8 ms·
> They pay you and you pinky swear not to release it? Yes. If any of this information does end up getting leaked, it kills the credibility of the ransomware gr
by RandallBrown 3y ago
> They pay you and you pinky swear not to release it?
Yes. If any of this information does end up getting leaked, it kills the credibility of the ransomware group and they'll never get paid again. Sort of mutually assured destruction.
Now of course, most people don't really trust criminals anyway so the business has a pretty strong bargaining position and I believe many of the ransoms are negotiated way down.
- tanelpoder 3y agoWouldn't it be easy to just pick a new name for the ransomware group then? (or do we need eBay-like "seller ratings" and customer reviews for ransomware groups?)
- ceejayoz 3y agoA no-name ransomware group is less likely to be trusted to hold up their end of the bargain than one with an established reputation. Didn't Silk Road have eBay-style ratings/reviews?
- jeron 3y agoWhat good are the reviews? “5 stars, didn’t leak data after ransom paid”
- barryrandall 3y agoIt's more like, "Security Company X says this gang has behaved predictably in their previous interactions."
- csydas 3y agoSilkRoad was a dark web market, so the comparison from the parent is a bit strange for me, but regarding your comment on reviews, yes they're very important and for the sites I've used, the reviews have been very reliable and useful. My understand is that since it's a much more limited market, access is very difficult even under normal circumstances (not because of security but just because dark web markets usually have awful performance for various reasons), so it's a far different review landscape than say shopping on Amazon, at least the ones I have used. The markets themselves were fantastic about refunds/conflict resolution, better than most normal online shops. Reputation is key for basically everything dark web, and the main actors in this space are notoriously petty and bold towards anyone that makes it harder to conduct business. I imagine it's very similar with Ransomware as there has to be some reason for the targets of the attack to believe paying the ransom is worth it, and anyone who upsets that balance for the ransomware gangs unexpectedly becomes rapidly unpopular, and usually a target for the other gangs. It very much so is heavily relying on the honor system, but it seems the groups are committed to such a system.
- yieldcrv 3y agoall the darknet markets have eBay style ratings, but for the vendor and products purchased, not for reviews on negotiating with a randomware group that weaponized it Silk Road was 10 years ago that would have been like the smallest one ever since then, just curious why it is referenced at all, and in such an odd way “I heard eBay has bulletin board like reviews” you know you can just go look, in a web browser “woah thats crazy talk, I prefer 10 year old hearsay” anyway, they often have a separate forum where one could ask more about a group
- progmetaldev 3y agoMost people are inexperienced with the dark web. I would hazard a guess that even most of the HN crowd, as far as having actually used the dark web. There is a lot of fear and misinformation, even when it comes to a tech-literate crowd. People fear government agencies infiltrating the servers that they might visit, and that server dropping malware/spyware that reveals their identity. Even just having your name associated with visiting a darknet market could be disastrous for your reputation, and I assume this is the line of thinking most people give to the idea of visiting these servers. Unfortunately, this line of thinking keeps people away, which actually reduces the ability to stay anonymous as compared to having lots of traffic moving through Tor.
- yieldcrv 3y agoits fascinating how media driven this is if people are still talking about the silk road based on its media coverage Department of Justice and Europol have lots of press releases about other markets and busts and ways they failed to bust them, and how their size eclipsed Silk Road I guess as long as the media doesnt parade it around or makes movies about it nobody knows
- adolph 3y ago5 star would hostage again Superhost for my datas
- echelon 3y agoAmazing satire, but I shudder to think that's how companies actually treat ransomware. All companies and governments should take the stance that any randomwared or compromised data is now public. And if they don't have the backups, then they should consider it permanently lost. Write it off as a business loss and hire better ops people.
- dkjaudyeqooe 3y agoGovts should make funding ransomware groups a criminal offense. The money likely going to RU and NK anyway.
- sweetjuly 3y agoThat probably wouldn't have a good outcome. If a company gets hit very hard, their options are either to pay or die. If you make it illegal to pay, their options are either to commit a crime (which will not kill the company even if they get caught) or die. All this will do is push companies into hiding when they get hit and not reaching out to the government and security companies for help, which makes catching these groups way harder. So, at best you kill some domestic businesses and at worst you kill domestic businesses AND help the attackers hit more companies.
- octacat 3y agoOptions to configure backups and spend the money on isolating their network and computers to begin with are not considered.
- dkjaudyeqooe 3y agoTo the contrary: the first company to die (or so) would set a fire under any companies who were not prepared. It's complacency and ignorance that creates problems. The attackers attack for money, not to kill their prey, that's not profitable.
- barryrandall 3y agoThey'd need to burn all their tools, techniques, and practices for this kind of rebrand to be successful.
- red-iron-pine 3y agoDepends on what their SOP is. Attribution is hard but there are a lot of really, really smart people trying really hard to identify orgs by their TTPs. You can rebrand as CaTBUTT, or Indrik Spider 2.0, or whatever, but if you're using some custom version of Mirai they'll eventually tag your M.O. and the threat intelligence briefings will reflect that. And then no ransom.
- tanelpoder 3y agoDidn't think of that, thank you.
- Exuma 3y agoWhat is Mirai? Can you re-explain what you said in plain english?
- not2b 3y agoYou could have Googled it, but you can start with https://en.wikipedia.org/wiki/Mirai_(malware) https://en.wikipedia.org/wiki/Mirai_(malware)
- Exuma 3y ago[flagged]
- red-iron-pine 3y agoMirai is malware that was written by a college student but their code was released to the public, and a lot of other malware uses it as a base. It (and other malware) tend to behave in specific ways and follow specific patterns, and those patterns can be analyzed. Ditto for the servers they use, targets they hit, etc. These approaches are known as TTPs, and documenting them is how you attribute an attack to a specific group or actor. Even if you change your org and start using servers in a different country eventually your MO will give you away. These approaches are cataloged by IT security types, and many cybersecurity orgs release publications about Group X using approach Y. So when you get hacked by Group Z, but they sound like X and Y, you guess it was them. And if Group X has a history of burning ransom payers then you don't pay -- they'd fuck you anyway, so save the money and start rebuilding.
- Jaepa 3y agoFrom what I understand there's a market for ransomware negotiators, and reputation (and tooling) is very much a thing that affects settled price. Understand: For the ransomer's point of view this is another monday, albeit one where a big fish walked away.
- FirmwareBurner 3y agoSo there's honor among thieves.
- deleted 3y ago[deleted]
- ben_w 3y agoThere's an iterated prisoner's dilemma, I wouldn't go as far as calling that honour.
- GuB-42 3y agoThat's fundamentally what honor is.
- ben_w 3y agoThe result may be the same, but I think honour requires a state of mind where you do the "honourable" thing even if nobody will know.
- __MatrixMan__ 3y agoAgreed. Honor may have its roots in a prisoner's dilemma, but you're not actually practicing it until you have Stockholm syndrome.
- deaddodo 3y ago"states of mind" are all externally influenced. If you have a fundamentally "honorable" mindset, it's because your history has reinforced that acting honorable nets you an overall positive outcome. Which just reinforces the "honor = iterative prisoner's dilemma" argument.
- paulcole 3y agoMy brother did this with lawn care and HVAC companies. The first business lesson he learned was never name your business after yourself. He was about 16 when he learned this and ever since it’s been like AAA Lawn Care or Aces HVAC until he gets so many negative reviews he can’t get more business.
- frandroid 3y agoSo lesson of the story, avoid the AAA named companies because they've been in the respawning business for a long time
- Tyr42 3y agoOr at least the ZZZ corps if they made it that far down the alphabet.
- sfink 3y agoThe lesson is that hiring "ZZZ Lawn Care" is a really bad idea.
- paulcole 3y agoThis was a plot point in The Accountant starring Ben Affleck. He’s a criminal who launders money through small businesses he owns and the accounting firm he runs. He names it ZZZ Accounting so it doesn’t get a lot of calls through people looking up accountants in phone book.
- jstarfish 3y agoNah, back in the old days A1 Locksmith or AAA Windshields were just competing for top placement in the (alphabetized) phone book. Look to Amazon for new ideas on DGA-derived names for your fly-by-night business.
- mr_toad 3y agoA lot of cowboys used AAA-Something to bring in rubes.
- tgsovlerkhgsel 3y agoIt would, but publishing the data of someone who paid gives the ransomware gang almost nothing, and the downside would be to start as a no-name. On the other hand, holding their side of the promise allows them to build a reputation, which makes it easier to get future victims to pay. Why would they leak the data if someone paid?
- deleted 3y ago[deleted]
- mysterydip 3y agoCouldn't the ransomeware group just come back under another alias to clean their slate?
- rtkwe 3y agoIf any group does it it kills the credibility new entrants too so there's still incentives to not do it.
- cjaybo 3y agoAre these rational actors who would even care about the collective long term effects? Eg the same could be said for drug dealers ripping off their customers, but that still happens daily because they often prioritize short term self interest over long term/collective concerns.
- NegativeK 3y agoMany ransomware groups have learned that acting more like a business results in higher payouts. They're not all going to do it, but they have payment portals, negotiators using professional language, attempts to maintain reputation, etc. Obviously this behavior doesn't apply to all of them, but it's a clear effort by some of them to immediately appear more palatable to random IT worker, the execs, and the lawyers who are watching the who process play out. And it also lines up with the fact that ransomware groups have freaking HR departments to handle their employees.
- galangalalgol 3y agoAnd Boeing could never know Airbus hadn't been given the opportunity to buy the data, as they would never disclose that.
- rtkwe 3y agoIt's not consistent across the broad category of criminal for sure but they're probably not the most long term oriented people as a rule now. Initial groups were more, for a lack of a better word, professional about the process with some groups even having a kind of tech support for helping victims to make sure people would believe they'd get their files back if they paid. Better preparation on the corporate side and a democratization of the tools to perform it has lead to some changes it looks like where ransomware groups didn't exfiltrate often before because it wasn't their main playbook.
- legitster 3y agoData ransoms have existed for a long time before "ransomware" was even really a thing - there's just never been a market for ransoms for the "stolen" data. Once it's out you can't put that genie back in the bottle. The reason ransomware worked was you didn't have to trust the group long-term - just enough to give you a copy of your data back. It's the difference between you making a copy of my car keys and stealing them. Yes, I will pay for "a" key back - I only have to trust you enough to hand it over.
- mcmoor 3y agoBut you don't only want your data back, you want the data disappear from circulation. While ransomware ensures the former transaction, it still in no way ensures the latter, making it still a dubious transaction.
- jowea 3y agoI wonder why they don't make into a recurring payment instead of a one time deal. Turn it into an iterated game theory game.
- timeon 3y agoRaaS
- neodymiumphish 3y agoThat's not what this means.
- augustulus 3y agomore risk of exposure presumably
- kspacewalk2 3y ago>credibility of the ransomware group Hilarious.
- waynesonfire 3y agoIt's your naive comment that I find hilarious. it's a business like any other that puts food on peoples plates. in fact, a mature business with a deep and sophisticated industry. it benefits all participants when everyone behaves reliably and predictably. These aren't amateurs.
- kspacewalk2 3y ago>it's a business like any other that puts food on peoples plates. So is murder for hire. However, both being firmly within the "crime" category of business, all allusions to legitimate business concepts such as "reputation", "contract" and "predictability" are illusory, rhetorical and rarely survive first contact with some felonious scumbag who wants to screw you over. Particularly when one side of the interaction is not an experienced and dangerous criminal.
- JohnFen 3y ago> it kills the credibility of the ransomware group There are people who consider these groups credible?? The world really has gone insane.
- neodymiumphish 3y agoMany of these groups have better bug bounty programs, SOPs, and organizationsla structure than your average company.
- RandallBrown 3y ago"Credible" here means that they stick to their word.
- dkjaudyeqooe 3y ago> it kills the credibility of the ransomware group There are review sites for ransomware groups? "honored promise not to disclose, didn't gloat or taunt, would pay again, 10/10"
- arnvald 3y agoNot sure about review sites, but there are companies specializing in ransomware negotiations on behalf of the victims and they can advise not to pay a group that is known to release the data anyway
- deleted 3y ago[deleted]
- hot_gril 3y agoEither way, seems like something that a government or other actor could mess with, thus making it harder for hackers to profit.
- miohtama 3y agoI am sure there are discreet nation state buyers, like Russia and China, who are happily to use the information without causing an incident. Russia does not even need to ask, as most ransomware gangs operate under the blessing of Putin.
- justsomehnguy 3y ago[citation needed] At least for 'most'.
- miohtama 3y agoIt’s in news https://www.reuters.com/technology/russia-based-ransomware-group-conti-issues-warning-kremlin-foes-2022-02-25/ https://www.reuters.com/technology/russia-based-ransomware-g...
- justsomehnguy 3y ago> A portion of actors involved with Conti ransomware are based in Russia and some criminals operating from there already have documented ties with Russian intelligence apparatus So a part of one gang made some claims and some other not-gang claims they have ties with FSB or SVR => all gangs are operating under personal Putin blessing. Even North Korean and Ukrainian, right?
- bastawhiz 3y ago> it kills the credibility of the ransomware group and they'll never get paid again I don't buy it. There's nothing to stop the group from rebranding themselves. The company has no proof nobody else got a copy of the data. And the group could simply hang onto the data, extort a bunch of money from other companies, then start back at the beginning and demand even more (knowing that the data is worth _at least_ what was already paid for it).
- sofixa 3y ago> I don't buy it. There's nothing to stop the group from rebranding themselves Apart from the fact that nobody would pay them if they have no reputation.
- raincole 3y agoThen how did they get "reputation" from the first place? Quite chicken and egg problem, right?
- hot_gril 3y agoBy starting with smaller ransoms. Same way any new business gets off the ground without rep, it's not easy or very profitable at first.
- tshaddox 3y agoSurely that can't be completely true. The reputation has to be bootstrapped somehow.
- neodymiumphish 3y agoNew groups can't demand as much as the next. Also most of the big groups are RaaS (Ransomware as a Service), meaning their affiliates get approval to operate using LockBit's name, infrastructure, and software. If LockBit does something to taint their image in the media and among security organizations, then rebrands to avoid their negative history, forensics will still eventually tie their new name back to their old org, and victim's will have to decide whether they should trust that their data will be handled correctly after payment. As for re-victimizing old organizations, there's almost zero chance of that working. Most data is only sensitive for a certain time frame, long enough that they can make the proper notifications, change credentials, etc. Lastly, there still needs to be someone to download and abuse the data they leak. I've monitored ransomware torrents a few times and not observed any downloads completed over the course of a couple weeks following a data leak.
- mvkel 3y agoMeh. They don't knowingly release it. But they could certainly continue to try to sell the data on the black market to competitors, etc, which the competitor would never disclose.
- ibejoeb 3y ago> I believe many of the ransoms are negotiated way down. LockBit just did a sort of collective bargaining with affiliate groups that resulted in guidance for setting initial ransom amounts and rules restricting discounts about 50%.