7 ms·

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bot

> When [you are infected with ransomware], you can’t get to the data unless you pay a ransom. However this is not guaranteed and you should never pay! What bothers me about their advice is that it is only correct macroeconomically. For your particular case it could be the best solution to just pay - as even police departments have done before. It also ignores that it is in cybercriminals' best interest to let you decrypt after you paid: They need their victims to trust them, and they have nothing to gain from keeping the files encrypted after payment.

user5994461 10y ago
I think the fear is that they would ask for more money and/or they'd repeat the ransom again later.
- GirlsCanCode 10y ago
  For people who are affected by ransom ware it also means something else--they had no off-line backup solution. So they'd be in the same situation if their disk drive were to have failed!
Taek 10y ago
It's been pointed out in the past that most ransomware services have better customer support than paid services. That's because they stand to gain $XXX from each successful interaction and they stand to lose substantially more if they have a reputation of not returning the data.
- the_duke 10y ago
  That's just hilariously twisted.
  - dwaltrip 10y ago
    It's such a perfect example of how human systems are molded by underlying incentives. Of course, the incentives themselves arise within immense cultural and technological contexts. Hopefully one day we see further past the dense fog of complexity. Assuming we aren't adding to it at a faster rate...
    - TeMPOraL 10y ago
      > Of course, the incentives themselves arise within immense cultural and technological contexts. To twist it even further, note that the shifts of culture and technology are directed by aggregated incentives of people. What a nice and strong feedback loop there. Only shows how little control societies have over where they're going.
- monochromatic 10y ago
  The market works!
  - muyuu 10y ago
    The invisible hand.
hannob 10y ago
> For your particular case it could be the best solution to just pay - as even police departments have done before. It could be the best solution for you to pay - if you don't care that you'll finance the attacks on other people and cause more harm overall. So yes, from a purely egoistic perspective it makes sense. The question you should ask is not "is it worth paying xxx for my data?", it's "is it worth paying xxx for my data and destroy the data of someone else?".
- ewzimm 10y ago
  But your individual case isn't going to affect their behavior. If you wanted to change the situation, not paying simply isn't going far enough. You'd need to coordinate with other potential victims or do something like this website and spread defenses. Without putting effort into organization, your thinking that you've helped others is pure egoism because these schemes only require a few people to pay to be profitable.
  - wpietri 10y ago
    > But your individual case isn't going to affect their behavior. It isn't going to affect them much. But as anybody who runs a business knows, the difference between loss and profit generally hinges on a number of sensitive factors. Note, for example, that drug dealing pays so poorly that many drug dealers live with their moms: http://articles.latimes.com/2005/apr/24/opinion/oe-dubner24 http://articles.latimes.com/2005/apr/24/opinion/oe-dubner24 Refusing to pay on your own doesn't help other people much, but it still helps.
  - TeMPOraL 10y ago
    Welcome to the real world. It's twisted in exactly this, game-theoretical way. In case of ransomware, criminals are exploiting the very difficulty of victims to coordinate their actions. They depend on you paying instead of solving it yourself, educating others, or even simply calling the police. In other words, they profit directly off people's short-term, selfish thinking. The advice of defaulting to not paying is sound because if enough people follow it, the whole ransom stops being viable, which makes ransomware attacks stop coming. The same, by the way, is the tried and true way of dealing with regular, meatspace, "I kidnapped your daughter" ransom cases.
hrehhf 10y ago
In a twisted sort of way, a person could destroy trust that paying the ransom will actually get your data back. Someone could create ransomware that will never decrypt, even after the ransom is paid. Once the victims know the dishonest ransomware is out there, that may ruin the revenue towards the "honest" ransomware.
- martey 10y ago
  > Someone could create ransomware that will never decrypt, even after the ransom is paid. This already exists: http://arstechnica.com/security/2016/07/posing-as-ransomware-windows-malware-just-deletes-victims-files/ http://arstechnica.com/security/2016/07/posing-as-ransomware... > "Once it executes it, it pops up a ransom message looking like any other ransomware," Earl Carter, security research engineer at Cisco Talos, told Ars. "But then what happens is it forces a reboot, and it just deletes all the files. It doesn't try to encrypt anything—it just deletes them all."
  - djsumdog 10y ago
    Makes me wonder if it's just buggy or intentional.
    - nom 10y ago
      Considering that the operators must actively keep the backend alive and support the users, it's more likely they abandoned it for whatever reason.
  - happy-go-lucky 10y ago
    In that case, the victims could refuse to pay ransom and the criminals will go out of business.
    - JoeAltmaier 10y ago
      But a virus has zero marginal cost. Even one guy paying and they make money.
logicallee 10y ago
This comment contains a policy suggestion. I want it to become law in the United States and elsewhere. I can't quite use the word "literally" but I almost can so I'll do so anyway: if you pay a ransom, you are literally paying for your party to attack someone else. And you are actually literally (not metaphorically) funding their next attack. Paying a ransom should be a criminal act that is twenty times worse than asking for one. It should be illegal for the exact same reason that possession of stolen goods is illegal. On a microeconomic level it might make sense for you personally to buy stolen goods off the street: the existence of the laws making you a criminal if you do no longer makes this true.
- stdbrouw 10y ago
  If you drive a car you are literally contributing to global warming. If you pay taxes you are literally funding bombs and missiles. If you download big files you are literally taking bandwidth away from your neighbors. Hyperbole does not a rational argument make.
  - hueving 10y ago
    None of those are hyperbolic, they are just true facts. Understanding the macroeconomic demand you are participating in isn't hyperbolic. Buying elephant tusks promotes the killing of elephants, regardless of where they came from because the demand you created supports a price in favor of bad actors as well.
  - logicallee 10y ago
    You are not drawing any policy conclusions from your statements. You state that "if you drive a car you are literally contributing to global warming" which implies the policy statement "if it is illegal to drive a car, contribution to global warming decreases" and use this to imply it's not a rational argument to make it illegal to drive cars. To your great surprise, I will now state that it is actually already illegal to drive cars, and it actually does have the exact effect that you say is not a rational conclusion: http://www.dmv.org/articles/what-to-do-if-your-car-fails-an-emissions-test/ http://www.dmv.org/articles/what-to-do-if-your-car-fails-an-... Today, today, it is literally illegal to drive a car....which doesn't meet EPA standards! As a direct effect, people do not buy and drive cars which fail emissions standards. So, yes, the exact policy suggestion that you don't go quite as far as to argue for actually is being enforced and actually demonstrably has the exact effect that you (only imply) doesn't happen. Since you don't even imply any policy conclusions for the other two points I can't address them, I have no idea why you would mention them. (If the government made it illegal to collect or pay taxes, obviously its tax base would evaporate overnight, this goes without saying, nobody would illegally pay money to the government out of civic duty despite its now being illegal to do so.)
makeapoint 10y ago
They don't need anyone to trust them and they have nothing to gain from decrypting your files. They may be a 14 year old kid who ran some kit that somebody else made. If they collect $50 from 25 people, they will be stoked. Or they may be a sophisticated criminal organization that want to built long term viability. It's impossible to know which it is. But it is guaranteed that they are criminal and inherently untrustworthy. It is also guaranteed that any money you pay will finance the next wave of more sophisticated malware. So, no, you cannot trust them to do good. You can trust them to do bad. Now, make your microeconimic choice.
pdkl95 10y ago
> What bothers me about their advice is that it is only correct macroeconomically. That's because it's the correct advice. Ransom is a very old business, and experience throughout history shows you should never pay the danegeld[1]. > ignores that it is in cybercriminals' best interest to let you decrypt after you paid That isn't being ignored. Paying the ransom is short-term thinking. Of course they will let you decrypt. By paying them you establish yourself as an easy/reliable mark that will probably pay again in the future. Paying would only make sense if you could somehow guarantee it was an isolated event. [1] http://www.poetryloverspage.com/poets/kipling/dane_geld.html http://www.poetryloverspage.com/poets/kipling/dane_geld.html
- notgood 10y ago
  Not only that, they know people close to you are potential targets as well (e.g. your mail contacts, facebook contacts), because most likely than not they are in the same economical bracket and are just as "savvy" technologically speaking.
- woah 10y ago
  You can guarantee that it is an isolated event by backing up your files in the future. I imagine most victims are embarrassed and try to think of it as an expensive lesson.
TeMPOraL 10y ago
It doesn't ignore any of the things you said. Yes, it's most likely better for you to pay. This kind of selfish thinking is, like many other kind of selfish thinking, what enables this type of crime in the first place. Sure the criminals will release your files. Just like with regular, "meatspace" ransom, only a stupid criminal would not release hostages after having their demands met. It's in their best interest to do so. But if people by default don't give in to ransom threats, the whole business model becomes unviable for criminals. So yeah, this advice is kind of like with vaccination and quarantines - it's not just about you. It's about all of us.
- BoorishBears 10y ago
  I'd say just like in real life, stupid criminals exist. If criminal A says to criminal B "I'll sell you a solution that encrypts their files and I'll host the decryptor for 5$ a month" I can totally see a dumb criminal B being fully willing to rely on the reputation of ransomware as working to not pay that 5$ a month. To a certain criminal any effort no matter how miniscule at all in actually providing a way to decrypt the files is useless, and I think with the reputation that's spread about ransomware we're at a point where more scammers will start to piggyback on reputation and stop following through
- ThrustVectoring 10y ago
  It's better for you not to pay, because it means that you're the sort of person who isn't worth trying to extort.
tgarma1234 10y ago
That problem comes up with collective action all the time. Workers rights in developing countries for example... if all of the workers banded together to resist their employer's unfair treatment then... blah blah blah.. but in reality average people are awful at joining together to create a change that results in a greater good. When people are isolated and feel the impact of some injustice, they tend to give up fairly quickly without any thought given to what would be best for the greater good. That's my experience of life anyway. Rationality doesn't work very well in abstracted problems that involve reasoning about how you should suffer in this moment for the greater good of everyone suffering such moments. So the scammers are smart to make the cost of cooperating fairly low in a lot of cases. It's definitely easier to pay up than to try to make a federal case out of it. And honestly your inconvenience is not going to cause the wheels of law enforcement to spin fast to figure out which international gang is targeting you. If you don't pay you probably won't ever get anything back and law enforcement won't do anything about it. So really what's the point of personal heroics here other than rational arguments about what the right move would be from a game theoretic point of view? Just pay and move on.

user5994461 10y ago

I think the fear is that they would ask for more money and/or they'd repeat the ransom again later.

GirlsCanCode 10y ago
For people who are affected by ransom ware it also means something else--they had no off-line backup solution. So they'd be in the same situation if their disk drive were to have failed!

Taek 10y ago

It's been pointed out in the past that most ransomware services have better customer support than paid services. That's because they stand to gain $XXX from each successful interaction and they stand to lose substantially more if they have a reputation of not returning the data.

the_duke 10y ago
That's just hilariously twisted.
- dwaltrip 10y ago
  It's such a perfect example of how human systems are molded by underlying incentives. Of course, the incentives themselves arise within immense cultural and technological contexts. Hopefully one day we see further past the dense fog of complexity. Assuming we aren't adding to it at a faster rate...
  - TeMPOraL 10y ago
    > Of course, the incentives themselves arise within immense cultural and technological contexts. To twist it even further, note that the shifts of culture and technology are directed by aggregated incentives of people. What a nice and strong feedback loop there. Only shows how little control societies have over where they're going.
monochromatic 10y ago
The market works!
- muyuu 10y ago
  The invisible hand.

hannob 10y ago

> For your particular case it could be the best solution to just pay - as even police departments have done before. It could be the best solution for you to pay - if you don't care that you'll finance the attacks on other people and cause more harm overall. So yes, from a purely egoistic perspective it makes sense. The question you should ask is not "is it worth paying xxx for my data?", it's "is it worth paying xxx for my data and destroy the data of someone else?".

ewzimm 10y ago
But your individual case isn't going to affect their behavior. If you wanted to change the situation, not paying simply isn't going far enough. You'd need to coordinate with other potential victims or do something like this website and spread defenses. Without putting effort into organization, your thinking that you've helped others is pure egoism because these schemes only require a few people to pay to be profitable.
- wpietri 10y ago
  > But your individual case isn't going to affect their behavior. It isn't going to affect them much. But as anybody who runs a business knows, the difference between loss and profit generally hinges on a number of sensitive factors. Note, for example, that drug dealing pays so poorly that many drug dealers live with their moms: http://articles.latimes.com/2005/apr/24/opinion/oe-dubner24 http://articles.latimes.com/2005/apr/24/opinion/oe-dubner24 Refusing to pay on your own doesn't help other people much, but it still helps.
- TeMPOraL 10y ago
  Welcome to the real world. It's twisted in exactly this, game-theoretical way. In case of ransomware, criminals are exploiting the very difficulty of victims to coordinate their actions. They depend on you paying instead of solving it yourself, educating others, or even simply calling the police. In other words, they profit directly off people's short-term, selfish thinking. The advice of defaulting to not paying is sound because if enough people follow it, the whole ransom stops being viable, which makes ransomware attacks stop coming. The same, by the way, is the tried and true way of dealing with regular, meatspace, "I kidnapped your daughter" ransom cases.

hrehhf 10y ago

In a twisted sort of way, a person could destroy trust that paying the ransom will actually get your data back. Someone could create ransomware that will never decrypt, even after the ransom is paid. Once the victims know the dishonest ransomware is out there, that may ruin the revenue towards the "honest" ransomware.

martey 10y ago
> Someone could create ransomware that will never decrypt, even after the ransom is paid. This already exists: http://arstechnica.com/security/2016/07/posing-as-ransomware-windows-malware-just-deletes-victims-files/ http://arstechnica.com/security/2016/07/posing-as-ransomware... > "Once it executes it, it pops up a ransom message looking like any other ransomware," Earl Carter, security research engineer at Cisco Talos, told Ars. "But then what happens is it forces a reboot, and it just deletes all the files. It doesn't try to encrypt anything—it just deletes them all."
- djsumdog 10y ago
  Makes me wonder if it's just buggy or intentional.
  - nom 10y ago
    Considering that the operators must actively keep the backend alive and support the users, it's more likely they abandoned it for whatever reason.
- happy-go-lucky 10y ago
  In that case, the victims could refuse to pay ransom and the criminals will go out of business.
  - JoeAltmaier 10y ago
    But a virus has zero marginal cost. Even one guy paying and they make money.

logicallee 10y ago

This comment contains a policy suggestion. I want it to become law in the United States and elsewhere. I can't quite use the word "literally" but I almost can so I'll do so anyway: if you pay a ransom, you are literally paying for your party to attack someone else. And you are actually literally (not metaphorically) funding their next attack. Paying a ransom should be a criminal act that is twenty times worse than asking for one. It should be illegal for the exact same reason that possession of stolen goods is illegal. On a microeconomic level it might make sense for you personally to buy stolen goods off the street: the existence of the laws making you a criminal if you do no longer makes this true.

stdbrouw 10y ago
If you drive a car you are literally contributing to global warming. If you pay taxes you are literally funding bombs and missiles. If you download big files you are literally taking bandwidth away from your neighbors. Hyperbole does not a rational argument make.
- hueving 10y ago
  None of those are hyperbolic, they are just true facts. Understanding the macroeconomic demand you are participating in isn't hyperbolic. Buying elephant tusks promotes the killing of elephants, regardless of where they came from because the demand you created supports a price in favor of bad actors as well.
- logicallee 10y ago
  You are not drawing any policy conclusions from your statements. You state that "if you drive a car you are literally contributing to global warming" which implies the policy statement "if it is illegal to drive a car, contribution to global warming decreases" and use this to imply it's not a rational argument to make it illegal to drive cars. To your great surprise, I will now state that it is actually already illegal to drive cars, and it actually does have the exact effect that you say is not a rational conclusion: http://www.dmv.org/articles/what-to-do-if-your-car-fails-an-emissions-test/ http://www.dmv.org/articles/what-to-do-if-your-car-fails-an-... Today, today, it is literally illegal to drive a car....which doesn't meet EPA standards! As a direct effect, people do not buy and drive cars which fail emissions standards. So, yes, the exact policy suggestion that you don't go quite as far as to argue for actually is being enforced and actually demonstrably has the exact effect that you (only imply) doesn't happen. Since you don't even imply any policy conclusions for the other two points I can't address them, I have no idea why you would mention them. (If the government made it illegal to collect or pay taxes, obviously its tax base would evaporate overnight, this goes without saying, nobody would illegally pay money to the government out of civic duty despite its now being illegal to do so.)

makeapoint 10y ago

They don't need anyone to trust them and they have nothing to gain from decrypting your files. They may be a 14 year old kid who ran some kit that somebody else made. If they collect $50 from 25 people, they will be stoked. Or they may be a sophisticated criminal organization that want to built long term viability. It's impossible to know which it is. But it is guaranteed that they are criminal and inherently untrustworthy. It is also guaranteed that any money you pay will finance the next wave of more sophisticated malware. So, no, you cannot trust them to do good. You can trust them to do bad. Now, make your microeconimic choice.

pdkl95 10y ago

> What bothers me about their advice is that it is only correct macroeconomically. That's because it's the correct advice. Ransom is a very old business, and experience throughout history shows you should never pay the danegeld[1]. > ignores that it is in cybercriminals' best interest to let you decrypt after you paid That isn't being ignored. Paying the ransom is short-term thinking. Of course they will let you decrypt. By paying them you establish yourself as an easy/reliable mark that will probably pay again in the future. Paying would only make sense if you could somehow guarantee it was an isolated event. [1] http://www.poetryloverspage.com/poets/kipling/dane_geld.html http://www.poetryloverspage.com/poets/kipling/dane_geld.html

notgood 10y ago
Not only that, they know people close to you are potential targets as well (e.g. your mail contacts, facebook contacts), because most likely than not they are in the same economical bracket and are just as "savvy" technologically speaking.
woah 10y ago
You can guarantee that it is an isolated event by backing up your files in the future. I imagine most victims are embarrassed and try to think of it as an expensive lesson.

TeMPOraL 10y ago

It doesn't ignore any of the things you said. Yes, it's most likely better for you to pay. This kind of selfish thinking is, like many other kind of selfish thinking, what enables this type of crime in the first place. Sure the criminals will release your files. Just like with regular, "meatspace" ransom, only a stupid criminal would not release hostages after having their demands met. It's in their best interest to do so. But if people by default don't give in to ransom threats, the whole business model becomes unviable for criminals. So yeah, this advice is kind of like with vaccination and quarantines - it's not just about you. It's about all of us.

BoorishBears 10y ago
I'd say just like in real life, stupid criminals exist. If criminal A says to criminal B "I'll sell you a solution that encrypts their files and I'll host the decryptor for 5$ a month" I can totally see a dumb criminal B being fully willing to rely on the reputation of ransomware as working to not pay that 5$ a month. To a certain criminal any effort no matter how miniscule at all in actually providing a way to decrypt the files is useless, and I think with the reputation that's spread about ransomware we're at a point where more scammers will start to piggyback on reputation and stop following through
ThrustVectoring 10y ago
It's better for you not to pay, because it means that you're the sort of person who isn't worth trying to extort.

tgarma1234 10y ago

That problem comes up with collective action all the time. Workers rights in developing countries for example... if all of the workers banded together to resist their employer's unfair treatment then... blah blah blah.. but in reality average people are awful at joining together to create a change that results in a greater good. When people are isolated and feel the impact of some injustice, they tend to give up fairly quickly without any thought given to what would be best for the greater good. That's my experience of life anyway. Rationality doesn't work very well in abstracted problems that involve reasoning about how you should suffer in this moment for the greater good of everyone suffering such moments. So the scammers are smart to make the cost of cooperating fairly low in a lot of cases. It's definitely easier to pay up than to try to make a federal case out of it. And honestly your inconvenience is not going to cause the wheels of law enforcement to spin fast to figure out which international gang is targeting you. If you don't pay you probably won't ever get anything back and law enforcement won't do anything about it. So really what's the point of personal heroics here other than rational arguments about what the right move would be from a game theoretic point of view? Just pay and move on.