https://posteo.de/blog/info-zur-ransomware-petrwrappetya-bet... (German)
https://posteo.de/en/blog/info-on-the-petrwrappetya-ransomwa... (English)
All the competent ransomware authors are probably quite unhappy whenever a defective ransomware strain pops up.
The best way to end ransomware is to get serious about security. In many cases, being attacked by a ransomware, is paying a low price compared to if it was a targeted attack.
edit: Also, I imagine it gets easier after you wrote one i.e. many ransomewares come from the same author. So he could gain a reputation by signing messages saying that yes, this is our ransomware, we always unlock after receiving the payment.
The idea would be to create "fake" ransomware that looks exactly like the real one
>The best way to end ransomware is to get serious about security
No matter how serious you get there always gonna be bugs, there isn't a single piece of mass distributed software in human history without bugs. That said, we should try to improve security of software but expecting it to be THE solution is wrong.
>Also, I imagine it gets easier after you wrote one i.e. many ransomewares come from the same author. So he could gain a reputation by signing messages saying that yes, this is our ransomware, we always unlock after receiving the payment.
Forging a signature is not that hard.
But even without it, there are so many options, e.g. timestamp signed message on the blockchain before the release. After just one confirmed message you don't care about pretenders because people can check if the signature matches with the previous message.
I like the idea though.
All blockchain state is public, since it needs to be calculated by and verified by all nodes, so there's nowhere to stash a private key without revealing it.
> by the time Prohibition ended in 1933, the federal poisoning program, by some estimates, had killed at least 10,000 people.
http://www.slate.com/articles/health_and_science/medical_exa...
It will cause a major headache for those who pay and will hopefully make people learn to distrust ransomware, in turn making it less lucrative.
On the other hand, that requires a fair number of "acceptable casualties" so to speak.
I personally think both sides of this are valid and don't know what the best option really is. It will be interesting to watch how things evolve at least.
Ransomware will never ever not be lucrative. Preventing people from getting their data back doesn't discourage future campaigns and primarily hurts the victims of the ransomware.
1) Ransomware authors have obvious economic incentive to decrypt, and no reason not to. This makes it a herculean task to convince the general public that they wouldn't do so.
2) By the time your data is encrypted, you'll be researching your specific ransomware strain and will find out if it's legit or not. Googling the onion address is an obvious choice and something the ransomware author can just tell you to do.
3) Most people will need someone more technical to arrange the bitcoin payment anyway, these people will verify if the ransomware seems to be legit or not.
4) People don't magically get smarter, phishing still works if you pass the spam filters.
5) Winlockers were immensely lucrative even before they started using crypto.
6) Unless you're going to run your fake-ransomware campaign at an immense scale you'll never drown out the real, working ransomware.
And then in the end, what the was your goal anyway? Good job, now you've deleted millions of peoples data on a retarded mission to "stop ransomware". But hey, at least you stopped those evil russians!!!
There are precisely zero good arguments for preventing people from decrypting their data.
Its irrelevant, this has nothing to do with the fake ransomwares.
>2) By the time your data is encrypted, you'll be researching your specific ransomware strain and will find out if it's legit or not. Googling the onion address is an obvious choice and something the ransomware author can just tell you to do.
The search results of any onion address are just as fake-able.
> 3) 3) Most people will need someone more technical to arrange the bitcoin payment anyway, these people will verify if the ransomware seems to be legit or not.
Sure, with their ransomware-detecting powers
>4) People don't magically get smarter, phishing still works if you pass the spam filters.
What has to do with anything
I got bored to keep answering, in general your points seem week which make you sound a bit too much like a ransomware creator. Probably not because you have 3 years here but otherwise you do.
Not a ransomware creator but I understand the economics at play. Ransomware is more profitable than sending spam, unless you're spamming to spread malware.
The value of individual installs has historically averaged at significantly less than a dollar each, ransomware is bringing that way up.
You aren't going to stop ransomware unless you figure out a solution to all other malware, or invent a more profitable scheme. People need to do something with their bots and ransomware is always going to make more money than spamming from bots that haven't been able to inbox anything for 5 years.
There's simply no way you'll stop enough people from paying to make viagra spam beat ransomware.
Sure, you could probably deter ransomware by sending DEVGRU to murder the authors, but I doubt it's worth the political shitstorm that'd follow.
This is a good description of some details https://medium.com/@thegrugq/pnyetya-yet-another-ransomware-... - it rather looks like a targeted attack to do chaos+damage to Ukraine.
Not that I want to give attackers any ideas... :-)
- Make a big target amount of money that any large company can pay, eg $10M, and tell people you'll release everyone's key if the amount is raised.
- Use an online board like this one to control the state of your network.
- Embarrass individual firms by posting pics of their offices from their own webcams.
Etc, etc. I reckon talking about these sorts of things will help find solutions rather than just inspire the bad guys.
That sounds like a good way to get state level actors on your case.
Now there is nothing to track until they rewrite their code and try the attack again with randomized email addrs