4 ms·

I think that time has passed. I've heard of too many cases of "ransomware" that just wipes your disks and asks for money that I wouldn't pay up. "True" ransomw

by billpg 7y ago

I think that time has passed. I've heard of too many cases of "ransomware" that just wipes your disks and asks for money that I wouldn't pay up. "True" ransomware requires a key management infrastructure with a capacity for delivering a service. Setting up a bitcoin recipient takes next to no resources. If you were criminally minded, what would you do? It would harm the ransomware-maker's reputation? Just pick a new name every week.

kkarakk 7y ago
you're assuming the knowledge on how to make a ransomware business is freely disseminated. it's not, there are very particular darknet websites and societies that keep each other updated on the latest techniques and likely targets for attack. It is trivial for them to hear about an attack where the person didn't follow through on the unlock and at that point they just freeze the offender out of their "club". It is that way in the ransomware/game cracking/early piracy(before release) "scene"
- billpg 7y ago
  I am an ordinary software engineer and I could build "ransomware" that does nothing but wipe the victim's disks and demands money be paid to a hard-coded bitcoin address in a convincing looking way. I don't need criminal contacts to do that.
  - kkarakk 7y ago
    sure you'd succeed...once. then how do you find another target that would also work with your delivery system? what companies have data sensitive enough for a ransom attack to work? Making a living off ransomware isn't easy if you're a lone wolf
    - billpg 7y ago
      In this hypothetical, I'm not delivering actual ransomware, but something that just demands money and will never actually release the files. But this is my original point. Someone hit by an attack has no way of knowing what type of attacker they are facing. Will the attacker return my files if I pay up? They might, but there's a very reasonable possibility they can't or won't. Remember, they just want your money. They have no reputation to maintain because they're already criminals.
      - kkarakk 7y ago
        No, the reputation they have to maintain is of following through on their threats ie maintain their aura of fear. If i KNOW a ransomware attack means an instant loss of data it takes away the sting - it just becomes the same as if the harddrive containing the data went poof. However if there is a chance for me to get the data back you better believe i will try as hard as i can to get the password from the datajackers.
dmurray 7y ago
At least one ransomware program gives you the option to pick one file to decrypt for free, to prove that the files can be recovered.
- billpg 7y ago
  Fine, I won't really delete the files, but move them all into a hidden ZIP file. When the user picks the one file to rescue, the code will pull that file out then delete the ZIP. You've got an hour to make your choice before the ZIP gets deleted anyway. Remember, ransomware-makers aren't providing a service anyone wants. They have inserted themselves into the system and only care about getting their victim's money.
- qwerty456127 7y ago
  I'd expect them to increase the price for decrypting this particular file you've chosen rather than actually decrypting it then.
qwerty456127 7y ago
> Just pick a new name every week. Can't a bitcoin (or whatever a cryptocurrency) recipient ID be used as a brand name?

by billpg 7y ago

kkarakk 7y ago

you're assuming the knowledge on how to make a ransomware business is freely disseminated. it's not, there are very particular darknet websites and societies that keep each other updated on the latest techniques and likely targets for attack. It is trivial for them to hear about an attack where the person didn't follow through on the unlock and at that point they just freeze the offender out of their "club". It is that way in the ransomware/game cracking/early piracy(before release) "scene"

billpg 7y ago
I am an ordinary software engineer and I could build "ransomware" that does nothing but wipe the victim's disks and demands money be paid to a hard-coded bitcoin address in a convincing looking way. I don't need criminal contacts to do that.
- kkarakk 7y ago
  sure you'd succeed...once. then how do you find another target that would also work with your delivery system? what companies have data sensitive enough for a ransom attack to work? Making a living off ransomware isn't easy if you're a lone wolf
  - billpg 7y ago
    In this hypothetical, I'm not delivering actual ransomware, but something that just demands money and will never actually release the files. But this is my original point. Someone hit by an attack has no way of knowing what type of attacker they are facing. Will the attacker return my files if I pay up? They might, but there's a very reasonable possibility they can't or won't. Remember, they just want your money. They have no reputation to maintain because they're already criminals.
    - kkarakk 7y ago
      No, the reputation they have to maintain is of following through on their threats ie maintain their aura of fear. If i KNOW a ransomware attack means an instant loss of data it takes away the sting - it just becomes the same as if the harddrive containing the data went poof. However if there is a chance for me to get the data back you better believe i will try as hard as i can to get the password from the datajackers.

dmurray 7y ago

At least one ransomware program gives you the option to pick one file to decrypt for free, to prove that the files can be recovered.

billpg 7y ago
Fine, I won't really delete the files, but move them all into a hidden ZIP file. When the user picks the one file to rescue, the code will pull that file out then delete the ZIP. You've got an hour to make your choice before the ZIP gets deleted anyway. Remember, ransomware-makers aren't providing a service anyone wants. They have inserted themselves into the system and only care about getting their victim's money.
qwerty456127 7y ago
I'd expect them to increase the price for decrypting this particular file you've chosen rather than actually decrypting it then.

qwerty456127 7y ago

> Just pick a new name every week. Can't a bitcoin (or whatever a cryptocurrency) recipient ID be used as a brand name?