8 ms·
Looks like ransomware criminals are going for the subscription model.
by anikan_vader 5y ago
Looks like ransomware criminals are going for the subscription model.
- marcosdumay 5y agoOnce the criminals start maintaining their own backups of victims data and helping them restore from rival attacks, they can successfully call themselves a mob. Somehow, that's a quite believable scenario.
- tomrod 5y agohttps://en.wikipedia.org/wiki/History_of_firefighting#Rome https://en.wikipedia.org/wiki/History_of_firefighting#Rome Fire fighting in Rome had a similar premise.
- antris 5y agoFree market in action.
- saltedonion 5y agoDoesn’t mean the free market doesn’t work. Asking people to pay before putting out the fire could be seen as a pay per use model. While a government run service funded by tax dollars could be seen as a subscription service that price discriminates on income tax rates. In both cases it’s the market at play.
- ethn 5y agoFree market requires strong property rights, as private property is a legal fiction which otherwise does not exist enough to sustain a market. This is instead a dysfunctional government approaching anarcho-individualism.
- CapriciousCptl 5y agoI think wikipedia got the details wrong there. Crassus didn't offer to buy the burning buildings, he offered to put fires out. At least, that's how I understood it years ago and that's what Wiki's own source shows-- http://www.trivia-library.com/b/richest-people-in-history-marcus-licinus-crassus.htm http://www.trivia-library.com/b/richest-people-in-history-ma... . edit: Actually, Plutarch wrote that Crassus did buy the burning buildings.
- rebuilder 5y agoThat's interesting - I definitely have heard it taught the way Wikipedia has it. But I suppose some website here or there doesn't really count as much of a source when we're talking of events so far in the past. Maybe someone can provide a primary source or two?
- CapriciousCptl 5y agoHmm, I dug further. The story probably comes from Plutarch (Lives), "[Crassus] would buy houses that were afire, and houses which adjoined those that were afire, and these their owners would let go at a trifling price owing to their fear and uncertainty"[1]. Plutarch was closer to Crassus than I am so I guess I can't argue. [1] https://penelope.uchicago.edu/Thayer/e/roman/texts/plutarch/lives/crassus*.htm https://penelope.uchicago.edu/Thayer/e/roman/texts/plutarch/...
- EGreg 5y agoThe privately owned fire brigades in NYC 100 years ago weren't much better. The free market at work: https://www.youtube.com/watch?v=9zoXk1vnmcg https://www.youtube.com/watch?v=9zoXk1vnmcg The real Bowery Boys would sometimes sabotage other companies' insured buildings by setting the fires. https://en.wikipedia.org/wiki/Bowery_Boys https://en.wikipedia.org/wiki/Bowery_Boys
- WalterBright 5y agoSetting fires on other peoples' property is not "the free market at work".
- EGreg 5y agoBut the rest of it was. The part in the first half of my message and the linked video is entirely free-market. Also, please do the work to expound on your claim.
- WalterBright 5y ago> do the work to expound on your claim A free market system requires protection of property rights. Arson violates property rights, and so is not free market.
- tomrod 5y agoWhat type of market is it when there is no regulation to protect rights, whether property, natural, or civil?
- WalterBright 5y agoAnarchy is one. Communism is the other, as you have no property rights.
- tomrod 5y ago
- josephorjoe 5y agoI think they can start calling themselves the corporate IT department.
- manquer 5y agoPerhaps the red team, there is more to IT than backups
- smnrchrds 5y ago> they can successfully call themselves a mob Or Backblaze's evil twin.
- stretchwithme 5y agoIf only organizations would backup their own data. Then they could just restore and avoid paying. I have a backup device of my own at home and that's the one I have to use. The company I work relies on some MSFT service that is pretty inflexible and won't back up the entire machine.
- smsm42 5y agoBackup is only part of the picture, one needs a proper disaster recovery strategy that is tested and updated. Otherwise it could turn out that backups exist, but it'd take half a year to bootstrap the company back into function using them. Backing up and restoring one PC is trivial, doing the same to 10000 PCs and another 1000 of interconnected software systems is a whole different business.
- wrycoder 5y agoMany people’s backup routines aren’t good enough. Some of these guys encrypt over a period of time which is long enough to exceed the backup rotation. Their code decrypts on request, until the trigger day, when it posts the banners and deletes itself.
- WalterBright 5y agoThat's why you have a combination of rotating backups, say 7, one a day, and non-rotating permanent backups, say once a week. Also, one should use "append only" backups (such as tape), or a disk drive designed to be append only with hardware write enables.
- wrycoder 5y agoWith a de-duplicating backup system like Borg, you can keep more backups in the same space. borgbase.com provides append-only and 2FA, which keeps your backups secure.
- dheera 5y agoMaybe corporations should make it standard practice to have cold storage backups that are physically disconnected from the network (by humans) in a rotated fashion. Backup A is physically disconnected on B days and backup B is physically disconnected on A days.
- tempestn 5y agoThe criminals already do often recommend firms to manage the payment and recovery process.
- pokstad 5y agoFor a second there, I thought you were going to say they can call themselves a backup service.
- tshaddox 5y agoIf only there were organizations who weren't criminals at all and who could be paid by a company to maintain backups of the company's data.
- lmkg 5y agoIt's a crowded marketplace, anybody who wants to succeed in there needs some growth hacking. Where in this case "growth hacking" hacking literally means hacking.
- Fragoel2 5y agoIf only managers would perceive the money spent to pay such organizations as a necessity rather than burned cash
- tshaddox 5y agoAs randomware attacks become more prevalent I suspect managers’ impressions will change!
- tartoran 5y agoHardest part is to find subscribers, from then on the milking process is easy. Leaving the joke aside, does this mean that the systems remained unprotected after the initial ransom was paid or that they continued to threat leaking sensitive data? Paying the ransom a second time would guarantee nothing. Neither was paying the first time either.
- ljm 5y agoIf they were caught in the first place and paid up, the attacker presumably learned enough about the infra to find another way in? Or it was social engineering. Like, is a company who runs its IT infra on Windows XP and pays the ransom likely to switch to the latest and greatest, no expenses spared, in a total and utter overhaul of all their systems? Or will they only try to patch the holes that were already revealed and gloss over the rest? Blame it on the intern, all that.
- Drakim 5y agoTo unsubscribe you have to talk to a sales representative and send in a fax.
- cronix 5y agoJust click that innocent looking unsubscribe link at the bottom of the email. Case solved!
- chucka9 5y agoWhy not just the prices up?
- mc32 5y agoI wonder if this hurts their reputation. If they earn a reputation of coming back for seconds... Two things: People fix things faster to prevent double dipping. People opt to not pay the initial ransom if they’re going to be taken hostage again. It’s a kind of tragedy of the commons where the commons are the potential victims.
- jnwatson 5y agoIt doesn’t even have to be the same attacker. The attacker could just as easily sell the info to another attacker. Plus, if the original vuln used to gain access is still open, there’s no reason why somebody else doesn’t find it later.
- sdenton4 5y agoWhich vulnerability did the attackers use to gain initial access? Do the attackers disclose this along with decrypting the data? And are you sure they didn't leave a sleeper Trojan behind for later?
- odshoifsdhfs 5y agoA few months ago one chat between hackers and the company was leaked. The hacker actually explained how to fix the vulnerabilities. On mobile but it should show up in google (think it was posted here on hn also)
- mike00632 5y agoThis assumes the blackmailer is trustworthy.
- jbverschoor 5y agoRaaS
- abledon 5y agoDo they have the Java SDK released yet?
- ineedasername 5y agoThey're becoming a file encryption service. No one can steal your files either because they will just get encrypted trash. Though I suppose those thieves could also pay for the encryption key, or just go directly to the "service provider" for a paid copy.
- fiddlerwoaroof 5y ago“Data escrow service”
- cblconfederate 5y agoAB testing shows 80% of the customers like it
- gentleman11 5y agoTheir engagement is through the roof and we have the data to prove it
- cblconfederate 5y agoTheir growth hacking worked
- arcticbull 5y agoI'm looking forward to one of them going public in a country where ransomware is legal lol, seems like they've got really solid ARR.
- dheera 5y agoHow the hell do people got hit with ransomware anyway? Do they not have offline nightly backups of critical data?
- wrycoder 5y agoSee my post in the peer thread.
- arthurcolle 5y agoI wonder if there are like Russian mob investors in these cybercrime "startups" and they also have to make decks that show YoY revenue / user growth. Lmao!
- trutannus 5y agoWell, to my understanding, fronting money in drug deals for a cut and interest is a common model crime already, so I would say it's more likely than you think. The only difference between VC funding and bankrolling the mob is one is legal.
- ozim 5y agoWell beating up someone to death will bring you money once, beaing someone multiple times will bring you more money. Ransom gangs are business oriented.
- akomtu 5y agoMeh, it looks like the ransom businesses have customer retention problem if only 80% stay.