6 ms·

In the real world protection rackets are a stable business. You either pay up and are protected or your business gets messed up. No sane criminal would xerox th

In the real world protection rackets are a stable business. You either pay up and are protected or your business gets messed up. No sane criminal would xerox the client list, split from the boss and also try to extort money - it is unhealthy as the turf will be defended. In the online world there is no concept of local. You can't protect your clients. But then, why should clients pay up - there is an infinite supply of copycats.

lifeisstillgood 7y ago
I cannot upvote this enough - a deep insight into the problem.
andybak 7y ago
So would a valid defence strategy be for a white or gray hat to send out millions of these threats (maybe linked to an invalid payment method so it became impossible to pay up). Everyone would get so many of them that the "genuine" threats would get lost among the fake ones. Alternatively somebody uses the same technique to send massive amounts of fake Adsense traffic to multiple businesses without any warning thus forcing Google to improve their customer service or validation algorithms...
- inetknght 7y ago
  > Everyone would get so many of them that the "genuine" threats would get lost among the fake ones. So the internet will turn into the United States Postal Service then w.r.t. advertisements vs legitimate correspondence?
  - saagarjha 7y ago
    Surely in many people’s spam folders this is already the case?
- manmal 7y ago
  I can already see my spam folder being made up of 100% extortions and threats of varying severity. A grizzly thought.
skrebbel 7y ago
> why should clients pay up Because otherwise their ad income stops. How does "I might get extorted again by someone else" factor into this?
- ergo14 7y ago
  And what prevents them from asking again next week. Or forging account ban regardless of ransom.
  - Dylan16807 7y ago
    You still probably get the best outcomes if you're willing to pay sufficiently credible threats a couple times.
  - staticassertion 7y ago
    We don't typically see that with ransomeware so I don't know why we'd see that with other types of extortion.
    - ergo14 7y ago
      With ransomware if you get hacked you usually fix your defenses.
  - gsich 7y ago
    Or a different extortionist comes along next week?
  - viraptor 7y ago
    The whole scheme would collapse. It only works as long as people reasonably believe paying will solve the problem for a long while. This is why many ransomware campaigns pretty much run a callcentre with support for how to easily buy BTC and make the transfer.
    - djannzjkzxn 7y ago
      If there’s only one group running the scheme it works, but if there are many, it becomes very difficult to coordinate and limit repeated demands. Soft of like how oil producers can only keep the price up if everyone joins the cartel. Each member will make more money if they defect.
hutzlibu 7y ago
"there is an infinite supply of copycats. " No there is not, as the number of botnets is big, but limited. And I can imagine something like online turfs to actually happen, with criminal hacker groups setting up areas. And taking other groups down, if they mess with their turf. (afaik some crackers take already good care of their botnets so they do not get under the control of other groups and effectivly remote admin their bot computers and patching) Now while there is never such a thing as 100% security, right now the average number is frightening low. So the root problem is that the average tech stack is just too vulnerable. There is way too much truth in that: https://xkcd.com/2166/ https://xkcd.com/2166/ And our government agencies don't seem too eager to change that.
- thenewnewguy 7y ago
  The same botnet can back an infinite number of these ransom notices, because when you get one of these ransom notices you have no way of knowing if the ransom notice you got today is the same botnet you paid off last week but with a different name. Add in the fact that there are botnets available to rent, and you create a near-infinite supply.
  - hutzlibu 7y ago
    Sure thing. But that is allways the thing with ransom. You don't know if paying once is enough. But also the criminals know, there is only a certain amount of money to be extracted from their victims.
    - malka 7y ago
      IRL, if another gang threatens me, I can go to the first I paid protection for, and usually they try to convince the other gang that, no, they should not do that. There is no such thing online.
      - sfj 7y ago
        Why not? Wouldn't you be able to forward contact info from one group to another?
aequitas 7y ago
Security companies have a pretty good grasp of how trustworthy an aversary you're dealing with. So if have doubt about whether to pay up for the cryptolocker ransomware that just infected your corporate network you can always give them a call. As happened recently with a Dutch University. https://www.maastrichtuniversity.nl/um-cyber-attack-symposium-%E2%80%93-lessons-learnt https://www.maastrichtuniversity.nl/um-cyber-attack-symposiu...
deleted 7y ago
[deleted]

lifeisstillgood 7y ago

I cannot upvote this enough - a deep insight into the problem.

andybak 7y ago

So would a valid defence strategy be for a white or gray hat to send out millions of these threats (maybe linked to an invalid payment method so it became impossible to pay up). Everyone would get so many of them that the "genuine" threats would get lost among the fake ones. Alternatively somebody uses the same technique to send massive amounts of fake Adsense traffic to multiple businesses without any warning thus forcing Google to improve their customer service or validation algorithms...

inetknght 7y ago
> Everyone would get so many of them that the "genuine" threats would get lost among the fake ones. So the internet will turn into the United States Postal Service then w.r.t. advertisements vs legitimate correspondence?
- saagarjha 7y ago
  Surely in many people’s spam folders this is already the case?
manmal 7y ago
I can already see my spam folder being made up of 100% extortions and threats of varying severity. A grizzly thought.

skrebbel 7y ago

> why should clients pay up Because otherwise their ad income stops. How does "I might get extorted again by someone else" factor into this?

ergo14 7y ago
And what prevents them from asking again next week. Or forging account ban regardless of ransom.
- Dylan16807 7y ago
  You still probably get the best outcomes if you're willing to pay sufficiently credible threats a couple times.
- staticassertion 7y ago
  We don't typically see that with ransomeware so I don't know why we'd see that with other types of extortion.
  - ergo14 7y ago
    With ransomware if you get hacked you usually fix your defenses.
- gsich 7y ago
  Or a different extortionist comes along next week?
- viraptor 7y ago
  The whole scheme would collapse. It only works as long as people reasonably believe paying will solve the problem for a long while. This is why many ransomware campaigns pretty much run a callcentre with support for how to easily buy BTC and make the transfer.
  - djannzjkzxn 7y ago
    If there’s only one group running the scheme it works, but if there are many, it becomes very difficult to coordinate and limit repeated demands. Soft of like how oil producers can only keep the price up if everyone joins the cartel. Each member will make more money if they defect.

hutzlibu 7y ago

"there is an infinite supply of copycats. " No there is not, as the number of botnets is big, but limited. And I can imagine something like online turfs to actually happen, with criminal hacker groups setting up areas. And taking other groups down, if they mess with their turf. (afaik some crackers take already good care of their botnets so they do not get under the control of other groups and effectivly remote admin their bot computers and patching) Now while there is never such a thing as 100% security, right now the average number is frightening low. So the root problem is that the average tech stack is just too vulnerable. There is way too much truth in that: https://xkcd.com/2166/ https://xkcd.com/2166/ And our government agencies don't seem too eager to change that.

thenewnewguy 7y ago
The same botnet can back an infinite number of these ransom notices, because when you get one of these ransom notices you have no way of knowing if the ransom notice you got today is the same botnet you paid off last week but with a different name. Add in the fact that there are botnets available to rent, and you create a near-infinite supply.
- hutzlibu 7y ago
  Sure thing. But that is allways the thing with ransom. You don't know if paying once is enough. But also the criminals know, there is only a certain amount of money to be extracted from their victims.
  - malka 7y ago
    IRL, if another gang threatens me, I can go to the first I paid protection for, and usually they try to convince the other gang that, no, they should not do that. There is no such thing online.
    - sfj 7y ago
      Why not? Wouldn't you be able to forward contact info from one group to another?

aequitas 7y ago

Security companies have a pretty good grasp of how trustworthy an aversary you're dealing with. So if have doubt about whether to pay up for the cryptolocker ransomware that just infected your corporate network you can always give them a call. As happened recently with a Dutch University. https://www.maastrichtuniversity.nl/um-cyber-attack-symposium-%E2%80%93-lessons-learnt https://www.maastrichtuniversity.nl/um-cyber-attack-symposiu...

deleted 7y ago

[deleted]