Don't pay off Ryuk ransomware, warn infoseccers: Its creators borked decryptor | Hacker News Reader

Don't pay off Ryuk ransomware, warn infoseccers: Its creators borked decryptor

theregister.co.uk

23 pointsLinuxBender13 comments

Perhaps we should release dirty ransomware that takes your money and doesn't unransom. Poison the well for ransom so everyone believes it's all a scam.

Was this accidental or intentional? Russia has recently been distributing fake ransomware in Ukraine which is intended to cause economic damage rather that generate profit.

It would be cool if somebody created some provably fair ransomware that used Bitcoin script or zero knowledge proofs or something. You pay the coins and are guaranteed the (correct) decryption key.

It would be cooler if someone cloned existing ransomware and took payment and never decrypted files. Then people would stop paying and stop encouraging it.

Seems pretty easily-fixable, if it's just one byte.

Or event if it some few bytes, I think it's possible to brute force it. The required time will just relate to how fast you can test if your file/container is correct, and might be worth depending on what you lost...

It is rather a moral dilemma or game theory in full glory. If nobody paid ransoms this would quickly end. As it is, people try to save themselves and only cause more ransomware to happen.

It’s not a moral dilemma because the question being asked is of whether the returns today outweight the returns of tomorrow.

It is a moral dilemma exactly because your statement is not true.

For any individual person it is easy to see and say they individually have little or no influence on future ransomware. From any individual person it seems the question is only whether the asked amount is less than the worth of encrypted files.

But they do individually have little influence over ransomware. On top of that, there’s little evidence of the fact that in the near future we will not all be using operating systems that disallow a single program to destroy the data of other programs.

You are taking this question at some ridiculously irrelevant limit and saying my statement isn’t true. Well, I think my statement is true in a higher proportion of contexts that yours.

Mmm maybe, but also:

"Victims who pay the ransoms are very likely to be funding the North Korean hereditary dictatorship, which actively practises all kinds of organised, deliberate barbarity"

So it's probably good to promulgate the idea that it doesn't even work - if no one pays the ransom, the ransomware will die. That's why it's in the creator's interest to make a working decryptor in the first place.

Well, the ransomware will continue spreading, if it operates autonomously, independent of whether the decryptor works. New ransomware might not be created however

I've heard that Ryuk is highly targeted, usually a manual secondary attack on enterprises that can afford a much higher ransom than normal. So it's probably not autonomous, and its reputation for unreliable decryption after payment should make victims less willing to pay.

Reply on news.ycombinator.com