FBI’s Advice on Ransomware? Just Pay the Ransom • Hacker News Board

Re: FBI’s Advice on Ransomware? Just Pay the Ransom

#31

Post by tobltobs » Sat, Oct 31, 2015, 2:57 PM UTC

icebraining wrote: post #17

pdkl95 wrote: post #6

And that is called paying the Dane-geld; But we've proved it again and again, That if once you have paid him the Dane-geld You never get rid of the Dane. http://www.poetryloverspage.com/poets/kipling/dane_geld.html Paying ransom merely teaches the criminal that you're an easy mark that they should demand more ransom from in the future.

But are the criminals in this case targeting specific individuals? You can't teach them you're a good target if they're just firing at random anyway.

As soon as you pay you will be a specific target for the future.

Re: FBI’s Advice on Ransomware? Just Pay the Ransom

#32

Post by vonklaus » Sat, Oct 31, 2015, 2:57 PM UTC

tptacek wrote: post #28

blisterpeanuts wrote: post #26

The FBI should always advise companies never to pay ransoms. It's the only way to stop it. The Bureau doesn't care if a company or individual loses data. They do care about crime, and the only logical way to stop a class of crime is to remove all financial incentive. Whoever is advising people to "just pay the ransom" is a fool.

No matter what the FBI says, ransomware is going to continue until vendors ship systems that are secure enough to prevent ransomware by default. Meanwhile, "don't pay the ransom" is not an honest answer to "what's the best thing for me to do now that I'm infected".

is it possible for vendors to ship a system like this that would also allow for users to encrypt their entire hard drives? Maybe it would be something like OS X firmware lockdown, but that is less convenient and takes away a lot of the options for the user.

Is this an either/or scenario?

Re: FBI’s Advice on Ransomware? Just Pay the Ransom

#33

Post by dogma1138 » Sat, Oct 31, 2015, 3:04 PM UTC

The sad part is that quite a few of the ransomware cases aren't actually recoverable, as the malware could be just dumb AES implementation which doesn't send the key to some C&C server some where, in some cases the key is hardcoded into the malware or is just generated at random so even if you pay the ransom you might not get your data back.

The other important thing to consider is that you data is already tainted so the cost of the ransom are meaningless compared to the cost of re-evaluating all the data once you manage to decrypt it, as well as the cost of the decryption it self it's not like you'll get an easy tool do it.

But considering that recovering data from backups also costs a small fortune it might be a reasonable gamble after all.

Re: FBI’s Advice on Ransomware? Just Pay the Ransom

#34

Post by mannykannot » Sat, Oct 31, 2015, 3:20 PM UTC

icebraining wrote: post #17

pdkl95 wrote: post #6

And that is called paying the Dane-geld; But we've proved it again and again, That if once you have paid him the Dane-geld You never get rid of the Dane. http://www.poetryloverspage.com/poets/kipling/dane_geld.html Paying ransom merely teaches the criminal that you're an easy mark that they should demand more ransom from in the future.

But are the criminals in this case targeting specific individuals? You can't teach them you're a good target if they're just firing at random anyway.

The 'you' in this case is all of us, collectively. Unfortunately, for the individual victim, paying is usually the best of a set of bad options, even though it is not the best one for us, collectively.

Re: FBI’s Advice on Ransomware? Just Pay the Ransom

#35

Post by dogma1138 » Sat, Oct 31, 2015, 3:23 PM UTC

icebraining wrote: post #17

pdkl95 wrote: post #6

And that is called paying the Dane-geld; But we've proved it again and again, That if once you have paid him the Dane-geld You never get rid of the Dane. http://www.poetryloverspage.com/poets/kipling/dane_geld.html Paying ransom merely teaches the criminal that you're an easy mark that they should demand more ransom from in the future.

But are the criminals in this case targeting specific individuals? You can't teach them you're a good target if they're just firing at random anyway.

Most ransomware cases aren't targeted they are opportunistic, ransomware spreads like normal malware rather than some targeted "APT" operation.

And while initially ransomware operators quite "solid" and for lack of a better word "trustworthy" the popularization of it lead to everyone and their mother writing ransomware in hopes to get a quick buck.

In those cases you can't even rely on the encryption being recoverable because the malware it self is utter garbage and the criminals don't care or don't even have the technical skills to operate a full ransom cycle campaign.

It's not uncommon to see even fairly fresh ransomware examples in the wild with dead BC wallet addresses, banned paypal, skrill (and other transaction providers accounts), incorrect routing numbers etc.

This ins't 5-10 years ago where some ransomware would actually give you a voip phone-number/skype/email to call or mail and you would get to speak to some Russian or Malaysian guy give them the money and actually get a key to recover your data.

Sure some ransomware operators still operate that way, some have more sophisticated automated systems with C&C servers but most figured it out that it doesn't matter because they are in it for the quick buck and well if you are going to commit a crime then what not fraud/scam your target in the same swoop.

Ironically this reality lead to the more established organized crime organizations that employ ransomware to generate income to actively fight against the new waves of quick cash ransom scams because they need people to still have some trust in the fact that they can get their data back if they pay.

Re: FBI’s Advice on Ransomware? Just Pay the Ransom

#36

Post by jhayward » Sat, Oct 31, 2015, 3:39 PM UTC

devit wrote: post #3

Looks like free enterprise has introduced a tax on people who fail to secure their systems against untargeted attacks and fail to make backups. One also wonders what's the point of all NSA's "SIGINT" efforts if they can't or won't use it to catch such usually foreign actors, so maybe they also introduced an argument against mass surveillance.

I believe free enterprise requires that all parties to a transaction be free to participate, or decline, according to their own judgement and resources. Clearly absconding with and holding another's property for ransom is not free enterprise.

I hesitate to say something so pedantic, but with the number of people who attribute crazy properties to the concept of "free markets", etc. I think we should just be clear on this one.

Re: FBI’s Advice on Ransomware? Just Pay the Ransom

#37

Post by michaelt » Sat, Oct 31, 2015, 3:42 PM UTC

purpled_haze wrote: post #23

pdkl95 wrote: post #11

Earlier quoted context omitted.

The NSA isn't interested in defensive work these days. As Dan Geer explained[1]: I suggest that the cybersecurity tool-set favors offense these days. Chris Inglis, recently retired NSA Deputy Director, remarked that if we were to score cyber the way we score soccer, the tally would be 462-456 twenty minutes into the game, i.e., all offense. I will take his comment as confirming at the highest level not only the dual…

> The NSA isn't interested in defensive work these days. Hasn't "a great offense is always the best defense" always been the name of the game? We've gone from fists, to stick and rocks, to spears, to swords, to Greek Fire, to gunpowder, to nuclear weapons. Why not now be the ones to own the power to take down any computer or network? Great efforts in defense aren't necessarily successful or rewarded either, e.g. Reag…

  Hasn't "a great offense is always the best defense"
  always been the name of the game?

An air offence against an airfield can put a billion dollars worth of planes out of operation permanently.

There's no cyberattack equivalent of that - it's not like bricking a few $1000 PCs would disable foreign cyberattack capabilities.

Re: FBI’s Advice on Ransomware? Just Pay the Ransom

#38

Post by monochromatic » Sat, Oct 31, 2015, 3:42 PM UTC

pdkl95 wrote: post #6

And that is called paying the Dane-geld; But we've proved it again and again, That if once you have paid him the Dane-geld You never get rid of the Dane. http://www.poetryloverspage.com/poets/kipling/dane_geld.html Paying ransom merely teaches the criminal that you're an easy mark that they should demand more ransom from in the future.

Not really relevant where (1) they're generally not targeting specific individuals, and (2) once you pay the ransom one time, you can mitigate your future risk with backups and other measures.

Re: FBI’s Advice on Ransomware? Just Pay the Ransom

#39

Post by hwstar » Sat, Oct 31, 2015, 3:46 PM UTC

benevol wrote: post #4

devit wrote: post #3

Looks like free enterprise has introduced a tax on people who fail to secure their systems against untargeted attacks and fail to make backups. One also wonders what's the point of all NSA's "SIGINT" efforts if they can't or won't use it to catch such usually foreign actors, so maybe they also introduced an argument against mass surveillance.

Just like the Brits could have used the cracked Enigma code to stop each and every German operation during the War, they refrained from doing so and used it only for very specific situations (in order to avoid their cover being blown). Expect the same behavior from the NSA. They will use their power first and foremost whenever it benefits themselves, not to protect all citizens or corporations.

American government agencies put one thing above all else: Self preservation. If a duty to society involves risk which could make them be seen in a bad light, they will avoid it, or try to state it isn't their problem.

Re: FBI’s Advice on Ransomware? Just Pay the Ransom

#40

Post by iamsohungry » Sat, Oct 31, 2015, 3:47 PM UTC

pdkl95 wrote: post #6

And that is called paying the Dane-geld; But we've proved it again and again, That if once you have paid him the Dane-geld You never get rid of the Dane. http://www.poetryloverspage.com/poets/kipling/dane_geld.html Paying ransom merely teaches the criminal that you're an easy mark that they should demand more ransom from in the future.

That's true from a societal perspective, but from the perspective of the victim of ransomware, "just pay the ransom" is even worse advice. Once you have paid the ransom, what incentive does the hacker have to fulfill their end of the bargain? If, for example, a hacker encrypts your hard drive and demands bitcoins as payment, paying the hacker means you're likely out a few bitcoins AND your hard drive is still encrypted.