6 ms·

I have to say I think ransomware is one of the most interesting "business" practices. The trustworthiness of the criminals is huge because if they have a track

I have to say I think ransomware is one of the most interesting "business" practices. The trustworthiness of the criminals is huge because if they have a track record of providing the decryption key, you may as well pay. In a logical extreme you could start adding features like "Give us the info of people you know and for every one we successfully extract a ransom from we'll give you 10% off your ransom." It's interesting to think about at least.

HanayamaTriplet 6y ago
There was a story published by ProPublica[1] reporting on this sort of progression from the side of people negotiating to pay the ransoms. Here's a small excerpt, but I think the whole thing is worth a read: Storfer learned quickly never to use the term “hacking.” Instead, he would assume his correspondent “thinks they’re a businessman,” Storfer said. “I’d say: ‘Look, we can’t afford this [ransom] at this time. Do you mind providing your product [recovery key] at a lower rate?’ And it worked,” he said. “They’re doing a job where everyone hates them, so feeling like they were respected made them work with us. I like to think empathy goes a long way.” The rapport sometimes reaped discounts. “We were able to get a $5,000 ransom lessened to $3,000 because they knew we could deliver it exactly when we said we were going to get it to them,” Storfer said. [1]: https://features.propublica.org/ransomware/ransomware-attack-data-recovery-firms-paying-hackers/ https://features.propublica.org/ransomware/ransomware-attack...
- gowld 6y ago
  Reads like someone bragging about being incompetent. I'm sure the foreign language native attackers who call themselves "Evil Corp" would respond to "non-business" negotiations as well. They don't want your data deleted, they want money.
- chillacy 6y ago
  Reminds me of some of the stories in Never Split The Difference, where the author was a hostage negotiator for the FBI who would reduce ransoms (on human hostages) from millions to in one case, a few thousand. He relayed a similar reasoning, at the end of the day they want to get paid and a dead person is worth $0 (and potentially the swat team coming in).
- jessriedel 6y ago
  Yes. In the few times I have interacted with criminals doing something that essentially everyone agrees is wrong -- not just people violating laws that many disagree with, but really unambiguously bad stuff -- they have all consistently had some strained story (that I think they truly believed, at some level) for why what they were doing is OK. It's really sobering to see in person, and deeply undermines the faith one has in one's justification for one's own behavior. There was a story a while back, perhaps on HN, discussing the results of an academic survey of prisoners (in the UK, I think). They consistently evaluated themselves as more honorable than the average person on almost every dimension.
gowld 6y ago
I don't think many admins would respond to a security breach by taking bribes to break more laws. But maybe they would, and help us clear out these incompetents.
e40 6y ago
Or even insiders helping ransom businesses infect a company with money. Seems unlikely, but not impossible, especially if the ransomware folks can find and make a significant offer to the insider. I would think the biggest impediment to insiders doing this would be how to successfully hide and use the money, if it was a lot.
vmception 6y ago
Wish one of these was publicly traded onchain. We almost have the level of privacy necessary to own the shares anonymously and distribute profits adequately too. I think you could do it by issueing the shares as a zkAsset using AZTEC, and any ransom paid in btc could be transposed to renBTC on Ethereum, deposited into zkSYNC and distributed to all shareholders proportionately in the zkSYNC, that distribution transaction wouldn't be recorded onchain (although maybe zkSYNC has some ability to monitor transactions) and shareholders can withdraw their dividend at their own will. But otherwise they can just convert the BTC to XMR first, and reintegrate that however they want.
jjeaff 6y ago
I think one of the only ways to stop ransomware would be to setup a team distributing the ransomware, extracting fees from the victims and then -not- providing the keys. A few high profile cases of this should be enough to destroy confidence that paying a random will work.
- russellendicott 6y ago
  This is brilliant. Destroy the credibility of the criminals.
  - pests 6y ago
    And a bunch of people's data.
  - jacquesm 6y ago
    By becoming a criminal yourself? The cure seems to be much worse than the disease.
- vkou 6y ago
  The ransomware guys will wise up, and use different keys to encrypt different parts of your database. They'll then request some fraction of the payment, in exchange for decrypting part of your DB, as proof that they do have keys.
- markkanof 6y ago
  Couldn't you also just plant some "shills" who claim that this happened to them and they lost all their data?
  - meowface 6y ago
    Yes, this'd probably be a better idea. But the issue is there are many different ransomware gangs and malware families. We'd probably start seeing a twisted form of corporate PR from most of them. "We're not like the rest. We abide by a strict code of ethics and believe fair and honest dealing is paramount to our reputation and customers' trust in us. We will never add hidden charges or 'alter the deal'. Rest assured that your keys are stored securely and will always be delivered to you within 4 hours of payment. That's the CryptoLockDeluxe guarantee." It reminds me a lot of piracy in EVE Online, where pirates' reputation for allowing ships to carry on after paying the random was considered a big deal.
_Nat_ 6y ago
If that became a big business model, then we might start getting meta-criminals: 1. They infect a major institution with ransomware. 2. They demand, and successfully receive, a major ransom. 3. They DON'T immediately release the key, despite the ransom being paid. Instead, they issue an open demand for ransoms to be paid to a random Bitcoin address from other major ransomware groups. 4. The meta-ransomers only release the key to the original victim if they receive sufficient ransoms from other ransomers. The meta-criminals would essentially be ransoming the credibility of ransomers. If the ransomers don't pay up, then the meta-ransomers will chip away at their credibility.
- jacquesm 6y ago
  You've got a partner now.
- to11mtm 6y ago
  That doesn't sound like it would work amazingly well. First thought is that the 'meta-ransomers' would probably only get one or two shots at such an action working before the major groups make some sort of statement (and even perhaps provide some sort of way to 'authenticate' that it an attack is from one of of the more 'trustworthy' ransomware groups.) Second thought is that it would have to be a gutsy group of rogue actors or group of rogue actors. A lot of these underground folks still know each other one way or another and this would probably be considered a big 'f--- you' to the rest of the community. Bridges would be burned, unspoken agreements in the sphere may be violated. You could even see the ransomers quickly turn their efforts to exposing the meta-ransomers. On the other hand, it could become an 'arms race' as the meta and non-meta ransomers start trying to shut each other's ransomware down
- jtsiskin 6y ago
  This doesn’t work because a ransomware group could just sign their message. I wouldn’t be surprised if they do already
ManBlanket 6y ago
You could look at it as an unsolicited security audit of your system and the ransom as a contractor's fee for a job well done.

HanayamaTriplet 6y ago

There was a story published by ProPublica[1] reporting on this sort of progression from the side of people negotiating to pay the ransoms. Here's a small excerpt, but I think the whole thing is worth a read: Storfer learned quickly never to use the term “hacking.” Instead, he would assume his correspondent “thinks they’re a businessman,” Storfer said. “I’d say: ‘Look, we can’t afford this [ransom] at this time. Do you mind providing your product [recovery key] at a lower rate?’ And it worked,” he said. “They’re doing a job where everyone hates them, so feeling like they were respected made them work with us. I like to think empathy goes a long way.” The rapport sometimes reaped discounts. “We were able to get a $5,000 ransom lessened to $3,000 because they knew we could deliver it exactly when we said we were going to get it to them,” Storfer said. [1]: https://features.propublica.org/ransomware/ransomware-attack-data-recovery-firms-paying-hackers/ https://features.propublica.org/ransomware/ransomware-attack...

gowld 6y ago
Reads like someone bragging about being incompetent. I'm sure the foreign language native attackers who call themselves "Evil Corp" would respond to "non-business" negotiations as well. They don't want your data deleted, they want money.
chillacy 6y ago
Reminds me of some of the stories in Never Split The Difference, where the author was a hostage negotiator for the FBI who would reduce ransoms (on human hostages) from millions to in one case, a few thousand. He relayed a similar reasoning, at the end of the day they want to get paid and a dead person is worth $0 (and potentially the swat team coming in).
jessriedel 6y ago
Yes. In the few times I have interacted with criminals doing something that essentially everyone agrees is wrong -- not just people violating laws that many disagree with, but really unambiguously bad stuff -- they have all consistently had some strained story (that I think they truly believed, at some level) for why what they were doing is OK. It's really sobering to see in person, and deeply undermines the faith one has in one's justification for one's own behavior. There was a story a while back, perhaps on HN, discussing the results of an academic survey of prisoners (in the UK, I think). They consistently evaluated themselves as more honorable than the average person on almost every dimension.

gowld 6y ago

I don't think many admins would respond to a security breach by taking bribes to break more laws. But maybe they would, and help us clear out these incompetents.

e40 6y ago

Or even insiders helping ransom businesses infect a company with money. Seems unlikely, but not impossible, especially if the ransomware folks can find and make a significant offer to the insider. I would think the biggest impediment to insiders doing this would be how to successfully hide and use the money, if it was a lot.

vmception 6y ago

Wish one of these was publicly traded onchain. We almost have the level of privacy necessary to own the shares anonymously and distribute profits adequately too. I think you could do it by issueing the shares as a zkAsset using AZTEC, and any ransom paid in btc could be transposed to renBTC on Ethereum, deposited into zkSYNC and distributed to all shareholders proportionately in the zkSYNC, that distribution transaction wouldn't be recorded onchain (although maybe zkSYNC has some ability to monitor transactions) and shareholders can withdraw their dividend at their own will. But otherwise they can just convert the BTC to XMR first, and reintegrate that however they want.

jjeaff 6y ago

I think one of the only ways to stop ransomware would be to setup a team distributing the ransomware, extracting fees from the victims and then -not- providing the keys. A few high profile cases of this should be enough to destroy confidence that paying a random will work.

russellendicott 6y ago
This is brilliant. Destroy the credibility of the criminals.
- pests 6y ago
  And a bunch of people's data.
- jacquesm 6y ago
  By becoming a criminal yourself? The cure seems to be much worse than the disease.
vkou 6y ago
The ransomware guys will wise up, and use different keys to encrypt different parts of your database. They'll then request some fraction of the payment, in exchange for decrypting part of your DB, as proof that they do have keys.
markkanof 6y ago
Couldn't you also just plant some "shills" who claim that this happened to them and they lost all their data?
- meowface 6y ago
  Yes, this'd probably be a better idea. But the issue is there are many different ransomware gangs and malware families. We'd probably start seeing a twisted form of corporate PR from most of them. "We're not like the rest. We abide by a strict code of ethics and believe fair and honest dealing is paramount to our reputation and customers' trust in us. We will never add hidden charges or 'alter the deal'. Rest assured that your keys are stored securely and will always be delivered to you within 4 hours of payment. That's the CryptoLockDeluxe guarantee." It reminds me a lot of piracy in EVE Online, where pirates' reputation for allowing ships to carry on after paying the random was considered a big deal.

_Nat_ 6y ago

If that became a big business model, then we might start getting meta-criminals: 1. They infect a major institution with ransomware. 2. They demand, and successfully receive, a major ransom. 3. They DON'T immediately release the key, despite the ransom being paid. Instead, they issue an open demand for ransoms to be paid to a random Bitcoin address from other major ransomware groups. 4. The meta-ransomers only release the key to the original victim if they receive sufficient ransoms from other ransomers. The meta-criminals would essentially be ransoming the credibility of ransomers. If the ransomers don't pay up, then the meta-ransomers will chip away at their credibility.

jacquesm 6y ago
You've got a partner now.
to11mtm 6y ago
That doesn't sound like it would work amazingly well. First thought is that the 'meta-ransomers' would probably only get one or two shots at such an action working before the major groups make some sort of statement (and even perhaps provide some sort of way to 'authenticate' that it an attack is from one of of the more 'trustworthy' ransomware groups.) Second thought is that it would have to be a gutsy group of rogue actors or group of rogue actors. A lot of these underground folks still know each other one way or another and this would probably be considered a big 'f--- you' to the rest of the community. Bridges would be burned, unspoken agreements in the sphere may be violated. You could even see the ransomers quickly turn their efforts to exposing the meta-ransomers. On the other hand, it could become an 'arms race' as the meta and non-meta ransomers start trying to shut each other's ransomware down
jtsiskin 6y ago
This doesn’t work because a ransomware group could just sign their message. I wouldn’t be surprised if they do already

ManBlanket 6y ago

You could look at it as an unsolicited security audit of your system and the ransom as a contractor's fee for a job well done.