7 ms·

I feel like giving criminals a platform like this is wrong. I'm all for reformed criminals giving interviews in the context of what they did being wrong, but t

• ailef 5y ago
  Considering the huge environmental damage created by e.g. oil companies (and many others), one could say the same about them? The only difference is what these people do is illegal while what the companies do is not: the damage, though, is arguably on the same scale, if not lower for ransomware attacks depending on which infrastructure is attacked.
  • eklavya 5y ago
    As much as I loathe our response towards global warming. This comment shows why equivalence should not be taken lightly and how absurd the result can be. How about holding people for ransom that is equivalent for sure, how about killing people? Well oil industry eventually ends up killing some people. Let’s put a stop to oil industry before we deal with the kidnappers and killers!!
    • ailef 5y ago
      > Let’s put a stop to oil industry before we deal with the kidnappers and killers!! Nobody said there has to be a priority. Why can't we stop both? Moreover OP comments was not talking about stopping them, but about giving these people a platform. Despite the damage done by oil companies they are still allowed to spend billions of dollars in marketing, lobbying, etc... Resulting in a much bigger, legalized, platform, while still causing way more damage than ransomware "companies".
      • Avtomatk 5y ago
        It's the sad double standard that most companies have: Look, I pollute half the planet and I don't give a shit about investing in new technology, I just want my ARR of 100 million, and I'm willing to lie with cheap marketing ... But ransomware It's clearly a priority, we can't risk being attacked if we didn't do anything illegal, that's morally wrong, and I'm a very moral person. How stupid people are on our planet, billionaire people are really very stupid people ... Put a scientific researcher and an entrepreneur to debate on any subject and that's when you realize that most "entrepreneurs" have the coefficient of a 5-year-old child. why do we never see Elon Musk debate with researchers if he has as much intelligence as he says (the techno king)? It must be so as not to make a fool of himself on television (or youtube)
  • deleted 5y ago
    [deleted]
  • cjblomqvist 5y ago
    Following that logic nurses delivering babies are also on the same level considering they're supporting the growth of the human race (which causes all the environmental damage)... There's a huge difference depending on "details"
    • ailef 5y ago
      That's of course a possible interpretation if you want to stretch everything to the extreme. OP thinks it's dangerous to publish a blog post with such an interview because it gives a platform to people who cause damage. I'm just pointing out that oil companies have caused way more damage than this guy and they have had a massive platform for decades, why shouldn't we stop giving them a platform as well?
      • cjblomqvist 5y ago
        What about the nurses then? Because they've definitely caused a lot more damage? Because one thing is illegal and the other isn't? In a society that holds laws relatively high that should be a super good argument?
  • danpalmer 5y ago
    I personally take moral issue with oil companies, but society as a whole has not decided that they are deserving of punishment, so I save my actions for campaigning, lobbying, and supporting groups that are pushing for change. On the other hand, society has decided, via law making, that ransomware attacks are deserving of punishment. With so many differing opinions it's hard to please everyone. I'm in favour of having a range of voices that I might not agree with represented in media, but criminals advertising their crimes and talking about how they're getting better at doing it feels like it's fairly clearly past a line.
  • wil421 5y ago
    Whataboutism. Let’s respond by bringing up a completely unrelated topic to justify the actions of criminal organizations. These are organized crime activities akin to cartel kidnappings, Somalia Pirates, mob extortion, and kidnapping tourists for ransom. 21st century pirates/mobsters. How long until ransomware becomes extortion or protection schemes? Pay us a yearly fee and we’ll not hack you and if someone does hack you we’ll hack them back.
    • ailef 5y ago
      You have misunderstood what we're talking about. Nobody is justifying anything, I'm just saying that if it's wrong to give these people a platform, why is it ok to give it to oil companies? The latter have caused way more damage than a random ransomware group.
      • ub99 5y ago
        Seems like the person you are responding to understood your point and labeled it (quite correctly) whataboutism.
        • ailef 5y ago
          Can you point out where I justified the actions of these criminal organizations (as parent said)? It's funny that the comment labeling mine as whataboutism is factually incorrect about what I said. It's easy to reply by labeling anything you don't agree with as whataboutism, because you don't have to go into the merit of the discussion. You don't have to articulate a reply, you don't need to reason about it. I made a pretty simple analogy, and the only one who actually replied with something sensible was OP, which I appreciate. Everyone else just tried to find logical fallacies (like now we need to stop nurses from giving birth) or just discredit the argument but without providing any meaningful reason.
          • wil421 5y ago
            Sorry to offend. Most of the damage oil companies are making is legal. At the moment fracking is legal but IMHO it’s very damaging. Undersea oil drilling is legal but there are many accidents. Shipping oil is legal but there are a lot of accidents that cause massive environmental problems. Ransomeware is never legal and organized crime is not legal in the West. They should not have a voice at all and should be treated like the criminal organizations they are.
• jongorer 5y ago
  what makes you so sure ransomware is "wrong"? let me rephrase this: do you think corporations are "good"?
  • andruby 5y ago
    that is not the same question :) some corporations provide value to society. some don't. the evaluation of this will depend on your personal values. my personal values do evaluate ransomware as "wrong". and the laws of most (all?) countries evaluate ransomware as illegal and thus legally "wrong".
  • TchoBeer 5y ago
    Ransomware companies are also corporations
    • rainonmoon 5y ago
      Not only this, but ransomware companies are even more nakedly in pursuit of profit than most non-ransomware companies. It's hard to imagine any ethical framework regarding capitalism etc. which would enable a favourable view of ransomware companies.
• zionic 5y ago
  It's hard to feel sorry for these companies when they have neglected security for so long. This outcome was inevitable, and hitting the bean counters where it hurts (financial bottom line) is the only way to effect change.
  • danpalmer 5y ago
    I don't have metal bars across my windows, should they start targeting my house to force me to add them? I'm being somewhat facetious, but I want to live in a society where not being hyper focused on all forms of security at all times, and just being _safe_ is an ok way to live your life. "It's easy so we'll do it" is not a defence of this practice. The only reason the security is needed at all is because of people like this. I'm not saying security isn't important, but being bad at security is not a defence of people who take advantage of that poor security.
    • trasz 5y ago
      Companies are not people. If your business is taming wild animals, should you have metal bars around them?
      • wastedhours 5y ago
        > Companies are not people. No, but employees and customers are, and they feel real, human costs as a result. Just because a management team has underfunded security is not an excuse to cause pain on other people.
        • trasz 5y ago
          Employees are being paid by hour, so they wouldn’t care at all. Customers - true, this might cause delays for them, if the company decided not to pay the ransom. It’s still just a delayed cost, though.
          • wastedhours 5y ago
• rpmisms 5y ago
  I completely agree. People should be unaware of ransomware attacks, despite the increase in frequency, scope, and severity over the last decade. Platforming criminals and making sure more people understand their competence and the threat model is a good thing. We should be scared.
  • danpalmer 5y ago
    There's a difference between educating and warning people about attacks, and having the attackers do that themselves. I'm not saying we shouldn't talk about these things, we absolutely should! It just shouldn't be by interviewing and glamorising those committing the crimes.
    • schoen 5y ago
      I share your concern that people will see this as cool or glamorous. But isn't it also helpful for people to try to understand the perspective of the attackers, for example because they might * become better able to defend themselves * become better motivated to defend themselves * better understand how to deter these attackers * become more motivated to seek action from government or vendors to deter these attackers * have a more informed debate about the ransomware industry or organized crime as a whole ...? Edit: for example, things that I had heard that were confirmed for me by this interview include that the Russian government is consciously tolerant of this activity (maybe someone could find ways to change that!?), that organized crime fears being caught or attacked by NSA, that ransomware attackers are very sensitive to their reputation and public image, that you can probably count on them to keep their side of their illicit bargains, and that they are especially motivated by money rather than ideology. All of those seem like pretty interesting ideas that might be hard to confirm quite as well in other ways.
• vmception 5y ago
  I think making companies and the industry more aware that their bug bounties are undervalued is important. It raises the bug bounties and creates more opportunities. This is an approach of like "okay lets just ignore your rational for not doing that and give the hackers a platform until you change"
• SCHiM 5y ago
  I think this is a good thing. It might show potential victims that their opponents are not a bunch of smelly teenagers hopping online after midnight. These are multi-million (billion?) businesses. There's strategic leadership, target acquisition pipelines, R&D, talent recruitment and coordination with other businesses in the space. There's every indication that with a little bit of protection money, you can even run your business with no interference from the law, as long as you don't mess around in your own backyard. You can see from the blog post, that this "company" has done a product-market-fit analysis. They've taken a look at their competitors' work, considered the pros/cons, and decided that they can do better. Since they are a b2b company (hehe) you can be reasonably sure this is not some PR aimed at consumers. I think it reads as a recruitment pitch to their lead generators (read: hackers whom infect other networks for them). You can see the pitch, it almost reads as a vacancy post: - We make a lot of money - We're new to the scene but already have had success - We only work with the best hackers - We pay you lots of money to infect a network, if you got what it takes
  • rmah 5y ago
    When groups do this in furtherance of illegal activities, it's called "organized crime". And such groups need to be pursued aggressively because they are corrosive and poisonous to society at large. If they are not actively and aggressively fought, their negative effects seep into broader society and can become entrenched for generations.
    • dcow 5y ago
      What about when your “organized crime” group has a moral compass and isn’t breaking local laws?: DS: Obviously, there are many talented professionals on your team. Why is it that this talent is aimed at destructive activities? Have you tried legal penetration testing? BM: We do not deny that business is destructive, but if we look deeper—as a result of these problems new technologies are developed and created. If everything was good everywhere there would be no room for new development. There is one life and we take everything from it, our business does not harm individuals and is aimed only at companies, and the company always has the ability to pay funds and restore all its data. We have not been involved in legal pentesting and we believe that this could not bring the proper material reward. For me the line between organized crime and robin hood is very blurry.