Hacker News Reader

Comment by billpg | Hacker News Reader

What I don't get is the idea of trusting a criminal to live up to their promises if the victim pays up.

"They would lose a lot of reputation if they broke their side of the deal."

What reputation? Is there some sort of website where I can go read reviews of a ransomware gang? Even if there were, what's stopping the "bad" gangs from pretending to be the "good" ones? Trademarks?

View on HN

I negotiated for a friend in a small ransomware case. They paid $2k. Yes, reputation is important, I did some research to check whether others had successfully negotiated. If you get a reputation for not delivering nobody will negotiate with you. Likewise if you have a good reputation the amount of money people are willing to risk on getting their data back goes up, and that's good for business. It's also a reason why the ransomware was very clearly branded.

It's criminal but the principles of business still apply.

I may been a bit glib in my original post, but is there actually a website where ransomware gangs reputation are tracked?

In our case I googled the email address that was left in every folder and read forums on how their users dealt with it. We negotiated $2k to $400.

My company bought a small business and it happened next day. A hole in RDP that was simply open to the internets. No backups, no failover, just a regular business, you know. Partially my fault, as this thing should have been evaluated/fixed before the deal. Convincing the owners that it wasn't me (I just got an administrative password) was a separate fun.

Seems like it was an inside job if it happened the same day.

Unlikely, all things considered. With default port RDP on the internet it is just a matter of time, and then of a coincidence.

For $400 or even $2000? That's an awfully small payout for an enormous legal risk.

Yes, but multiply the ransom by multiple small, low ransom targets, as is commonly the case with groups taking a more diversified approach of targeting many small companies in the same attack type, partly depending on such small ransom demands to individually not even be reported to investigating authorities, and getting at least a partial ROI. This opposed to making a huge single demand from one large company that almost certainly causes your ransom attempt to trigger a police investigation and the not small chance of the company simply deciding not to pay, leaving you with 0 for that particular effort.

What about if it had happened 2 days later? or 3?

What's the magic number to make you think that it was/wasn't an inside job?

Even if there isn't, you can still probably copy and paste part of the ransomware message into Google and find stories of other people that interacted with them.

Although there are incentives, what is really being challenged, for you, is a childish view of a categorization.

Ransomware operators are as trustworthy as any corporation, because they are a corporation.

Probably reputation among ransom-ware negotiators (by this I mean the cottage industry described in the original post)

Ransomware "negotiators" are "affiliate salespeople", as I see it.

Yup, the expected value of the key is P(valid_key) * savings_from_decrypting. So if you're known to negotiators as providing a valid key, it makes the likelihood of paying higher.

> Even if there were, what's stopping the "bad" gangs from pretending to be the "good" ones? Trademarks?

I have no idea if that is actually done, but the criminals could simply cryptographically sign a unique message for each attack.

Reply on news.ycombinator.com