18 ms·
80% of orgs that paid the ransom were hit again
- acheron 5y agoOnce you pay 'em the Danegeld You'll never be rid of the Dane
- sharken 5y agoI don't see why you have to pick on the Danes :) But the similarities are there, although the person's behind the ransomware attacks are probably not vikings.
- hprotagonist 5y agohttps://www.poetryloverspage.com/poets/kipling/dane_geld.html https://www.poetryloverspage.com/poets/kipling/dane_geld.htm... https://en.wikipedia.org/wiki/Danegeld https://en.wikipedia.org/wiki/Danegeld
- coldcode 5y agoThe ancestors of the Russians were themselves Vikings. Their kingdom of Rus is where the name came from.
- admax88q 5y agoMeaningless stat without a baseline to compare against. How many who didn't pay were hit again?
- jessaustin 5y agoIf the attacker isn't paid for the first attack, why would she attack again? She's not doing it for the lulz! I do agree with you that there should be more visibility for the "silent majority" of firms who operate their businesses responsibly, and therefore don't ever need to pay ransom.
- Trias11 5y agoBecause second attacker might not be briefed by the first one.
- Covzire 5y agoIf they actually have proper backups to avoid paying the first one, my guess is they are much more likely to also have the skills to prevent a second breach.
- Trias11 5y agoI agree on backups and actually working and robust restore system. Cheapest way to avoid paying ransoms. You can never be sure about 100% hacker safe but backup/restore system can be life saver
- 8note 5y agoAnd also due to the attacks being cheap to run
- arnvald 5y agoIf the victim doesn't pay the first time, they suffer consequences and next time might decide to pay instead.
- jessaustin 5y agoISTM we only hear about the tiny minority of "victims" who do "suffer consequences". Most organizations who get ransomed just shut off a bunch of unnecessary stuff, re-provision the necessary stuff with passwords turned off, restore from backup, and hire some security consultants.
- Tade0 5y agoI'm sorry but I have to ask: why assume the attacker is female?
- 5y ago
- insickness 5y agoIt's likely the reinfection rate is high in both cases since it's so difficult to ensure every possible back door has been closed.
- spywaregorilla 5y agoThe most important line: > 80% of organizations that paid the ransom were hit by a second attack, and almost half were hit by the same threat group. The same group!
- tyingq 5y agoMakes sense to me. From what I've read, it's pretty clear the ransom payment is for a one-time ability to get your data back. It's not advertised as some sort of permanent opt-out.
- judge2020 5y agoAlthough I think false advertising would be the least of their worries if they decided to do it.
- cdstyh 5y agoMakes more sense if the group offered a subscription model for decrypting files encrypted by that group. Then you wouldn't have to keep paying the big lump sum.
- rossdavidh 5y ago...and if you pay for our Premium Level Service, we'll secure your systems against other criminal enterprises as well!
- mywittyname 5y agoWhat Hackers Can Learn From The Sopranos.
- weare138 5y agoThat's a nice network you have there. It would be ashamed if something happened to it if you know what I mean.
- 5y ago
- mateuszf 5y agoShouldn't they improve their security?
- cronix 5y agoAbout half did. From the article... > After an organization experienced a ransomware attack, the top 5 solutions implemented included security awareness training (48%), security operations (SOC) (48%), endpoint protection (44%), data backup and recovery (43%), and email scanning (41%). The least deployed solutions post-attack included web scanning (40%), endpoint detection and response (EDR) and extended detection and response (XDR) technologies (38%), antivirus software (38%), mobile and SMS security solutions (36%), and managed security services provider (MSSP) or managed detection and response (MDR) provider (34%). Only 3% of respondents said they did not make any new security investments after a ransomware attack.
- jcims 5y agoGiven 0-day vulnerabilities and supply chain risks, I'm going to take a little bit of poetic license and say it's impossible to stop ransomware attacks, certainly with commercially viable levels of investment in infosec. You can mitigate some of the exposure, but the level of validation required to continuously guarantee that those mitigations are intact and effective. So attacks will continue, the level of impact will hopefully be reduced along with the commensurate justifiable ransom payment.
- TwoBit 5y agomaybe, but most ransomware attacks aren't via zero-days but via simpler means. Also ransomware infects a whole network and so part of the cause is systems that allow that.
- anikan_vader 5y agoLooks like ransomware criminals are going for the subscription model.
- marcosdumay 5y agoOnce the criminals start maintaining their own backups of victims data and helping them restore from rival attacks, they can successfully call themselves a mob. Somehow, that's a quite believable scenario.
- tomrod 5y agohttps://en.wikipedia.org/wiki/History_of_firefighting#Rome https://en.wikipedia.org/wiki/History_of_firefighting#Rome Fire fighting in Rome had a similar premise.
- antris 5y agoFree market in action.
- saltedonion 5y agoDoesn’t mean the free market doesn’t work. Asking people to pay before putting out the fire could be seen as a pay per use model. While a government run service funded by tax dollars could be seen as a subscription service that price discriminates on income tax rates. In both cases it’s the market at play.
- ethn 5y agoFree market requires strong property rights, as private property is a legal fiction which otherwise does not exist enough to sustain a market. This is instead a dysfunctional government approaching anarcho-individualism.
- CapriciousCptl 5y agoI think wikipedia got the details wrong there. Crassus didn't offer to buy the burning buildings, he offered to put fires out. At least, that's how I understood it years ago and that's what Wiki's own source shows-- http://www.trivia-library.com/b/richest-people-in-history-marcus-licinus-crassus.htm http://www.trivia-library.com/b/richest-people-in-history-ma... . edit: Actually, Plutarch wrote that Crassus did buy the burning buildings.
- Trias11 5y agoPay or not - you gotta fix security. Outsourcing it to el-cheapo, offshore middlemen is not going to cut it.
- bserge 5y agoI believe that's a big part of why governments don't negotiate with terrorists and police just stall for time in real world ransom cases.
- fibers 5y agoExcept that is a terrible analogy and has everything to do with a poor security culture on the firm's part because IT is treated as a liability rather than an asset.
- prepend 5y agoI think the analogy is apt since both paying terrorists and ransomers is counterproductive. If you pay the terrorists they just do it again. If you pay the ransomers they just do it again. And the payment increases their capabilities. I think, except for rare conditions where a temporary need exists, it’s a net negative to pay. But I think the security flaws that allow random ware typically are a sign of institutional incompetence so it makes sense they would also be incompetent to pay, and pay again, and pay again. Rather than to prevent the attack or to correct the flaw that allowed the attack.
- mullingitover 5y ago"We don't negotiate with terrorists" is more of a slogan than a real policy[1]. [1] https://www.foreignaffairs.com/articles/2007-01-01/negotiating-terrorists https://www.foreignaffairs.com/articles/2007-01-01/negotiati...
- anoncake 5y agoThe difference is that even if you don't negotiate with terrorists, they can still terrorize you. It's impossible to successfully ransom someone without their cooperation.
- uhhhhhhhhhhhhhh 5y agoThis is an interesting dance. Which company has paid the most? Is it on the jira board every monday "remit darkside for db access"
- tempfs 5y agoI mean they just proved that they are willing to pay the ransom. If they are also unwilling or unable to clean up their shop and keep it from happening again, it surely will.
- avgDev 5y agoIt is almost like the groups hacking them are providing a good service. If they get hacked once, shit happens. But if it happens multiple times then someone should probably answer for it.
- deleted 5y ago[deleted]
- chihuahua 5y ago"We don't have money in the budget for backups. But we do have money in a different budget for ransom payments!"
- mywittyname 5y ago"how much you got?"
- BizarroLand 5y agoRAAS, Ransomware As A Service
- ArkanExplorer 5y agoThe responsibility lies at the nation-state level, and the clear decision is for Governments to ban the formal exchange of cryptocurrencies. As soon as this occurs, ransomware events will collapse since the ransoms will become unpayable. The negatives of cryptocurrencies (ransomware enablement, chip and electricity shortages, scams) clearly outweigh the positives at this point.
- 5y ago
- _tom_ 5y agoAnyone else think we should make it illegal to pay ransom? These people are just financing the next generation of cyber criminals. Once people stop paying, people will stop attacking.
- Miner49er 5y agoI think we should actually legalize ransomware. By that I mean create a government-ran national bug bounty program. All companies of a certain size are automatically included in it. Bounties are awarded based off severity, and bounties are paid for by fines to the companies hit.
- trvrprkr 5y agoInteresting idea. But what you're describing is absolutely not "ransomware."
- jjeaff 5y agoIt is already illegal in the US as of late 2020. But we know nothing really happens when corporations break the law. https://cisomag.eccouncil.org/paying-ransom-is-now-illegal-u-s-dept-of-treasury-warns/amp/ https://cisomag.eccouncil.org/paying-ransom-is-now-illegal-u...
- randomhodler84 5y agoOnly for sanctioned parties I believe — which would apply for any money transfers regardless of purpose. Most random criminal rw attackers are not going to be on a sanction list.
- rytcio 5y agoYes, because criminals definitely follow the law.
- jhgb 5y agoNo, you become a criminal by paying. You continue not being a criminal by not paying.
- makeitdouble 5y ago“Never negotiate with terrorists” is a simple and clear mantra, and as most clear and simple concepts it hides a lot of assumptions. One of them is you are ready to lose the hostage in the worst case scenario. That’s how the police sees it, because the society benefits more from being firm in individual cases than losing a few of its members that might not come back anyway. That’s a hard one to swallow, hard enough that govs also sometimes can’t follow the mantra and just pay the ransom. It’s crazy hard to get people to sacrifice themselves for the better good, it’s yet a bigger ask for corporations who already screw the public day in day out.
- enkid 5y agoNever negotiate with terrorists is only a thing because it puts you in a stronger negotiation position.
- cwkoss 5y agoAnd it's just posturing. I'm sure the US negotiates with groups it labels as terrorists through backchannels.
- koheripbal 5y agoLiterally every government says this publicly, and then negotiates privately.
- andrewmcwatters 5y agoFrom the perspective of the individual, there is no greater good than defending one’s self.
- kag0 5y agoHardly. There are many philosophies that argue that the greatest good lies with how we interact with the other. And on a purely primal level it's common to prioritize one's offspring over one's self. I think most cultures recognize this intuitively.
- ghostly_s 5y agoWhy would you expect otherwise?
- cronix 5y agoDoes it really surprise anyone that criminals would (re)target a place that paid out quickly and made their "jobs" easier? The aim is to get paid as quickly as possible with the least complexity and move on to the next target, is it not? If you're a freelancer and you have 10 clients and 8 always pay within 14 days of invoice and the other 2 let it drag on 90+ days and having to send out "reminder" letters, who do you favor doing business with?
- yelling_cat 5y agoAccording to a study by Cybereason, which sells endpoint protection software.
- robocat 5y agoOne has to wonder if Cybereason measured the 80% figure from their own clients - endpoint protection is the lowest form of security. Alternatively, Cybereason are probably in a really good position to snarf passwords and then parallel construct an attack from a third party who gives a few major individual shareholders a kickback. Does endpoint security even work?
- tfang17 5y agoRansomware attacks are multi-round games.
- boringg 5y agoIS ANYONE SURPRISED?!
- boringg 5y agoThere is no honor among thieves.
- eh9 5y agoAnd that's why you never pay dane-geld[1] [1]https://en.wikipedia.org/wiki/Dane-geld_(poem) https://en.wikipedia.org/wiki/Dane-geld_(poem)
- deleted 5y ago[deleted]
- mkr-hn 5y agoSee also: why people who want to pay to not see ads are ideal ad targets.
- systematical 5y agoThe amazing part is they allowed themselves to get hit again. You'd think these organizations would tighten security after the first one...
- okareaman 5y agoOnce they are in, who knows what back doors the installed
- deleted 5y ago[deleted]
- kag0 5y agoI wish this said how many of those hit again also paid again. I find it easy to believe that you could be hit twice in a row despite your best intentions, but hard to believe that you'd need to pay the second time if you had established a backup solution.
- skybrian 5y agoThere's a somewhat better article about the survey here [1], including which countries were surveyed. It looks like you can download the full report by filling out a form [2]. (So I didn't.) [1] https://www.zdnet.com/article/most-firms-face-second-ransomware-attack-after-paying-off-first/ https://www.zdnet.com/article/most-firms-face-second-ransomw... [2] https://www.cybereason.com/ebook-ransomware-the-true-cost-to-business https://www.cybereason.com/ebook-ransomware-the-true-cost-to...
- dragonwriter 5y agoRudyard Kipling explained this: --- But we've proved it again and again, / That if once you have paid him the Dane-geld / You never get rid of the Dane. --- https://www.poetryloverspage.com/poets/kipling/dane_geld.html https://www.poetryloverspage.com/poets/kipling/dane_geld.htm.... By paying, you’ve just proven that you are a profitable target to hit.
- dalbasal 5y agoI'm from Dublin. We didn't pay the Danegeld, and in retaliation they built a city.
- pas 5y agoCould you explain that a bit? :o
- dalbasal 5y agoDanes/Vikings established Dublin, and Irish urbanism generally. They're like our Romans. I was just throwing some complexity into the Danegeld narrative.. not sure what it means in terms of the metaphor. Maybe ransomware hackers eventually build operating systems?
- kristopolous 5y agoWhat percent that didn't though? Basic controls here...
- RalfWausE 5y agoSolution: Don't pay the ransom, instead offer a bounty 'Wanted dead or alive (preferred dead of course, if it can be made to look like an accident)'
- surround 5y agoWhat percentage of orgs that didn't pay the ransom were hit again?
- yawaworht1978 5y agoSeems like the ones with the payloads distribute it to more than one affiliate. Or at least a previously hit target does not get a mark that is globally respected. The fast growth desires lead to a lot of vulnerabilities, yesterday I signed up to a service and they emailed me my own username and password, simple plain text. Incredible.
- holtalanm 5y agoDoesnt this just mean that 80% of orgs that were hit with ransomware attacks just didn't bother to fix their infosec, and got hit again because they left the same holes open to be exploited? Fool me once, shame on you. Fool me twice, shame on me.
- astockwell 5y agoMost likely.
- kerblang 5y agoIt can just as easily mean that the attacker found a second exploit after the first was resolved.
- beloch 5y agoSince so many were hit by the very same ransomware group, it's likely that the attacker spotted a second exploit during the first attack. It's easier to spot things when you've already busted your way in and have the run of the place. i.e. An attacker breaks into a system using one vulnerability, spots a few more vulnerabilities while snooping for data, files them away for future reference, extracts a ransom, and then repeats the process later after the victim fixes the first vulnerability but fails to address the others. The takeaway lesson appears to be that, if you are hacked and fix the vulnerability that made it possible, you shouldn't stop there. You're marked as a target that pays and detailed information on your system is now out there. Even having fixed the first hack, you're more vulnerable than ever.
- ADHDreamer 5y agoSo ransomware already means they got into the system, they could open a new secret backdoor or completely tear down your security if they wanted to. Plus it takes time to identify the ransomware to undo/remove it, so in that time they could attack again. paying ransomware ransoms is just saying "pretty please don't do this again".
- aiisjustanif 5y agoYes, but even more importantly it means they don’t have proper backups and disaster recovery.
- simonw 5y ago"After an organization experienced a ransomware attack, the top 5 solutions implemented included security awareness training (48%), security operations (SOC) (48%), endpoint protection (44%), data backup and recovery (43%), and email scanning (41%)." Only 43% of organizations invested in data backup and recovery after a randsomware attack? I would expect that number to be closer to 100%!
- artful-hacker 5y agoAnd how many of that 43% actually put in place a method to test their backups regularly? I'd bet its less than 5%
- trentnix 5y agoBecause that’s where the money is, someone once said.
- smsm42 5y agoMakes sense. We have a company with bad security practices (not easy to fix), inadequate disaster recovery strategy (not easy to fix) and willing to pay money to criminals to make problems go away. Of course it's an ideal target. I wonder if by now the criminals compile and trade the list of easy target companies.
- flowerlad 5y agoI don't see any discussion of typical entry points. How do these guys get into the system? Is it by having someone download a malicious file? If so what type of file? PDF? MS Office? If so Adobe and Microsoft should be held accountable for their security holes, only then will they have enough motivation to maybe consider rewriting some of their code in a safer language such as Rust.
- lurquer 5y agoAgree. There is much confusion and many bad analogies surrounding this issue. Some claim - without evidence - that nation states are behind it. Which, with a moments reflection, is absurd; nation states may have an interest in disabling certain systems for military purposes (at the appropriate time), but no nation state needs ransom money. Easier ways for a government to get money; namely, just print some. Others liken it to the mafia or cartel or other well-organized criminal organizations. This too misses the mark. Like most business crimes, the culprit is almost always an insider. Period. As the tools to pull this off are trivial to come by on the internet, the obvious suspect would be some disgruntled IT person within the company. It’s as if — after a bank robbery — everyone claims it must have been some crack team of Russians flown in under radar in helicopters. Instead, they should be looking at the numerous employees who have access to the security system and the safe. But, it’s much more exciting to pretend that Putin is sponsoring hackers to get trivial amounts of money from companies across the globe. Ha. I’m not even an IT guy, but at my last job, even I had access sufficient to destroy or corrupt all the data. That was before cryptocurrency and the like... I assume assembling a ransomware set of tools off the internet is no more or less difficult than it was to assemble a set of tools to make pirated copies of AdobePhotshop back in the day.
- perl4ever 5y ago>no nation state needs ransom money. Easier ways for a government to get money; namely, just print some Sure, this is obvious, makes intuitive sense, except...it explains why something like Iran-Contra or the equivalent in other countries can't happen.
- squiggleblaz 5y ago
- fairity 5y agoWhat does the outcome distribution look like if you don't pay the ransom? What percent of orgs that did not pay the ransom get hit again?
- diego_moita 5y agoWhat I suspect: the first ransom was paid by insurance, therefore it didn't hurt them, therefore they didn't bother protect themselves for the second. Now just wait to see what will happen to your insurance rate after you pay the third ransom. They certainly will begin to understand the need for backups.
- SV_BubbleTime 5y agoMost of these start as phishes to lower level employees. It makes sense to me that’ll happen again and I’m not sure I can say the solution is better backups. Another issue with backups, is are you restoring to an already infected / immediately infectable state? I think the better closer is “The certainly will begin to take security, training, and best practices seriously”.
- ryanmcbride 5y agoI'd like to think security training can take care of it, that people can be careful and considerate and have a skeptical eye about every single message they receive. But it only takes one person and these huge companies employ so many people. So many times, even at companies with really strict security training I've seen people just walk away from their unlocked computers, click random links in emails, stuff like that. People are always the first line of defense but it's one of those one-sided battles, where every single person in the entire company has to make 0 mistakes, and an attacker only has to get lucky once.
- spicybright 5y agoWhich is why you need a level above the individual to protet from attacks. It sucks locking things down for each employee, and subjecting them to bureaucracy to unlock things they need to do, but it's better than ransomware. It's unrealistic to expect every employee to catch hacking attempts 100% of the time.
- WalterBright 5y agoA single computer should never have access to all the company's data. Neither should a single login. It's like compartmentalization on a battleship. A single hole won't sink it, in fact, many holes won't.
- munk-a 5y agoHey guys - I know security is hard to justify cost-wise but if you get hit by ransomware then shape up and actually do some due-diligence around your data stewardship. Wait - is this how the market fixes poor security practices?
- mike00632 5y agoMore like a hostile and unregulated environment adding costs to doing business.
- ajonit 5y agoIt is Sales101 - Getting business from an existing customer is easier than on-boarding a new one.
- underseacables 5y agoHow long do major companies keep back ups? It seems like all of these companies that keep getting hit with ransomware Only have last weeks back up laying around. Why can’t you go back eight months? True the data is going to be lacking, but at least the structure is going to be there. I completely understand that a Trojan or a virus can get locked into a back up and it just keeps getting backed up, but if you go far enough back you will find a clean copy.
- SV_BubbleTime 5y agoI have yearly backups for three years. Right now, we could use one of those. At my last place, they only kept 1 year and monthly, but the problem was it was hundreds of terabytes of data on lots of VMs. We tried to restore backups and it was going to take longer than the long weekend just for file transfer. I don’t know what normal process is, but I believe I saw file locker Trojan that didn’t hit every byte of the drive; but rather crawled the file system and did a bit on every file header for speed. So I imagine it’s still faster to pay and fix than restore from backups for some.
- underseacables 5y agoThe company I work for does nightly back ups and we keep them for five years in cold storage. Our CTO got hit with an attack years ago that almost cost him his job at another company, and he vowed to never let it happen again. Are we unusual for this?
- toxik 5y agoRansomware is actually a net benefit. They force information security into the business agenda in a way that we haven’t really been able to accomplish before. You can now quantify the cost of getting pwned. It’s a bit like the immune system needing pathogens every once in a while.
- squiggleblaz 5y agoThis argument is reasonable-ish but wrong. Companies have long been subject to information security crises. Earlier, there were viruses; today, it is ransomware. Business practices will change in a way that makes these hacks less feasible, but not most businesses just aren't interested in it. The fantastic new security of the future won't be secure by design, it'll be known-ransomware-proof. (Also, implicit in the claim is the argument that any activity is good activity. I don't think that holds: I think paying for security guards and spending disk space or CPU cycles on security measures are necessary, but not beneficial. Probably, the world would be better if there are no bad actors. But I can only assent to your claim if I believe that the world is better if we protect against bad actors than if we have no bad actors and no protection. This is probably the cause of you getting downvoted.)
- datadata 5y agoWhy not just criminalize paying ransoms? Remove incentives and don't fund criminals.
- perlgeek 5y agoBecause in the short term, this could have some pretty nasty consequences for some companies that are hit the hardest, and few politicians want to take that hit.
- AbraKdabra 5y agoGet attacked once? It's on me. Get attacked TWICE by the same group and did absolutely nothing to better the security after the first attack? Yeah, it's on you.
- splithalf 5y agoSecurity is impossible. As long as there are incentives, nothing will be secure. It’s just a matter of incentive/difficulty. With enough incentive stuxnet or solar winds or omb are possible. Bitcoin values are causing this equilibrium to be disrupted, making this appear as though it were a new problem.
- afrcnc 5y agoPlease never take these security surveys seriously. Most are created by companies looking for media coverage and are just made up.
- heavyset_go 5y agoOnce scammers know you're a mark, they'll exploit it. This is why email lists are next to gold to scammers, because they're lists of people or organizations who have parted with their money under false pretenses before, and are most likely willing to do so again in the future.
- Beached 5y agofrom my experience responding to these. orgs that entertain the ide of paying the ransom often do not care about root cause analysis to the degree they should. orgs that completely ignore payment as an option spend their time identifying the entry point, and vulns, and close those before restoring or rebuilding.
- data_spy 5y agohow many were hit again who didn't pay?
- qyi 5y agoThe standard business solution to solve security issues - for example like having all your database in a public folder - is to get a guy to implement "security" (whatever that means) who is 40 years old and is really confident he knows what he is doing. He will go configure some firewalls and stuff that has absolutely nothing to do with preventing any real risk aside from automated attacks. Every time someone still gets the files from some 90's vuln, everyone is surprised that some sooper dooper hacker wizard was able to own their fortune 500 company. > The least deployed solutions post-attack included web scanning (40%), endpoint detection and response (EDR) and extended detection and response (XDR) technologies (38%), antivirus software (38%), mobile and SMS security solutions (36%), and managed security services provider (MSSP) or managed detection and response (MDR) provider (34%). Only 3% of respondents said they did not make any new security investments after a ransomware attack. uh huh. uh huh. uh huh. uh huh. Meanwhile, for example, earlier today: a web search for "cat /etc/passwd" blocks my IP. What even is the point of this article? _Of course_ if you don't patch they will just hack you again. _Of course_ if your company follows terrible 90's practices, it will get owned again.
- YuriNiyazov 5y agoSo, what age must one be to supervise implementing security practices at an organization?
- albertgoeswoof 5y agoDid you choose 40 year old because it’s too old, or because it’s too young? I genuinely can’t tell
- qyi 5y agoThe essential point is that he's 40 and still doesn't know what he's doing (a common problem in any technical field).
- dcow 5y agoThis may be an impossible question to ask: does anybody know of organizations running entirely dark copies of infrastructure possibly using an entirely different stack up to the application layer? Rather than redundancy, which is an announced component of your infrastructure available for failover and thus known to attackers, this dark infrastructure exists unknown to all but a select few employees and can be engaged during a ransomware attack. Throw the old infrastructure away and rebuild new dark infra. I have heard at least one story of something like this earlier today when discussing this headline. Curious how common it is.
- ht85 5y agoKeeping two infras in sync means that you gotta have some kind of formalized management process. If you do have that, then there isn't much value in having the fail over up and running at all time, you can just build/launch it if needed. This is easy in a containerized env, if you don't have that luxury having batch scripts that can provision all the critical servers quickly does the trick. This combined with reliable database backups should be enough to make the impact of such an attack trivial.
- runbathtime 5y agoAn argument some have suggested is to make it illegal to pay ransoms. But with crypto, someone could pay it for you (maybe the hacker), just to have charges filled on the victim.
- simonblack 5y agoI simply can't fathom why any organisation can't go offline for an hour or so to rebuild their systems from backups, rather than go offline for days or more while ransom is being paid.
- kaesar14 5y agoSupposing they have backups and that the backups werent compromised.
- Proven 5y agoWhat did they expect? You payment was one off, not a subscription. Would you think you wrote a shit article if you said 80% of companies that paid tax were hit by IRS again?
- smitty1e 5y ago"And that is called paying the Dane-geld; But we've proved it again and again, That if once you have paid him the Dane-geld You never get rid of the Dane." https://www.poetryloverspage.com/poets/kipling/dane_geld.html https://www.poetryloverspage.com/poets/kipling/dane_geld.htm...
- aaron695 5y ago> 80% of orgs that paid the ransom were hit again This isn't true and I'm not sure why people think it is. This is not how the world works. Ransom crews are not cartoons, they are people like the rest of us running a business. At a very high level, sure, ransom paid then they might be 'hit again' by a random hacker testing the defences next year. Is that 'hit again'? 'Hit again' is not 'ransom again' If this is cookie cutter ransomware that's automated and you pay an automated system to un-encrypt. Sure the worm or what not will attack again is you don't fix that worms hole. This has zero to do with REvil and all the famous ransom crews that the title implies. That should be pretty obvious.
- titzer 5y agoRansomware is why all my important data is backed up to dumb media--optical disks.
- wolverine876 5y agoNote that, > 80% of organizations that paid the ransom were hit by a second attack, and almost half were hit by the same threat group Why would victims pay them? Why would the attackers bother to reinfect? Just up the price on the original infection, after the first payment.
- jonasft 5y agoThis is a good case of the prisoners dilemma. If the groups of attackers don’t hit the same victims twice, it would increase their chances of getting paid for each attack. Whilst also everyone is tempted to re-hit a victim who has already proved their willingness to pay, but this decreases the willingness for each victim to pay because they have seen that it won’t actually protect against a new attack.
- trashtester 5y agoIf an insurance company would also offered IT security included in the premium, they should be able privide better security at a lower total cost. Actuaries could even asist in calculating how much risk is mitigated by each security measure, and optimize meausures to match costs to risk.