3 ms·

The damage would be a lot worse than $500.

by joopxiv 12y ago

toxicFork 12y ago
Sure but do you really expect them to actually decrypt the files and then walk away? If they do I think they would be more honourable than some non-criminals!
- MichaelGG 12y ago
  Uh, yes? Because if they behave well, then word spreads and people know they can trust the ransom. If they kill the hostage each time, then no one pays. It's not like they make more money if they defect. Yeah, they could try to ransom again, but a: the success rate might be lower since right after ransom people are likely to have made a backup and b: word spreads that paying just results in more extortion, leading to less payments.
  - toxicFork 12y ago
    That's a good point.
- thaumaturgy 12y ago
  Yes, CryptoLocker does actually decrypt your files if you pay the ransom. At first, there was an expiration date; you had 10 days or something like that to pay the ransom, and then your files were gone forever. More recently, it changed so that you can pay a ransom at any time to retrieve your files, but the ransom goes up after the initial 10 day period (or whatever it is now). The developers are savvy business people and CryptoLocker is very well done.
  - deleted 12y ago
    [deleted]
    - thaumaturgy 12y ago
      I think we'll have to agree to disagree. I follow the "respect your enemy" school of thought, and I dislike the kind of us-vs-them hyperbole that passes for political debate these days. It should be clear from my comments that I'm opposed to CryptoLocker. You'd have to assume the worst of me to imagine that I'm encouraging it at all. But it's factually correct to say that CryptoLocker is well-written and well-executed and is making good money, and that's exactly the argument I use to convince people that they need to have backups.
      - deleted 12y ago
        [deleted]
        maxerickson 12y ago
        People writing aggressive malware aren't tipping back and forth based on the language they see in message board comments. Their default state is no shits given. Imagine them having an interview where they say they were going to give it all up, but then they saw that one guy remark that their software was effective at doing what it does, and they were so chuffed that they went on to scam thousands and thousands dollars more out of people. It's preposterous.
        thaumaturgy 12y ago
        > It's simple thuggery No, it's not, and this is where your approach and mine differ. You're trying to speak as though your audience is "people who might be encouraged to write something like this"; I'm speaking as though my audience is "potential victims who might underestimate the danger of CryptoLocker". People, especially technically savvy people, constantly overestimate their ability to avoid problems like this. Every time there's a popular thread about malware on Reddit, there will be popular comments along the lines of, "I don't know how other peasants get infected with stuff like this, all you have to do is (not click on the wrong things online || run my favorite software || use an ad-blocker || use Linux || use MacOS || only browse the web on Wednesdays)". That is the kind of mindset I have to regularly defeat in order to get people to take sensible precautions, like having backups, and CryptoLocker is the one piece of malware out there that I can effectively use against that mindset, because I can point to my highly technical business customers (with current enterprise-class AV and ad blockers and Chrome/Firefox and and and...) that have been hit by it, I can point to news articles like this one about governmental agencies paying the ransom after being hit by it, I can use it to scare a few over-confident people into doing the thing they should have done all along to utterly defeat CryptoLocker: get a good backup system. Frankly, the best thing that could happen, in the long run, would be for half a dozen people on HN to go, "Oh, that thaumaturgy, he thinks CryptoLocker is cool, now I'll write a clone of it too," because, after the initial horror and pain of data loss and suffering that many people would be subjected to, suddenly backup software would be one of the most popular projects in the computer industry, instead of being the totally unsexy project that nobody really wants to bother working on, and my job would go from, "let me spend 2 hours trying to convince you to listen to reason and spend money on a mediocre backup system" to "here's the really great all-in-one backup system that you already know you need, call me if you need anything else". Your approach doesn't convince anyone that CryptoLocker is a threat they should take seriously. My approach is consciously intended to protect people from their own bad judgement.
  - maxerickson 12y ago
    I wonder if logicallee deleted all their comments in this story as a not very good way to admit that they were wrong, as a way to stop getting negative internet points, or for some other reason? What a frustrating way to interact.

The damage would be a lot worse than $500.

by joopxiv 12y ago

The damage would be a lot worse than $500.

Sure but do you really expect them to actually decrypt the files and then walk away? If they do I think they would be more honourable than some non-criminals!

MichaelGG 12y ago
Uh, yes? Because if they behave well, then word spreads and people know they can trust the ransom. If they kill the hostage each time, then no one pays. It's not like they make more money if they defect. Yeah, they could try to ransom again, but a: the success rate might be lower since right after ransom people are likely to have made a backup and b: word spreads that paying just results in more extortion, leading to less payments.
- toxicFork 12y ago
  That's a good point.
thaumaturgy 12y ago
Yes, CryptoLocker does actually decrypt your files if you pay the ransom. At first, there was an expiration date; you had 10 days or something like that to pay the ransom, and then your files were gone forever. More recently, it changed so that you can pay a ransom at any time to retrieve your files, but the ransom goes up after the initial 10 day period (or whatever it is now). The developers are savvy business people and CryptoLocker is very well done.
- deleted 12y ago
  [deleted]
  - thaumaturgy 12y ago
    I think we'll have to agree to disagree. I follow the "respect your enemy" school of thought, and I dislike the kind of us-vs-them hyperbole that passes for political debate these days. It should be clear from my comments that I'm opposed to CryptoLocker. You'd have to assume the worst of me to imagine that I'm encouraging it at all. But it's factually correct to say that CryptoLocker is well-written and well-executed and is making good money, and that's exactly the argument I use to convince people that they need to have backups.
    - deleted 12y ago
      [deleted]
      - maxerickson 12y ago
        People writing aggressive malware aren't tipping back and forth based on the language they see in message board comments. Their default state is no shits given. Imagine them having an interview where they say they were going to give it all up, but then they saw that one guy remark that their software was effective at doing what it does, and they were so chuffed that they went on to scam thousands and thousands dollars more out of people. It's preposterous.
      - thaumaturgy 12y ago
        > It's simple thuggery No, it's not, and this is where your approach and mine differ. You're trying to speak as though your audience is "people who might be encouraged to write something like this"; I'm speaking as though my audience is "potential victims who might underestimate the danger of CryptoLocker". People, especially technically savvy people, constantly overestimate their ability to avoid problems like this. Every time there's a popular thread about malware on Reddit, there will be popular comments along the lines of, "I don't know how other peasants get infected with stuff like this, all you have to do is (not click on the wrong things online || run my favorite software || use an ad-blocker || use Linux || use MacOS || only browse the web on Wednesdays)". That is the kind of mindset I have to regularly defeat in order to get people to take sensible precautions, like having backups, and CryptoLocker is the one piece of malware out there that I can effectively use against that mindset, because I can point to my highly technical business customers (with current enterprise-class AV and ad blockers and Chrome/Firefox and and and...) that have been hit by it, I can point to news articles like this one about governmental agencies paying the ransom after being hit by it, I can use it to scare a few over-confident people into doing the thing they should have done all along to utterly defeat CryptoLocker: get a good backup system. Frankly, the best thing that could happen, in the long run, would be for half a dozen people on HN to go, "Oh, that thaumaturgy, he thinks CryptoLocker is cool, now I'll write a clone of it too," because, after the initial horror and pain of data loss and suffering that many people would be subjected to, suddenly backup software would be one of the most popular projects in the computer industry, instead of being the totally unsexy project that nobody really wants to bother working on, and my job would go from, "let me spend 2 hours trying to convince you to listen to reason and spend money on a mediocre backup system" to "here's the really great all-in-one backup system that you already know you need, call me if you need anything else". Your approach doesn't convince anyone that CryptoLocker is a threat they should take seriously. My approach is consciously intended to protect people from their own bad judgement.
- maxerickson 12y ago
  I wonder if logicallee deleted all their comments in this story as a not very good way to admit that they were wrong, as a way to stop getting negative internet points, or for some other reason? What a frustrating way to interact.