5 ms·

Sony paying = Sony saying to the hackers please still our data we will give millions. There is no doubt the hackers would take sonys money and then sell the da

Sony paying = Sony saying to the hackers please still our data we will give millions. There is no doubt the hackers would take sonys money and then sell the data anyway. You will lose badly by paying them. You have to consider the breach as a total loss if you are Sony, paying up ransomware is foolish decision. The target for these hacks is always for the company to pay, so companies not paying is a very good play.

simmerup 3y ago
While true sometimes, like when the US says they won't negotiate with terrorists, the realpolitik is that if the data is valuable enough normally companies will pay for it. Most won't take some moral stand that costs them money.
- AndroTux 3y ago
  Of course companies would pay for data if they had the choice. And small companies often do in case of a ransom attack. But if you're as big as Sony, there's really no upside to paying them. Like the other commenter said, if they did pay, the attackers would without a doubt still sell the data to others. Why wouldn't they? It's not like they have any morale. And to make things worse, this would just signal to other hacker groups that hacking Sony is very profitable, since they apparently are happy to pay. So they would just increase the target on their back. No upside.
  - simmerup 3y ago
    Ransomware encrypts files on the disk also. The business pays to unencrypt the files and achieve business as usual operations. The business doesn't need to trust the attackers not to further share data to get their upside, though I'm sure that helps.
  - deleted 3y ago
    [deleted]
btilly 3y ago
Actually there is lots of doubt The ransomware groups hit lots of companies. Their reputation for holding up their side of the bargain is how they get paid. So they tend to keep their side of the deal.
- thathndude 3y ago
  Yep. It’s in their self interest to make good on their “promise.”
- ilyt 3y ago
  Leave a backdoor, steal again in 4 months presenting different hacking group name, cash in on corporation again. The money is better spent improving security. Them spending money with hackers won't stop GDPR from ripping them new asshole either.
  - simmerup 3y ago
    The money is generally spent doing both things surely. One doesn't stop the other
    - ilyt 3y ago
      And what is the return on investment of paying the hackers ? Wrong. The "return" is pointing a bigger target on your back because now future attackers know it is worth it to attack you.
      - simmerup 3y ago
        The ROI is unencrypting your files and returning to business as usual
        eddiewithzato 3y ago
        companies have backups, paying hackers is ultimately just for avoiding leaks of data. Ransomware only works against individuals

simmerup 3y ago

While true sometimes, like when the US says they won't negotiate with terrorists, the realpolitik is that if the data is valuable enough normally companies will pay for it. Most won't take some moral stand that costs them money.

AndroTux 3y ago
Of course companies would pay for data if they had the choice. And small companies often do in case of a ransom attack. But if you're as big as Sony, there's really no upside to paying them. Like the other commenter said, if they did pay, the attackers would without a doubt still sell the data to others. Why wouldn't they? It's not like they have any morale. And to make things worse, this would just signal to other hacker groups that hacking Sony is very profitable, since they apparently are happy to pay. So they would just increase the target on their back. No upside.
- simmerup 3y ago
  Ransomware encrypts files on the disk also. The business pays to unencrypt the files and achieve business as usual operations. The business doesn't need to trust the attackers not to further share data to get their upside, though I'm sure that helps.
- deleted 3y ago
  [deleted]

btilly 3y ago

Actually there is lots of doubt The ransomware groups hit lots of companies. Their reputation for holding up their side of the bargain is how they get paid. So they tend to keep their side of the deal.

thathndude 3y ago
Yep. It’s in their self interest to make good on their “promise.”
ilyt 3y ago
Leave a backdoor, steal again in 4 months presenting different hacking group name, cash in on corporation again. The money is better spent improving security. Them spending money with hackers won't stop GDPR from ripping them new asshole either.
- simmerup 3y ago
  The money is generally spent doing both things surely. One doesn't stop the other
  - ilyt 3y ago
    And what is the return on investment of paying the hackers ? Wrong. The "return" is pointing a bigger target on your back because now future attackers know it is worth it to attack you.
    - simmerup 3y ago
      The ROI is unencrypting your files and returning to business as usual
      - eddiewithzato 3y ago
        companies have backups, paying hackers is ultimately just for avoiding leaks of data. Ransomware only works against individuals