6 ms·

on one hand, every ransom paid encourages like-minded individuals to start or ramp up their ransomware game , which is not great. on the other hand, the ransom

on one hand, every ransom paid encourages like-minded individuals to start or ramp up their ransomware game , which is not great. on the other hand, the ransomware groups that want to stay in business need to be honest (with respect to not releasing/deleting data) or they wont be 'credible' ransomware operators, which is kind of funny to think about. and in many cases, the victims would rather the ransomware operator be paid (so their data is not leaked) vs. having their data leaked. so paying is the best for current victims (but increases the potential for future victims). the dynamics/economics around ransomware is fascinating.

cortesoft 6mo ago
This is always the game theory of ransoms, and it is a classic example of a collective action problem (and is a form of a prisoner's dilemma). Each individual company is probably better off paying the ransom, but everyone would be better off if no one paid a ransom. This is why the United States, for example, has an official no-ransom policy, and why other no-ransom policies exist. You have to have something forcing the individual victim to not pay, otherwise they will always be incentivized to pay and ransoms will continue to be profitable. https://en.wikipedia.org/wiki/Collective_action_problem https://en.wikipedia.org/wiki/Collective_action_problem https://en.wikipedia.org/wiki/Prisoner%27s_dilemma https://en.wikipedia.org/wiki/Prisoner%27s_dilemma
- Hizonner 6mo ago
  ... except that "policies" don't cut it. Criminal penalties for paying are what you need, and not just for payments to specific designated entities, either. The executive making the decision to pay has to have a real fear of personally spending time in actual prison.
  - gnopgnip 6mo ago
    US law has criminal penalties for paying a ransom to a designated criminal terrorist organization or under treasury sanctions.
    - esseph 6mo ago
      Most hacking groups don't fall under that. Some, sure.
  - cortesoft 6mo ago
    A criminal penalty is a form of policy
    - Hizonner 6mo ago
      ... but not the form of policy they actually have. Except for payments to specifically sanctioned organizations, the policy is "we'd really rather you didn't do that, but whatever". The specific sanctions don't cover most of the groups, either, and even when they do cover the group who got paid, you can't necessarily prove the people who got paid were the ones on the list. And there may be a scienter requirement even then; I don't know. Making a list of specific criminals you can't pay is just stupid. No ransoms, ever, period, or it's da slammah.
- bombcar 6mo ago
  You can also have the "excessive force" doctrine, where holding someone or something for ransom results in your entire country being a smoldering crater. But just like fail2ban, this gives someone else decision-making control over your actions, which can be abused.
- kjkjadksj 6mo ago
  While the us stance has resulted in savings on potential ransom, it has also lead to people being kept in prison for very long time until prisoner exchanges might be worked out. That cost to an individuals life being imprisoned is probably far in excess whatever the US might pay. Plus the US prints its own monopoly money and doesn’t really play by the rules of economics anyhow ever since getting off gold standard.
  - WillPostForFood 6mo ago
    Cash is not the real cost; the cost is by agreeing to continue printing ransom money, you cause more individuals to be kidnapped.
    - kjkjadksj 6mo ago
      Seems the rate of kidnapping is currently orthogonal from the ransom so it is unclear that they will have a linear relationship in this way as you describe.
  - appreciatorBus 6mo ago
    That ransoms today are denominated in USD and that the US might be printing too many USD has nothing to do with whether or not ransoms should be paid. The day the USD falls, ransoms will simply be denominated in something else and the same underlying collective action problem will remain. This is just way of avoiding the core issue by blaming something unrelated that you don't like. A: U should clean your room, it would be better for you & the rest of your family B: FU dad, everyone knows there's no such thing as a clean room under capitalism!!!!!
  - cortesoft 6mo ago
    This is literally the exact point I am making, and the US policy isn’t about saving money. Like you said (and like I said in my post), for an individual kidnap victim, the best option would be to pay the ransom. It is better to pay the money and be free. However, that means a kidnap group now has more money, which will make them better able to kidnap another victim and demand more money. The point of a “no ransom” policy is that it takes the choice away from the individual, who would choose to pay it, and changes the game theory to make kidnapping not worth it. The whole reason you need a policy at all is BECAUSE it is better for the person to pay the ransom.
- Ysx 6mo ago
  > Each individual company is probably better off paying the ransom, but everyone would be better off if no one paid a ransom. You're then a target known to be vulnerable and pay ransoms, so best focus on security.
  - sgc 6mo ago
    If you have to pay, at least try to negotiate 1) a guarantee that the hackers won't just do it again sometime later, and 2) full disclosure / assistance in repairing your vulnerabilities so you have some kind of head start for the future. Outside of politically motivated hackers, this would probably be reasonably successful.
    - Symbiote 6mo ago
      Other hacking groups now know Instructure pays up.
    - LgWoodenBadger 6mo ago
      What possible type of guarantee could one ever hope to "negotiate" with someone who has just successfully blackmailed/ransomed/extorted?
      - sgc 6mo ago
        We are in the context of already having to pay. You are at their mercy no matter what, so the only value of any interaction with them is based on hoping they have incentive to maintain their promises to protect their reputation etc. It's not a good situation to be in, but still, try to make the best of it.
      - kelnos 6mo ago
        If the ransomware operator believes that breaking their word might make it harder to get money out of future victims, they'll keep their word. They might not believe that, but if you're at the point where you're paying anyway, you might as well try to get that commitment from them.
- janalsncm 6mo ago
  There’s a similar dynamic from within the hacker group itself. For the ransom group, it is better for them to be perceived as trustworthy. Pay the ransom and we won’t leak your data. For any individual within the ransom group, they can get a big payout by selling the data.
  - MagicMoonlight 6mo ago
    I don’t know if that’s really true. Nobody would really give a shit if you leaked where everyone goes to college… because it’s already on their LinkedIn or whatever. The only people it’s valuable for is the ransomee, because they don’t want the reputational hit of having their data everywhere.
    - HDBaseT 6mo ago
      It really isn't as simple as that. You are leaking email addresses that likely otherwise wouldn't be out there publicly. Whilst email addresses and names are "effectively" public, they aren't just in a one big database anyone on the planet can access. Every single one of those email addresses will receive increased spam and phishing attempts, with more isolated information (such as School, First+Last Name, Subjects, Teachers/Lecturers, etc) the phishing attempts can be more refined. i.e, Student receives an email that looks like its from their school (has email footer, has student name, has relevant teacher name, subject name, etc), the user is now more likely to click some sketchy link. These little identifiers add up, especially when cross-references with other leaks. Even more problematic when most of the users wrapped up in a leak like this are under 18 too. A lot of this stuff could be done previously, although the effort and scale to do so would of been higher/harder.
  - SoftTalker 6mo ago
    Depends on what they actually got. Names and email addresses? Considered public and are not so valuable. Universities usually publish those in a directory anyway. Messages between students and instructors? Likely pretty boring, but possibly embarassing or confidential for a given individual. Grades? Could be a FERPA violation. Critical PII such as SSNs? Probably not in the LMS to begin with.
- gopher_space 6mo ago
  Famously summarized by Kipling https://www.kiplingsociety.co.uk/poem/poems_danegeld.htm https://www.kiplingsociety.co.uk/poem/poems_danegeld.htm
  - esafak 6mo ago
    TIL https://en.wikipedia.org/wiki/Danegeld https://en.wikipedia.org/wiki/Danegeld
- BennyH26 6mo ago
  And that’s exactly why the incidence of kidnapping plummeted in Italy once ransom payments were made illegal
  - latexr 6mo ago
    How does that work? I.e. say a kidnapping occurs and the ransom is paid. What kind of trouble does the paying party get into? A fine? Jail?
    - bluGill 6mo ago
      So long as the potential payer knows they will get something they are going to slow down. They might pay, but suddenly becomes harder because they have to hide what they are doing. Many won't figure out how to pay. The real value though is enough people consider themselves honest and won't do anything they know is illegal. They already hate dealing with criminals, but so long as paying is legal they might do it, but as soon as it affects their moral code they won't. The whole system collapses because just a few people saying no to paying means the kidnappers lose money on too many operations.
      - latexr 6mo ago
        I understand the mechanism and the point of making it illegal, that’s not the question. What I want to know is what exactly are the lawful repercussions for the person who paid.
    - jasonfarnon 6mo ago
      A fine or sentence is probably on the books but it never comes to that. The main thing is to freeze the family's assets, and more importantly to publicize this procedure so the mafia or whoever knows there's no point in threatening the family.
- mlyle 6mo ago
  There's one more piece that matters. If no one pays the ransoms, but people believe that large ransoms are paid-- you still have the crime.
  - Ancapistani 6mo ago
    The obverse is true - because a ransom organization is dependent upon their reputation, a company claiming to have paid and received confirmation from the group could prevent them from releasing it as well. The general public (including the next victims) don't have a way to confirm if payment was made. ShinyHunters would have to choose between arguing publicly that they were not paid or not releasing the data to protect their own reputation...
    - mlyle 6mo ago
      Good/funny observation. Game theory and economics are fun. :D I do think that the partial information problem relating to new entrants into this market is interesting though. The number of potential threat actors with partial/no information but that might speculate based on grandiose visions of ransom or outdated history is high. We see dumb attempts at real-world ransoms/extortion which don't get paid at a pretty high clip based on this kind of partial knowledge.
      - HDBaseT 6mo ago
        It's an interesting idea, although I think in the heat of the moment, the last thing your org should be thinking of will be playing games with one of the most prolific hacker groups on the planet. You'll probably get your data leaked anyways, potentially get compromised again (see Instructure situation) and end up in a way worse place if you just shut up and paid it, or let it leak normally.
- protocolture 6mo ago
  >but everyone would be better off if no one paid a ransom. I doubt if everyone would be better off if state level actors found and used these vulnerabilities instead of ransom seekers.
- ergocoder 6mo ago
  Why don't someone pretend to be ransom hacker, take the money, and release the hacked data anyway? This will progress the game theory to the point where nobody will pay ransom because the thieves won't honor the deals anyway.
bombcar 6mo ago
If we assume a world where ransomware is continually existent and all your data is ransomed at anytime, we'd have a world designed to work around that. We'd either end up with a Discworld "Ransomware Guild" that you pay "insurance" to and they murdicate anyone who dares do extracurricular data ransoming, or you'd have systems build on end-to-end encryption where the data is worthless.
- zbentley 6mo ago
  I think you may have re-invented email reputation.
AlotOfReading 6mo ago
I'm not sure that attacker reputation is particularly meaningful. The group can rebrand into a new identity at any time. They're anonymous cybercriminals after all and there are lots of reasons they might need to do that beyond reputation laundering. The calculus for the victims doesn't seem to change much whether the same people are using a "new" name or an old one to hold their systems hostage.
- onemoresoop 6mo ago
  Yeah but fewer ransomes would be paid out regardless of who is attacking. They could be spoiling their own market and am sure they would
  - AlotOfReading 6mo ago
    That's a motivation to avoid tragedy of the commons, not because they're trying to maintain their own reputation to victims. It benefits the criminals even if they change their name.
- Freak_NL 6mo ago
  The name ShinyHunters is currently quite well-known due to a number of high-profile hacks (Odido in the Netherlands this year was huge). Their brand has a significant value right now.
  - jasonfarnon 6mo ago
    How does everyone know its ShinyHunters and not someone pretending? I imagine they have some mechanism to authenticate, I'm curious what it is.
    - HDBaseT 6mo ago
      Because ShinyHunters published they hacked Canvas on their own website. They also redirected the canvas login pages to a ShinyHunters message, whilst this could be done by another group/person, its unlikely. You can also validate PGP keys and TOX accounts, etc via their website.
esaym 6mo ago
> on the other hand, the ransomware groups that want to stay in business need to be honest I was thinking about that the other day. Honestly I'm not sure it matters. I feel like if a company didn't pay the ransom that would possibly open them up to lawsuits or something because they "tried nothing". At least paying it makes it look like they did something and could be some sort of legal defense. But again I'm not a lawyer.
patrickthebold 6mo ago
So, maybe we could consider a "White Hat" ransomware group that takes the money and also leaks the data, so that long term no one bothers to pay which ultimately disincentivizes ransomware attacks?
- esseph 6mo ago
  White hats that take money are not white hats, those are grey hats. https://en.wikipedia.org/wiki/Grey_hat https://en.wikipedia.org/wiki/Grey_hat
ashleyn 6mo ago
Another way to view this calculation: if you keep your infrastructure secure and up to date, you (very likely) don't have to pay any ransom in the first place.
- joseda-hg 6mo ago
  There is a line where the ransom price beats the capex of keeping a secure system, specially when the risk so nebulous Kind of like the recall math auto makers do to see if it's more expensive to actually recall a manufacturing problem, or just deal with it and compensate those who seek it personally
joseda-hg 6mo ago
What stops a ransomware group copying all data and just selling it piecemeal on the darknet under posibly a different name? Realistically, the only people that could check that it's true are buyers, and those benefit from keeping a low profile
arjie 6mo ago
An idea I idly thought about is that of a "Benevolent Terrorist"[0]: one who does great harm to some number of people so that they may make it to a better world. Not entirely original, I suppose, since the Kwisatz Haderach from Dune is the trope definer. But a fun thought I had was what if you ran a ransomware company that just didn't pay? You'd screw a lot of people over but eventually you'd make ransomware a non-business the better you impersonated them and failed to deliver after taking the ransom. What could go wrong? ;) 0: https://wiki.roshangeorge.dev/w/Benevolent_Terrorist#Poisoning_The_Well https://wiki.roshangeorge.dev/w/Benevolent_Terrorist#Poisoni...
barkingcat 6mo ago
one issue is that modern ransomeware groups are also being hunted themselves - there are many ransomeware orgs that are themselves being ransomed so are not reliable. even if you pay the ransom to the 1st group, the 2nd group will leak.
LastTrain 6mo ago
That operates on the idea that hacker organizations use long term strategic thinking, something the US government and a good number of corporations don’t even practice. I wouldn’t put my money on that.
- john_strinlai 6mo ago
  while i am not about to bet the farm on the long-term strategic thinking ability of extortion groups, they are much smaller than most corporations and the US government, thus its much easier to think strategically and execute on longer-term goals. shinyhunters, for example, has been active and acted as a cohesive unit for the past 7 years.
nradov 6mo ago
Paying a ransom should always be illegal with federal criminal charges for the employees who authorize the payment. If businesses are destroyed or people die as a consequence then those are acceptable casualties.

cortesoft 6mo ago

This is always the game theory of ransoms, and it is a classic example of a collective action problem (and is a form of a prisoner's dilemma). Each individual company is probably better off paying the ransom, but everyone would be better off if no one paid a ransom. This is why the United States, for example, has an official no-ransom policy, and why other no-ransom policies exist. You have to have something forcing the individual victim to not pay, otherwise they will always be incentivized to pay and ransoms will continue to be profitable. https://en.wikipedia.org/wiki/Collective_action_problem https://en.wikipedia.org/wiki/Collective_action_problem https://en.wikipedia.org/wiki/Prisoner%27s_dilemma https://en.wikipedia.org/wiki/Prisoner%27s_dilemma

Hizonner 6mo ago
... except that "policies" don't cut it. Criminal penalties for paying are what you need, and not just for payments to specific designated entities, either. The executive making the decision to pay has to have a real fear of personally spending time in actual prison.
- gnopgnip 6mo ago
  US law has criminal penalties for paying a ransom to a designated criminal terrorist organization or under treasury sanctions.
  - esseph 6mo ago
    Most hacking groups don't fall under that. Some, sure.
- cortesoft 6mo ago
  A criminal penalty is a form of policy
  - Hizonner 6mo ago
    ... but not the form of policy they actually have. Except for payments to specifically sanctioned organizations, the policy is "we'd really rather you didn't do that, but whatever". The specific sanctions don't cover most of the groups, either, and even when they do cover the group who got paid, you can't necessarily prove the people who got paid were the ones on the list. And there may be a scienter requirement even then; I don't know. Making a list of specific criminals you can't pay is just stupid. No ransoms, ever, period, or it's da slammah.
bombcar 6mo ago
You can also have the "excessive force" doctrine, where holding someone or something for ransom results in your entire country being a smoldering crater. But just like fail2ban, this gives someone else decision-making control over your actions, which can be abused.
kjkjadksj 6mo ago
While the us stance has resulted in savings on potential ransom, it has also lead to people being kept in prison for very long time until prisoner exchanges might be worked out. That cost to an individuals life being imprisoned is probably far in excess whatever the US might pay. Plus the US prints its own monopoly money and doesn’t really play by the rules of economics anyhow ever since getting off gold standard.
- WillPostForFood 6mo ago
  Cash is not the real cost; the cost is by agreeing to continue printing ransom money, you cause more individuals to be kidnapped.
  - kjkjadksj 6mo ago
    Seems the rate of kidnapping is currently orthogonal from the ransom so it is unclear that they will have a linear relationship in this way as you describe.
- appreciatorBus 6mo ago
  That ransoms today are denominated in USD and that the US might be printing too many USD has nothing to do with whether or not ransoms should be paid. The day the USD falls, ransoms will simply be denominated in something else and the same underlying collective action problem will remain. This is just way of avoiding the core issue by blaming something unrelated that you don't like. A: U should clean your room, it would be better for you & the rest of your family B: FU dad, everyone knows there's no such thing as a clean room under capitalism!!!!!
- cortesoft 6mo ago
  This is literally the exact point I am making, and the US policy isn’t about saving money. Like you said (and like I said in my post), for an individual kidnap victim, the best option would be to pay the ransom. It is better to pay the money and be free. However, that means a kidnap group now has more money, which will make them better able to kidnap another victim and demand more money. The point of a “no ransom” policy is that it takes the choice away from the individual, who would choose to pay it, and changes the game theory to make kidnapping not worth it. The whole reason you need a policy at all is BECAUSE it is better for the person to pay the ransom.
Ysx 6mo ago
> Each individual company is probably better off paying the ransom, but everyone would be better off if no one paid a ransom. You're then a target known to be vulnerable and pay ransoms, so best focus on security.
- sgc 6mo ago
  If you have to pay, at least try to negotiate 1) a guarantee that the hackers won't just do it again sometime later, and 2) full disclosure / assistance in repairing your vulnerabilities so you have some kind of head start for the future. Outside of politically motivated hackers, this would probably be reasonably successful.
  - Symbiote 6mo ago
    Other hacking groups now know Instructure pays up.
  - LgWoodenBadger 6mo ago
    What possible type of guarantee could one ever hope to "negotiate" with someone who has just successfully blackmailed/ransomed/extorted?
    - sgc 6mo ago
      We are in the context of already having to pay. You are at their mercy no matter what, so the only value of any interaction with them is based on hoping they have incentive to maintain their promises to protect their reputation etc. It's not a good situation to be in, but still, try to make the best of it.
    - kelnos 6mo ago
      If the ransomware operator believes that breaking their word might make it harder to get money out of future victims, they'll keep their word. They might not believe that, but if you're at the point where you're paying anyway, you might as well try to get that commitment from them.
janalsncm 6mo ago
There’s a similar dynamic from within the hacker group itself. For the ransom group, it is better for them to be perceived as trustworthy. Pay the ransom and we won’t leak your data. For any individual within the ransom group, they can get a big payout by selling the data.
- MagicMoonlight 6mo ago
  I don’t know if that’s really true. Nobody would really give a shit if you leaked where everyone goes to college… because it’s already on their LinkedIn or whatever. The only people it’s valuable for is the ransomee, because they don’t want the reputational hit of having their data everywhere.
  - HDBaseT 6mo ago
    It really isn't as simple as that. You are leaking email addresses that likely otherwise wouldn't be out there publicly. Whilst email addresses and names are "effectively" public, they aren't just in a one big database anyone on the planet can access. Every single one of those email addresses will receive increased spam and phishing attempts, with more isolated information (such as School, First+Last Name, Subjects, Teachers/Lecturers, etc) the phishing attempts can be more refined. i.e, Student receives an email that looks like its from their school (has email footer, has student name, has relevant teacher name, subject name, etc), the user is now more likely to click some sketchy link. These little identifiers add up, especially when cross-references with other leaks. Even more problematic when most of the users wrapped up in a leak like this are under 18 too. A lot of this stuff could be done previously, although the effort and scale to do so would of been higher/harder.
- SoftTalker 6mo ago
  Depends on what they actually got. Names and email addresses? Considered public and are not so valuable. Universities usually publish those in a directory anyway. Messages between students and instructors? Likely pretty boring, but possibly embarassing or confidential for a given individual. Grades? Could be a FERPA violation. Critical PII such as SSNs? Probably not in the LMS to begin with.
gopher_space 6mo ago
Famously summarized by Kipling https://www.kiplingsociety.co.uk/poem/poems_danegeld.htm https://www.kiplingsociety.co.uk/poem/poems_danegeld.htm
- esafak 6mo ago
  TIL https://en.wikipedia.org/wiki/Danegeld https://en.wikipedia.org/wiki/Danegeld
BennyH26 6mo ago
And that’s exactly why the incidence of kidnapping plummeted in Italy once ransom payments were made illegal
- latexr 6mo ago
  How does that work? I.e. say a kidnapping occurs and the ransom is paid. What kind of trouble does the paying party get into? A fine? Jail?
  - bluGill 6mo ago
    So long as the potential payer knows they will get something they are going to slow down. They might pay, but suddenly becomes harder because they have to hide what they are doing. Many won't figure out how to pay. The real value though is enough people consider themselves honest and won't do anything they know is illegal. They already hate dealing with criminals, but so long as paying is legal they might do it, but as soon as it affects their moral code they won't. The whole system collapses because just a few people saying no to paying means the kidnappers lose money on too many operations.
    - latexr 6mo ago
      I understand the mechanism and the point of making it illegal, that’s not the question. What I want to know is what exactly are the lawful repercussions for the person who paid.
  - jasonfarnon 6mo ago
    A fine or sentence is probably on the books but it never comes to that. The main thing is to freeze the family's assets, and more importantly to publicize this procedure so the mafia or whoever knows there's no point in threatening the family.
mlyle 6mo ago
There's one more piece that matters. If no one pays the ransoms, but people believe that large ransoms are paid-- you still have the crime.
- Ancapistani 6mo ago
  The obverse is true - because a ransom organization is dependent upon their reputation, a company claiming to have paid and received confirmation from the group could prevent them from releasing it as well. The general public (including the next victims) don't have a way to confirm if payment was made. ShinyHunters would have to choose between arguing publicly that they were not paid or not releasing the data to protect their own reputation...
  - mlyle 6mo ago
    Good/funny observation. Game theory and economics are fun. :D I do think that the partial information problem relating to new entrants into this market is interesting though. The number of potential threat actors with partial/no information but that might speculate based on grandiose visions of ransom or outdated history is high. We see dumb attempts at real-world ransoms/extortion which don't get paid at a pretty high clip based on this kind of partial knowledge.
    - HDBaseT 6mo ago
      It's an interesting idea, although I think in the heat of the moment, the last thing your org should be thinking of will be playing games with one of the most prolific hacker groups on the planet. You'll probably get your data leaked anyways, potentially get compromised again (see Instructure situation) and end up in a way worse place if you just shut up and paid it, or let it leak normally.
protocolture 6mo ago
>but everyone would be better off if no one paid a ransom. I doubt if everyone would be better off if state level actors found and used these vulnerabilities instead of ransom seekers.
ergocoder 6mo ago
Why don't someone pretend to be ransom hacker, take the money, and release the hacked data anyway? This will progress the game theory to the point where nobody will pay ransom because the thieves won't honor the deals anyway.

bombcar 6mo ago

If we assume a world where ransomware is continually existent and all your data is ransomed at anytime, we'd have a world designed to work around that. We'd either end up with a Discworld "Ransomware Guild" that you pay "insurance" to and they murdicate anyone who dares do extracurricular data ransoming, or you'd have systems build on end-to-end encryption where the data is worthless.

zbentley 6mo ago
I think you may have re-invented email reputation.

AlotOfReading 6mo ago

I'm not sure that attacker reputation is particularly meaningful. The group can rebrand into a new identity at any time. They're anonymous cybercriminals after all and there are lots of reasons they might need to do that beyond reputation laundering. The calculus for the victims doesn't seem to change much whether the same people are using a "new" name or an old one to hold their systems hostage.

onemoresoop 6mo ago
Yeah but fewer ransomes would be paid out regardless of who is attacking. They could be spoiling their own market and am sure they would
- AlotOfReading 6mo ago
  That's a motivation to avoid tragedy of the commons, not because they're trying to maintain their own reputation to victims. It benefits the criminals even if they change their name.
Freak_NL 6mo ago
The name ShinyHunters is currently quite well-known due to a number of high-profile hacks (Odido in the Netherlands this year was huge). Their brand has a significant value right now.
- jasonfarnon 6mo ago
  How does everyone know its ShinyHunters and not someone pretending? I imagine they have some mechanism to authenticate, I'm curious what it is.
  - HDBaseT 6mo ago
    Because ShinyHunters published they hacked Canvas on their own website. They also redirected the canvas login pages to a ShinyHunters message, whilst this could be done by another group/person, its unlikely. You can also validate PGP keys and TOX accounts, etc via their website.

esaym 6mo ago

> on the other hand, the ransomware groups that want to stay in business need to be honest I was thinking about that the other day. Honestly I'm not sure it matters. I feel like if a company didn't pay the ransom that would possibly open them up to lawsuits or something because they "tried nothing". At least paying it makes it look like they did something and could be some sort of legal defense. But again I'm not a lawyer.

patrickthebold 6mo ago

So, maybe we could consider a "White Hat" ransomware group that takes the money and also leaks the data, so that long term no one bothers to pay which ultimately disincentivizes ransomware attacks?

esseph 6mo ago
White hats that take money are not white hats, those are grey hats. https://en.wikipedia.org/wiki/Grey_hat https://en.wikipedia.org/wiki/Grey_hat

ashleyn 6mo ago

Another way to view this calculation: if you keep your infrastructure secure and up to date, you (very likely) don't have to pay any ransom in the first place.

joseda-hg 6mo ago
There is a line where the ransom price beats the capex of keeping a secure system, specially when the risk so nebulous Kind of like the recall math auto makers do to see if it's more expensive to actually recall a manufacturing problem, or just deal with it and compensate those who seek it personally

joseda-hg 6mo ago

What stops a ransomware group copying all data and just selling it piecemeal on the darknet under posibly a different name? Realistically, the only people that could check that it's true are buyers, and those benefit from keeping a low profile

arjie 6mo ago

An idea I idly thought about is that of a "Benevolent Terrorist"[0]: one who does great harm to some number of people so that they may make it to a better world. Not entirely original, I suppose, since the Kwisatz Haderach from Dune is the trope definer. But a fun thought I had was what if you ran a ransomware company that just didn't pay? You'd screw a lot of people over but eventually you'd make ransomware a non-business the better you impersonated them and failed to deliver after taking the ransom. What could go wrong? ;) 0: https://wiki.roshangeorge.dev/w/Benevolent_Terrorist#Poisoning_The_Well https://wiki.roshangeorge.dev/w/Benevolent_Terrorist#Poisoni...

barkingcat 6mo ago

one issue is that modern ransomeware groups are also being hunted themselves - there are many ransomeware orgs that are themselves being ransomed so are not reliable. even if you pay the ransom to the 1st group, the 2nd group will leak.

LastTrain 6mo ago

That operates on the idea that hacker organizations use long term strategic thinking, something the US government and a good number of corporations don’t even practice. I wouldn’t put my money on that.

john_strinlai 6mo ago
while i am not about to bet the farm on the long-term strategic thinking ability of extortion groups, they are much smaller than most corporations and the US government, thus its much easier to think strategically and execute on longer-term goals. shinyhunters, for example, has been active and acted as a cohesive unit for the past 7 years.

nradov 6mo ago

Paying a ransom should always be illegal with federal criminal charges for the employees who authorize the payment. If businesses are destroyed or people die as a consequence then those are acceptable casualties.