Hacker News Reader

Comment by john_strinlai | Hacker News Reader

on one hand, every ransom paid encourages like-minded individuals to start or ramp up their ransomware game , which is not great.

on the other hand, the ransomware groups that want to stay in business need to be honest (with respect to not releasing/deleting data) or they wont be 'credible' ransomware operators, which is kind of funny to think about. and in many cases, the victims would rather the ransomware operator be paid (so their data is not leaked) vs. having their data leaked. so paying is the best for current victims (but increases the potential for future victims).

the dynamics/economics around ransomware is fascinating.

View on HN

This is always the game theory of ransoms, and it is a classic example of a collective action problem (and is a form of a prisoner's dilemma).

Each individual company is probably better off paying the ransom, but everyone would be better off if no one paid a ransom.

This is why the United States, for example, has an official no-ransom policy, and why other no-ransom policies exist. You have to have something forcing the individual victim to not pay, otherwise they will always be incentivized to pay and ransoms will continue to be profitable.

https://en.wikipedia.org/wiki/Collective_action_problem

https://en.wikipedia.org/wiki/Prisoner%27s_dilemma

... except that "policies" don't cut it. Criminal penalties for paying are what you need, and not just for payments to specific designated entities, either. The executive making the decision to pay has to have a real fear of personally spending time in actual prison.

US law has criminal penalties for paying a ransom to a designated criminal terrorist organization or under treasury sanctions.

Most hacking groups don't fall under that. Some, sure.

A criminal penalty is a form of policy

... but not the form of policy they actually have.

Except for payments to specifically sanctioned organizations, the policy is "we'd really rather you didn't do that, but whatever".

The specific sanctions don't cover most of the groups, either, and even when they do cover the group who got paid, you can't necessarily prove the people who got paid were the ones on the list. And there may be a scienter requirement even then; I don't know.

Making a list of specific criminals you can't pay is just stupid. No ransoms, ever, period, or it's da slammah.

You can also have the "excessive force" doctrine, where holding someone or something for ransom results in your entire country being a smoldering crater.

But just like fail2ban, this gives someone else decision-making control over your actions, which can be abused.

While the us stance has resulted in savings on potential ransom, it has also lead to people being kept in prison for very long time until prisoner exchanges might be worked out. That cost to an individuals life being imprisoned is probably far in excess whatever the US might pay. Plus the US prints its own monopoly money and doesn’t really play by the rules of economics anyhow ever since getting off gold standard.

Cash is not the real cost; the cost is by agreeing to continue printing ransom money, you cause more individuals to be kidnapped.

Seems the rate of kidnapping is currently orthogonal from the ransom so it is unclear that they will have a linear relationship in this way as you describe.

That ransoms today are denominated in USD and that the US might be printing too many USD has nothing to do with whether or not ransoms should be paid.

The day the USD falls, ransoms will simply be denominated in something else and the same underlying collective action problem will remain.

This is just way of avoiding the core issue by blaming something unrelated that you don't like.

A: U should clean your room, it would be better for you & the rest of your family

B: FU dad, everyone knows there's no such thing as a clean room under capitalism!!!!!

This is literally the exact point I am making, and the US policy isn’t about saving money.

Like you said (and like I said in my post), for an individual kidnap victim, the best option would be to pay the ransom. It is better to pay the money and be free.

However, that means a kidnap group now has more money, which will make them better able to kidnap another victim and demand more money.

The point of a “no ransom” policy is that it takes the choice away from the individual, who would choose to pay it, and changes the game theory to make kidnapping not worth it.

The whole reason you need a policy at all is BECAUSE it is better for the person to pay the ransom.

> Each individual company is probably better off paying the ransom, but everyone would be better off if no one paid a ransom.

You're then a target known to be vulnerable and pay ransoms, so best focus on security.

If you have to pay, at least try to negotiate 1) a guarantee that the hackers won't just do it again sometime later, and 2) full disclosure / assistance in repairing your vulnerabilities so you have some kind of head start for the future. Outside of politically motivated hackers, this would probably be reasonably successful.

Other hacking groups now know Instructure pays up.

What possible type of guarantee could one ever hope to "negotiate" with someone who has just successfully blackmailed/ransomed/extorted?

We are in the context of already having to pay. You are at their mercy no matter what, so the only value of any interaction with them is based on hoping they have incentive to maintain their promises to protect their reputation etc.

It's not a good situation to be in, but still, try to make the best of it.

If the ransomware operator believes that breaking their word might make it harder to get money out of future victims, they'll keep their word.

They might not believe that, but if you're at the point where you're paying anyway, you might as well try to get that commitment from them.

There’s a similar dynamic from within the hacker group itself. For the ransom group, it is better for them to be perceived as trustworthy. Pay the ransom and we won’t leak your data.

For any individual within the ransom group, they can get a big payout by selling the data.

I don’t know if that’s really true. Nobody would really give a shit if you leaked where everyone goes to college… because it’s already on their LinkedIn or whatever.

The only people it’s valuable for is the ransomee, because they don’t want the reputational hit of having their data everywhere.

It really isn't as simple as that.

You are leaking email addresses that likely otherwise wouldn't be out there publicly. Whilst email addresses and names are "effectively" public, they aren't just in a one big database anyone on the planet can access.

Every single one of those email addresses will receive increased spam and phishing attempts, with more isolated information (such as School, First+Last Name, Subjects, Teachers/Lecturers, etc) the phishing attempts can be more refined.

i.e, Student receives an email that looks like its from their school (has email footer, has student name, has relevant teacher name, subject name, etc), the user is now more likely to click some sketchy link.

These little identifiers add up, especially when cross-references with other leaks. Even more problematic when most of the users wrapped up in a leak like this are under 18 too.

A lot of this stuff could be done previously, although the effort and scale to do so would of been higher/harder.

Depends on what they actually got. Names and email addresses? Considered public and are not so valuable. Universities usually publish those in a directory anyway.

Messages between students and instructors? Likely pretty boring, but possibly embarassing or confidential for a given individual.

Grades? Could be a FERPA violation.

Critical PII such as SSNs? Probably not in the LMS to begin with.

SSNs have been used as student IDs by particularly stupid educational institutions. The 'nice' thing about getting SSNs from students is the likelihood they'll live for a long time after the breach and thus be subject to identity theft for many years to come.

This was common years (decades, really) ago but I'd be surprised if any university today was still doing that. I guess there could still be some....

My university stopped putting SSNs on student IDs more than 25 years ago. I'd be surprised if there are many who still do that.

Though I wouldn't be surprised if some 40 year old university IT system requires its use as an identifier, regardless of whether or not it gets printed anywhere.

I just spoke with a K-12 teacher I know, and she confirmed SSNs in the Canvas instance.

Yikes.

Wow. A lot of K-12 students probably don't even know their own SSN off the top of their head, much less understand the impact of having it stored in this way. I can't fathom why it would be necessary for the SSN to be tracked by the school. At most, the school district as a whole might want a record so they could make sure kids are getting schooled but putting that into Canvas doesn't make any sense to me.

Agreed, seems wild to me that anyone in 2026 is using SSN as an identifier in a system that's not doing some kind of tax reporting. It's kryptonite for any other purpose.

Oh, it's insane and I recoiled when she mentioned that.

But it is 100% happening.

People do amazingly stupid things with systems, especially when they don't have enough people with the expertise to set them up properly, so they just throw things in there without stopping to think about whether or not it's a good idea.

So, a particular school system decided to add SSN to the student profile? Or Canvas requires it?

It's not required. I don't know precisely what her district is doing or why - I don't work there But she unprompted brought up that a lot of the minors' PII was in there including SSNs.

It would be nice if system owners stopped thinking "we'll just ask for all the info in case we need it" and instead "we might get sued (or ransomed, or both) because we are collecting this."

I'm guessing that Canvas just sort of lets you put in whatever data you want, and someone evidently decided that putting the student's SSNs in there made sense...

They already have your SSN, as does anyone else who wants it.

True. It's more yikes about what this says about the technical knowledge in that school.

That is a big yikes, but definitely not the norm. Most school districts switched from using SSN as their SIS identifier decades ago.

I have trouble imagining that a ransomware group would care about a regulation like FERPA when they've already done something criminal that would more than enough for prosecution if they got caught.

I didn't mean that the ransomware group would care... but if they got grades, that might command a higher ransom than if they just had names and emails and other non-very-sensitive stuff.

Those laws reduce the value though - "honest" people who are interested in such data won't be interested it from ransomware because they need to have legally obtained data. That is there are a lot of "honest but shady" uses of this data that are stopped by these laws.

> For the ransom group, it is better for them to be perceived as trustworthy.

They've already proved themselves to be untrustworthy simply by ransoming you in the first place.

No, they're proven themselves to be malicious. That's not the same thing at all.

Famously summarized by Kipling

https://www.kiplingsociety.co.uk/poem/poems_danegeld.htm

TIL https://en.wikipedia.org/wiki/Danegeld

And that’s exactly why the incidence of kidnapping plummeted in Italy once ransom payments were made illegal

How does that work? I.e. say a kidnapping occurs and the ransom is paid. What kind of trouble does the paying party get into? A fine? Jail?

So long as the potential payer knows they will get something they are going to slow down. They might pay, but suddenly becomes harder because they have to hide what they are doing. Many won't figure out how to pay.

The real value though is enough people consider themselves honest and won't do anything they know is illegal. They already hate dealing with criminals, but so long as paying is legal they might do it, but as soon as it affects their moral code they won't. The whole system collapses because just a few people saying no to paying means the kidnappers lose money on too many operations.

I understand the mechanism and the point of making it illegal, that’s not the question.

What I want to know is what exactly are the lawful repercussions for the person who paid.

A fine or sentence is probably on the books but it never comes to that. The main thing is to freeze the family's assets, and more importantly to publicize this procedure so the mafia or whoever knows there's no point in threatening the family.

There's one more piece that matters.

If no one pays the ransoms, but people believe that large ransoms are paid-- you still have the crime.

The obverse is true - because a ransom organization is dependent upon their reputation, a company claiming to have paid and received confirmation from the group could prevent them from releasing it as well.

The general public (including the next victims) don't have a way to confirm if payment was made. ShinyHunters would have to choose between arguing publicly that they were not paid or not releasing the data to protect their own reputation...

Good/funny observation. Game theory and economics are fun. :D

I do think that the partial information problem relating to new entrants into this market is interesting though.

The number of potential threat actors with partial/no information but that might speculate based on grandiose visions of ransom or outdated history is high.

We see dumb attempts at real-world ransoms/extortion which don't get paid at a pretty high clip based on this kind of partial knowledge.

It's an interesting idea, although I think in the heat of the moment, the last thing your org should be thinking of will be playing games with one of the most prolific hacker groups on the planet.

You'll probably get your data leaked anyways, potentially get compromised again (see Instructure situation) and end up in a way worse place if you just shut up and paid it, or let it leak normally.

>but everyone would be better off if no one paid a ransom.

I doubt if everyone would be better off if state level actors found and used these vulnerabilities instead of ransom seekers.

Why don't someone pretend to be ransom hacker, take the money, and release the hacked data anyway?

This will progress the game theory to the point where nobody will pay ransom because the thieves won't honor the deals anyway.

I'm not sure that attacker reputation is particularly meaningful. The group can rebrand into a new identity at any time. They're anonymous cybercriminals after all and there are lots of reasons they might need to do that beyond reputation laundering.

The calculus for the victims doesn't seem to change much whether the same people are using a "new" name or an old one to hold their systems hostage.

Yeah but fewer ransomes would be paid out regardless of who is attacking. They could be spoiling their own market and am sure they would

That's a motivation to avoid tragedy of the commons, not because they're trying to maintain their own reputation to victims. It benefits the criminals even if they change their name.

The name ShinyHunters is currently quite well-known due to a number of high-profile hacks (Odido in the Netherlands this year was huge). Their brand has a significant value right now.

How does everyone know its ShinyHunters and not someone pretending? I imagine they have some mechanism to authenticate, I'm curious what it is.

Because ShinyHunters published they hacked Canvas on their own website. They also redirected the canvas login pages to a ShinyHunters message, whilst this could be done by another group/person, its unlikely.

You can also validate PGP keys and TOX accounts, etc via their website.

OK, I didn't realize they had a stable website all this time. I guess it's all out there in the open with these groups.

> I'm not sure that attacker reputation is particularly meaningful. The group can rebrand into a new identity at any time. They're anonymous cybercriminals after all and there are lots of reasons they might need to do that beyond reputation laundering.

It is very meaningful. You seem to equate that "new" = "trust by default", but a new group is distrusted by default. Let's say that for a new group which is unproven to hold up their end of the deal, only 5% of victims will pay the ransom. But if you've built up a reputation over 5 years of honoring your ransoms, then maybe 50% of your victims will pay the ransom. Reputation is literally everything here. I doubt Instructure would have paid such a high-profile ransom if they didn't have a strong reason to believe it would work.

Agreed.

This is the same problem that crypto addresses in an unregulated market - it provides attestation and continuity, but not much else.

New actors are untrusted. Trust must be built through small transactions until someone trusts you enough for larger transactions. Survive long enough without major reputational harm and you can even offer to act as an escrow service for parties with less trust.

> I'm not sure that attacker reputation is particularly meaningful. The group can rebrand into a new identity at any time.

Reputation is everything in a collective.

If we assume a world where ransomware is continually existent and all your data is ransomed at anytime, we'd have a world designed to work around that.

We'd either end up with a Discworld "Ransomware Guild" that you pay "insurance" to and they murdicate anyone who dares do extracurricular data ransoming, or you'd have systems build on end-to-end encryption where the data is worthless.

I think you may have re-invented email reputation.

An idea I idly thought about is that of a "Benevolent Terrorist"[0]: one who does great harm to some number of people so that they may make it to a better world. Not entirely original, I suppose, since the Kwisatz Haderach from Dune is the trope definer. But a fun thought I had was what if you ran a ransomware company that just didn't pay? You'd screw a lot of people over but eventually you'd make ransomware a non-business the better you impersonated them and failed to deliver after taking the ransom.

What could go wrong? ;)

0: https://wiki.roshangeorge.dev/w/Benevolent_Terrorist#Poisoni...

What stops a ransomware group copying all data and just selling it piecemeal on the darknet under posibly a different name?

Realistically, the only people that could check that it's true are buyers, and those benefit from keeping a low profile

Another way to view this calculation: if you keep your infrastructure secure and up to date, you (very likely) don't have to pay any ransom in the first place.

There is a line where the ransom price beats the capex of keeping a secure system, specially when the risk so nebulous

Kind of like the recall math auto makers do to see if it's more expensive to actually recall a manufacturing problem, or just deal with it and compensate those who seek it personally

Paying a ransom should always be illegal with federal criminal charges for the employees who authorize the payment. If businesses are destroyed or people die as a consequence then those are acceptable casualties.

That operates on the idea that hacker organizations use long term strategic thinking, something the US government and a good number of corporations don’t even practice. I wouldn’t put my money on that.

while i am not about to bet the farm on the long-term strategic thinking ability of extortion groups, they are much smaller than most corporations and the US government, thus its much easier to think strategically and execute on longer-term goals.

shinyhunters, for example, has been active and acted as a cohesive unit for the past 7 years.

> on the other hand, the ransomware groups that want to stay in business need to be honest

I was thinking about that the other day. Honestly I'm not sure it matters. I feel like if a company didn't pay the ransom that would possibly open them up to lawsuits or something because they "tried nothing". At least paying it makes it look like they did something and could be some sort of legal defense. But again I'm not a lawyer.

one issue is that modern ransomeware groups are also being hunted themselves - there are many ransomeware orgs that are themselves being ransomed so are not reliable.

even if you pay the ransom to the 1st group, the 2nd group will leak.

So, maybe we could consider a "White Hat" ransomware group that takes the money and also leaks the data, so that long term no one bothers to pay which ultimately disincentivizes ransomware attacks?

White hats that take money are not white hats, those are grey hats.

https://en.wikipedia.org/wiki/Grey_hat

Reply on news.ycombinator.com