5 ms·
As I understand it, it is indeed illegal in most countries. What happens in practice is the victim hires a 'data recovery specialist' company, provides them th
by hyperman1 4y ago
As I understand it, it is indeed illegal in most countries.
What happens in practice is the victim hires a 'data recovery specialist' company, provides them the encrypted files, and ask them to decrypt them with their magic algorithms. The data recovery specialist coincidentally is paid a little bit more than the ransom. The specialist then contacts the hackers, pays the ransom, decrypts the files, and provides them back to the victim. Specialist, victim and maybe also law enforcement do their utmost best not to ask/explain how exactly the files were decrypted, citing e.g. trade secrets or an accidental key leak in the malware.
The data recovery specialist generally hires a contractor, who hires a contractor, who ... , so ransom money trail passes trough plenty of jurisdictions to darken the trail.
- deleted 4y ago[deleted]
- sefrost 4y agoAny sources on that?
- windthrown 4y agoCertainly not 100% of cases but very common: "As ransomware attacks crippled businesses and law enforcement agencies, two U.S. data recovery firms claimed to offer an ethical way out. Instead, they typically paid the ransom and charged victims extra." https://features.propublica.org/ransomware/ransomware-attack-data-recovery-firms-paying-hackers/ https://features.propublica.org/ransomware/ransomware-attack...
- charlieyu1 4y agoWhat if ransom is paid but the attackers do not fulfill their end?
- bee_rider 4y agoThis is possible of course, but it would reduce the willingness of people to pay bribes generally. Also I guess it might cause the victims to take more desperate measures, possibly get more attention by law enforcement somehow.
- hyperman1 4y agoAlways a good question. A group of security people with experience in the scenario was trading about it on a conference a while ago. I far from knew everyone in the group. Always a risky answer, of course, especially from some random person on HN. But in this case, it makes sense, and a 'long arm', international treatment is a general solution for powerfull entities needing to break a law. I don't think you'll find anyone going officially on record as breaking the law, however. Most companies won't even let it leak they're a victim.
- sublinear 4y agoSo the data recovery specialists are providing money laundering as a service (MLaaS)? ;)