7 ms·

Whilst paying the ransom is often advisable in specific cases like these, it’s absolutely a bad thing for society as a whole. Seeing successes like this will en

Whilst paying the ransom is often advisable in specific cases like these, it’s absolutely a bad thing for society as a whole. Seeing successes like this will encourage organised crime to keep doing this, as they know there’s gonna be a big reward. It’s like the prisoners dilemma. If people didn’t pay the ransom, there wouldn’t be ransomware. But people don’t take precautions, so they have to pay the ransom, leading to more ransomware... it’s a vicious cycle

dannyw 6y ago
To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. The money is funnelled to a criminal group, but what difference does it make? Some people consider the USG to be a criminal group; many people are out on the streets for that. My tax dollars directly go to corrupt crooks and nonexistent companies claiming billions for nonexistent PPE. As a member of society, I don’t care if I’m paying a professional ransomware group, or a professional corruption gang.
- ryan_j_naughton 6y ago
  > It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. That argument could be used to justify any theft or even kidnapping. I know many people who grew up in countries where kidnapping was a very real concern. Consequently, they had to adopt "greater security practices" and it had a very real, negative effect on their lives. There are real harms to randomware. Companies go out of business, people lose their jobs, people lose their service providers, etc. To say, "it serves them right for not following proper security" literally can be said for a mom/pop business in a poor neighborhood who didn't have bulletproof glass or bars on their windows. It is negating the fact that (a) the harms are very real and (b) security costs money and resources, which is effectively another tax on their business. If instead the government made it illegal to pay such ransoms and actively audited large BTC transactions and charged people accordingly, then we could get rid of the incentives to do this in the first place. The government should similarly hold firms accountable when they are hacked (due to the harms on consumers) and require prompt disclosure of any hacks. There are ways to incentivize the preferred outcomes without supporting the active theft of property and destruction of someone's business.
  - scrollaway 6y ago
    Physical and digital security aren't the same thing. There's no such thing as "this website is in a bad internet neighbourhood and should take extra precautions". I get where you're coming from but you can't really just flat out say "you can justify kidnapping with the same logic". Like, no, you can't. Fully agreed the government should be the ones playing the role of incentivizing security, but you can't then go back and say that security takes time and money those companies should not have to spend. They should, regardless of who keeps them accountable for it...
  - sumedh 6y ago
    > The government should similarly hold firms accountable when they are hacked What should the govt so when govt agencies get hacked?
  - MattSayar 6y ago
    In addition, the company isn't the only victim in a ransomware attack, its customers are too. And does anyone really believe the hackers deleted the data off their own servers? They can easily double-dip by selling that information. It's valuable, so why would they delete it?
    - dannyw 6y ago
      Double dipping ruins the reputation of the hackers and future income potential.
- frequentnapper 6y ago
  I agree. It's a trade-off, especially if you're a startup or a company with a hot product trying to beat competitors to market. Security practices would translate to loss of opportunity, so maybe it's a worthwhile trade-off to pay 1% of the gained revenue to these kinds of threats as a company. Unless there are harsher penalties and victims start caring more (and are given more tools and power to punish the companies that make that trade-off), this situation will remain. But then again, this makes the barrier to entry even higher for newcomers and gives an unfair advantage to the entrenched players. Tragedy of the commons?
- koolba 6y ago
  > As a member of society, I don’t care if I’m paying a professional ransomware group, or a professional corruption gang. The kidnapping analogy makes for a better understanding of why paying ransoms is bad for everybody else. If kidnappers know, or really just think, that they’ll get paid, they’re more likely to kidnap and hold hostages. It’s not that companies are not solely responsible for their own lax security policies. It’s that incentivizing the exploiting of them is bad for society.
- DownGoat 6y ago
  It sucks for the people who got their personal information caught up in this. They do more than just encrypt your files, they typically siphon as much data as possible from the companies before they execute the ransom part.
- onion2k 6y ago
  It encourages greater security practices. I don't think it does. It puts a much more tangible value on security, which encourages businesses to do a risk analysis like 'Do we spend $1m on security every year, or accept that there's a 0.xxx probability of a $4.5m ransom every n years?' That cost base analysis is often used to reduce the value of things that aren't obvious profit centers.
- benlumen 6y ago
  > To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. I see your point but this is flat-out organized crime, extortion to be precise. How long will it be before we're all making protection payments to ransomware groups?
  - markdown 6y ago
    What makes crime "organised"? There's no indication that this involved more than one thief.
    - stagger87 6y ago
      Organized crime has a specific meaning. Whether this particular outfit is one or more people has no bearing on the use of the term organized crime in this instance.
      - markdown 6y ago
        I asked: > What makes crime "organised"? Your answer is: > Organized crime has a specific meaning Well... what is it?
        stagger87 6y ago
        Sorry, I didn't think you might not be able to search for it. Here's a link. https://en.m.wikipedia.org/wiki/Organized_crime https://en.m.wikipedia.org/wiki/Organized_crime
        markdown 6y ago
        The link says you're wrong, and that in fact you can't have organised crime without at least two people.
  - usrusr 6y ago
    A difference to physical "protection" schemes is that the group you'd pay to might actually keep other groups out of what they consider their turf. Ransomware attacks are not geographically bound so I really doubt that similar structures would develop there. With growing numbers of ransomers demands just wouldn't stop until either the company runs out if money or security gets good enough to keep them out.
anonu 6y ago
It should encourage companies to lock down their infrastructure as well.
sytelus 6y ago
The folks like this should actually do a startup. Hardening security is often just keeping up with and following checklists, installing proper monitoring, backup and audit software however for large majority of company it is impossible to hire competitive security specialists. These guys can scale up by hiring 100s of employees who they train on different aspects and contract with small firms like these at annual subscription. That would enable them making much more than $10M. With their current approach they will almost certainly get traced eventually and end up in jail.
- vermilingua 6y ago
  They are likely based in a country not regarded to be a technology leader. Say you were the CTO of a firm looking to improve security, would you engage a Nigerian cybersec consultant? Almost certainly not, you would look in your home country, or the US/Europe. If they were to start a consultancy, even if they are as skilled as anyone else, they’d have an uphill battle from the get go; and have to either stick to their home market, or heavily discount their services. Either way making less than from their ransomware.
- limomium 6y ago
  Even just hiring one guy whose only job is to take backups would solve ransomware for much cheaper.
  - DangitBobby 6y ago
    There was a post on here a few days back about why it's not that simple. Basically, by the time your stuff is ransomed, they've potentially been in your network for a long time. There's no telling how far you have to go in your backups to make sure they are gone. Who knows, maybe they wait on your computers for several months just so restoring from backups isn't a realistic option, and punish you for trying.
    - limomium 6y ago
      What? I mean back up your data. Not your whole... computer, or whatever. Install latest software, import data from back up, back in business. It's trivial to tell intact data from ransomed data - the latter looks like random noise, as it's encrypted. If your backup process "isn't that simple", then you should make it that simple. Otherwise failure looms.
tenuousemphasis 6y ago
On the other hand, due to the same dilemma, every ransomware attacker has a strong incentive to actually deliver the keys upon payment of the ransom. Perhaps the key to ending ransomware is some high profile attacks (real or fictional) where the victim pays but does not get their data back.
frodo_77 6y ago
"once you have paid him the Dane-geld, you never get rid of the Dane."
Bobbcatt 6y ago
>Whilst paying the ransom is often advisable in specific cases like these, it’s absolutely a bad thing for society as a whole. If your family member was ever kidnapped by a group of terrorists, please keep this in mind before paying those terrorists to not cut their head off.
benlumen 6y ago
My thoughts, also. It's obvious why they don't, but ideally, every business would take a "we don't negotiate with terrorists" stance on this. Could governments outlaw these ransom payments?
- wendyshu 6y ago
  Seems like there's a great case to make it illegal, I wonder why it's not.
  - coryfklein 6y ago
    You would need a way to legislate this globally. Outlawing it here in the US only intensifies the prisoner dilemma aspect of this - the criminal enterprises keep winning the remaining 85% of world GDP, while all US companies suffer the most from the ransomware. You'd likely still see US companies pay the ransom anyway, but just try to keep it secret. Probably less risky than losing their crucial data and systems.
jasonhansel 6y ago
Not to mention the fact that the money could be going to terrorists or rogue states. This is clearly unethical, and IMHO should absolutely be against the law.
- tenuousemphasis 6y ago
  The U.S. government funded terrorism throughout the world. Thus paying taxes to the U.S. should be made illegal.

dannyw 6y ago

To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. The money is funnelled to a criminal group, but what difference does it make? Some people consider the USG to be a criminal group; many people are out on the streets for that. My tax dollars directly go to corrupt crooks and nonexistent companies claiming billions for nonexistent PPE. As a member of society, I don’t care if I’m paying a professional ransomware group, or a professional corruption gang.

ryan_j_naughton 6y ago
> It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. That argument could be used to justify any theft or even kidnapping. I know many people who grew up in countries where kidnapping was a very real concern. Consequently, they had to adopt "greater security practices" and it had a very real, negative effect on their lives. There are real harms to randomware. Companies go out of business, people lose their jobs, people lose their service providers, etc. To say, "it serves them right for not following proper security" literally can be said for a mom/pop business in a poor neighborhood who didn't have bulletproof glass or bars on their windows. It is negating the fact that (a) the harms are very real and (b) security costs money and resources, which is effectively another tax on their business. If instead the government made it illegal to pay such ransoms and actively audited large BTC transactions and charged people accordingly, then we could get rid of the incentives to do this in the first place. The government should similarly hold firms accountable when they are hacked (due to the harms on consumers) and require prompt disclosure of any hacks. There are ways to incentivize the preferred outcomes without supporting the active theft of property and destruction of someone's business.
- scrollaway 6y ago
  Physical and digital security aren't the same thing. There's no such thing as "this website is in a bad internet neighbourhood and should take extra precautions". I get where you're coming from but you can't really just flat out say "you can justify kidnapping with the same logic". Like, no, you can't. Fully agreed the government should be the ones playing the role of incentivizing security, but you can't then go back and say that security takes time and money those companies should not have to spend. They should, regardless of who keeps them accountable for it...
- sumedh 6y ago
  > The government should similarly hold firms accountable when they are hacked What should the govt so when govt agencies get hacked?
- MattSayar 6y ago
  In addition, the company isn't the only victim in a ransomware attack, its customers are too. And does anyone really believe the hackers deleted the data off their own servers? They can easily double-dip by selling that information. It's valuable, so why would they delete it?
  - dannyw 6y ago
    Double dipping ruins the reputation of the hackers and future income potential.
frequentnapper 6y ago
I agree. It's a trade-off, especially if you're a startup or a company with a hot product trying to beat competitors to market. Security practices would translate to loss of opportunity, so maybe it's a worthwhile trade-off to pay 1% of the gained revenue to these kinds of threats as a company. Unless there are harsher penalties and victims start caring more (and are given more tools and power to punish the companies that make that trade-off), this situation will remain. But then again, this makes the barrier to entry even higher for newcomers and gives an unfair advantage to the entrenched players. Tragedy of the commons?
koolba 6y ago
> As a member of society, I don’t care if I’m paying a professional ransomware group, or a professional corruption gang. The kidnapping analogy makes for a better understanding of why paying ransoms is bad for everybody else. If kidnappers know, or really just think, that they’ll get paid, they’re more likely to kidnap and hold hostages. It’s not that companies are not solely responsible for their own lax security policies. It’s that incentivizing the exploiting of them is bad for society.
DownGoat 6y ago
It sucks for the people who got their personal information caught up in this. They do more than just encrypt your files, they typically siphon as much data as possible from the companies before they execute the ransom part.
onion2k 6y ago
It encourages greater security practices. I don't think it does. It puts a much more tangible value on security, which encourages businesses to do a risk analysis like 'Do we spend $1m on security every year, or accept that there's a 0.xxx probability of a $4.5m ransom every n years?' That cost base analysis is often used to reduce the value of things that aren't obvious profit centers.
benlumen 6y ago
> To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices. I see your point but this is flat-out organized crime, extortion to be precise. How long will it be before we're all making protection payments to ransomware groups?
- markdown 6y ago
  What makes crime "organised"? There's no indication that this involved more than one thief.
  - stagger87 6y ago
    Organized crime has a specific meaning. Whether this particular outfit is one or more people has no bearing on the use of the term organized crime in this instance.
    - markdown 6y ago
      I asked: > What makes crime "organised"? Your answer is: > Organized crime has a specific meaning Well... what is it?
      - stagger87 6y ago
        Sorry, I didn't think you might not be able to search for it. Here's a link. https://en.m.wikipedia.org/wiki/Organized_crime https://en.m.wikipedia.org/wiki/Organized_crime
        markdown 6y ago
        The link says you're wrong, and that in fact you can't have organised crime without at least two people.
- usrusr 6y ago
  A difference to physical "protection" schemes is that the group you'd pay to might actually keep other groups out of what they consider their turf. Ransomware attacks are not geographically bound so I really doubt that similar structures would develop there. With growing numbers of ransomers demands just wouldn't stop until either the company runs out if money or security gets good enough to keep them out.

anonu 6y ago

It should encourage companies to lock down their infrastructure as well.

sytelus 6y ago

The folks like this should actually do a startup. Hardening security is often just keeping up with and following checklists, installing proper monitoring, backup and audit software however for large majority of company it is impossible to hire competitive security specialists. These guys can scale up by hiring 100s of employees who they train on different aspects and contract with small firms like these at annual subscription. That would enable them making much more than $10M. With their current approach they will almost certainly get traced eventually and end up in jail.

vermilingua 6y ago
They are likely based in a country not regarded to be a technology leader. Say you were the CTO of a firm looking to improve security, would you engage a Nigerian cybersec consultant? Almost certainly not, you would look in your home country, or the US/Europe. If they were to start a consultancy, even if they are as skilled as anyone else, they’d have an uphill battle from the get go; and have to either stick to their home market, or heavily discount their services. Either way making less than from their ransomware.
limomium 6y ago
Even just hiring one guy whose only job is to take backups would solve ransomware for much cheaper.
- DangitBobby 6y ago
  There was a post on here a few days back about why it's not that simple. Basically, by the time your stuff is ransomed, they've potentially been in your network for a long time. There's no telling how far you have to go in your backups to make sure they are gone. Who knows, maybe they wait on your computers for several months just so restoring from backups isn't a realistic option, and punish you for trying.
  - limomium 6y ago
    What? I mean back up your data. Not your whole... computer, or whatever. Install latest software, import data from back up, back in business. It's trivial to tell intact data from ransomed data - the latter looks like random noise, as it's encrypted. If your backup process "isn't that simple", then you should make it that simple. Otherwise failure looms.

tenuousemphasis 6y ago

On the other hand, due to the same dilemma, every ransomware attacker has a strong incentive to actually deliver the keys upon payment of the ransom. Perhaps the key to ending ransomware is some high profile attacks (real or fictional) where the victim pays but does not get their data back.

frodo_77 6y ago

"once you have paid him the Dane-geld, you never get rid of the Dane."

Bobbcatt 6y ago

>Whilst paying the ransom is often advisable in specific cases like these, it’s absolutely a bad thing for society as a whole. If your family member was ever kidnapped by a group of terrorists, please keep this in mind before paying those terrorists to not cut their head off.

benlumen 6y ago

My thoughts, also. It's obvious why they don't, but ideally, every business would take a "we don't negotiate with terrorists" stance on this. Could governments outlaw these ransom payments?

wendyshu 6y ago
Seems like there's a great case to make it illegal, I wonder why it's not.
- coryfklein 6y ago
  You would need a way to legislate this globally. Outlawing it here in the US only intensifies the prisoner dilemma aspect of this - the criminal enterprises keep winning the remaining 85% of world GDP, while all US companies suffer the most from the ransomware. You'd likely still see US companies pay the ransom anyway, but just try to keep it secret. Probably less risky than losing their crucial data and systems.

jasonhansel 6y ago

Not to mention the fact that the money could be going to terrorists or rogue states. This is clearly unethical, and IMHO should absolutely be against the law.

tenuousemphasis 6y ago
The U.S. government funded terrorism throughout the world. Thus paying taxes to the U.S. should be made illegal.