Hacker News Reader

Comment by ryan_j_naughton | Hacker News Reader

Related article: Could a Ban on Ransom Payments Have Stopped the Colonial Pipeline Attack? https://news.ycombinator.com/item?id=27196299

While banning such payments might remove the incentives, that also put a huge burden on the victim and the transition to better cybersecurity should be less disruptive than an outright ban.

Another solution that has no harms and only benefit is to require the reporting of every ransom payment. That would give the government the crypto transaction information to conduct taint and attribution analysis. It is currently illegal to knowingly use funds received from kidnapping or ransoms, and this reporting requirement would help the government enforce that.

View on HN

It places on some victims to prevent a lot of others from becoming victims. That is fairly standard trade off in any society. Also this is always the case for paying ransom for hostages, and is only simply being extended for data.

Without a legal way to make payments, companies can no longer justify the tradeoff of paying up and fixing the leaks as they spring up. This incentivize them to give importance to security and actually overhauling their infrastructure properly.

it's a textbook prisoner's dilemma paradox.

If everybody agrees not to pay ransom and follows through, criminals won't try to hack companies to collect ransom.

But as an individual company, you can't coordinate with everybody else to prevent everybody from paying ransom, so not doing so puts you on disadvantage.

Philosophically, the usefulnes of government is to threaten violence to solve the coordination problems amongst individuals.

Yes, thank you for saying so.

People rarely understand that the coordination solution is one of the most important powers the government offers over privatization.

They can tax/penalize undesired behavior. Individual companies may end up worse off, but as a whole the business community is better off with the rules in place.

This is why governments have to tackle pollution and climate change too. Companies are profit-motivated, and will only respond to what the economics demand. When governments start imposing demands with penalties attached, that's when companies actually start changing behaviors.

> Another solution that has no harms and only benefit is to require the reporting of every ransom payment. That would give the government the crypto transaction information to conduct taint and attribution analysis. It is currently illegal to knowingly use funds received from kidnapping or ransoms, and this reporting requirement would help the government enforce that.

Definitely a must have for now and on a international scale IMHO.

But a effective ban on ransom payments would still be the most effective measurement.

The problem is how do you effectively ban it?

For many countries such thing could never be enforced, so it wouldn't remove the sensitive for non-specific target ransomware attacks IMHO and as such won't work.

> The problem is how do you effectively ban it?

If a corporation pays, and ledger history can provide definitive proof, the corporation faces the same penalties as if they violated international sanctions. Corporations will need to onramp fiat to crypto somewhere, and FinCEN [1] will know based on SARs (Suspicious Activity Report)/CTRs (Currency Transaction Reports), or SWIFT if international monies transfers [2].

[1] https://www.fincen.gov/resources/statutes-regulations

[2] https://www.swift.com/our-solutions/compliance-and-shared-se...

> For many countries such thing could never be enforced

so it follows that if a country bans ransoms payments criminals will just ingnore that country and focus on the next easiest target, putting pressure on every country to follow the example and ban it too.

I think this will be very effective at stopping the most sofisticated targeted attacks but won't have much effect on indiscriminate "viral" attacks because those attack indiscriminately and wrecking targets from banned countries at least would serve as detterrant for victims in countries that can.

Another fun idea via someone on Twitter: make randomware legal but capped at a low amount, e.g., $5k. (And, perhaps, public reporting required after a 1 year delay.) Now white hats can enter the market safely, many holes are discovered for relatively low prices, and the country's tech infrastructure as a whole is less vulnerable to serious attack.

One issue is that if the costs of finding different vulnerabilities are distributed along a spectrum, this only lets you find the <$5k ones.

The problem is ransomware is software just like all the others. What do you do when some random script kiddie in way over their head manages to encrypt a seriously important network but can't develop decryption tools - or worse, loses the encryption key? Nobody really wants to promote unsophisticated attackers in this space. At least the existing criminals give you proven tools once you pay the ransom.

The transition to better security? It's been almost 20 years since the Code Red worm. How much longer should we wait?

I think the transition to better security will go faster if companies know they can't buy their way out of the problem.

> While banning such payments might remove the incentives,

They'd pretty obviously not; companies are already forced to pay a fine (or a ransom, but it's money spent) and it obviously does not incentivize them to properly secure their network. Adding a fine to pay to the government on top (or, more cynically, a tax) will not change much, except that stricken companies now get hit harder, as you said.

Companies purchase cyber insurance for a small fee and avoid risk of paying ransoms directly.

Make cyber insurance paying ransoms illegal and you'll see boards start funding IT security.

Insurance companies are likely to disallow ransom payments in their entirety. Too much risk considering the security posture of most organizations.

Boards will, generally, still not fund and support effective security culture without steep penalties for breaches (i am in infosec and speak to c suite folks as part of my gig; breach impact, in their current form, are "cost of business"). “Show me the incentive, and I will show you the outcome.” – Charlie Munger

https://www.insurancejournal.com/news/international/2021/05/... (Insurer AXA to Stop Paying for Ransomware Crime Payments in France)

Paying the ransom should make you an accessory to the crime with jail time and all for the executive who cleared it. This should put an end to it pretty quickly.

And also put an end to the organisations ability to operate making potentially thousands of people instantly and needlessly unemployed because their bosses didn't think security was important.

Allowing executives to commit crimes because imprisoning them would deprive workers of an executive is just plain foolish.

The executives should be punished, yes, but I don't see why the entire workforce should be when insurance can cover the cost.

That is the system working as intended. Organizations, and those that lead them that can't hack it in the modern economy must be removed in order to make room for those that can.

So what’s the point of restricting ransomware payments then? Only organizations that can’t hack it in the modern economy will be affected anyway.

Ransomware gangs exist and thrive because their crime is profitable -- their victims are willing and able to pay. Make many of their victims unable to pay, and the equation changes.

Someone with the correct competencies will get the job instead. Or better yet executives the world over will start taking security seriously.

I think the grandparent means banning such payments might remove the incentives to hack in the first place, since a hacker can't expect to make any ransom revenue from a company that obeys such a ban.

Illegal btc -> UniSwap -> btc/Monero -> Monero wallet -> Monero Wallet 2, Money is cleaned. Monero doesn't include wallet headers.

Reply on news.ycombinator.com