4 ms·

I don't think so. The success of this would all hinge on an un-easy trust between the organizers and the individuals. Backstabbing your partner would ensure tha

I don't think so. The success of this would all hinge on an un-easy trust between the organizers and the individuals. Backstabbing your partner would ensure that you would never get anyone else to do this for you again. That would be the end of your operation. You need the world to know that yes people really do this for you, and yes they really do get paid. A similar dynamic is at play between ransomware attackers and their victims. Why would ransomware attackers restore files from a successful attack after the ransom is paid? Easy. The attackers need the world to know that paying the ransom will work, otherwise no one would pay it.

hinkley 5y ago
It is odd watching a bunch of people who effectively deal with rules all day try to predict behavior for a group of people who effectively ignore rules all day. Why is a ransomware company going to follow the rules of common decorum when dealing with a collaborator if the whole point is to defraud a third party? How do I know that they made the payout? Is the collaborator going to come forward and identify themselves? The only way you know that person got paid is if they don't get arrested. There are whole branches of organized crime than live and breathe in the space between 'got paid and lived happily ever after' and 'ended up on the front page of the NYT'. Just off the top of my head you have blackmail, extortion, and hiding the body.
- SonicScrub 5y ago
  We aren't invoking the ethics of "rule-following" to explain why criminals behave certain ways, rather we are speculating on based on incentive alignments and rational self-interest. The answer to your question is quite simple: because they need third parties to work with them. There are lots of ways as to make past history of payouts known without releasing who the individual collaborators were in each case.
  - hinkley 5y ago
    No. Not even close. This isn't 7-11 trying to con me into buying their scary hot dogs, these are bad people, in all senses of the word. They need third parties to think that working with them is their best option. Their best option is to do something legal, but desperate people can be manipulated. Greedy people can be really manipulated. Maintaining the illusion of safety is just marketing. If the game is extortion, then psychological manipulation is part of the game. I have no assurances that you've given me $1.4 million today and this is the last I will ever hear from you. If I know little about you I can't even turn State's Evidence to save my ass if I get caught but you don't. If I think I know that you or anyone with details of your operation won't come back later and threaten to turn me in unless I pay you money, then I'm a fucking idiot. You could ask for money, or to "deliver a package" for you. In that situation, what you and your associates are counting on me forgetting is that I am mortgaging my future by piling on new crimes with later statute of limitations dates, and establishing a pattern of behavior that makes me look even more complicit. There is no honor among thieves. Stop trying to figure out how to pet a wolf without getting bit.
munk-a 5y ago
Most folks will follow this approach - but it's not guaranteed. Some of the attackers will betray their victim and ride on the goodwill garnered by other attackers to make their strategy sustainable.
kortilla 5y ago
You missed something fundamental there about the difference between the two scenarios that drastically changes the optimal play. Victims of ransomware are public and will publicize if they don’t get their files back. An individual willingly trying to compromise their employer’s network is not going to publicize not getting paid because it will get him/her arrested.
- EMM_386 5y ago
  > An individual willingly trying to compromise their employer’s network is not going to publicize not getting paid because it will get him/her arrested. They will anonymously post on the message boards dedicated to ransomeware gangs that this particular gang is not reputable. Like leaving a Yelp review, except even more trustworthy because it's a relatively tight-knit community. It would only work out for the gang if the ransom was enough money they decide to "retire" and not pay out. In all other situations, they need their reputation.
  - kortilla 5y ago
    > They will anonymously post on the message boards dedicated to ransomeware gangs that this particular gang is not reputable. And why would someone believe an anonymous post? Don’t you see the problem here?

hinkley 5y ago

It is odd watching a bunch of people who effectively deal with rules all day try to predict behavior for a group of people who effectively ignore rules all day. Why is a ransomware company going to follow the rules of common decorum when dealing with a collaborator if the whole point is to defraud a third party? How do I know that they made the payout? Is the collaborator going to come forward and identify themselves? The only way you know that person got paid is if they don't get arrested. There are whole branches of organized crime than live and breathe in the space between 'got paid and lived happily ever after' and 'ended up on the front page of the NYT'. Just off the top of my head you have blackmail, extortion, and hiding the body.

SonicScrub 5y ago
We aren't invoking the ethics of "rule-following" to explain why criminals behave certain ways, rather we are speculating on based on incentive alignments and rational self-interest. The answer to your question is quite simple: because they need third parties to work with them. There are lots of ways as to make past history of payouts known without releasing who the individual collaborators were in each case.
- hinkley 5y ago
  No. Not even close. This isn't 7-11 trying to con me into buying their scary hot dogs, these are bad people, in all senses of the word. They need third parties to think that working with them is their best option. Their best option is to do something legal, but desperate people can be manipulated. Greedy people can be really manipulated. Maintaining the illusion of safety is just marketing. If the game is extortion, then psychological manipulation is part of the game. I have no assurances that you've given me $1.4 million today and this is the last I will ever hear from you. If I know little about you I can't even turn State's Evidence to save my ass if I get caught but you don't. If I think I know that you or anyone with details of your operation won't come back later and threaten to turn me in unless I pay you money, then I'm a fucking idiot. You could ask for money, or to "deliver a package" for you. In that situation, what you and your associates are counting on me forgetting is that I am mortgaging my future by piling on new crimes with later statute of limitations dates, and establishing a pattern of behavior that makes me look even more complicit. There is no honor among thieves. Stop trying to figure out how to pet a wolf without getting bit.

munk-a 5y ago

Most folks will follow this approach - but it's not guaranteed. Some of the attackers will betray their victim and ride on the goodwill garnered by other attackers to make their strategy sustainable.

kortilla 5y ago

You missed something fundamental there about the difference between the two scenarios that drastically changes the optimal play. Victims of ransomware are public and will publicize if they don’t get their files back. An individual willingly trying to compromise their employer’s network is not going to publicize not getting paid because it will get him/her arrested.

EMM_386 5y ago
> An individual willingly trying to compromise their employer’s network is not going to publicize not getting paid because it will get him/her arrested. They will anonymously post on the message boards dedicated to ransomeware gangs that this particular gang is not reputable. Like leaving a Yelp review, except even more trustworthy because it's a relatively tight-knit community. It would only work out for the gang if the ransom was enough money they decide to "retire" and not pay out. In all other situations, they need their reputation.
- kortilla 5y ago
  > They will anonymously post on the message boards dedicated to ransomeware gangs that this particular gang is not reputable. And why would someone believe an anonymous post? Don’t you see the problem here?