6 ms·

Wouldn't it be easy to just pick a new name for the ransomware group then? (or do we need eBay-like "seller ratings" and customer reviews for ransomware groups

Wouldn't it be easy to just pick a new name for the ransomware group then? (or do we need eBay-like "seller ratings" and customer reviews for ransomware groups?)

ceejayoz 3y ago
A no-name ransomware group is less likely to be trusted to hold up their end of the bargain than one with an established reputation. Didn't Silk Road have eBay-style ratings/reviews?
- jeron 3y ago
  What good are the reviews? “5 stars, didn’t leak data after ransom paid”
  - barryrandall 3y ago
    It's more like, "Security Company X says this gang has behaved predictably in their previous interactions."
  - csydas 3y ago
    SilkRoad was a dark web market, so the comparison from the parent is a bit strange for me, but regarding your comment on reviews, yes they're very important and for the sites I've used, the reviews have been very reliable and useful. My understand is that since it's a much more limited market, access is very difficult even under normal circumstances (not because of security but just because dark web markets usually have awful performance for various reasons), so it's a far different review landscape than say shopping on Amazon, at least the ones I have used. The markets themselves were fantastic about refunds/conflict resolution, better than most normal online shops. Reputation is key for basically everything dark web, and the main actors in this space are notoriously petty and bold towards anyone that makes it harder to conduct business. I imagine it's very similar with Ransomware as there has to be some reason for the targets of the attack to believe paying the ransom is worth it, and anyone who upsets that balance for the ransomware gangs unexpectedly becomes rapidly unpopular, and usually a target for the other gangs. It very much so is heavily relying on the honor system, but it seems the groups are committed to such a system.
- yieldcrv 3y ago
  all the darknet markets have eBay style ratings, but for the vendor and products purchased, not for reviews on negotiating with a randomware group that weaponized it Silk Road was 10 years ago that would have been like the smallest one ever since then, just curious why it is referenced at all, and in such an odd way “I heard eBay has bulletin board like reviews” you know you can just go look, in a web browser “woah thats crazy talk, I prefer 10 year old hearsay” anyway, they often have a separate forum where one could ask more about a group
  - progmetaldev 3y ago
    Most people are inexperienced with the dark web. I would hazard a guess that even most of the HN crowd, as far as having actually used the dark web. There is a lot of fear and misinformation, even when it comes to a tech-literate crowd. People fear government agencies infiltrating the servers that they might visit, and that server dropping malware/spyware that reveals their identity. Even just having your name associated with visiting a darknet market could be disastrous for your reputation, and I assume this is the line of thinking most people give to the idea of visiting these servers. Unfortunately, this line of thinking keeps people away, which actually reduces the ability to stay anonymous as compared to having lots of traffic moving through Tor.
    - yieldcrv 3y ago
      its fascinating how media driven this is if people are still talking about the silk road based on its media coverage Department of Justice and Europol have lots of press releases about other markets and busts and ways they failed to bust them, and how their size eclipsed Silk Road I guess as long as the media doesnt parade it around or makes movies about it nobody knows
adolph 3y ago
5 star would hostage again Superhost for my datas
- echelon 3y ago
  Amazing satire, but I shudder to think that's how companies actually treat ransomware. All companies and governments should take the stance that any randomwared or compromised data is now public. And if they don't have the backups, then they should consider it permanently lost. Write it off as a business loss and hire better ops people.
  - dkjaudyeqooe 3y ago
    Govts should make funding ransomware groups a criminal offense. The money likely going to RU and NK anyway.
    - sweetjuly 3y ago
      That probably wouldn't have a good outcome. If a company gets hit very hard, their options are either to pay or die. If you make it illegal to pay, their options are either to commit a crime (which will not kill the company even if they get caught) or die. All this will do is push companies into hiding when they get hit and not reaching out to the government and security companies for help, which makes catching these groups way harder. So, at best you kill some domestic businesses and at worst you kill domestic businesses AND help the attackers hit more companies.
      - octacat 3y ago
        Options to configure backups and spend the money on isolating their network and computers to begin with are not considered.
      - dkjaudyeqooe 3y ago
        To the contrary: the first company to die (or so) would set a fire under any companies who were not prepared. It's complacency and ignorance that creates problems. The attackers attack for money, not to kill their prey, that's not profitable.
barryrandall 3y ago
They'd need to burn all their tools, techniques, and practices for this kind of rebrand to be successful.
red-iron-pine 3y ago
Depends on what their SOP is. Attribution is hard but there are a lot of really, really smart people trying really hard to identify orgs by their TTPs. You can rebrand as CaTBUTT, or Indrik Spider 2.0, or whatever, but if you're using some custom version of Mirai they'll eventually tag your M.O. and the threat intelligence briefings will reflect that. And then no ransom.
- tanelpoder 3y ago
  Didn't think of that, thank you.
- Exuma 3y ago
  What is Mirai? Can you re-explain what you said in plain english?
  - not2b 3y ago
    You could have Googled it, but you can start with https://en.wikipedia.org/wiki/Mirai_(malware) https://en.wikipedia.org/wiki/Mirai_(malware)
    - Exuma 3y ago
      [flagged]
  - red-iron-pine 3y ago
    Mirai is malware that was written by a college student but their code was released to the public, and a lot of other malware uses it as a base. It (and other malware) tend to behave in specific ways and follow specific patterns, and those patterns can be analyzed. Ditto for the servers they use, targets they hit, etc. These approaches are known as TTPs, and documenting them is how you attribute an attack to a specific group or actor. Even if you change your org and start using servers in a different country eventually your MO will give you away. These approaches are cataloged by IT security types, and many cybersecurity orgs release publications about Group X using approach Y. So when you get hacked by Group Z, but they sound like X and Y, you guess it was them. And if Group X has a history of burning ransom payers then you don't pay -- they'd fuck you anyway, so save the money and start rebuilding.
Jaepa 3y ago
From what I understand there's a market for ransomware negotiators, and reputation (and tooling) is very much a thing that affects settled price. Understand: For the ransomer's point of view this is another monday, albeit one where a big fish walked away.
- FirmwareBurner 3y ago
  So there's honor among thieves.
  - deleted 3y ago
    [deleted]
  - ben_w 3y ago
    There's an iterated prisoner's dilemma, I wouldn't go as far as calling that honour.
    - GuB-42 3y ago
      That's fundamentally what honor is.
      - ben_w 3y ago
        The result may be the same, but I think honour requires a state of mind where you do the "honourable" thing even if nobody will know.
        __MatrixMan__ 3y ago
        Agreed. Honor may have its roots in a prisoner's dilemma, but you're not actually practicing it until you have Stockholm syndrome.
        deaddodo 3y ago
        "states of mind" are all externally influenced. If you have a fundamentally "honorable" mindset, it's because your history has reinforced that acting honorable nets you an overall positive outcome. Which just reinforces the "honor = iterative prisoner's dilemma" argument.
paulcole 3y ago
My brother did this with lawn care and HVAC companies. The first business lesson he learned was never name your business after yourself. He was about 16 when he learned this and ever since it’s been like AAA Lawn Care or Aces HVAC until he gets so many negative reviews he can’t get more business.
- frandroid 3y ago
  So lesson of the story, avoid the AAA named companies because they've been in the respawning business for a long time
  - Tyr42 3y ago
    Or at least the ZZZ corps if they made it that far down the alphabet.
  - sfink 3y ago
    The lesson is that hiring "ZZZ Lawn Care" is a really bad idea.
    - paulcole 3y ago
      This was a plot point in The Accountant starring Ben Affleck. He’s a criminal who launders money through small businesses he owns and the accounting firm he runs. He names it ZZZ Accounting so it doesn’t get a lot of calls through people looking up accountants in phone book.
  - jstarfish 3y ago
    Nah, back in the old days A1 Locksmith or AAA Windshields were just competing for top placement in the (alphabetized) phone book. Look to Amazon for new ideas on DGA-derived names for your fly-by-night business.
    - mr_toad 3y ago
      A lot of cowboys used AAA-Something to bring in rubes.
tgsovlerkhgsel 3y ago
It would, but publishing the data of someone who paid gives the ransomware gang almost nothing, and the downside would be to start as a no-name. On the other hand, holding their side of the promise allows them to build a reputation, which makes it easier to get future victims to pay. Why would they leak the data if someone paid?
deleted 3y ago
[deleted]

Wouldn't it be easy to just pick a new name for the ransomware group then? (or do we need eBay-like "seller ratings" and customer reviews for ransomware groups?)

ceejayoz 3y ago

A no-name ransomware group is less likely to be trusted to hold up their end of the bargain than one with an established reputation. Didn't Silk Road have eBay-style ratings/reviews?

jeron 3y ago
What good are the reviews? “5 stars, didn’t leak data after ransom paid”
- barryrandall 3y ago
  It's more like, "Security Company X says this gang has behaved predictably in their previous interactions."
- csydas 3y ago
  SilkRoad was a dark web market, so the comparison from the parent is a bit strange for me, but regarding your comment on reviews, yes they're very important and for the sites I've used, the reviews have been very reliable and useful. My understand is that since it's a much more limited market, access is very difficult even under normal circumstances (not because of security but just because dark web markets usually have awful performance for various reasons), so it's a far different review landscape than say shopping on Amazon, at least the ones I have used. The markets themselves were fantastic about refunds/conflict resolution, better than most normal online shops. Reputation is key for basically everything dark web, and the main actors in this space are notoriously petty and bold towards anyone that makes it harder to conduct business. I imagine it's very similar with Ransomware as there has to be some reason for the targets of the attack to believe paying the ransom is worth it, and anyone who upsets that balance for the ransomware gangs unexpectedly becomes rapidly unpopular, and usually a target for the other gangs. It very much so is heavily relying on the honor system, but it seems the groups are committed to such a system.
yieldcrv 3y ago
all the darknet markets have eBay style ratings, but for the vendor and products purchased, not for reviews on negotiating with a randomware group that weaponized it Silk Road was 10 years ago that would have been like the smallest one ever since then, just curious why it is referenced at all, and in such an odd way “I heard eBay has bulletin board like reviews” you know you can just go look, in a web browser “woah thats crazy talk, I prefer 10 year old hearsay” anyway, they often have a separate forum where one could ask more about a group
- progmetaldev 3y ago
  Most people are inexperienced with the dark web. I would hazard a guess that even most of the HN crowd, as far as having actually used the dark web. There is a lot of fear and misinformation, even when it comes to a tech-literate crowd. People fear government agencies infiltrating the servers that they might visit, and that server dropping malware/spyware that reveals their identity. Even just having your name associated with visiting a darknet market could be disastrous for your reputation, and I assume this is the line of thinking most people give to the idea of visiting these servers. Unfortunately, this line of thinking keeps people away, which actually reduces the ability to stay anonymous as compared to having lots of traffic moving through Tor.
  - yieldcrv 3y ago
    its fascinating how media driven this is if people are still talking about the silk road based on its media coverage Department of Justice and Europol have lots of press releases about other markets and busts and ways they failed to bust them, and how their size eclipsed Silk Road I guess as long as the media doesnt parade it around or makes movies about it nobody knows

adolph 3y ago

5 star would hostage again Superhost for my datas

echelon 3y ago
Amazing satire, but I shudder to think that's how companies actually treat ransomware. All companies and governments should take the stance that any randomwared or compromised data is now public. And if they don't have the backups, then they should consider it permanently lost. Write it off as a business loss and hire better ops people.
- dkjaudyeqooe 3y ago
  Govts should make funding ransomware groups a criminal offense. The money likely going to RU and NK anyway.
  - sweetjuly 3y ago
    That probably wouldn't have a good outcome. If a company gets hit very hard, their options are either to pay or die. If you make it illegal to pay, their options are either to commit a crime (which will not kill the company even if they get caught) or die. All this will do is push companies into hiding when they get hit and not reaching out to the government and security companies for help, which makes catching these groups way harder. So, at best you kill some domestic businesses and at worst you kill domestic businesses AND help the attackers hit more companies.
    - octacat 3y ago
      Options to configure backups and spend the money on isolating their network and computers to begin with are not considered.
    - dkjaudyeqooe 3y ago
      To the contrary: the first company to die (or so) would set a fire under any companies who were not prepared. It's complacency and ignorance that creates problems. The attackers attack for money, not to kill their prey, that's not profitable.

barryrandall 3y ago

They'd need to burn all their tools, techniques, and practices for this kind of rebrand to be successful.

red-iron-pine 3y ago

Depends on what their SOP is. Attribution is hard but there are a lot of really, really smart people trying really hard to identify orgs by their TTPs. You can rebrand as CaTBUTT, or Indrik Spider 2.0, or whatever, but if you're using some custom version of Mirai they'll eventually tag your M.O. and the threat intelligence briefings will reflect that. And then no ransom.

tanelpoder 3y ago
Didn't think of that, thank you.
Exuma 3y ago
What is Mirai? Can you re-explain what you said in plain english?
- not2b 3y ago
  You could have Googled it, but you can start with https://en.wikipedia.org/wiki/Mirai_(malware) https://en.wikipedia.org/wiki/Mirai_(malware)
  - Exuma 3y ago
    [flagged]
- red-iron-pine 3y ago
  Mirai is malware that was written by a college student but their code was released to the public, and a lot of other malware uses it as a base. It (and other malware) tend to behave in specific ways and follow specific patterns, and those patterns can be analyzed. Ditto for the servers they use, targets they hit, etc. These approaches are known as TTPs, and documenting them is how you attribute an attack to a specific group or actor. Even if you change your org and start using servers in a different country eventually your MO will give you away. These approaches are cataloged by IT security types, and many cybersecurity orgs release publications about Group X using approach Y. So when you get hacked by Group Z, but they sound like X and Y, you guess it was them. And if Group X has a history of burning ransom payers then you don't pay -- they'd fuck you anyway, so save the money and start rebuilding.

Jaepa 3y ago

From what I understand there's a market for ransomware negotiators, and reputation (and tooling) is very much a thing that affects settled price. Understand: For the ransomer's point of view this is another monday, albeit one where a big fish walked away.

FirmwareBurner 3y ago
So there's honor among thieves.
- deleted 3y ago
  [deleted]
- ben_w 3y ago
  There's an iterated prisoner's dilemma, I wouldn't go as far as calling that honour.
  - GuB-42 3y ago
    That's fundamentally what honor is.
    - ben_w 3y ago
      The result may be the same, but I think honour requires a state of mind where you do the "honourable" thing even if nobody will know.
      - __MatrixMan__ 3y ago
        Agreed. Honor may have its roots in a prisoner's dilemma, but you're not actually practicing it until you have Stockholm syndrome.
      - deaddodo 3y ago
        "states of mind" are all externally influenced. If you have a fundamentally "honorable" mindset, it's because your history has reinforced that acting honorable nets you an overall positive outcome. Which just reinforces the "honor = iterative prisoner's dilemma" argument.

paulcole 3y ago

My brother did this with lawn care and HVAC companies. The first business lesson he learned was never name your business after yourself. He was about 16 when he learned this and ever since it’s been like AAA Lawn Care or Aces HVAC until he gets so many negative reviews he can’t get more business.

frandroid 3y ago
So lesson of the story, avoid the AAA named companies because they've been in the respawning business for a long time
- Tyr42 3y ago
  Or at least the ZZZ corps if they made it that far down the alphabet.
- sfink 3y ago
  The lesson is that hiring "ZZZ Lawn Care" is a really bad idea.
  - paulcole 3y ago
    This was a plot point in The Accountant starring Ben Affleck. He’s a criminal who launders money through small businesses he owns and the accounting firm he runs. He names it ZZZ Accounting so it doesn’t get a lot of calls through people looking up accountants in phone book.
- jstarfish 3y ago
  Nah, back in the old days A1 Locksmith or AAA Windshields were just competing for top placement in the (alphabetized) phone book. Look to Amazon for new ideas on DGA-derived names for your fly-by-night business.
  - mr_toad 3y ago
    A lot of cowboys used AAA-Something to bring in rubes.

tgsovlerkhgsel 3y ago

It would, but publishing the data of someone who paid gives the ransomware gang almost nothing, and the downside would be to start as a no-name. On the other hand, holding their side of the promise allows them to build a reputation, which makes it easier to get future victims to pay. Why would they leak the data if someone paid?

deleted 3y ago

[deleted]