Negotiating ransoms: when to play and when to fold
zetter.substack.com
Negotiating ransoms: when to play and when to fold
1–10 of 35 posts
Re: Negotiating ransoms: when to play and when to fold
#2>Coveware has negotiated a “few thousand” ransomware cases since its founding in 2018, and each case is different, Siegel says.
Hmmm.
That would be a handful of negotiations per working day, or at least two/three per day 24/7.
Re: Negotiating ransoms: when to play and when to fold
#3Before it gets mentioned here is a good post why ransomware gangs love (traceable) Bitcoin. Most of ransomware gangs are more or less well known, not really anonymous.
http://jpkoning.blogspot.com/2021/06/why-do-ransomware-gangs...
Re: Negotiating ransoms: when to play and when to fold
#4I don't think I would ever pay ransom under any circumstances. Not for data or system functionality. I'd throw the computers in the river. I know this about myself because I had to deal with a kidnapping and extortion of my best friend in south america around 15 years ago.. and a few years later a ddos extortion attempt on one of my servers (the criminal was released from prison recently and I won a federal judgment against him for damages). Not a day goes by that I don't wish misery and sickness on those people. But something emerged in me during those crises that was not necessarily something I liked about myself in the long run. I wouldn't negotiate. I'm ashamed to admit I risked a friend's life by lying to the kidnappers. But I couldn't believe a word they were saying or even know if she was alive. I went cold and stopped cooperating. It was terrifying but I was in shock. I played poker with someone's life. It's something you don't really know about yourself or ever want to know until you're in the situation. I still have nightmares about it.
Re: Negotiating ransoms: when to play and when to fold
#5I don't think I would ever pay ransom under any circumstances. Not for data or system functionality. I'd throw the computers in the river. I know this about myself because I had to deal with a kidnapping and extortion of my best friend in south america around 15 years ago.. and a few years later a ddos extortion attempt on one of my servers (the criminal was released from prison recently and I won a federal judgment…
No such thing as "under any circumstances". The circumstances determine your decision, and what your priorities are.
Re: Negotiating ransoms: when to play and when to fold
#6I don't think I would ever pay ransom under any circumstances. Not for data or system functionality. I'd throw the computers in the river. I know this about myself because I had to deal with a kidnapping and extortion of my best friend in south america around 15 years ago.. and a few years later a ddos extortion attempt on one of my servers (the criminal was released from prison recently and I won a federal judgment…
No such thing as "under any circumstances". The circumstances determine your decision, and what your priorities are.
Right. True. But I mean I'm not sure if my decisions would be based on logical priorities. The first experience really primed me. Terrorized me. Made me want to kill people who do things like that. The second, the one that didn't involve a human life, brought down a transatlantic cable and cost mid six figures not including me working 72 hours straight trying to get into my own servers to migrate them. I not only refused to pay the ransom, which was around $2k, I didn't even disclose the ransom letter to the clients who were down until it was over. I got on the phone with the FBI and devoted a solid chunk of time over the next year to hunting down the attacker. That's not a good priority. It came from deep damage and unresolved anger about the earlier situation.
Re: Negotiating ransoms: when to play and when to fold
#7So many businesses don't do DR/BCP or security properly. 99% of businesses cannot survive losing data, so it's crazy to not have proven backups and automated infrastructure restoration.
It's like with cloud and microservices, most of the time backups, monitoring, and security aren't even considered.
Re: Negotiating ransoms: when to play and when to fold
#8> So you’re like, “Oh great. We have backups, the data is there, but the application to actually do the restoration is encrypted.”
From my experience dealing with ransomware, most encrypted applications are not recoverable, even with the key. Those app servers need to be rebuilt or restored. File servers and individual files can be decrypted using the key, but applications get scrambled.
Re: Negotiating ransoms: when to play and when to fold
#9[deleted]
Re: Negotiating ransoms: when to play and when to fold
#10I don't think I would ever pay ransom under any circumstances. Not for data or system functionality. I'd throw the computers in the river. I know this about myself because I had to deal with a kidnapping and extortion of my best friend in south america around 15 years ago.. and a few years later a ddos extortion attempt on one of my servers (the criminal was released from prison recently and I won a federal judgment…
[deleted]