aura of fear. If i KNOW a ransomware attack means an instant loss of data it takes away the sting - it just becomes the same as if the harddrive containing the data went poof. However if there is a chance for me to get the data back you better believe i will try as hard as i can to get the password from the datajackers.
- dmurray 8y ago
  At least one ransomware program gives you the option to pick one file to decrypt for free, to prove that the files can be recovered.
  - billpg 8y ago
    Fine, I won't really delete the files, but move them all into a hidden ZIP file. When the user picks the one file to rescue, the code will pull that file out then delete the ZIP. You've got an hour to make your choice before the ZIP gets deleted anyway. Remember, ransomware-makers aren't providing a service anyone wants. They have inserted themselves into the system and only care about getting their victim's money.
  - qwerty456127 7y ago
    I'd expect them to increase the price for decrypting this particular file you've chosen rather than actually decrypting it then.
- qwerty456127 7y ago
  > Just pick a new name every week. Can't a bitcoin (or whatever a cryptocurrency) recipient ID be used as a brand name?
wpietri 8y ago
That's only true if you have an established brand that is hard to forge. Or if enforcement of the shared brand is reliable enough to deter exploiters. But the whole point of ransomware attacks is that they're hard to trace and are being performed by people who are insensitive to enforcement. So my expectation is that it's a crapshoot and always will be.
asdff 8y ago
Sounds like you wouldn't need clout in the ransomeware community if you snagged a big enough cow to keep milking. Whats to stop you from just not following through? It's a file system and you are a completely anonymous hacker located anywhere on earth, not a physical hostage that the CIA could extract and shoot you in the head in the process. There's no incentive at all to follow through, you can lock it again and disappear into thin air if you wanted.

teekert 8y ago

That would be an insta-kill of their business-model. In reality they are very helpful and are known to even accept post-deadline payments etc.

cyphar 8y ago
Who are their returning customers? It's strange to refer to literal extortion as a "business model".
- jacobush 8y ago
  People saving on education and best practices.
- LeftTurnSignal 8y ago
  In a previous life, I supported a local govt and I had a judge get a different variant of the cryptowall virus 6 times before I took his "work" PC away. His real work PC was controlled by the state and not me, hence the quotes. That's the type of person who is a repeat offender. He could never tell me how he got the virus, but some recon between email and internet history showed otherwise. He loved clicking on EVERYTHING while "researching" cases. I get the research, but a lot of court cases probably aren't on page 20 of google on some shady half English sites either. Lots of fun in local government. /also I just restored from backups each time but they were ready to pay to have "all their data restored."
  - shearskill 7y ago
    Reminds me of doing tech support for my father in law the lawyer. Clicked on everything, including tons of porn malware. I fixed and added what security and regular backups I could and never said a word about it. Several re-installs later he put me in his will, worked out well for everyone.

sudhirj 8y ago

Yes and no. One offs that are personally targeted at you or anonymous scams, it makes sense to just keep asking for more money. But when ransomware has a name, it needs a “good” reputation to be successful. Just paying must be a well known and publicised way to get your files back - that’s what makes it easier to everyone to just pay. If the ransomware gains a reputation for not holding up their end, no one will pay.

asdff 8y ago
Why does a ransomware need a name and reputation? The results should speak for themselves if the program works. If the files are critical, people will pay as much as they possibly can.
- sudhirj 7y ago
  People will not pay unless they believe the files will be unlocked, which they will do en mass only if they have some publicity with positive indications it’ll work or at least a lack of negative indications that it won’t. If ransomware gets a reputation of not unlocking on payment, then it degenerates into a virus and you’ll have mainstream news media telling people not to bother paying.

cbzoiav 8y ago

That might actually be where these companies are useful. They can do that to you because there is no benefit to them to decrypting (and a cost/risk that these actions aid in them getting caught). If a single company handles hundreds of ransoms then not decrypting for them removes a lot of future revenue potential.