Hacker News Reader

Comment by renewiltord | Hacker News Reader

There's an easier way that forces them to behave in this manner: poison the well by releasing ransomware en masse, receiving the money, and then not releasing the data.

Once the well is sufficiently poisoned, no victim has an incentive to participate. They don't know if they're paying a defector or a cooperator.

No state can take this action. Any hero who does so will be prosecuted. But if they /dev/null their bitcoin address private key, they can rest easy that what they did was purely selfless.

View on HN

The ransomeware makers can counter that by making their ransomware divide the victim’s data into a very large number of separately encrypted sections each using a different key. Then instead of trying to sell the victim one key for a million dollars they would offer say 100000 keys at $10 each.

Now it only costs the victim $10 to pick a random section and buy its key. If that works they can pick another and buy it’s key, and so one until they are confident the seller can be trusted and they can then buy the remaining keys.

Oh, that's a clever counter. Is it possible to think of a way to circumvent that?

Perhaps it is sufficient to simply ransomware the data in the first place and then refuse to give it back. Any measure that makes the victim immune to that will make them immune to the true ransomware folks as well.

Practically, this is how all these ransomwares work in big organisations...

It's usually ~$1000 per machine. Sometimes more for machines with big disks or depending on which active directory groups they're in.

That tells you that UCSF paid for data recovery on 1000+ machines probably...

Is there a volume discount for Enterprise customers?

Yes. It was $1M after the volume discount.

Perhaps, but fakers can do that too. Also I expect that the actual effective cost of the individual keys - especially the first - would be more than $10.

It should be possible for ransomware groups to then just start sending signed messages, proving that a given attack was by them.

That way, they could build up a sort of "reputation".

Most companies probably wouldn't want to give credit to the randsomware group. I don't think signed messages of criminal organizations would make people trust them.

Reply on news.ycombinator.com