Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

cyberscoop.com

Post reply on HN
Print view View original

11–20 of 105 posts

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#11

Post by hawk_ »

jve wrote: post #7
waihtis wrote: post #5

This is the right course of action. Always think about how your actions incentivize future behaviour. The only right course of action is to halt the flow of revenue to the attackers in order to disincentivize future attacks. This will not solve the problem of ransomware alone, but is a step in the right direction.

Put yourself in the shoes of business. Well, like the oil company now in USA. Lets say you haven't learn the lesson of backup importance. Your business has stopped. Your ONLY way to recover and restore revenue stream is to get the data. You are aware that paying ransom may or may NOT work. Now, what do you do? The suggestions (cut the attackers revenue stream) may sound very right, correct and whatnot. But think of t…

Businesses can't expect claims for theft insurance to be honored if they didn't take reasonable measures (install security cameras, alarms etc... and lock the valuables). How is this different?

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#12

Post by mjevans »

jve wrote: post #7
waihtis wrote: post #5

This is the right course of action. Always think about how your actions incentivize future behaviour. The only right course of action is to halt the flow of revenue to the attackers in order to disincentivize future attacks. This will not solve the problem of ransomware alone, but is a step in the right direction.

Put yourself in the shoes of business. Well, like the oil company now in USA. Lets say you haven't learn the lesson of backup importance. Your business has stopped. Your ONLY way to recover and restore revenue stream is to get the data. You are aware that paying ransom may or may NOT work. Now, what do you do? The suggestions (cut the attackers revenue stream) may sound very right, correct and whatnot. But think of t…

You can't trust a compromised system. It has to be purged and rebuilt from the ground up. I really miss the days of write-enable jumpers for BIOSes...

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#13

Post by waihtis »

jve wrote: post #7
waihtis wrote: post #5

This is the right course of action. Always think about how your actions incentivize future behaviour. The only right course of action is to halt the flow of revenue to the attackers in order to disincentivize future attacks. This will not solve the problem of ransomware alone, but is a step in the right direction.

Put yourself in the shoes of business. Well, like the oil company now in USA. Lets say you haven't learn the lesson of backup importance. Your business has stopped. Your ONLY way to recover and restore revenue stream is to get the data. You are aware that paying ransom may or may NOT work. Now, what do you do? The suggestions (cut the attackers revenue stream) may sound very right, correct and whatnot. But think of t…

You can still pay the ransom, the insurer will just not reimburse it.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#14

Post by drunkenmagician »

Call me cynical, but anytime an insurance company decides its in everyone's 'best interest', and by everyone I mean the policy holders, I cannot help but translate to mean - 'Its costing us more money that we expected, so we don't want to cover this'

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#15

Post by paxys »

drunkenmagician wrote: post #14

Call me cynical, but anytime an insurance company decides its in everyone's 'best interest', and by everyone I mean the policy holders, I cannot help but translate to mean - 'Its costing us more money that we expected, so we don't want to cover this'

Well insurance companies account for this by raising premiums. In fact it sounds counterintuitive but something which happens often is more profitable for insurance companies because otherwise few people bother to take out policies for it.

In this specific case, I imagine the reason for the announcement wasn't moral or financial – the company likely decided it did not want the legal liability of potentially funding international terrorism.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#16

Post by deanclatworthy »

waihtis wrote: post #5

This is the right course of action. Always think about how your actions incentivize future behaviour. The only right course of action is to halt the flow of revenue to the attackers in order to disincentivize future attacks. This will not solve the problem of ransomware alone, but is a step in the right direction.

I don't think this will set any precedent. Unlike a standard kidnapping and ransom, where there is a huge amount at stake for the kidnapper - there is little consequence for ransomware authors and those who hold businesses hostage. They do it from the other side of the world, anonymously (assuming good opsec) and if someone doesn't pay up, they just move on.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#17

Post by hrktb »

waihtis wrote: post #5

This is the right course of action. Always think about how your actions incentivize future behaviour. The only right course of action is to halt the flow of revenue to the attackers in order to disincentivize future attacks. This will not solve the problem of ransomware alone, but is a step in the right direction.

I wish they were this well intended, or even that it’s actually what’s happening behind the scenes.

More often than not “don’t negociate with terrorists” [0] facades are just a message sent to the world, only enforced when the stakes are low enough and the ‘terrorist’ party has nothing actually valuable.

[0] https://en.wikipedia.org/wiki/Government_negotiation_with_te...

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#18

Post by viraptor »

jve wrote: post #7
waihtis wrote: post #5

This is the right course of action. Always think about how your actions incentivize future behaviour. The only right course of action is to halt the flow of revenue to the attackers in order to disincentivize future attacks. This will not solve the problem of ransomware alone, but is a step in the right direction.

Put yourself in the shoes of business. Well, like the oil company now in USA. Lets say you haven't learn the lesson of backup importance. Your business has stopped. Your ONLY way to recover and restore revenue stream is to get the data. You are aware that paying ransom may or may NOT work. Now, what do you do? The suggestions (cut the attackers revenue stream) may sound very right, correct and whatnot. But think of t…

> You are aware that paying ransom may or may NOT work.

The ransomware campaigns are pretty good on support. You will get a key for a sample of your data as a proof. You can sometimes pay progressively to get more trust. Getting your data back is just as important for the criminals as encrypting it in the first place - otherwise their business goes down.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#19

Post by oefrha »

gruez wrote: post #3

>A spokesperson for AXA XL [...] said the announcement doesn’t apply [...] to ransomware-related incident cleanup costs. So rather than paying the ransom, they'll hire a "ransomware cleanup" consultancy which cleans up the ransomware by paying the ransom (under the table and with plausible deniability, of course).

I read that certain ransomware distributors have been found to operate their own cleanup/“negotiation” service. Can’t be bothered to find a reference now, but this type of behavior is perfectly logical, and has been going on since forever in many traditional shady enterprises.

Re: Experts suggest AXA’s plan to shun ransomware payouts will set a precedent

#20

Post by waihtis »

hrktb wrote: post #17
waihtis wrote: post #5

This is the right course of action. Always think about how your actions incentivize future behaviour. The only right course of action is to halt the flow of revenue to the attackers in order to disincentivize future attacks. This will not solve the problem of ransomware alone, but is a step in the right direction.

I wish they were this well intended, or even that it’s actually what’s happening behind the scenes. More often than not “don’t negociate with terrorists” [0] facades are just a message sent to the world, only enforced when the stakes are low enough and the ‘terrorist’ party has nothing actually valuable. [0] https://en.wikipedia.org/wiki/Government_negotiation_with_te...

We place too much value on intention, when focus should be on the outcome
Post reply on HN