4 ms·
> It's just a matter of time before it goes online, ransom or not Sometimes the groups want a good reputation for not disclosing stuff if the ransom was paid.
by sacrosanct 3y ago
> It's just a matter of time before it goes online, ransom or not
Sometimes the groups want a good reputation for not disclosing stuff if the ransom was paid. They earn that reputation over time.
- sillysaurusx 3y agoThe likelihood that one particular group will ransom more than a handful of times decreases exponentially as LEO becomes more interested.
- xkekjrktllss 3y agoWhat is LEO?
- wepple 3y agoLaw Enforcement Officers. The O maybe wasn’t necessary here
- deleted 3y ago[deleted]
- anonymouskimmer 3y agoLow Earth Orbit. It has become sentient as more starlink satellites have gone into orbit. As starlink is used to transfer data LEO has become interested in the uses of the data transfer. Being of Lawful orientation LEO doesn't like ransomware, and may at some point use its computational and communication abilities to redirect any ballistic missiles or rockets which are fired into LEO at the points of origin of the ransomware demands. j/k, of course.
- ShamelessC 3y agoThrow a few [redacted]’s in there and you’ve got yourself an SCP article.
- ASalazarMX 3y agoPity we can't use black bars here, this was such a perfect opportunity.
- runeofdoom 3y agoOr it could use the Low Orbit Ion Cannon.
- wnevets 3y agothat may have been true 10 years ago but the vast number of criminals in the ransomware game renders having a good reputation meaningless.
- knightofmars 3y agoIt's still impossible to prove the files were deleted even if they don't release after the initial payment. All it takes is a single individual in a group to make a backup or have a default policy of keeping a backup "just in case". One should assume at this point that it's not a question of whether the files will be leaked but when.
- euroderf 3y agoChina sure isn't going to advertise buying a copy.
- cyanydeez 3y agoalso, governments like china, North Korea , Russia, Iran are basically silent endpoints for this stuff, so assuming it's valuable data, the ransom request should trigger whatever intelligence protocols you have.
- deleted 3y ago[deleted]
- belltaco 3y agoThe 'when' can be important too, because the sensitivity and value of data generally goes down over time.
- sofixa 3y ago> It's still impossible to prove the files were deleted even if they don't release after the initial payment Often the data isn't exfiltrated at all, only encrypted in place, which should be relatively easy to prove.
- dartos 3y agoEven in that case, do you think the ransom group’s security is better than their target?
- axlee 3y agoObviously. The surface for such an enterprise is tiny, while a worldwide multinational with hundred of thousands of employees and contractors can't afford that luxury.
- 8n4vidtmkvmk 3y agoIf they were the tiniest bit decent, they'd delete the files after the ransom was paid.
- jlarocco 3y agoIf they were the "tiniest bit decent" they wouldn't be ransoming exfiltrated data.
- erhaetherth 3y agoYes, yes, that's why I said "tiniest".
- Libcat99 3y agoIf they were the tiniest bit decent they wouldn't be working in ransom ware. If they delete the files, it's not out of decency. It's out of a desire to build a reputation of post-ransom trustworthiness so others will pay in the future.
- GolfPopper 3y agoYeah! If they were decent people, they'd be nonconsensually taking individuals' data and profiting off selling that, instead.
- Libcat99 3y ago
- victorbjorklund 3y agodoesnt most of them operate as franchaises these days?
- bastawhiz 3y agoIf one group got it, there's no reason to assume another group didn't also get to it first and simply sat on the data. There's also no reason to assume the group holding your data ransom is acting as a single reasonable entity: it could be a group of people, each with a copy, who all have different opinions on what to do.