I find myself puzzled by organizations like these. Let's say they do not attack infrastructure or other critical services, and only leech off huge companies.
I cannot argue against it?
I cannot argue against it?
To me what's more obviously wrong whether I'm rich or poor is leaking personal info on employees, HR correspondence etc. I don't know whether this group would since they say it hasn't got that far yet but other groups have.
Extortion, mugging, burglary etc are worse than the "perfect theft" where you move some numbers from one account to another.
I wonder if the people involved believe their own spin that "your boss is the one at fault, would rather you suffer than pay"
Are we really going to justify this just by "it is against the law"? So many things are against the law, so many ancient laws demonstrate the inability of humans to create the absolute corpus of ethical behaviours™.
The Kantian categorical imperative goes something like, "act as if the basis of your actions would be made universal law." What happens if everyone conducts denial of service and ransom attacks against anyone they perceive as a legitimate target?
https://www.aamc.org/news-insights/growing-threat-ransomware...
https://www.wsj.com/articles/the-ruthless-cyber-gang-behind-...
I think it's kind of neat that we're waging war via bit flipping instead of meat flipping, let's call it progress.
Take any organization you think is "worthy" of being attacked in this manner, and consider all of the implications of such an attack. Think about the people inside the organization, and those outside of the organization that benefit from that its continued operations.
I think it's fair to say the public opinion of oil companies is fairly low; however, arguably the biggest impact of the Colonial Pipeline attack was not on the executives running the company, but on the end customers of gas stations unable to fuel their vehicles due to the shortage (whether truly real or created by panic). I would argue that everyday workers unable to get to work or to the store to buy food is more important than a few executives not getting their bonuses or having their shares lose value.
This isn't to say that these corporations are above all reproach and should be allowed to continued operating in whatever way they see fit simply because they have employees and customers are relying on them. But it's also the wrong mindset to think that it's OK to attack corporations in this way just because they "deserve it" in some way.
Médecins Sans Frontières is a huge company. Their annual budget is around $1.6bn. Are you ok with them being subject to ransomware attacks?
> It would not extort healthcare, critical infrastructure, oil and gas, defense, non-profit, and government organizations
There is so much collateral damaged created by this sort of attack against any company of sufficient size. It's easy to wave your hand and say they're a rich company they can afford it, but no company exists in isolation, they're all part of economies, and ultimately it's real people somewhere who take the damage.
Leeching off of companies is kind of like stealing a grain of rice from everyone. The company's costs increase and the price eventually makes its way back to the consumer.
Another way to think about it is the total amount of labor needed for the world to operate as it does. In a world that has no ransomware, the labor needed is X. In a world with ransomware it is X + cost of building ransomware + cost of dealing with ransomware.
I'm sure the criminals console themselves by thinking about it that way, but as someone who had to use an emergency room and was denied other services during the month+ Scripps was down (during a global pandemic, no less), it was easy to see how ransomware attacks can directly hurt an enormous number of employees and customers.
My point was that ransomware is wrong even in an idealized abstract scenario where it only targets non-critical companies.
Thanks for providing your experience. It drive home that in practice it is much more like beating and robbing many people than it is like stealing just a single grain of rice from them.