5 ms·

> To put it another way, if this data had value, the ransomware group wouldn't be leaking it for free. This is entirely incorrect and just speculation. Most l

> To put it another way, if this data had value, the ransomware group wouldn't be leaking it for free. This is entirely incorrect and just speculation. Most likely reason for not paying up is that law enforcement (involved in this case as well) does not like it and have even been considering a ban on ransom payments. This in no way implies this data has no value, it is very probable this data contains credentials (Citrix appliances) and might allow future compromises unless Boeing improves their security posture. - https://www.techradar.com/pro/security/a-huge-hoard-of-boeing-data-leaked-by-lockbit-ransomware https://www.techradar.com/pro/security/a-huge-hoard-of-boein... - https://hbr.org/2023/08/how-a-federal-ban-on-ransomware-payments-could-help-cisos https://hbr.org/2023/08/how-a-federal-ban-on-ransomware-paym...

tomcar288 3y ago
but, could you just imagine having to filter through 45 GB of emails! to try to find any value in that at all, might be expensive, even if you try to automate it.
- user32489318 3y ago
  firms this size may have plugins to mark the mails before sending them out. E.g. internal, external, sensitive labels and what not. Could make it easier to traverse.
ggeorgovassilis 3y ago
> ... just speculation. The formulation (3rd conditional) makes it clear the author is aware they're speculating. > This [the dump is worthless] is entirely incorrect Which isn't telling us why (the dump is valuable). You say that there's a legal ban on ransom, so the ban supposedly reduces market value. Black market participants evade bans, there is a black market value which clearly is the prime market for such loot. You write "it is very probable this data contains credentials" which is plausible, but the article you linked mentions logs and configs, not credentials. Maybe (before you point it out: that is also speculation) there were no credentials in the first place (dump was of low-value), or the hackers filtered them out for later use (seller filleted the fish), either way the resulting merchandise is of low value.
- tejohnso 3y ago
  > The formulation (3rd conditional) makes it clear the author is aware they're speculating. If the author had meant to convey speculation, their sentence would have included a modal verb or expression for speculation.
- vsl 3y ago
  > You say that there's a legal ban That’s a significant semantic shift from “have even been considering a ban“.
suprfsat 3y ago
By demanding a ransom, they've already notified the customer that the credentials have been stolen. The value doesn't lie in releasing them. If they wanted to be paid to steal credentials they should have gotten hired as a red team.
sonicanatidae 3y ago
The very best reason not to pay ransoms is because it requires trusting the piece of garbage that stole from you, to be honest. Never pay the ransom...ever.
- shmolf 3y ago
  Agreed. Paying the ransom only funds the operation, prompting growth and incentives
  - sonicanatidae 3y ago
    And in a majority of cases I've read about, no or little data is recovered.

tomcar288 3y ago

but, could you just imagine having to filter through 45 GB of emails! to try to find any value in that at all, might be expensive, even if you try to automate it.

user32489318 3y ago
firms this size may have plugins to mark the mails before sending them out. E.g. internal, external, sensitive labels and what not. Could make it easier to traverse.

ggeorgovassilis 3y ago

> ... just speculation. The formulation (3rd conditional) makes it clear the author is aware they're speculating. > This [the dump is worthless] is entirely incorrect Which isn't telling us why (the dump is valuable). You say that there's a legal ban on ransom, so the ban supposedly reduces market value. Black market participants evade bans, there is a black market value which clearly is the prime market for such loot. You write "it is very probable this data contains credentials" which is plausible, but the article you linked mentions logs and configs, not credentials. Maybe (before you point it out: that is also speculation) there were no credentials in the first place (dump was of low-value), or the hackers filtered them out for later use (seller filleted the fish), either way the resulting merchandise is of low value.

tejohnso 3y ago
> The formulation (3rd conditional) makes it clear the author is aware they're speculating. If the author had meant to convey speculation, their sentence would have included a modal verb or expression for speculation.
vsl 3y ago
> You say that there's a legal ban That’s a significant semantic shift from “have even been considering a ban“.

suprfsat 3y ago

By demanding a ransom, they've already notified the customer that the credentials have been stolen. The value doesn't lie in releasing them. If they wanted to be paid to steal credentials they should have gotten hired as a red team.

sonicanatidae 3y ago

The very best reason not to pay ransoms is because it requires trusting the piece of garbage that stole from you, to be honest. Never pay the ransom...ever.

shmolf 3y ago
Agreed. Paying the ransom only funds the operation, prompting growth and incentives
- sonicanatidae 3y ago
  And in a majority of cases I've read about, no or little data is recovered.