3 ms·

I have to wonder if, in macro economic terms, we'd be better off spending whatever is necessary to successfully investigate and prosecute scammers/telemarketers

I have to wonder if, in macro economic terms, we'd be better off spending whatever is necessary to successfully investigate and prosecute scammers/telemarketers/ransomers.

bluGill 7y ago
We are best off not paying them regardless: if there is no payout the bad actors will give up the attack. If you are in a group that pays out target them. It doesn't pay to target someone who has good backups (though it might not be worth checking if infecting everyone is easy)
- crankylinuxuser 7y ago
  >if there is no payout the bad actors will give up the attack I'd argue that isn't true. Ransomware is a form of terror in the form of "losing everything". And that threat of impending loss combined with 'backups are hard wahhhh' and the fact that no Corp I know backs up user machines... As a numbers game, it pays. Well. And even if it didn't, some still hack for the "lulz".
  - wpietri 7y ago
    Definitely. Look at all the people pursuing "make money fast" scams. Some people will happily do anything they think might make them a buck. Not paying out will help, of course, but it doesn't eliminate the problem.
    - bluGill 7y ago
      When there is no money in it nobody will be developing the exploits that make it easy. There is a large difference between buying a recent vulnerability and exploiting it vs finding a vulnerability.
  - davinic 7y ago
    >>no Corp I know backs up user machines Most of the orgs I've worked at (for at least the last decade) map the local profile to a network share, which is definitely backed up. The only things not backed up would be saved outside that folder structure, but the organizations have always been clear about that.
- nullc 7y ago
  The attack is inexpensive enough that even if 0.001% pay it's probably still worth doing. Even if you criminalize paying you'll still have a tiny portion that do.
  - nitwit005 7y ago
    For takeovers of larger systems, probably not. They're clearly finding vulnerabilities/targets, doing some minimal investigation to set a price to charge them, and some other basic effort. Doing it 10000 times for a single payout probably wouldn't be worth it.
    - sokoloff 7y ago
      1 / .001% = 100,000
      - nitwit005 7y ago
        I mentioned a lower value to indicate it definitely wasn't worth it.
randogogogo 7y ago
Some of that is going on. I've heard of some orgs being asked to pay a ransom in hopes of picking up a trail to the perpetrators following the BitCoin. https://www.fbi.gov/news/stories/ransomware-abettor-sentenced-120618 https://www.fbi.gov/news/stories/ransomware-abettor-sentence...
tracker1 7y ago
One problem with that... international borders.

I have to wonder if, in macro economic terms, we'd be better off spending whatever is necessary to successfully investigate and prosecute scammers/telemarketers/ransomers.

bluGill 7y ago

We are best off not paying them regardless: if there is no payout the bad actors will give up the attack. If you are in a group that pays out target them. It doesn't pay to target someone who has good backups (though it might not be worth checking if infecting everyone is easy)

crankylinuxuser 7y ago
>if there is no payout the bad actors will give up the attack I'd argue that isn't true. Ransomware is a form of terror in the form of "losing everything". And that threat of impending loss combined with 'backups are hard wahhhh' and the fact that no Corp I know backs up user machines... As a numbers game, it pays. Well. And even if it didn't, some still hack for the "lulz".
- wpietri 7y ago
  Definitely. Look at all the people pursuing "make money fast" scams. Some people will happily do anything they think might make them a buck. Not paying out will help, of course, but it doesn't eliminate the problem.
  - bluGill 7y ago
    When there is no money in it nobody will be developing the exploits that make it easy. There is a large difference between buying a recent vulnerability and exploiting it vs finding a vulnerability.
- davinic 7y ago
  >>no Corp I know backs up user machines Most of the orgs I've worked at (for at least the last decade) map the local profile to a network share, which is definitely backed up. The only things not backed up would be saved outside that folder structure, but the organizations have always been clear about that.
nullc 7y ago
The attack is inexpensive enough that even if 0.001% pay it's probably still worth doing. Even if you criminalize paying you'll still have a tiny portion that do.
- nitwit005 7y ago
  For takeovers of larger systems, probably not. They're clearly finding vulnerabilities/targets, doing some minimal investigation to set a price to charge them, and some other basic effort. Doing it 10000 times for a single payout probably wouldn't be worth it.
  - sokoloff 7y ago
    1 / .001% = 100,000
    - nitwit005 7y ago
      I mentioned a lower value to indicate it definitely wasn't worth it.

randogogogo 7y ago

Some of that is going on. I've heard of some orgs being asked to pay a ransom in hopes of picking up a trail to the perpetrators following the BitCoin. https://www.fbi.gov/news/stories/ransomware-abettor-sentenced-120618 https://www.fbi.gov/news/stories/ransomware-abettor-sentence...

tracker1 7y ago

One problem with that... international borders.