3 ms·
Actually there is lots of doubt The ransomware groups hit lots of companies. Their reputation for holding up their side of the bargain is how they get paid. So
by btilly 3y ago
Actually there is lots of doubt
The ransomware groups hit lots of companies. Their reputation for holding up their side of the bargain is how they get paid. So they tend to keep their side of the deal.
- thathndude 3y agoYep. It’s in their self interest to make good on their “promise.”
- ilyt 3y agoLeave a backdoor, steal again in 4 months presenting different hacking group name, cash in on corporation again. The money is better spent improving security. Them spending money with hackers won't stop GDPR from ripping them new asshole either.
- simmerup 3y agoThe money is generally spent doing both things surely. One doesn't stop the other
- ilyt 3y agoAnd what is the return on investment of paying the hackers ? Wrong. The "return" is pointing a bigger target on your back because now future attackers know it is worth it to attack you.
- simmerup 3y agoThe ROI is unencrypting your files and returning to business as usual
- eddiewithzato 3y agocompanies have backups, paying hackers is ultimately just for avoiding leaks of data. Ransomware only works against individuals
- btilly 3y agoSorry, but that's dead wrong. Ransomware only works against companies, because individuals can't pay you. Most individuals can't figure out bitcoin, and the overhead of the transaction is too much. But for $10 million, a company can figure out bitcoin and the transaction overhead is minimal. As for the backups, the groups running ransomware are very aware of the importance of backups. Therefore they have developed best practices targeting the backup systems in a variety of ways. If the backups are online, delete them. If the backups are offline, compromise the backup server so it stops taking backups, leave that for a while, then do your attack. (You'd be shocked at how many companies don't test backups regularly...) If whole computers are backed up, insert a malware timebomb - as soon as the computer realizes the date, it destroys itself. When it is restored from backup, the backup also destroys itself. Most companies pay too little attention to backups. And therefore highly motivated attackers regularly succeed in attacking them.