3 ms·

> as good as a response you can have to an incident like this. From customer perspective “in an effort to reduce the likelihood of this data becoming widely av

> as good as a response you can have to an incident like this. From customer perspective “in an effort to reduce the likelihood of this data becoming widely available, we’ve paid the ransom” is probably better, even if some people will not like it. Also to really be transparent it’d be good to post a detailed postmortem along with audit results detailing other problems they (most likely) discovered.

croemer 11mo ago
Depends. Not paying ransom decreases the likelihood of being attacked in the future.
- walletdrainer 11mo ago
  Probably not that significantly, these are primarily crimes of opportunity. An attacker isn’t likely to do much research on the company until they already have access, and that point they might as well proceed (especially since getting hit a second time would be doubly awkward for the company, presumably dramatically increasing the chances of payment) And selling the data from companies like Checkout.com is generally still worth a decent amount, even if nowhere close to the bigger ransom payments.
jacquesm 11mo ago
No, that would not help me as a customer. Because I would never believe that that party would keep their word, besides, it can't be verified. You'll have that shadow hanging around for ever. The good thing is that those assholes now have less budget to go after the next party. The herd is safe from wolves by standing together, not by trying to see which of their number should be sacrificed next.
- walletdrainer 11mo ago
  There’s a very real difference between the data possibly still being saved in some huge storage dump of a ransomware group and being available for everybody to exploit on a leak site. It’s a sliding scale, where payment firmly pushes you in the more comfortable direction. Also, the uncomfortable truth is that ransomware payments are very common. Not paying will make essentially no difference, the business would probably still be incredibly lucrative even if payment rates dropped to 5% of what they are now. If there was global co-operation to outlaw ransom payments, that’d be great. Until then, individual companies refusing to pay is largely pointless.
  - jacquesm 11mo ago
    > It’s a sliding scale, where payment firmly pushes you in the more comfortable direction. No, it pushes you in a more comfortable direction, and I'm not you.
    - walletdrainer 11mo ago
      Yes, but your concerns are less rooted in reality and more in the fact that you find the idea of paying ransomware groups repulsive. That’s fine, but there’s rational analysis to be done here, and it often leads to paying being the best option. If your company gets hit by one of these groups and you want to protect your customers, paying is almost always the most effective way to do that. Someone who isn’t particularly interested in protecting their customers probably wouldn’t pay if the damage from not paying would be lower than the cost of paying. A third possibility is that you simply feel uncomfortable about paying, which is fine, but it isn’t a particularly rational basis for the decision. I think we can also fairly assume that the vast majority of people have no strong feelings about ransomware, so there’s likely going to be no meaningful reputational damage caused by paying.
tobyhinloopen 11mo ago
I strongly disagree. Paying the ransom will put everyone in danger.
- walletdrainer 11mo ago
  I would totally agree with you if we lived in a hypothetical world where ransomware payments aren’t super common anyway. Until there is legislation to stop these payments, there will be countless situations where paying is simply the best option.
  - yreg 11mo ago
    > Until there is legislation to stop these payments, there will be countless situations where paying is simply the best option. Paying the ransom is not exactly legal, is it? Surely the attackers don't provide you with a legitimate invoice for your accounting. As a company you cannot just buy a large amount of crypto and randomly send it to someone.
    - walletdrainer 11mo ago
      Paying the ransoms is almost always legal in basically all western countries unless the recipient has been sanctioned. > As a company you cannot just buy a large amount of crypto and randomly send it to someone. You can totally do that, why wouldn’t you be able to?
      - yreg 11mo ago
        Because its fraud. You cannot just take money out of the company, you have to put something in your books.
        walletdrainer 11mo ago
        So you obviously put “ransomware payment” in the books.
rollcat 11mo ago
Never pay the ransom. The extortionist knows they cannot prove they destroyed the data, so they will eventually sell it anyway. They will maybe hold off for a bit to prove their "reputation" or "legitimacy". Just don't pay.
- walletdrainer 11mo ago
  If this is actually frequently happening, your claim should be pretty easy to prove. Most stolen databases are sold fairly publicly. The ransom payments tend to be so big anyway that selling the data and associated reputational damage is most likely not worth the hassle. Basic game theory shows that the best course of action for any ransomware group with multiple victims is to act honestly. You can never be sure, but the incentives are there and they’re pretty obvious. The big groups are making in the neighbourhood of $billions, earning extra millions by sabotaging their main source of revenue seems ridiculous.
  - rollcat 11mo ago
    > reputational damage Whoa. You're a crime organization. The data may as well "leak" the same way it leaked out of your victim's "reputable" system.
    - walletdrainer 11mo ago
      We’re talking about criminal organisations that depend on a certain level of trust to make any money at all. Yes, the data might still leak. It’s absurd to suggest that it’s not less likely to leak if you pay. There’s a reason why businesses very frequently arrive at the conclusion that it’s better to pay, and it’s not because they’re stupid or malicious. They actually have money on the line too, unlike almost everyone who would criticise them for paying.
  - wordpad 11mo ago
    Do you think ransomware groups do referrals to their satisfied customers who paid and didn't have their data leaked?
weird-eye-issue 11mo ago
Ah yes let's fund literal criminal groups so they have an incentive to keep hacking people
- walletdrainer 11mo ago
  Completely useless take in the real world where these payments are common, it makes no difference whatsoever if an individual or even vast majority of victims stop paying. Ransomware will remain incredibly lucrative until payments are outlawed. The cost of an attack like this is in the thousands of dollars at most, the ransom payments tend to be in the millions. The economics of not paying just don’t add up in the current situation.
  - weird-eye-issue 11mo ago
    How do you know it isn't illegal when you pay the ransom? You could very well be making a payment to a sanctioned individual or country, or a terrorist organization etc.
    - walletdrainer 11mo ago
      There are best practices for this, you normally hire a third party to handle the negotiations, payment process and the necessary due diligence. For example the UK government publishes guidelines on how to do this and which mitigating circumstances they consider if you do end up making a payment to a sanctioned entity anyway https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware https://www.gov.uk/government/publications/financial-sanctio... They directly state as follows: > An investigation by the NCA is very unlikely to be commenced into a ransomware victim, or those involved in the facilitation of the victim’s payment, who have proactively engaged with the relevant bodies as set out in the mitigating factors above i.e you’re not even going to be investigated unless you try to cover things up. This is a solved problem, big companies with big legal departments make large ransomware payments every day. Big incident response companies have teams of negotiators to work through the process of paying, and to get the best possible price.
gchamonlive 11mo ago
You mean as a customer you'd feel better if the company victim of ransom would help fund the very group that put the business and your data in jeopardy?
- walletdrainer 11mo ago
  Of course, it makes my data and my customers data less likely to end up public on the internet. It’s not great, but it’s the least shitty option.
  - gchamonlive 11mo ago
    What makes you think they won't get the money and sell the database in the dark web? This is like falling victim to a scam and paying more on top of it because the scammers promised to return the money if you pay a bit more. I see no likelihood game to be played there because you can't trust criminals by default. Thinking otherwise is just naive and wishful. Your data is out in the wild, nothing you can do about that. As soon as you accept that the better are your chances to do damage reduction.
    - walletdrainer 11mo ago
      Their incentives are well known. You don’t have to trust them to assume that they will act rationally. Picking up hundreds of thousands at best (very few databases would be worth so much) when your main business pays millions or tens of millions per victim simply isn’t worth it, selling the data would jeopardise their main business which is orders of magnitude more profitable. Absolutely no IR company will advise their clients to pay if the particular ransomware group is known to renege on their promises.
      - gchamonlive 11mo ago
        Did some research and indeed there is a sort of "honor among thieves" kinda vibes when it comes to ransom attacks. Still, it's illegal or quite bureaucratic in some places to pay up. And idk... It still feels like these ransom groups could well sit on the data a while, collect data from other attacks, shuffle, shard and share these databases, and then sell the data in a way that is hard to trace back to the particular incident and to a particular group, so they get away with getting the ransom money and then selling the db latter. It's also not granted that even with the decrypt tools you'd be able to easily recover data at scale given how janky these tools are. I don't know. I am less sure now than I was before about this, but I feel like it's the correct move not to pay up and fund the group that struck you, only so it can strike others, and also risk legal litigations.

croemer 11mo ago

Depends. Not paying ransom decreases the likelihood of being attacked in the future.

walletdrainer 11mo ago
Probably not that significantly, these are primarily crimes of opportunity. An attacker isn’t likely to do much research on the company until they already have access, and that point they might as well proceed (especially since getting hit a second time would be doubly awkward for the company, presumably dramatically increasing the chances of payment) And selling the data from companies like Checkout.com is generally still worth a decent amount, even if nowhere close to the bigger ransom payments.

jacquesm 11mo ago

No, that would not help me as a customer. Because I would never believe that that party would keep their word, besides, it can't be verified. You'll have that shadow hanging around for ever. The good thing is that those assholes now have less budget to go after the next party. The herd is safe from wolves by standing together, not by trying to see which of their number should be sacrificed next.

walletdrainer 11mo ago
There’s a very real difference between the data possibly still being saved in some huge storage dump of a ransomware group and being available for everybody to exploit on a leak site. It’s a sliding scale, where payment firmly pushes you in the more comfortable direction. Also, the uncomfortable truth is that ransomware payments are very common. Not paying will make essentially no difference, the business would probably still be incredibly lucrative even if payment rates dropped to 5% of what they are now. If there was global co-operation to outlaw ransom payments, that’d be great. Until then, individual companies refusing to pay is largely pointless.
- jacquesm 11mo ago
  > It’s a sliding scale, where payment firmly pushes you in the more comfortable direction. No, it pushes you in a more comfortable direction, and I'm not you.
  - walletdrainer 11mo ago
    Yes, but your concerns are less rooted in reality and more in the fact that you find the idea of paying ransomware groups repulsive. That’s fine, but there’s rational analysis to be done here, and it often leads to paying being the best option. If your company gets hit by one of these groups and you want to protect your customers, paying is almost always the most effective way to do that. Someone who isn’t particularly interested in protecting their customers probably wouldn’t pay if the damage from not paying would be lower than the cost of paying. A third possibility is that you simply feel uncomfortable about paying, which is fine, but it isn’t a particularly rational basis for the decision. I think we can also fairly assume that the vast majority of people have no strong feelings about ransomware, so there’s likely going to be no meaningful reputational damage caused by paying.

tobyhinloopen 11mo ago

I strongly disagree. Paying the ransom will put everyone in danger.

walletdrainer 11mo ago
I would totally agree with you if we lived in a hypothetical world where ransomware payments aren’t super common anyway. Until there is legislation to stop these payments, there will be countless situations where paying is simply the best option.
- yreg 11mo ago
  > Until there is legislation to stop these payments, there will be countless situations where paying is simply the best option. Paying the ransom is not exactly legal, is it? Surely the attackers don't provide you with a legitimate invoice for your accounting. As a company you cannot just buy a large amount of crypto and randomly send it to someone.
  - walletdrainer 11mo ago
    Paying the ransoms is almost always legal in basically all western countries unless the recipient has been sanctioned. > As a company you cannot just buy a large amount of crypto and randomly send it to someone. You can totally do that, why wouldn’t you be able to?
    - yreg 11mo ago
      Because its fraud. You cannot just take money out of the company, you have to put something in your books.
      - walletdrainer 11mo ago
        So you obviously put “ransomware payment” in the books.

rollcat 11mo ago

Never pay the ransom. The extortionist knows they cannot prove they destroyed the data, so they will eventually sell it anyway. They will maybe hold off for a bit to prove their "reputation" or "legitimacy". Just don't pay.

walletdrainer 11mo ago
If this is actually frequently happening, your claim should be pretty easy to prove. Most stolen databases are sold fairly publicly. The ransom payments tend to be so big anyway that selling the data and associated reputational damage is most likely not worth the hassle. Basic game theory shows that the best course of action for any ransomware group with multiple victims is to act honestly. You can never be sure, but the incentives are there and they’re pretty obvious. The big groups are making in the neighbourhood of $billions, earning extra millions by sabotaging their main source of revenue seems ridiculous.
- rollcat 11mo ago
  > reputational damage Whoa. You're a crime organization. The data may as well "leak" the same way it leaked out of your victim's "reputable" system.
  - walletdrainer 11mo ago
    We’re talking about criminal organisations that depend on a certain level of trust to make any money at all. Yes, the data might still leak. It’s absurd to suggest that it’s not less likely to leak if you pay. There’s a reason why businesses very frequently arrive at the conclusion that it’s better to pay, and it’s not because they’re stupid or malicious. They actually have money on the line too, unlike almost everyone who would criticise them for paying.
- wordpad 11mo ago
  Do you think ransomware groups do referrals to their satisfied customers who paid and didn't have their data leaked?

weird-eye-issue 11mo ago

Ah yes let's fund literal criminal groups so they have an incentive to keep hacking people

walletdrainer 11mo ago
Completely useless take in the real world where these payments are common, it makes no difference whatsoever if an individual or even vast majority of victims stop paying. Ransomware will remain incredibly lucrative until payments are outlawed. The cost of an attack like this is in the thousands of dollars at most, the ransom payments tend to be in the millions. The economics of not paying just don’t add up in the current situation.
- weird-eye-issue 11mo ago
  How do you know it isn't illegal when you pay the ransom? You could very well be making a payment to a sanctioned individual or country, or a terrorist organization etc.
  - walletdrainer 11mo ago
    There are best practices for this, you normally hire a third party to handle the negotiations, payment process and the necessary due diligence. For example the UK government publishes guidelines on how to do this and which mitigating circumstances they consider if you do end up making a payment to a sanctioned entity anyway https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware https://www.gov.uk/government/publications/financial-sanctio... They directly state as follows: > An investigation by the NCA is very unlikely to be commenced into a ransomware victim, or those involved in the facilitation of the victim’s payment, who have proactively engaged with the relevant bodies as set out in the mitigating factors above i.e you’re not even going to be investigated unless you try to cover things up. This is a solved problem, big companies with big legal departments make large ransomware payments every day. Big incident response companies have teams of negotiators to work through the process of paying, and to get the best possible price.

gchamonlive 11mo ago

You mean as a customer you'd feel better if the company victim of ransom would help fund the very group that put the business and your data in jeopardy?

walletdrainer 11mo ago
Of course, it makes my data and my customers data less likely to end up public on the internet. It’s not great, but it’s the least shitty option.
- gchamonlive 11mo ago
  What makes you think they won't get the money and sell the database in the dark web? This is like falling victim to a scam and paying more on top of it because the scammers promised to return the money if you pay a bit more. I see no likelihood game to be played there because you can't trust criminals by default. Thinking otherwise is just naive and wishful. Your data is out in the wild, nothing you can do about that. As soon as you accept that the better are your chances to do damage reduction.
  - walletdrainer 11mo ago
    Their incentives are well known. You don’t have to trust them to assume that they will act rationally. Picking up hundreds of thousands at best (very few databases would be worth so much) when your main business pays millions or tens of millions per victim simply isn’t worth it, selling the data would jeopardise their main business which is orders of magnitude more profitable. Absolutely no IR company will advise their clients to pay if the particular ransomware group is known to renege on their promises.
    - gchamonlive 11mo ago
      Did some research and indeed there is a sort of "honor among thieves" kinda vibes when it comes to ransom attacks. Still, it's illegal or quite bureaucratic in some places to pay up. And idk... It still feels like these ransom groups could well sit on the data a while, collect data from other attacks, shuffle, shard and share these databases, and then sell the data in a way that is hard to trace back to the particular incident and to a particular group, so they get away with getting the ransom money and then selling the db latter. It's also not granted that even with the decrypt tools you'd be able to easily recover data at scale given how janky these tools are. I don't know. I am less sure now than I was before about this, but I feel like it's the correct move not to pay up and fund the group that struck you, only so it can strike others, and also risk legal litigations.