5 ms·

No, that is counter to their making money. The way to make money through ransoming something on a regular basis is to always ensure you follow through. There a

No, that is counter to their making money. The way to make money through ransoming something on a regular basis is to always ensure you follow through. There are actual cases in history of ransomers attacking fellow ransomers who don't follow through for hurting the shared business model.

billpg 7y ago
I think that time has passed. I've heard of too many cases of "ransomware" that just wipes your disks and asks for money that I wouldn't pay up. "True" ransomware requires a key management infrastructure with a capacity for delivering a service. Setting up a bitcoin recipient takes next to no resources. If you were criminally minded, what would you do? It would harm the ransomware-maker's reputation? Just pick a new name every week.
- kkarakk 7y ago
  you're assuming the knowledge on how to make a ransomware business is freely disseminated. it's not, there are very particular darknet websites and societies that keep each other updated on the latest techniques and likely targets for attack. It is trivial for them to hear about an attack where the person didn't follow through on the unlock and at that point they just freeze the offender out of their "club". It is that way in the ransomware/game cracking/early piracy(before release) "scene"
  - billpg 7y ago
    I am an ordinary software engineer and I could build "ransomware" that does nothing but wipe the victim's disks and demands money be paid to a hard-coded bitcoin address in a convincing looking way. I don't need criminal contacts to do that.
    - kkarakk 7y ago
      sure you'd succeed...once. then how do you find another target that would also work with your delivery system? what companies have data sensitive enough for a ransom attack to work? Making a living off ransomware isn't easy if you're a lone wolf
      - billpg 7y ago
        In this hypothetical, I'm not delivering actual ransomware, but something that just demands money and will never actually release the files. But this is my original point. Someone hit by an attack has no way of knowing what type of attacker they are facing. Will the attacker return my files if I pay up? They might, but there's a very reasonable possibility they can't or won't. Remember, they just want your money. They have no reputation to maintain because they're already criminals.
        kkarakk 7y ago
        No, the reputation they have to maintain is of following through on their threats ie maintain their aura of fear. If i KNOW a ransomware attack means an instant loss of data it takes away the sting - it just becomes the same as if the harddrive containing the data went poof. However if there is a chance for me to get the data back you better believe i will try as hard as i can to get the password from the datajackers.
- dmurray 7y ago
  At least one ransomware program gives you the option to pick one file to decrypt for free, to prove that the files can be recovered.
  - billpg 7y ago
    Fine, I won't really delete the files, but move them all into a hidden ZIP file. When the user picks the one file to rescue, the code will pull that file out then delete the ZIP. You've got an hour to make your choice before the ZIP gets deleted anyway. Remember, ransomware-makers aren't providing a service anyone wants. They have inserted themselves into the system and only care about getting their victim's money.
  - qwerty456127 7y ago
    I'd expect them to increase the price for decrypting this particular file you've chosen rather than actually decrypting it then.
- qwerty456127 7y ago
  > Just pick a new name every week. Can't a bitcoin (or whatever a cryptocurrency) recipient ID be used as a brand name?
wpietri 7y ago
That's only true if you have an established brand that is hard to forge. Or if enforcement of the shared brand is reliable enough to deter exploiters. But the whole point of ransomware attacks is that they're hard to trace and are being performed by people who are insensitive to enforcement. So my expectation is that it's a crapshoot and always will be.
asdff 7y ago
Sounds like you wouldn't need clout in the ransomeware community if you snagged a big enough cow to keep milking. Whats to stop you from just not following through? It's a file system and you are a completely anonymous hacker located anywhere on earth, not a physical hostage that the CIA could extract and shoot you in the head in the process. There's no incentive at all to follow through, you can lock it again and disappear into thin air if you wanted.

billpg 7y ago

I think that time has passed. I've heard of too many cases of "ransomware" that just wipes your disks and asks for money that I wouldn't pay up. "True" ransomware requires a key management infrastructure with a capacity for delivering a service. Setting up a bitcoin recipient takes next to no resources. If you were criminally minded, what would you do? It would harm the ransomware-maker's reputation? Just pick a new name every week.

kkarakk 7y ago
you're assuming the knowledge on how to make a ransomware business is freely disseminated. it's not, there are very particular darknet websites and societies that keep each other updated on the latest techniques and likely targets for attack. It is trivial for them to hear about an attack where the person didn't follow through on the unlock and at that point they just freeze the offender out of their "club". It is that way in the ransomware/game cracking/early piracy(before release) "scene"
- billpg 7y ago
  I am an ordinary software engineer and I could build "ransomware" that does nothing but wipe the victim's disks and demands money be paid to a hard-coded bitcoin address in a convincing looking way. I don't need criminal contacts to do that.
  - kkarakk 7y ago
    sure you'd succeed...once. then how do you find another target that would also work with your delivery system? what companies have data sensitive enough for a ransom attack to work? Making a living off ransomware isn't easy if you're a lone wolf
    - billpg 7y ago
      In this hypothetical, I'm not delivering actual ransomware, but something that just demands money and will never actually release the files. But this is my original point. Someone hit by an attack has no way of knowing what type of attacker they are facing. Will the attacker return my files if I pay up? They might, but there's a very reasonable possibility they can't or won't. Remember, they just want your money. They have no reputation to maintain because they're already criminals.
      - kkarakk 7y ago
        No, the reputation they have to maintain is of following through on their threats ie maintain their aura of fear. If i KNOW a ransomware attack means an instant loss of data it takes away the sting - it just becomes the same as if the harddrive containing the data went poof. However if there is a chance for me to get the data back you better believe i will try as hard as i can to get the password from the datajackers.
dmurray 7y ago
At least one ransomware program gives you the option to pick one file to decrypt for free, to prove that the files can be recovered.
- billpg 7y ago
  Fine, I won't really delete the files, but move them all into a hidden ZIP file. When the user picks the one file to rescue, the code will pull that file out then delete the ZIP. You've got an hour to make your choice before the ZIP gets deleted anyway. Remember, ransomware-makers aren't providing a service anyone wants. They have inserted themselves into the system and only care about getting their victim's money.
- qwerty456127 7y ago
  I'd expect them to increase the price for decrypting this particular file you've chosen rather than actually decrypting it then.
qwerty456127 7y ago
> Just pick a new name every week. Can't a bitcoin (or whatever a cryptocurrency) recipient ID be used as a brand name?

wpietri 7y ago

That's only true if you have an established brand that is hard to forge. Or if enforcement of the shared brand is reliable enough to deter exploiters. But the whole point of ransomware attacks is that they're hard to trace and are being performed by people who are insensitive to enforcement. So my expectation is that it's a crapshoot and always will be.

asdff 7y ago

Sounds like you wouldn't need clout in the ransomeware community if you snagged a big enough cow to keep milking. Whats to stop you from just not following through? It's a file system and you are a completely anonymous hacker located anywhere on earth, not a physical hostage that the CIA could extract and shoot you in the head in the process. There's no incentive at all to follow through, you can lock it again and disappear into thin air if you wanted.