Hacker News Reader

Comment by bluGill | Hacker News Reader

We are best off not paying them regardless: if there is no payout the bad actors will give up the attack. If you are in a group that pays out target them. It doesn't pay to target someone who has good backups (though it might not be worth checking if infecting everyone is easy)

View on HN

The attack is inexpensive enough that even if 0.001% pay it's probably still worth doing.

Even if you criminalize paying you'll still have a tiny portion that do.

For takeovers of larger systems, probably not. They're clearly finding vulnerabilities/targets, doing some minimal investigation to set a price to charge them, and some other basic effort. Doing it 10000 times for a single payout probably wouldn't be worth it.

1 / .001% = 100,000

I mentioned a lower value to indicate it definitely wasn't worth it.

>if there is no payout the bad actors will give up the attack

I'd argue that isn't true. Ransomware is a form of terror in the form of "losing everything". And that threat of impending loss combined with 'backups are hard wahhhh' and the fact that no Corp I know backs up user machines...

As a numbers game, it pays. Well. And even if it didn't, some still hack for the "lulz".

Definitely. Look at all the people pursuing "make money fast" scams. Some people will happily do anything they think might make them a buck. Not paying out will help, of course, but it doesn't eliminate the problem.

When there is no money in it nobody will be developing the exploits that make it easy. There is a large difference between buying a recent vulnerability and exploiting it vs finding a vulnerability.

>>no Corp I know backs up user machines

Most of the orgs I've worked at (for at least the last decade) map the local profile to a network share, which is definitely backed up. The only things not backed up would be saved outside that folder structure, but the organizations have always been clear about that.

Reply on news.ycombinator.com