4 ms·

Related article: Could a Ban on Ransom Payments Have Stopped the Colonial Pipeline Attack? https://news.ycombinator.com/item?id=27196299 https://news.ycombinato

Related article: Could a Ban on Ransom Payments Have Stopped the Colonial Pipeline Attack? https://news.ycombinator.com/item?id=27196299 https://news.ycombinator.com/item?id=27196299 While banning such payments might remove the incentives, that also put a huge burden on the victim and the transition to better cybersecurity should be less disruptive than an outright ban. Another solution that has no harms and only benefit is to require the reporting of every ransom payment. That would give the government the crypto transaction information to conduct taint and attribution analysis. It is currently illegal to knowingly use funds received from kidnapping or ransoms, and this reporting requirement would help the government enforce that.

Sebb767 5y ago
> While banning such payments might remove the incentives, They'd pretty obviously not; companies are already forced to pay a fine (or a ransom, but it's money spent) and it obviously does not incentivize them to properly secure their network. Adding a fine to pay to the government on top (or, more cynically, a tax) will not change much, except that stricken companies now get hit harder, as you said.
- abarringer 5y ago
  Companies purchase cyber insurance for a small fee and avoid risk of paying ransoms directly. Make cyber insurance paying ransoms illegal and you'll see boards start funding IT security.
  - toomuchtodo 5y ago
    Insurance companies are likely to disallow ransom payments in their entirety. Too much risk considering the security posture of most organizations. Boards will, generally, still not fund and support effective security culture without steep penalties for breaches (i am in infosec and speak to c suite folks as part of my gig; breach impact, in their current form, are "cost of business"). “Show me the incentive, and I will show you the outcome.” – Charlie Munger https://www.insurancejournal.com/news/international/2021/05/09/613255.htm https://www.insurancejournal.com/news/international/2021/05/... (Insurer AXA to Stop Paying for Ransomware Crime Payments in France)
- rorykoehler 5y ago
  Paying the ransom should make you an accessory to the crime with jail time and all for the executive who cleared it. This should put an end to it pretty quickly.
  - breakfastduck 5y ago
    And also put an end to the organisations ability to operate making potentially thousands of people instantly and needlessly unemployed because their bosses didn't think security was important.
    - wearywanderer 5y ago
      Allowing executives to commit crimes because imprisoning them would deprive workers of an executive is just plain foolish.
      - breakfastduck 5y ago
        The executives should be punished, yes, but I don't see why the entire workforce should be when insurance can cover the cost.
    - willcipriano 5y ago
      That is the system working as intended. Organizations, and those that lead them that can't hack it in the modern economy must be removed in order to make room for those that can.
      - ryanlol 5y ago
        So what’s the point of restricting ransomware payments then? Only organizations that can’t hack it in the modern economy will be affected anyway.
        duskwuff 5y ago
        Ransomware gangs exist and thrive because their crime is profitable -- their victims are willing and able to pay. Make many of their victims unable to pay, and the equation changes.
- edouard-harris 5y ago
  I think the grandparent means banning such payments might remove the incentives to hack in the first place, since a hacker can't expect to make any ransom revenue from a company that obeys such a ban.
dathinab 5y ago
> Another solution that has no harms and only benefit is to require the reporting of every ransom payment. That would give the government the crypto transaction information to conduct taint and attribution analysis. It is currently illegal to knowingly use funds received from kidnapping or ransoms, and this reporting requirement would help the government enforce that. Definitely a must have for now and on a international scale IMHO. But a effective ban on ransom payments would still be the most effective measurement. The problem is how do you effectively ban it? For many countries such thing could never be enforced, so it wouldn't remove the sensitive for non-specific target ransomware attacks IMHO and as such won't work.
- toomuchtodo 5y ago
  > The problem is how do you effectively ban it? If a corporation pays, and ledger history can provide definitive proof, the corporation faces the same penalties as if they violated international sanctions. Corporations will need to onramp fiat to crypto somewhere, and FinCEN [1] will know based on SARs (Suspicious Activity Report)/CTRs (Currency Transaction Reports), or SWIFT if international monies transfers [2]. [1] https://www.fincen.gov/resources/statutes-regulations https://www.fincen.gov/resources/statutes-regulations [2] https://www.swift.com/our-solutions/compliance-and-shared-services/financial-crime-compliance/compliance-analytics-solutions/correspondent-monitoring https://www.swift.com/our-solutions/compliance-and-shared-se...
- bernawil 5y ago
  > For many countries such thing could never be enforced so it follows that if a country bans ransoms payments criminals will just ingnore that country and focus on the next easiest target, putting pressure on every country to follow the example and ban it too. I think this will be very effective at stopping the most sofisticated targeted attacks but won't have much effect on indiscriminate "viral" attacks because those attack indiscriminately and wrecking targets from banned countries at least would serve as detterrant for victims in countries that can.
manquer 5y ago
It places on some victims to prevent a lot of others from becoming victims. That is fairly standard trade off in any society. Also this is always the case for paying ransom for hostages, and is only simply being extended for data. Without a legal way to make payments, companies can no longer justify the tradeoff of paying up and fixing the leaks as they spring up. This incentivize them to give importance to security and actually overhauling their infrastructure properly.
- bernawil 5y ago
  it's a textbook prisoner's dilemma paradox. If everybody agrees not to pay ransom and follows through, criminals won't try to hack companies to collect ransom. But as an individual company, you can't coordinate with everybody else to prevent everybody from paying ransom, so not doing so puts you on disadvantage. Philosophically, the usefulnes of government is to threaten violence to solve the coordination problems amongst individuals.
  - ggggtez 5y ago
    Yes, thank you for saying so. People rarely understand that the coordination solution is one of the most important powers the government offers over privatization. They can tax/penalize undesired behavior. Individual companies may end up worse off, but as a whole the business community is better off with the rules in place. This is why governments have to tackle pollution and climate change too. Companies are profit-motivated, and will only respond to what the economics demand. When governments start imposing demands with penalties attached, that's when companies actually start changing behaviors.
wpietri 5y ago
The transition to better security? It's been almost 20 years since the Code Red worm. How much longer should we wait? I think the transition to better security will go faster if companies know they can't buy their way out of the problem.
jessriedel 5y ago
Another fun idea via someone on Twitter: make randomware legal but capped at a low amount, e.g., $5k. (And, perhaps, public reporting required after a 1 year delay.) Now white hats can enter the market safely, many holes are discovered for relatively low prices, and the country's tech infrastructure as a whole is less vulnerable to serious attack. One issue is that if the costs of finding different vulnerabilities are distributed along a spectrum, this only lets you find the <$5k ones.
- nexuist 5y ago
  The problem is ransomware is software just like all the others. What do you do when some random script kiddie in way over their head manages to encrypt a seriously important network but can't develop decryption tools - or worse, loses the encryption key? Nobody really wants to promote unsophisticated attackers in this space. At least the existing criminals give you proven tools once you pay the ransom.
RhodoGSA 5y ago
Illegal btc -> UniSwap -> btc/Monero -> Monero wallet -> Monero Wallet 2, Money is cleaned. Monero doesn't include wallet headers.

Sebb767 5y ago

> While banning such payments might remove the incentives, They'd pretty obviously not; companies are already forced to pay a fine (or a ransom, but it's money spent) and it obviously does not incentivize them to properly secure their network. Adding a fine to pay to the government on top (or, more cynically, a tax) will not change much, except that stricken companies now get hit harder, as you said.

abarringer 5y ago
Companies purchase cyber insurance for a small fee and avoid risk of paying ransoms directly. Make cyber insurance paying ransoms illegal and you'll see boards start funding IT security.
- toomuchtodo 5y ago
  Insurance companies are likely to disallow ransom payments in their entirety. Too much risk considering the security posture of most organizations. Boards will, generally, still not fund and support effective security culture without steep penalties for breaches (i am in infosec and speak to c suite folks as part of my gig; breach impact, in their current form, are "cost of business"). “Show me the incentive, and I will show you the outcome.” – Charlie Munger https://www.insurancejournal.com/news/international/2021/05/09/613255.htm https://www.insurancejournal.com/news/international/2021/05/... (Insurer AXA to Stop Paying for Ransomware Crime Payments in France)
rorykoehler 5y ago
Paying the ransom should make you an accessory to the crime with jail time and all for the executive who cleared it. This should put an end to it pretty quickly.
- breakfastduck 5y ago
  And also put an end to the organisations ability to operate making potentially thousands of people instantly and needlessly unemployed because their bosses didn't think security was important.
  - wearywanderer 5y ago
    Allowing executives to commit crimes because imprisoning them would deprive workers of an executive is just plain foolish.
    - breakfastduck 5y ago
      The executives should be punished, yes, but I don't see why the entire workforce should be when insurance can cover the cost.
  - willcipriano 5y ago
    That is the system working as intended. Organizations, and those that lead them that can't hack it in the modern economy must be removed in order to make room for those that can.
    - ryanlol 5y ago
      So what’s the point of restricting ransomware payments then? Only organizations that can’t hack it in the modern economy will be affected anyway.
      - duskwuff 5y ago
        Ransomware gangs exist and thrive because their crime is profitable -- their victims are willing and able to pay. Make many of their victims unable to pay, and the equation changes.
edouard-harris 5y ago
I think the grandparent means banning such payments might remove the incentives to hack in the first place, since a hacker can't expect to make any ransom revenue from a company that obeys such a ban.

dathinab 5y ago

> Another solution that has no harms and only benefit is to require the reporting of every ransom payment. That would give the government the crypto transaction information to conduct taint and attribution analysis. It is currently illegal to knowingly use funds received from kidnapping or ransoms, and this reporting requirement would help the government enforce that. Definitely a must have for now and on a international scale IMHO. But a effective ban on ransom payments would still be the most effective measurement. The problem is how do you effectively ban it? For many countries such thing could never be enforced, so it wouldn't remove the sensitive for non-specific target ransomware attacks IMHO and as such won't work.

toomuchtodo 5y ago
> The problem is how do you effectively ban it? If a corporation pays, and ledger history can provide definitive proof, the corporation faces the same penalties as if they violated international sanctions. Corporations will need to onramp fiat to crypto somewhere, and FinCEN [1] will know based on SARs (Suspicious Activity Report)/CTRs (Currency Transaction Reports), or SWIFT if international monies transfers [2]. [1] https://www.fincen.gov/resources/statutes-regulations https://www.fincen.gov/resources/statutes-regulations [2] https://www.swift.com/our-solutions/compliance-and-shared-services/financial-crime-compliance/compliance-analytics-solutions/correspondent-monitoring https://www.swift.com/our-solutions/compliance-and-shared-se...
bernawil 5y ago
> For many countries such thing could never be enforced so it follows that if a country bans ransoms payments criminals will just ingnore that country and focus on the next easiest target, putting pressure on every country to follow the example and ban it too. I think this will be very effective at stopping the most sofisticated targeted attacks but won't have much effect on indiscriminate "viral" attacks because those attack indiscriminately and wrecking targets from banned countries at least would serve as detterrant for victims in countries that can.

manquer 5y ago

It places on some victims to prevent a lot of others from becoming victims. That is fairly standard trade off in any society. Also this is always the case for paying ransom for hostages, and is only simply being extended for data. Without a legal way to make payments, companies can no longer justify the tradeoff of paying up and fixing the leaks as they spring up. This incentivize them to give importance to security and actually overhauling their infrastructure properly.

bernawil 5y ago
it's a textbook prisoner's dilemma paradox. If everybody agrees not to pay ransom and follows through, criminals won't try to hack companies to collect ransom. But as an individual company, you can't coordinate with everybody else to prevent everybody from paying ransom, so not doing so puts you on disadvantage. Philosophically, the usefulnes of government is to threaten violence to solve the coordination problems amongst individuals.
- ggggtez 5y ago
  Yes, thank you for saying so. People rarely understand that the coordination solution is one of the most important powers the government offers over privatization. They can tax/penalize undesired behavior. Individual companies may end up worse off, but as a whole the business community is better off with the rules in place. This is why governments have to tackle pollution and climate change too. Companies are profit-motivated, and will only respond to what the economics demand. When governments start imposing demands with penalties attached, that's when companies actually start changing behaviors.

wpietri 5y ago

The transition to better security? It's been almost 20 years since the Code Red worm. How much longer should we wait? I think the transition to better security will go faster if companies know they can't buy their way out of the problem.

jessriedel 5y ago

Another fun idea via someone on Twitter: make randomware legal but capped at a low amount, e.g., $5k. (And, perhaps, public reporting required after a 1 year delay.) Now white hats can enter the market safely, many holes are discovered for relatively low prices, and the country's tech infrastructure as a whole is less vulnerable to serious attack. One issue is that if the costs of finding different vulnerabilities are distributed along a spectrum, this only lets you find the <$5k ones.

nexuist 5y ago
The problem is ransomware is software just like all the others. What do you do when some random script kiddie in way over their head manages to encrypt a seriously important network but can't develop decryption tools - or worse, loses the encryption key? Nobody really wants to promote unsophisticated attackers in this space. At least the existing criminals give you proven tools once you pay the ransom.

RhodoGSA 5y ago

Illegal btc -> UniSwap -> btc/Monero -> Monero wallet -> Monero Wallet 2, Money is cleaned. Monero doesn't include wallet headers.