4 ms·

Still, the GP's point stands. Especially as attackers create a "brand" and establish trust -- if a few quick searches show other people reporting that they paid

by Jach 5y ago

Still, the GP's point stands. Especially as attackers create a "brand" and establish trust -- if a few quick searches show other people reporting that they paid and things were restored, then you can bet people will feel much more at ease with the idea of paying and actually being left alone after. When a business depends on it, when data loss is at play instead of just downtime, even more so. People will pay.

noduerme 5y ago
I think paying is a dumb move, regardless of the "brand" of extortionist you're dealing with. It just signals that you're a mark. It might briefly make an executive's life easier, but it'll come back and bite you. I didn't refuse to pay because I thought it would be inspirational or set an example or bla bla bla. It was because I'm not a dumb mark, and I'm not going to let my clients be. And personally, I'd rather burn my house to the ground than let someone rob it.
- FpUser 5y ago
  >"And personally, I'd rather burn my house to the ground than let someone rob it." That is your personal choice and you're more than welcome to go up in flames if that is what you wish. You should have no rights however to force your personal choice upon the others. They might have a different perspective.
- FDSGSG 5y ago
  Paying can't be a dumb move when your business continuity depends on an attacker returning your encrypted files. I agree that with DDoS extortion the situation is way more complicated, and the attacker will eventually move on if you don't pay. > And personally, I'd rather burn my house to the ground than let someone rob it. I think we can all agree that this is just plain stupid. Cutting off your nose to spite your face.
  - hermes8329 5y ago
    I think we can all agree that this is just plain stupid. Cutting off your nose to spite your face. No we can't alI agree on that and I think you would be surprised. Personally I'd be seen with a gas can and a box of matches
    - FDSGSG 5y ago
      It is well known that there are many stupid people in this world, perhaps you are one of them?
      - hermes8329 5y ago
        No personal attacks buddy
bluGill 5y ago
But if people don't pay the attackers give up on attacking the next target. By paying out your are rewarding the attackers for being evil.
- FDSGSG 5y ago
  Yeah, but this just completely detached from real life. Companies will always pay, even if you make it illegal, companies will still pay. Will fewer companies pay? Sure. Does it matter? No. Ransomware gangs wouldn't go anywhere even if their average payments got cut down by 90%, and the stuff they might switch to (BEC) isn't going to go away either.
  - bluGill 5y ago
    Maybe, but even if just a few don't pay, they will do other things. The attacks ransomware uses will become harder and harder to exploit. (already it is a lot harder than 20 years ago). More things will be invented to prevent them in the first place. Maybe formal proofs of all code? There are a lot of things that companies who aren't going to pay will start demanding of their vendors who they will pay.
    - FDSGSG 5y ago
      > Maybe, but even if just a few don't pay, they will do other things You're joking. There are already many who don't pay, payment rates could fall by 90% and it wouldn't slow them down a bit. You clearly have no idea how hugely profitable ransomware is. If less companies pay, the ransomware operations will just scale up their customer support teams and further automate deployment. This really isn't going to be a problem for them. > Maybe formal proofs of all code? There are a lot of things that companies who aren't going to pay will start demanding of their vendors who they will pay. Haha. Funny. Have you ever worked with formal proofs in a software context?
      - bluGill 5y ago
        > There are already many who don't pay, payment rates could fall by 90% and it wouldn't slow them down a bit. You clearly have no idea how hugely profitable ransomware is. You misunderstand. Those who don't pay still have the problem. They will invest in solutions. Some (like good well tested backups) only affect them, but others like hardening software make it harder for ransomeware to get anyone in the first place. > f less companies pay, the ransomware operations will just scale up their customer support teams and further automate deployment. This really isn't going to be a problem for them. True. Though the less companies that pay, the more examples of not paying get out there and so the more likely it is other companies will get good protection for themselves. Probably not enough to really affect profits too much, but still helpful to limit the amount of investment "big evil" can afford to do. > Have you ever worked with formal proofs in a software context Just a little bit. I'm looking to work with them more because for my area quality is important and we have reached the limits of what unit and manual testing can do. (but not the limits of other automatic code analysis which I'm also looking into)

by Jach 5y ago

noduerme 5y ago

I think paying is a dumb move, regardless of the "brand" of extortionist you're dealing with. It just signals that you're a mark. It might briefly make an executive's life easier, but it'll come back and bite you. I didn't refuse to pay because I thought it would be inspirational or set an example or bla bla bla. It was because I'm not a dumb mark, and I'm not going to let my clients be. And personally, I'd rather burn my house to the ground than let someone rob it.

FpUser 5y ago
>"And personally, I'd rather burn my house to the ground than let someone rob it." That is your personal choice and you're more than welcome to go up in flames if that is what you wish. You should have no rights however to force your personal choice upon the others. They might have a different perspective.
FDSGSG 5y ago
Paying can't be a dumb move when your business continuity depends on an attacker returning your encrypted files. I agree that with DDoS extortion the situation is way more complicated, and the attacker will eventually move on if you don't pay. > And personally, I'd rather burn my house to the ground than let someone rob it. I think we can all agree that this is just plain stupid. Cutting off your nose to spite your face.
- hermes8329 5y ago
  I think we can all agree that this is just plain stupid. Cutting off your nose to spite your face. No we can't alI agree on that and I think you would be surprised. Personally I'd be seen with a gas can and a box of matches
  - FDSGSG 5y ago
    It is well known that there are many stupid people in this world, perhaps you are one of them?
    - hermes8329 5y ago
      No personal attacks buddy

bluGill 5y ago

But if people don't pay the attackers give up on attacking the next target. By paying out your are rewarding the attackers for being evil.

FDSGSG 5y ago
Yeah, but this just completely detached from real life. Companies will always pay, even if you make it illegal, companies will still pay. Will fewer companies pay? Sure. Does it matter? No. Ransomware gangs wouldn't go anywhere even if their average payments got cut down by 90%, and the stuff they might switch to (BEC) isn't going to go away either.
- bluGill 5y ago
  Maybe, but even if just a few don't pay, they will do other things. The attacks ransomware uses will become harder and harder to exploit. (already it is a lot harder than 20 years ago). More things will be invented to prevent them in the first place. Maybe formal proofs of all code? There are a lot of things that companies who aren't going to pay will start demanding of their vendors who they will pay.
  - FDSGSG 5y ago
    > Maybe, but even if just a few don't pay, they will do other things You're joking. There are already many who don't pay, payment rates could fall by 90% and it wouldn't slow them down a bit. You clearly have no idea how hugely profitable ransomware is. If less companies pay, the ransomware operations will just scale up their customer support teams and further automate deployment. This really isn't going to be a problem for them. > Maybe formal proofs of all code? There are a lot of things that companies who aren't going to pay will start demanding of their vendors who they will pay. Haha. Funny. Have you ever worked with formal proofs in a software context?
    - bluGill 5y ago
      > There are already many who don't pay, payment rates could fall by 90% and it wouldn't slow them down a bit. You clearly have no idea how hugely profitable ransomware is. You misunderstand. Those who don't pay still have the problem. They will invest in solutions. Some (like good well tested backups) only affect them, but others like hardening software make it harder for ransomeware to get anyone in the first place. > f less companies pay, the ransomware operations will just scale up their customer support teams and further automate deployment. This really isn't going to be a problem for them. True. Though the less companies that pay, the more examples of not paying get out there and so the more likely it is other companies will get good protection for themselves. Probably not enough to really affect profits too much, but still helpful to limit the amount of investment "big evil" can afford to do. > Have you ever worked with formal proofs in a software context Just a little bit. I'm looking to work with them more because for my area quality is important and we have reached the limits of what unit and manual testing can do. (but not the limits of other automatic code analysis which I'm also looking into)