4 ms·

It was always a bad idea to pay ransomware groups, but I'm surprised they'd eat their own. I guess "There is no honor among thieves" after all.

QuiDortDine 3y ago
Bad idea to guarantee the improbable (deleting their own copies), a valid choice for a one-time result (unlocking your data on your device).
- autoexec 3y ago
  That's typically what backups are for. No business should be so negligent as to ever need to pay a ransomware group in order to get their own data back.
  - nonethewiser 3y ago
    But if they are, it may make sense to pay. For the company. Not from a more macro view.
    - autoexec 3y ago
      That I can agree with. If the company has already screwed up so badly they're stuck paying the price and hoping for the best.
  - pants2 3y ago
    It may also be about not wanting their data to be made public.
    - danlugo92 3y ago
      Yeah...
  - irjustin 3y ago
    In this case I would include "getting their systems back online"
    - autoexec 3y ago
      There could be times when there's an immediate need to get everything back up and running, but I'd be willing to bet that in at least some situations the time spent going back and forth with the extortionists to arrange the payment, then gather the funds, and then wait for them the verify that they have your money could take longer than it would to just re-image a new server, reset some passwords, and copy over the needed data from backups. It's the same stuff they'd have to do either way. My guess is that companies that have their shit together enough that they could get back to a "We're total compromised and vulnerable, but at least we're online for now" state fairly quickly without paying up are a lot less likely to have ransomware problems in the first place.
  - wlonkly 3y ago
    As a data point, the Toronto Public Library decided to take the "restore from scratch" approach after being hit by ransomware, and it took four months before books could be borrowed again. Now, I'd expect a library would move slower than an IT-heavy company, but there are substantial costs either way and only one of them is probably covered by their cyber insurance.
    - danlugo92 3y ago
      Four months wtf, they should have offsite backups maybe every 15 days at most, but I can understand how even that can be a headache to restore from...
    - ornornor 3y ago
      So that’s what happened. I was wondering why they were having so much trouble. Their wording was evasive and I thought I til now that it was Covid closures related somehow without really understanding how covid would have that impact.
treme 3y ago
fwiw they have a pretty good reputation to release data after payment, not much the companies can do ex-post if they don't have a backup to their valued data.
yieldcrv 3y ago
Historically its been a reliably good idea to pay ransomware groups This is the worst case scenario and its ridiculous I hope it prompts reforms in that industry such as using smart contracts as escrow to handle payment to affiliates a direct payment to an EOA is just sad affiliates, moderators, and the ransomed should demand a model smart contract behind every address presented for payment, cybersecurity industry (and even the feds) could help craft this and give more confidence to the outcome
- countrpt 3y ago
  Are… you really suggesting that the real problem here is not criminal extortion but that the payment approach isn’t safe enough to ensure their criminal associates get paid, and that this is what the feds should help improve?
  - buffington 3y ago
    I'm not invested enough to do the napkin math, but I wonder what costs more: ignoring security and paying the ransom, or investing in the right strategy to prevent being held ransom. If I consider my own experience in tech for the past few decades, I have to think it could go either way. (This says nothing of the damage releases of private data can do, which of course makes investing in the right strategy the correct thing to do, no matter the cost.)
    - autoexec 3y ago
      From a cost perspective it'd be easy to be tempted into thinking you can play the odds and come out ahead. It's not like getting infected with ransomware is something that happens all the time. Fortunately not being negligent when it comes to security does a lot more than just protect you from ransomware extortionists. It can make it possible to easily recover data after all kinds of incidents (human error, software bugs, hardware failures, fires/floods, etc) and also help keep you protected from other types of viruses/malware, malicious employees, corporate espionage, whistleblowers, and anyone else who would take your data and then actually use it instead of just demanding payment to make it go away. It can also prevent the reputational harm a company can suffer by having a data breach go public. Good security is one of those things that could easily save a company way more than it costs them, but the costs are immediate and non-trivial and companies seem to love to cut corners even when they know it'll screw them down the road because they're pathologically short-sighted and it's hard to brag about doing something that didn't have an immediate and obvious impact on their next quarter's bottom line
deleted 3y ago
[deleted]

QuiDortDine 3y ago

Bad idea to guarantee the improbable (deleting their own copies), a valid choice for a one-time result (unlocking your data on your device).

autoexec 3y ago
That's typically what backups are for. No business should be so negligent as to ever need to pay a ransomware group in order to get their own data back.
- nonethewiser 3y ago
  But if they are, it may make sense to pay. For the company. Not from a more macro view.
  - autoexec 3y ago
    That I can agree with. If the company has already screwed up so badly they're stuck paying the price and hoping for the best.
- pants2 3y ago
  It may also be about not wanting their data to be made public.
  - danlugo92 3y ago
    Yeah...
- irjustin 3y ago
  In this case I would include "getting their systems back online"
  - autoexec 3y ago
    There could be times when there's an immediate need to get everything back up and running, but I'd be willing to bet that in at least some situations the time spent going back and forth with the extortionists to arrange the payment, then gather the funds, and then wait for them the verify that they have your money could take longer than it would to just re-image a new server, reset some passwords, and copy over the needed data from backups. It's the same stuff they'd have to do either way. My guess is that companies that have their shit together enough that they could get back to a "We're total compromised and vulnerable, but at least we're online for now" state fairly quickly without paying up are a lot less likely to have ransomware problems in the first place.
- wlonkly 3y ago
  As a data point, the Toronto Public Library decided to take the "restore from scratch" approach after being hit by ransomware, and it took four months before books could be borrowed again. Now, I'd expect a library would move slower than an IT-heavy company, but there are substantial costs either way and only one of them is probably covered by their cyber insurance.
  - danlugo92 3y ago
    Four months wtf, they should have offsite backups maybe every 15 days at most, but I can understand how even that can be a headache to restore from...
  - ornornor 3y ago
    So that’s what happened. I was wondering why they were having so much trouble. Their wording was evasive and I thought I til now that it was Covid closures related somehow without really understanding how covid would have that impact.

treme 3y ago

fwiw they have a pretty good reputation to release data after payment, not much the companies can do ex-post if they don't have a backup to their valued data.

yieldcrv 3y ago

Historically its been a reliably good idea to pay ransomware groups This is the worst case scenario and its ridiculous I hope it prompts reforms in that industry such as using smart contracts as escrow to handle payment to affiliates a direct payment to an EOA is just sad affiliates, moderators, and the ransomed should demand a model smart contract behind every address presented for payment, cybersecurity industry (and even the feds) could help craft this and give more confidence to the outcome

countrpt 3y ago
Are… you really suggesting that the real problem here is not criminal extortion but that the payment approach isn’t safe enough to ensure their criminal associates get paid, and that this is what the feds should help improve?
- buffington 3y ago
  I'm not invested enough to do the napkin math, but I wonder what costs more: ignoring security and paying the ransom, or investing in the right strategy to prevent being held ransom. If I consider my own experience in tech for the past few decades, I have to think it could go either way. (This says nothing of the damage releases of private data can do, which of course makes investing in the right strategy the correct thing to do, no matter the cost.)
  - autoexec 3y ago
    From a cost perspective it'd be easy to be tempted into thinking you can play the odds and come out ahead. It's not like getting infected with ransomware is something that happens all the time. Fortunately not being negligent when it comes to security does a lot more than just protect you from ransomware extortionists. It can make it possible to easily recover data after all kinds of incidents (human error, software bugs, hardware failures, fires/floods, etc) and also help keep you protected from other types of viruses/malware, malicious employees, corporate espionage, whistleblowers, and anyone else who would take your data and then actually use it instead of just demanding payment to make it go away. It can also prevent the reputational harm a company can suffer by having a data breach go public. Good security is one of those things that could easily save a company way more than it costs them, but the costs are immediate and non-trivial and companies seem to love to cut corners even when they know it'll screw them down the road because they're pathologically short-sighted and it's hard to brag about doing something that didn't have an immediate and obvious impact on their next quarter's bottom line

deleted 3y ago

[deleted]