The No More Ransom Project • Hacker News Board

Re: The No More Ransom Project

#91

Post by notgood » Sun, Oct 30, 2016, 10:42 PM UTC

pmoriarty wrote: post #86

CalChris wrote: post #31

So this is what a ransom note looks like: https://d1b10bmlvqabco.cloudfront.net/attach/is23h8nx8ff3jw/... Short, blunt, helpful, clear. Pretty much what you'd like every memo you've ever gotten to be. Me, I'm a huge fan of ransom notes and Nigerian scam emails. We can learn a lot from them. I'm pretty sure that when you get one of these that you're dealing with a script. You pay .65880 BTC into its wallet, period. Th…

"If it gets out that you paid and you didn't get unlocked then no one would pay." Sounds like an easy way to get rid of ransomware. Just spread rumors that you didn't get your files back even though you paid. Somehow I have a feeling that wouldn't work, though. Many people would still pay.

Another way then: create a script that sends hundreds of emails to the victim from different addresses (wallets) and different amounts; the victim cannot identify which email is from the actual scammer, therefore he will pay none and the scam chances of success would reduce, and with it -eventually- the number of scammers.

Re: The No More Ransom Project

#92

Post by TeMPOraL » Sun, Oct 30, 2016, 10:43 PM UTC

dwaltrip wrote: post #56

the_duke wrote: post #24

Earlier quoted context omitted.

That's just hilariously twisted.

It's such a perfect example of how human systems are molded by underlying incentives. Of course, the incentives themselves arise within immense cultural and technological contexts. Hopefully one day we see further past the dense fog of complexity. Assuming we aren't adding to it at a faster rate...

> Of course, the incentives themselves arise within immense cultural and technological contexts.

To twist it even further, note that the shifts of culture and technology are directed by aggregated incentives of people. What a nice and strong feedback loop there. Only shows how little control societies have over where they're going.

Re: The No More Ransom Project

#93

Post by pooper » Sun, Oct 30, 2016, 10:43 PM UTC

notahacker wrote: post #71

hrehhf wrote: post #23

Earlier quoted context omitted.

In a twisted sort of way, a person could destroy trust that paying the ransom will actually get your data back. Someone could create ransomware that will never decrypt, even after the ransom is paid. Once the victims know the dishonest ransomware is out there, that may ruin the revenue towards the "honest" ransomware.

Or we could be slightly less nefarious and create ransomware that decrypts everyone's stuff after the allotted time but leaves a congratulatory "thank you for not cooperating with criminals" message to the people that didn't pay...

> Or we could be slightly less nefarious and create ransomware that decrypts everyone's stuff after the allotted time but leaves a congratulatory "thank you for not cooperating with criminals" message to the people that didn't pay...

Please don't do this. People (some would call them victims of cyber crime but not me) are EVIL and if they can trace it back to you, they will sue you. Doing this is not a good idea except as a thought experiment.

It is probably obvious to a lot of people but there are still good people out there who believe in the goodness of people so I thought I should spell it out.

Re: The No More Ransom Project

#94

Post by mioelnir » Sun, Oct 30, 2016, 10:43 PM UTC

hannob wrote: post #17

toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

> For your particular case it could be the best solution to just pay - as even police departments have done before. It could be the best solution for you to pay - if you don't care that you'll finance the attacks on other people and cause more harm overall. So yes, from a purely egoistic perspective it makes sense. The question you should ask is not "is it worth paying xxx for my data?", it's "is it worth paying xxx…

One option gives an immediate, personally beneficial effect - "you get your files back".

The other option gives you an immediate, personal loss - "your files are gone" - together with an all but unobservable, mid- to longterm benefit for society.

You can of course hope for the majority to take the second option, but hope is the first step on the path to disappointment.

Re: The No More Ransom Project

#95

Post by lucb1e » Sun, Oct 30, 2016, 10:44 PM UTC

tgb wrote: post #53

ktRolster wrote: post #51

Earlier quoted context omitted.

If enough people do that, then attackers will start attacking dropbox, as well.

Hence my question. They'll ransom my Dropbox but Dropbox keeps deleted files and old versions around, so I'd be safe unless they specifically target Dropbox and Dropbox can't mitigate it.

Last time I used Dropbox, you can always get deleted versions back. They might make it difficult though, spamming the log with a gazillion created/deleted files. And maybe there is actually a limitation of, say, 10 deleted versions of the same file path (that might make sense)... but I don't remember seeing any of those limitations last time I looked at it (which was a few years ago).

But if you are a concerned customer, why don't you just head over to their help pages and see what the features and limits regarding history and file deletion are?

Re: The No More Ransom Project

#96

Post by r3bl » Sun, Oct 30, 2016, 10:44 PM UTC

happy-go-lucky wrote: post #40

My mini Ask HN: Do you trust makers of security software?

I do love to read their analyses on APTs and things like that, but other than that, no. There's not a single security software vendor that I trust.

Re: The No More Ransom Project

#97

Post by TeMPOraL » Sun, Oct 30, 2016, 10:45 PM UTC

JoeAltmaier wrote: post #55

happy-go-lucky wrote: post #54

Earlier quoted context omitted.

In that case, the victims could refuse to pay ransom and the criminals will go out of business.

But a virus has zero marginal cost. Even one guy paying and they make money.

They have to weigh in the risk of getting caught, especially if they piss off enough people. So one paying victim may not be enough for a criminal to go this route.

Re: The No More Ransom Project

#98

Post by mioelnir » Sun, Oct 30, 2016, 10:46 PM UTC

tgb wrote: post #53

ktRolster wrote: post #51

Earlier quoted context omitted.

If enough people do that, then attackers will start attacking dropbox, as well.

Hence my question. They'll ransom my Dropbox but Dropbox keeps deleted files and old versions around, so I'd be safe unless they specifically target Dropbox and Dropbox can't mitigate it.

I think there was at least one type out there that detected dropbox, encrypted those as well and deleted shadow copies.

Re: The No More Ransom Project

#99

Post by notgood » Sun, Oct 30, 2016, 10:47 PM UTC

pdkl95 wrote: post #65

toennisforst wrote: post #6

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you dec…

> What bothers me about their advice is that it is only correct macroeconomically. That's because it's the correct advice. Ransom is a very old business, and experience throughout history shows you should never pay the danegeld[1] . > ignores that it is in cybercriminals' best interest to let you decrypt after you paid That isn't being ignored. Paying the ransom is short-term thinking. Of course they will let you dec…

Not only that, they know people close to you are potential targets as well (e.g. your mail contacts, facebook contacts), because most likely than not they are in the same economical bracket and are just as "savvy" technologically speaking.

Re: The No More Ransom Project

#100

Post by TeMPOraL » Sun, Oct 30, 2016, 10:48 PM UTC

nodesocket wrote: post #68

This is a Windows phenomenon only right? I'd just restore from Time Machine and go along on my way.

It's primarily a Windows thing, but it only happens because Windows is the most popular desktop OS. Mac users sound like a pretty good target though, so I'd expect to see more MacOS-targeted malware in the future.