Hacker News Reader

Comment by autoexec | Hacker News Reader

It was always a bad idea to pay ransomware groups, but I'm surprised they'd eat their own. I guess "There is no honor among thieves" after all.

View on HN

Bad idea to guarantee the improbable (deleting their own copies), a valid choice for a one-time result (unlocking your data on your device).

That's typically what backups are for. No business should be so negligent as to ever need to pay a ransomware group in order to get their own data back.

But if they are, it may make sense to pay. For the company. Not from a more macro view.

That I can agree with. If the company has already screwed up so badly they're stuck paying the price and hoping for the best.

It may also be about not wanting their data to be made public.

Yeah...

In this case I would include "getting their systems back online"

There could be times when there's an immediate need to get everything back up and running, but I'd be willing to bet that in at least some situations the time spent going back and forth with the extortionists to arrange the payment, then gather the funds, and then wait for them the verify that they have your money could take longer than it would to just re-image a new server, reset some passwords, and copy over the needed data from backups. It's the same stuff they'd have to do either way.

My guess is that companies that have their shit together enough that they could get back to a "We're total compromised and vulnerable, but at least we're online for now" state fairly quickly without paying up are a lot less likely to have ransomware problems in the first place.

As a data point, the Toronto Public Library decided to take the "restore from scratch" approach after being hit by ransomware, and it took four months before books could be borrowed again. Now, I'd expect a library would move slower than an IT-heavy company, but there are substantial costs either way and only one of them is probably covered by their cyber insurance.

So that’s what happened. I was wondering why they were having so much trouble. Their wording was evasive and I thought I til now that it was Covid closures related somehow without really understanding how covid would have that impact.

Four months wtf, they should have offsite backups maybe every 15 days at most, but I can understand how even that can be a headache to restore from...

fwiw they have a pretty good reputation to release data after payment, not much the companies can do ex-post if they don't have a backup to their valued data.

Historically its been a reliably good idea to pay ransomware groups

This is the worst case scenario and its ridiculous

I hope it prompts reforms in that industry such as using smart contracts as escrow to handle payment to affiliates

a direct payment to an EOA is just sad

affiliates, moderators, and the ransomed should demand a model smart contract behind every address presented for payment, cybersecurity industry (and even the feds) could help craft this and give more confidence to the outcome

Are… you really suggesting that the real problem here is not criminal extortion but that the payment approach isn’t safe enough to ensure their criminal associates get paid, and that this is what the feds should help improve?

I'm not invested enough to do the napkin math, but I wonder what costs more: ignoring security and paying the ransom, or investing in the right strategy to prevent being held ransom. If I consider my own experience in tech for the past few decades, I have to think it could go either way. (This says nothing of the damage releases of private data can do, which of course makes investing in the right strategy the correct thing to do, no matter the cost.)

From a cost perspective it'd be easy to be tempted into thinking you can play the odds and come out ahead. It's not like getting infected with ransomware is something that happens all the time.

Fortunately not being negligent when it comes to security does a lot more than just protect you from ransomware extortionists. It can make it possible to easily recover data after all kinds of incidents (human error, software bugs, hardware failures, fires/floods, etc) and also help keep you protected from other types of viruses/malware, malicious employees, corporate espionage, whistleblowers, and anyone else who would take your data and then actually use it instead of just demanding payment to make it go away. It can also prevent the reputational harm a company can suffer by having a data breach go public.

Good security is one of those things that could easily save a company way more than it costs them, but the costs are immediate and non-trivial and companies seem to love to cut corners even when they know it'll screw them down the road because they're pathologically short-sighted and it's hard to brag about doing something that didn't have an immediate and obvious impact on their next quarter's bottom line

No, that is not what you need at all.

You are correct in saying it has historically been the smart choice to pay a ransomware group, but that is only the best decision for that individual company; as a society, we are better off when we make a blanket policy to never negotiate with terrorists (or ransomware groups). The fact that what is the best policy for individual companies is the opposite of what is the best policy for society as a whole is simply because this is a prime example of a prisoners dilemma; everyone is better off if no one pays a ransom, but any individual company is best off paying the ransom.

So what we should do instead of making ransom payments reliable, is make it nearly impossible to reliably pay a ransom without the ransomware group being caught in the end.

And in the meantime we can streamline the payment process

it will help many low trust business relationships and entire industries

Reply on news.ycombinator.com