7 ms·

Negotiating ransoms: when to play and when to fold

39 points by tmfi 5y ago

jaclaz 5y ago
>Coveware has negotiated a “few thousand” ransomware cases since its founding in 2018, and each case is different, Siegel says. Hmmm. That would be a handful of negotiations per working day, or at least two/three per day 24/7.
- deleted 5y ago
  [deleted]
miohtama 5y ago
Before it gets mentioned here is a good post why ransomware gangs love (traceable) Bitcoin. Most of ransomware gangs are more or less well known, not really anonymous. http://jpkoning.blogspot.com/2021/06/why-do-ransomware-gangs-like-bitcoin.html?m=1 http://jpkoning.blogspot.com/2021/06/why-do-ransomware-gangs...
- amelius 5y ago
  The FBI could set up a website where you can check whether your Bitcoins were involved in some crime. This would set up an interesting experiment. Would you accept a $20 dollar bill in the supermarket if you knew it was used in some ransom case? And what if suddenly you knew you owned such a $20 dollar bill? Would you try to get rid of it as quickly as possible?
  - diab0lic 5y ago
    Does the bill’s involvement in a ransom reduce the value of the bill or implicate me in any way? I’ve never considered someone morally responsible for the provenance of their money outside their control. Maybe I’m missing the point.
    - amelius 5y ago
      Well, the FBI could make it illegal to own Bitcoins that can be traced to criminal activity.
  - miohtama 5y ago
    2% of money on bank accounts have been involved in some crime. What would you set as a threshold?
    - amelius 5y ago
      I'd invalidate that 2%.
      - CRConrad 5y ago
        That's exactly as stupid as invalidating, say, a 20€ note that I got in change from paying a taxi ride, and the driver received in good faith from some crook who took a ride with him before me. By "invalidating" it, you're robbing me of the worth of that note, those 20€, even though I had nothing to do with that crook.
- koheripbal 5y ago
  Bitcoin recent changes now allow for untraceable atomic swaps with Monero, breaking any hope of traceability in bitcoin.
  - miohtama 5y ago
    Tracebility has been hideable for long time with coin join transactions and Ethereum bridges. However ransomware gangs have not utilized them, so it is a sign that they do not care.
noduerme 5y ago
I don't think I would ever pay ransom under any circumstances. Not for data or system functionality. I'd throw the computers in the river. I know this about myself because I had to deal with a kidnapping and extortion of my best friend in south america around 15 years ago.. and a few years later a ddos extortion attempt on one of my servers (the criminal was released from prison recently and I won a federal judgment against him for damages). Not a day goes by that I don't wish misery and sickness on those people. But something emerged in me during those crises that was not necessarily something I liked about myself in the long run. I wouldn't negotiate. I'm ashamed to admit I risked a friend's life by lying to the kidnappers. But I couldn't believe a word they were saying or even know if she was alive. I went cold and stopped cooperating. It was terrifying but I was in shock. I played poker with someone's life. It's something you don't really know about yourself or ever want to know until you're in the situation. I still have nightmares about it.
- Synaesthesia 5y ago
  No such thing as "under any circumstances". The circumstances determine your decision, and what your priorities are.
  - noduerme 5y ago
    Right. True. But I mean I'm not sure if my decisions would be based on logical priorities. The first experience really primed me. Terrorized me. Made me want to kill people who do things like that. The second, the one that didn't involve a human life, brought down a transatlantic cable and cost mid six figures not including me working 72 hours straight trying to get into my own servers to migrate them. I not only refused to pay the ransom, which was around $2k, I didn't even disclose the ransom letter to the clients who were down until it was over. I got on the phone with the FBI and devoted a solid chunk of time over the next year to hunting down the attacker. That's not a good priority. It came from deep damage and unresolved anger about the earlier situation.
- deleted 5y ago
  [deleted]
- 5y ago
failwhaleshark 5y ago
So many businesses don't do DR/BCP or security properly. 99% of businesses cannot survive losing data, so it's crazy to not have proven backups and automated infrastructure restoration. It's like with cloud and microservices, most of the time backups, monitoring, and security aren't even considered.
insickness 5y ago
> So you’re like, “Oh great. We have backups, the data is there, but the application to actually do the restoration is encrypted.” From my experience dealing with ransomware, most encrypted applications are not recoverable, even with the key. Those app servers need to be rebuilt or restored. File servers and individual files can be decrypted using the key, but applications get scrambled.
- jon-wood 5y ago
  They need to be rebuilt. There’s no ifs or buts about that, once a server has been compromised by a malicious actor it can no longer be trusted. Even if you could just restore functionality you have no guarantees that there’s not a time bomb ticking away to hit you again at some later date now they’ve established you’ll pay out.
  - chiph 5y ago
    Rebuilt? Replaced! All of them are now suspect.
deleted 5y ago
[deleted]
eqvinox 5y ago
From a practical viewpoint, the question is simply whether the money multiplied by the chance of success is a better option than the money needed to rebuild. But I'd rather compare this to a natural disaster you were ill-prepared for. A lightning strike or tornado can also wipe all your data. You can't negotiate ransom with nature. And giving in to ransomware makes it worse for everybody else since it makes ransomware financially viable. IMHO it needs to become socially unacceptable to be ill-prepared for a ransomware attack. I don't care if it was a 0day or whether your security was sloppy. It was your job to be prepared for this. At CCC events you commonly find a sticker at the exchange tables that reads "Kein Backup, kein Mitleid" - "no backup, no compassion". But the post makes a good point - you don't need backups. You need restore. Which takes time and is frequently ill planned. Sadly.
- eqvinox 5y ago
  Actually — even better point from the post: > If you discover that the data was corrupted during the encryption process, is it game over? > Most of the time, yeah. If it’s database files, typically they’re gone. I hadn't even considered what happens when ransomware tries to encrypt a database while it is in use. That's not gonna end well...
  - londons_explore 5y ago
    The ransomware I've come across has lots of special heuristics to try and not destroy your data... Things like taking a copy and then doing an atomic replace...
    - eqvinox 5y ago
      Admittedly I've only had to deal with ransomware once, trying to help a friend. That one was way too shoddily written for anything like atomic replace or DB identification heuristics…
- jon-wood 5y ago
  Ransomware really is the best possible kind of data loss, at least there’s a recovery path built into it. On three occasions in my career I’ve been involved in events which led to large scale data loss. The first time the backups failed, and there was no recovering from it, ever since then I’m religious about testing backups. If you’re in a position to just restore from offsite backups not only can you just flip the bird to people trying to ransom your data, you’re also in a good position to deal with anything else, up to and including the data centre containing all your servers being burnt to the ground.
ctdonath 5y ago
The U.S. Constitution permits “Letters of Marque and Reprisal”, essentially Congress giving individuals permission to wage outright war on foreign entities. Ransoms (be it for life or data) are absolutely an appropriate application.
chews 5y ago
First off, I remember reading that it was not control of their infrastructure that the hackers had, it was control of the accounting systems. They are separated functions and the pipeline could not bill folks that’s why they shut it down... think about that... these folks shut it down cause they were worried about counter-party risk in payments...

39 points by tmfi 5y ago

>Coveware has negotiated a “few thousand” ransomware cases since its founding in 2018, and each case is different, Siegel says. Hmmm. That would be a handful of negotiations per working day, or at least two/three per day 24/7.

deleted 5y ago
[deleted]

miohtama 5y ago

Before it gets mentioned here is a good post why ransomware gangs love (traceable) Bitcoin. Most of ransomware gangs are more or less well known, not really anonymous. http://jpkoning.blogspot.com/2021/06/why-do-ransomware-gangs-like-bitcoin.html?m=1 http://jpkoning.blogspot.com/2021/06/why-do-ransomware-gangs...

amelius 5y ago
The FBI could set up a website where you can check whether your Bitcoins were involved in some crime. This would set up an interesting experiment. Would you accept a $20 dollar bill in the supermarket if you knew it was used in some ransom case? And what if suddenly you knew you owned such a $20 dollar bill? Would you try to get rid of it as quickly as possible?
- diab0lic 5y ago
  Does the bill’s involvement in a ransom reduce the value of the bill or implicate me in any way? I’ve never considered someone morally responsible for the provenance of their money outside their control. Maybe I’m missing the point.
  - amelius 5y ago
    Well, the FBI could make it illegal to own Bitcoins that can be traced to criminal activity.
- miohtama 5y ago
  2% of money on bank accounts have been involved in some crime. What would you set as a threshold?
  - amelius 5y ago
    I'd invalidate that 2%.
    - CRConrad 5y ago
      That's exactly as stupid as invalidating, say, a 20€ note that I got in change from paying a taxi ride, and the driver received in good faith from some crook who took a ride with him before me. By "invalidating" it, you're robbing me of the worth of that note, those 20€, even though I had nothing to do with that crook.
koheripbal 5y ago
Bitcoin recent changes now allow for untraceable atomic swaps with Monero, breaking any hope of traceability in bitcoin.
- miohtama 5y ago
  Tracebility has been hideable for long time with coin join transactions and Ethereum bridges. However ransomware gangs have not utilized them, so it is a sign that they do not care.

noduerme 5y ago

I don't think I would ever pay ransom under any circumstances. Not for data or system functionality. I'd throw the computers in the river. I know this about myself because I had to deal with a kidnapping and extortion of my best friend in south america around 15 years ago.. and a few years later a ddos extortion attempt on one of my servers (the criminal was released from prison recently and I won a federal judgment against him for damages). Not a day goes by that I don't wish misery and sickness on those people. But something emerged in me during those crises that was not necessarily something I liked about myself in the long run. I wouldn't negotiate. I'm ashamed to admit I risked a friend's life by lying to the kidnappers. But I couldn't believe a word they were saying or even know if she was alive. I went cold and stopped cooperating. It was terrifying but I was in shock. I played poker with someone's life. It's something you don't really know about yourself or ever want to know until you're in the situation. I still have nightmares about it.

Synaesthesia 5y ago
No such thing as "under any circumstances". The circumstances determine your decision, and what your priorities are.
- noduerme 5y ago
  Right. True. But I mean I'm not sure if my decisions would be based on logical priorities. The first experience really primed me. Terrorized me. Made me want to kill people who do things like that. The second, the one that didn't involve a human life, brought down a transatlantic cable and cost mid six figures not including me working 72 hours straight trying to get into my own servers to migrate them. I not only refused to pay the ransom, which was around $2k, I didn't even disclose the ransom letter to the clients who were down until it was over. I got on the phone with the FBI and devoted a solid chunk of time over the next year to hunting down the attacker. That's not a good priority. It came from deep damage and unresolved anger about the earlier situation.
deleted 5y ago
[deleted]
5y ago

failwhaleshark 5y ago

So many businesses don't do DR/BCP or security properly. 99% of businesses cannot survive losing data, so it's crazy to not have proven backups and automated infrastructure restoration. It's like with cloud and microservices, most of the time backups, monitoring, and security aren't even considered.

insickness 5y ago

> So you’re like, “Oh great. We have backups, the data is there, but the application to actually do the restoration is encrypted.” From my experience dealing with ransomware, most encrypted applications are not recoverable, even with the key. Those app servers need to be rebuilt or restored. File servers and individual files can be decrypted using the key, but applications get scrambled.

jon-wood 5y ago
They need to be rebuilt. There’s no ifs or buts about that, once a server has been compromised by a malicious actor it can no longer be trusted. Even if you could just restore functionality you have no guarantees that there’s not a time bomb ticking away to hit you again at some later date now they’ve established you’ll pay out.
- chiph 5y ago
  Rebuilt? Replaced! All of them are now suspect.

deleted 5y ago

[deleted]

eqvinox 5y ago

From a practical viewpoint, the question is simply whether the money multiplied by the chance of success is a better option than the money needed to rebuild. But I'd rather compare this to a natural disaster you were ill-prepared for. A lightning strike or tornado can also wipe all your data. You can't negotiate ransom with nature. And giving in to ransomware makes it worse for everybody else since it makes ransomware financially viable. IMHO it needs to become socially unacceptable to be ill-prepared for a ransomware attack. I don't care if it was a 0day or whether your security was sloppy. It was your job to be prepared for this. At CCC events you commonly find a sticker at the exchange tables that reads "Kein Backup, kein Mitleid" - "no backup, no compassion". But the post makes a good point - you don't need backups. You need restore. Which takes time and is frequently ill planned. Sadly.

eqvinox 5y ago
Actually — even better point from the post: > If you discover that the data was corrupted during the encryption process, is it game over? > Most of the time, yeah. If it’s database files, typically they’re gone. I hadn't even considered what happens when ransomware tries to encrypt a database while it is in use. That's not gonna end well...
- londons_explore 5y ago
  The ransomware I've come across has lots of special heuristics to try and not destroy your data... Things like taking a copy and then doing an atomic replace...
  - eqvinox 5y ago
    Admittedly I've only had to deal with ransomware once, trying to help a friend. That one was way too shoddily written for anything like atomic replace or DB identification heuristics…
jon-wood 5y ago
Ransomware really is the best possible kind of data loss, at least there’s a recovery path built into it. On three occasions in my career I’ve been involved in events which led to large scale data loss. The first time the backups failed, and there was no recovering from it, ever since then I’m religious about testing backups. If you’re in a position to just restore from offsite backups not only can you just flip the bird to people trying to ransom your data, you’re also in a good position to deal with anything else, up to and including the data centre containing all your servers being burnt to the ground.

ctdonath 5y ago

The U.S. Constitution permits “Letters of Marque and Reprisal”, essentially Congress giving individuals permission to wage outright war on foreign entities. Ransoms (be it for life or data) are absolutely an appropriate application.

chews 5y ago

First off, I remember reading that it was not control of their infrastructure that the hackers had, it was control of the accounting systems. They are separated functions and the pipeline could not bill folks that’s why they shut it down... think about that... these folks shut it down cause they were worried about counter-party risk in payments...