FBI softens stance on ransomware: it's (sort of) okay to pay off crims to get your data back The FBI is easing up a bit on its hardline stance against paying ransomware demands. The Bureau has posted an updated version of the guidance it offers for companies on how to handle ransomware demands with a section discussing the option of paying the hackers to get data decrypted. In short, the FBI still says that companies …
"via a consultant or security professional who is able to verify that the decryption keys will work and the malware infection can be thoroughly purged after"
Please someone explain to me, how can any security professional know this without access to to the decryption key in advance? Is this the equivalent of an independent hostage negotiator trusted by both the police and the mafia? Such people do exist, apparently.
I think they can do two things, though only the first one is guaranteed to be available:
1. Check what ransomware strain was used and see if it's on a list of ransomware known not to decrypt. If it is, don't allow the company to pay. This can catch some old ransomware, but most strains that don't decrypt and are used nowadays are relatively new.
2. Try to negotiate with the people demanding the ransom for proof they can decrypt. This can be done by giving them an encrypted file and asking them to decrypt it. Anyone with the decryption key can decode that file and then the decryption key can be purchased with more confidence. Of course, only the nicest of ransomware criminals are likely to put that amount of effort in to gain the confidence of a victim.
In general, even with competent technical assistance, a ransomware attack can only be partially rewound by paying the ransom. Instead, get competent technical assistance now, create a backup system that works, and you won't need to pay the ransom at all.
The last paragraph is key. If you have good backups and good people (contracted or in company) then all will be good (or should be).
I suspect the FBI advice about paying really applies to companies that don't have a good backup system or even one at all. I know of one office that has 10 computers and no backups. They claim all the computers back each other up. The owner thinks he's knows it all and any ransomwear will only stay on one PC. <sigh>
But isn't there some risk for the ransom payers that they could be prosecuted for aiding and abetting?
You get no credit for doing backups, it's taken as granted, yet it's much more work than just printing out a grandfather-father-son or whatever routine. You also have to verify the backups can be restored, without overwriting new data.
I started as a sys admin in the Netherlands where the backups had been automated onto DAT cassettes by a popular local employee who'd wanted my job. I noticed at least two of the DAT's tape were all chewed up and hadn't worked for ages but it wasn't a priority. I was more bothered by the fact the sacked previous sys admin had changed all the comms equipment passwords and hadn't left a copy, so he basically owned our network.
Trying to fix compromised systems is hellish. I seriously proposed throwing out all their kit and giving me £50k to replace it, but naturally I was told it was my job to fix it. My advice is not to hire disgruntled employees in the first place, only ever hire gruntled employees.
I should put that on my CV - "I may look miserable but I have always been gruntled"
Do you take a hit in order to further the greater good (or at least in order to avoid increasing the harm to society), or do you take the dog-eat-dog approach and cover your own ass even when doing so increases the harm to everybody else?
While my personal ethics fall strongly on the "take the hit" side, I do also recognize that others may think otherwise.
"So tell me again Mortimer. Why can't we have the exact same tax set up as the likes of Amazon and Starbucks?"
"It's complicated Mr Smith. The set up costs would almost wipe out any gains, and HMRC would be constantly clawing at our accounts for the slightest error. It just isn't worth the bother"
"£100,000 in tax is worth the bother Mortimer. I'm not giving up until a solution is worked out"
The months pass...
"I've got some bad news boss. Our systems have been compromised by hackers and they're demanding £500,000 to unlock them"
"Oh! That's not good news. We best pay them immediately"
"Are you sure?"
"Yes. It makes sense"
"It's a lot of money boss"
"Yes, but is it tax deductible Mortimer?"
"Well it is a cost to the company"
"And this horrible crime could potentially happen every year?"
"Am I hearing you correctly?"
"Yes you are. I appear to have minimised our taxes with a tactic not too dissimilar to paying off a brand owner in the Caymans, and without giving HMRC cause to blink."
At least the FBI actually has an easy, logical, public way to report cybercrime. Their cyber-crime reporting web page.
Not like my country or state (vic.aus), which just has a variety of searchable pages telling you that the vic and aus police and other agencies have no capacity to prosecute criminals located overseas, and are not interested.
"Doing so provides investigators with the critical information they need to track ransomware attackers, hold them accountable under US law, and prevent future attacks."
So this is my issue... US law doesn't hold sway in many countries. Pretty much just the USA, really. This is a good thing, unless the US wants to be held accountable under Sharia Law, or Israel Law, or Chinese Law...?
i can understand a company wanting their data back, but there is no reason to believe that after paying the ransom, will actually get any data back at all.
the bad guys once paid, have no reason to unlock the encryption.
so i have to agree that paying these bad guys will just lead to them doing business as usual.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
