Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Royal Mail dismisses ‘absurd’ $80M ransom demand

theguardian.com

Post reply on HN
Print view View original

61–70 of 108 posts

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#61

Post by windthrown »

sefrost wrote: post #55
hyperman1 wrote: post #24

Earlier quoted context omitted.

As I understand it, it is indeed illegal in most countries. What happens in practice is the victim hires a 'data recovery specialist' company, provides them the encrypted files, and ask them to decrypt them with their magic algorithms. The data recovery specialist coincidentally is paid a little bit more than the ransom. The specialist then contacts the hackers, pays the ransom, decrypts the files, and provides them…

Any sources on that?

Certainly not 100% of cases but very common:

"As ransomware attacks crippled businesses and law enforcement agencies, two U.S. data recovery firms claimed to offer an ethical way out. Instead, they typically paid the ransom and charged victims extra."

https://features.propublica.org/ransomware/ransomware-attack...

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#62

Post by tshaddox »

bluGill wrote: post #29
bena wrote: post #23

Earlier quoted context omitted.

Should we also make it illegal to get mugged? Make it a crime to be murdered? Making the payment of ransom illegal just means you never hear about ransoms again.

In general you are allowed to do something illegal if your life is in danger. That is if I'm kidnapped I'm allowed to pay what is otherwise a bribe to go free. So we should make getting mugged illegal, so long as the law is clear that the illegal part only applies if you have a reasonable way to get away from the mugging without paying. I'm not sure how you can be mugged and yet have a reasonable way to get away with…

> I'm not sure how you can be mugged and yet have a reasonable way to get away without paying, I leave that question to the reader.

What if you're skilled in hand to hand combat? Or what if you're familiar enough with firearms to notice the mugger's weapon looks fake? Would you then be legally required to attempt to fight back? Would a judge need to estimate your probability of dying, and if it was under some threshold you would be punished for not attempting to fight?

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#63

Post by californical »

tshaddox wrote: post #53
ukoki wrote: post #11

How is it even legal to pay ransoms? Surely this is transferring money to criminal enterprises. If it is not illegal it needs to be made illegal.

That's weird. It's like saying it should be illegal to give your wallet to a mugger.

It’s more like the mugger already has your wallet, but says they’ll give it back if you make a $1000 donation to their criminal organization, going around normal law enforcement.

I’d guess that’s also illegal, but IANAL.

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#64

Post by hyperman1 »

sefrost wrote: post #55
hyperman1 wrote: post #24

Earlier quoted context omitted.

As I understand it, it is indeed illegal in most countries. What happens in practice is the victim hires a 'data recovery specialist' company, provides them the encrypted files, and ask them to decrypt them with their magic algorithms. The data recovery specialist coincidentally is paid a little bit more than the ransom. The specialist then contacts the hackers, pays the ransom, decrypts the files, and provides them…

Any sources on that?

Always a good question. A group of security people with experience in the scenario was trading about it on a conference a while ago. I far from knew everyone in the group.

Always a risky answer, of course, especially from some random person on HN. But in this case, it makes sense, and a 'long arm', international treatment is a general solution for powerfull entities needing to break a law.

I don't think you'll find anyone going officially on record as breaking the law, however. Most companies won't even let it leak they're a victim.

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#66

Post by fleddr »

908B64B197 wrote: post #60
ukoki wrote: post #11

How is it even legal to pay ransoms? Surely this is transferring money to criminal enterprises. If it is not illegal it needs to be made illegal.

It's also orders of magnitude cheaper to just restore from backup. I can't imagine their S3 bill is above 80 millions...

That's not how ransomware works. They typically wait 3-6 months before making the demand, your backups will contain the infected files.

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#67

Post by charlieyu1 »

windthrown wrote: post #61
sefrost wrote: post #55

Earlier quoted context omitted.

Any sources on that?

Certainly not 100% of cases but very common: "As ransomware attacks crippled businesses and law enforcement agencies, two U.S. data recovery firms claimed to offer an ethical way out. Instead, they typically paid the ransom and charged victims extra." https://features.propublica.org/ransomware/ransomware-attack...

What if ransom is paid but the attackers do not fulfill their end?

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#68

Post by JTbane »

clnq wrote: post #44

Why is ransomware still a problem? Is it that difficult to make off-site backups every hour? Storage is cheap. There are many air gapping options for backups, too. It sounds like a case of normalized deviance, for which the management should be held accountable. As much as I don’t like victim blaming, I think it’s beyond incompetent to still not backup your data in 2023 as a government org.

>Is it that difficult to make off-site backups every hour? Storage is cheap. There are many air gapping options for backups, too.

I'd imagine that often your backups get encrypted as well, early enough that the data loss to the last good backup becomes unacceptable.

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#69

Post by yesco »

tshaddox wrote: post #62
bluGill wrote: post #29

Earlier quoted context omitted.

In general you are allowed to do something illegal if your life is in danger. That is if I'm kidnapped I'm allowed to pay what is otherwise a bribe to go free. So we should make getting mugged illegal, so long as the law is clear that the illegal part only applies if you have a reasonable way to get away from the mugging without paying. I'm not sure how you can be mugged and yet have a reasonable way to get away with…

> I'm not sure how you can be mugged and yet have a reasonable way to get away without paying, I leave that question to the reader. What if you're skilled in hand to hand combat? Or what if you're familiar enough with firearms to notice the mugger's weapon looks fake? Would you then be legally required to attempt to fight back? Would a judge need to estimate your probability of dying, and if it was under some thresho…

While ridiculous, I bet it would probably result in less muggings...

Re: Royal Mail dismisses ‘absurd’ $80M ransom demand

#70

Post by bee_rider »

charlieyu1 wrote: post #67
windthrown wrote: post #61

Earlier quoted context omitted.

Certainly not 100% of cases but very common: "As ransomware attacks crippled businesses and law enforcement agencies, two U.S. data recovery firms claimed to offer an ethical way out. Instead, they typically paid the ransom and charged victims extra." https://features.propublica.org/ransomware/ransomware-attack...

What if ransom is paid but the attackers do not fulfill their end?

This is possible of course, but it would reduce the willingness of people to pay bribes generally. Also I guess it might cause the victims to take more desperate measures, possibly get more attention by law enforcement somehow.
Post reply on HN