Ransomware crims saying 'We'll burn your data if you get a negotiator' can't be legally paid off anyway

A couple of ransomware gangs have threatened to start deleting files if targeted companies call in professional negotiators to help lower prices for decryption tools. Grief Corp is the latest criminal crew to warn its victims with instant data destruction if it suspects a mark has engaged a mediator. In a statement posted to …

[Helcat]

Ransomware is just the new kidnap gang, but no need to actually be present, nor keep someone locked up in order to extort money.

So yes, best advice is : Don't pay them, because it just encourages them.

Downside is : If you don't have secure backups of your data, it could seriously harm or collapse your business - which is why they pay, and then pay again and again, and other businesses suffer as a result as the gangs see profit and go after more marks.

Perhaps finding out how much such ransom would be and paying that into IT for enhanced security, backups etc. would be a lot more beneficial - after all, every minute your data is encrypted and unusable is costing you money...

But preaching to the converted: We all know this. Shame so many managers/directors/investors don't.

[elsergiovolador]

Ransomware is just the new kidnap gang

New? I remember getting Ransomware in the early 2000s. Instead of crypto, they wanted cash to be mailed to a certain location.

[MJI]

mailed cash

Did anyone mail a bomb?

Certain people would have

[MrDamage]

Re: mailed cash

They wouldn't get unmarked bills from me. I'd wipe my arse with every single tenner.

[veti]

"We already pay IT a buttload to maintain security and backups. And, like every other department in the company, they are always asking for more. Threats to the business range from criminals to competitors to hostile influencers to rogue presidents to lockdowns to technological advances to changing fashions, any of which could put us out of business within a couple of months, tops. What makes this threat so special, and why can't IT manage it out of the handsome allowance we already make to them?"

[doublelayer]

That's the job of management. Assuming you manage the various departments, you have to figure out if IT is correctly using the money you give them to protect you from the various threats to your business, not limited to ransomware. They might be incompetent and taking your money for a shoddy system, able to achieve a better backup setup with the resources they have, or they could also be doing their job well and really require extra resources. It's simplistic to assume one without checking on the details, which is why IT doesn't rule the company.

That said, IT equipment and those who manage it are expensive. People unfamiliar with it may have many incorrect assumptions about its actual value. In order to ensure that you have backups of everything, going back a long time, in different places to deal with local risk (building fire, for example), online for easy access, offline for more resilliance against deliberate attack, takes a lot of equipment. Getting the system to back up everything takes proper configuration, I.E. a lot of time. Ensuring that each stage of that is secure from external risk is another place where a lot of work is needed. So it's quite possible that the money that IT is asking for is being used toward those goals in a reasonably efficient manner (or if you have a professional staff, incredibly efficiently). If for some reason you don't care about the goals, then by all means tell them not to bother with them. But then be aware that you're increasing your risk.

[Anonymous Coward]

Oh I don't know. Because PHBs with less IQ than a banana insist on cutting corners and costs in the mistaken belief that some money they slung IT's way for kit/software 10 years ago is still relevant and able to protect against the ever changing threat model.

And I'd love to hear how you expect IT to prevent PHBs wanting 'special consideration' for their laptop so they can browse whatever they want on PornHub while they sit in their office doing whatever it is they do when not out on a jolly.....

[IGotOut]

I like the US idea.

Just call the a criminal / terrorist organisation and make it an offence to pay them.

[Throatwarbler Mangrove]

Re: I like the US idea.

Simple solutions for simple minds.

[DS999]

Re: I like the US idea.

You have a better idea for stopping ransomware?

[Throatwarbler Mangrove]

Re: I like the US idea.

Yes. Go after the ransomware scum themselves instead of punishing the victims.

[veti]

Re: I like the US idea.

You volunteering to lead a SWAT team to Russia to raid them? Good show, let us know how that goes.

[Throatwarbler Mangrove]

Re: I like the US idea.

So let's punish the victims since we can't punish the perpetrators. Why not apply that to every crime? If your house gets broken into, it's your fault for not securing it correctly, so you should have to pay the state for your failure and be thrown out into the street. It's only fair, since allowing thieves into your home just encourages them, so you've shown that you're not fit to own a house or even rent one!

[runt row raggy]

Re: I like the US idea.

that's a terrible analogy. the punishment is not for being victim of a crime but for paying criminals.

[Throatwarbler Mangrove]

Re: I like the US idea.

Ah, but you are implicitly paying the criminals by failing to stop them and allowing them to profit. Therefore you deserve to be punished.

[doublelayer]

Re: I like the US idea.

No, by not paying the criminals, you are denying them what they thought they would be getting and therefore you are hurting them; their efforts have been wasted. Your analogy is flawed at multiple levels.

[The First Dave]

Re: I like the US idea.

The most obvious (and much closer) analogy is with "protection rackets" - a man comes into your bar with a baseball bat, smashes a couple of bottles, then says "shame if someone else were to do that - gimme £XX and I'll make sure it doesn't happen"

Pay him, and he'll come back next week for another installment, or pay your own bouncer...

[Anonymous Coward]

Re: I like the US idea.

"So let's punish the victims since we can't punish the perpetrators. Why not apply that to every crime? If your house gets broken into, it's your fault for not securing it correctly."

You do get punished! The Police do sod all and don't really care, you get nothing back that was nicked and your insurance premiums go through the roof!

Trust me, as a just another burglary victim statistic a few years back, I know. They stole £25 worth of cheap trinket jewellry ( value was priceless to my wife ) and a fiver sitting on the mantel, it cost me £500 to put in a CCTV system and £150 upfront to make an insurance claim that paid out £200 in cash and covered the cost of a smashed double glazed back window.

[Cliffwilliams44]

Re: I like the US idea.

Well, not a punishment for being a victim by the state, but if your house is robbed and the insurance investigator finds that you left your doors and windows unlocked and posted on Facebook that your were going on a 2 week holiday, there a real chance your not getting your settlement.

[DS999]

Re: I like the US idea.

Surely you understand WHY ransomware exists, right? They do it to make money. If they won't be paid, ransomware will go away.

Same reason why no one has tried to hijack a plane since 9/11, because everyone knows if it happened the passengers will assume they're dead anyway if they don't do something and they'll attack the hijackers en masse like the passengers on United Flight 93 did after they heard about the planes hitting the WTC towers.

You will still get hacked if you have security they can breach, but it will be like the "good old days" when black hats were hacking you because they want to see the world burn, to make you part of their botnet, or to put up a "LeetHaxkor222 was here!" on your web site to impress their black hat buddies.

[AVR]

Re: I like the US idea.

It doesn't seem that telling people not to pay the crims has killed the ransomware business. Assuming that saying it again and again will work is one definition of insanity.

Until and unless there is some way of thoroughly securing against them while still connecting to the outside world in ways that modern business needs, ransomware gangs are here to stay.

[alain williams]

It is easy for us to say "don't pay"

but if you have been attacked then things might look very different.

Yes: there should be good backups but not everyone does. Yes: bad backups is stupid/negligent/... but it happens.

Sacking the IT director or the bean counter director who refused to fund good backups does not solve today's problem.

A requirement for companies with more than 100 employees to have to have their backups externally audited once a year might be a way forwards but is unlikely to be the silver bullet: affordable audits are never 100%.

[Robert Helpmann??]

Re: It is easy for us to say "don't pay"

Sacking the IT director or the bean counter director who refused to fund good backups does not solve today's problem.

But it goes a long way in preventing tomorrow's. Pour encourager les autres.

[Aitor 1]

Re: It is easy for us to say "don't pay"

Probably the IT director acted on orders of the financial director. Sack him too?

[NickHolland]

Re: It is easy for us to say "don't pay"

Fire 'em all the way up the chain. Publicly. Let 'em go sling burgers at a fast food shop, don't let them glorify their "accomplishments" and repeat the stupid at the next job for even higher pay.

Most security problems (and in this case, backup problems) come from the C-level.

[veti]

Re: It is easy for us to say "don't pay"

Sounds satisfying, but how exactly do you propose to stop them getting another high level job?

[Anonymous Coward]

Re: It is easy for us to say "don't pay"

Sounds satisfying, but how exactly do you propose to stop them getting another high level job?

It's really quite easy. Reputation is all in high level management, and it's really easy to destroy a reputation - I know, I did it to someone who decided not to pay me for a large job I'd done. He was out of business in a couple of months - due to lack of trust - and he's failed to get any job he's applied for....

Anon - because destroying a reputation is probably illegal!

[Anonymous Coward]

Re: It is easy for us to say "don't pay"

Basically you're saying the company should declare bankruptcy and lay off everybody.

However hollywoodishly satisfying those "solutions" are, they just end up hurting more people. It's happening in the US, a country where there's no real safety net to protect the people laid off, and where the executives will leave with their bonuses, no matter how bad their management was.

[stewwy]

Re: It is easy for us to say "don't pay"

If you want to get rid of ransomware just enact a law that says the ransom can be paid, but only out of senior managements yearly bonus.

[Anonymous Coward]

Re: Fire 'em all the way up the chain. Publicly.

this is easy to say, impossible to do. Arguably, the responsibility for every single failure in a given company goes up the ladder, to the very top. But the higher it goes, the less definite who is CLEARLY responsible. There's a certain level above which no responsibility ever can, or is established (and punishment meted out). Think uk.gov, as an example. The only real worry (for those ass-lickers trying to get higher in that... group (Boris' mates and those, who believe are Boris' mates) is that they never know whether they're already above, i.e. safe from responsibility, or whether the 'safety' level has been pulled above their heads. If done by the boss, this indicates he feels unsafe and responsible for the shit that happened.

[Gene Cash]

Re: It is easy for us to say "don't pay"

Yes: there should be good backups but not everyone does. Yes: bad backups is stupid/negligent/... but it happens.

If you're that incompetent, possibly you deserve to go out of business.

Doing backups is a necessary task and cost of business, like keeping the lights on, maintaining a website, tracking your finances, and paying your employees.

[Anonymous Coward]

Re: It is easy for us to say "don't pay"

"If you're that incompetent, possibly you deserve to go out of business."

In most companies, especially small companies, IT is not the primary product, and probably isn't even a product at all. It's a set of tools to help market/sell/manufacture/account-for whatever the company's main product is. Telling a widget manufacturer that they "deserve" to go out of business because they hired some flashy, smooth-talking pseudo-IT guy to run their systems and they subsequently got ransomed, is a bit of a stretch. There's probably 1 or 2 IT guys in the company, but hundreds of floor workers actually making widgets. All of those folks "deserve" to be out of a job because the IT guy is an idiot? Get a grip.

[MiguelC]

Re: It is easy for us to say "don't pay"

In the following tale it wasn't ransomware but, to the effect, it's the same as if it were.

In the (late) 90's I was called to "rescue" a largish occupational health company that had all of their information (I really mean everything, client info, contracts, test results, payroll) in a single 700 MB Access application. They had an hardware failure that crashed the .mdb and their most recent backup copy was over a month old. Unfortunately (for them), we were unable to restore it, we only managed to salvage parts of tables, unlinked to anything else.

They ended up losing several contracts over the issue but, hey!, they weren't in IT and didn't know any better at the time.

BUT.... do you think they learned the lesson? Well think again because they just rebuilt from the backup copy and manually re-inputted all that could be saved from the crashed file, leaving everything else as before.

I really have no idea if this was part of the reason but they are now, in fact, out of business.

[sev.monster]

Re: It is easy for us to say "don't pay"

If anyone "deserves" to be punished, it's the management that allowed the company to be put in such a position. The boots on the ground employees likely have little to no say in the direction of the IT department, even the IT staff themselves, while the upper managrment does. If the employee was not directed to do something, and something bad happens to the company because of it, it's the manager's fault. Get rid of that manager, salvage what you can, and those hundred some innocent employees hopefully get to keep their jobs.

[druck]

Re: It is easy for us to say "don't pay"

There's probably 1 or 2 IT guys in the company, but hundreds of floor workers actually making widgets. All of those folks "deserve" to be out of a job because the IT guy is an idiot? Get a grip.

How many guys are employed fixing the widget machines? If they are idiots, does the company go out of business?

If you cannot function without IT, it is just as important as any other aspect of the business, and needs to be resourced accordingly.

[Throatwarbler Mangrove]

Re: It is easy for us to say "don't pay"

"If you cannot function without IT, it is just as important as any other aspect of the business, and needs to be resourced accordingly."

In principle, I agree with you. In practice, it is perfectly possible for many companies to limp along with under-resourced IT departments and still produce their core product. The first sign that IT has issues may be a catastrophic failure. The other piece, which I got downvoted for mentioning previously, is that building a really resilient tech stack in the face of aggressive attackers is actually hard: it's expensive, requires specialized expertise, takes time, and IT only has to get it wrong once in order for a determined attacker to gain a foothold and do serious damage.

[Phil O'Sophical]

Re: It is easy for us to say "don't pay"

building a really resilient tech stack in the face of aggressive attackers is actually hard: it's expensive, requires specialized expertise, takes time,

The same is true of building aircraft, bridges, skyscrapers and the like. Should we therefore not prosecute Boeing etc. when their constructions fail, because it was too hard to do them right?

[Throatwarbler Mangrove]

Re: It is easy for us to say "don't pay"

"The same is true of building aircraft, bridges, skyscrapers and the like."

Quite right. We should sue and criminally punish the architects and builders of the World Trade Center, Boeing, and the families of the crews, pilots, and passengers of the airliners that crashed into those buildings because they failed to withstand a coordinated terrorist attack. It's all the fault of literally everyone else besides the criminals, and all those people need to pay for their failure!

We're not talking about a failure of routine technical execution, we're talking about coordinated attacks.

[veti]

Re: It is easy for us to say "don't pay"

There is quite a difference between failure that puts your own company out of business and you out of work, and failure that kills an indeterminate number of wholly innocent people.

[BOFH in Training]

Re: It is easy for us to say "don't pay"

If you are planning to start a business or find investors, presumably you will make sure you got the capital to cover the office / workshop / machines / salary for at least a few months / utilities, etc.

Now you just need to add a bit more to the amount you going to prepare to buy computers, pay for internet, etc to the office.

For the extremely small businesses, 1-3 men shows, they can at the least pay for some cloud storage and arrange for someone (or one or all of them) to take backups on a few portable drives and rotate amoungst them.

My non-IT aunt has a cloud storage and an external drive for her important data backups. Don't tell me you can't do even slightly better in a small office? If you cant afford another 300-500 bucks + maybe a yearly fee of 50 to 100, maybe you are not the right person to start a small business.

[Throatwarbler Mangrove]

Re: It is easy for us to say "don't pay"

You have much to learn, PFY.

Read up on how modern ransomware works, evaluate your proposed plan, and come back to us when you've identified the flaws in it.

[doublelayer]

Re: It is easy for us to say "don't pay"

"hundreds of floor workers actually making widgets. All of those folks "deserve" to be out of a job because the IT guy is an idiot?"

None of those people deserve anything, as they didn't do anything wrong. However, they are likely to lose their jobs due to the incompetence of others, which is the problem. It's not new, and it's not limited to IT.

If these people worked in a manufacturing plant as your example suggests, that plant likely has safety risks and equipment to deal with them. If the management decided not to include fire protection and the plant caught fire, the workers would probably lose their jobs. In that case too, the workers did not deserve any bad consequences. That is why negligence related to safety is in most cases a crime and sufficient penalties assessed to prevent it from happening frequently (void in some countries or particularly negligent operators).

I do not like saying that someone deserved a bad outcome happening to them, and in this case I don't think that's the best word for the situation. However, in many cases, I don't have sympathy for the management who didn't try for backups. If it was very small or the attackers very good at their job, there would be some. If a business is large enough to employ a hundred widget-makers and still doesn't bother to invest in their survival, I do think the management needs to take some blame for that as they would in many similar circumstances where computers are not involved.

[Cliffwilliams44]

Re: It is easy for us to say "don't pay"

Possibly, but as I see it the real problem is lack of proper "old school" security.

Far too often we get some C level person who just "has" to be exempt from the companies security procedures, and that same person has to have full access to EVERYTHING!

It amazes me that when a single point of entry gets compromised (one user) now ALL the companies data, including their backups, are compromised! Why does this person have this access? Why does the account they are using for daily work have this access?

As a senior IT person "I do not have that level of access!" I certainly do not have that level of access into our financial system.

Putting aside the cost of securing your operation, correcting the above cost almost nothing except having the courage to tell management it must be done. If they refuse, you have 2 choices, accept the risk (and accept you will most likely be blamed when some thing does happen) or find another position!

[Anonymous Coward]

Re: It is easy for us to say "don't pay"

Yes, firing and/or killing all of the accountants yesterday would definitely help.

[Anonymous Coward]

If we see professional negotiator from Recovery Company™ – we will just destroy the data.

I think it's a bluff. It takes time, patience and resources (= investment) to catch the fish. I don't seriously believe they'll cut the line because they _think_ the catch might turn out less than what they bargained for. In fact, I expect the bad guy to start recruiting for counter-negotiatiors...

[sev.monster]

Re: If we see professional negotiator from Recovery Company™ – we will just destroy the data.

There's also the fact that there's no incentive for them to actually delete any exfiltrated data, besides a potential increase to legal woes if they get caught. Who's going to stop them extorting the same mark twice with the same data, after all?

"Oh hey we found some juicy data in your previously extorted files, so we're extorting you again! Surprise, a criminal organization lied!"

[Jimmy2Cows]

Re: If we see professional negotiator from Recovery Company™ – we will just destroy the data.

Just a scare tactic. Deleting the data definitely kills any chance of getting paid. Bad guy is just trying to maximise payout.

[Zippy´s Sausage Factory]

They called themselves "Evil Corp"?

Seriously? Evil Corp? Did they think they were in an Austin Powers movie or something?

[sev.monster]

Re: They called themselves "Evil Corp"?

The paperwork for sanction placed againt them was delivered to the courthouse in a very slow moving steamroller. Save the enviroment! Flatten bumpy roads! It's a win-win!

[Anonymous Coward]

burn data ?

"Ransomware crims saying 'We'll burn your data if you get a negotiator' can't be legally paid off anyway"

Wait, they're using an OVH DC ?

[Clausewitz 4.0]

Plethora of Tools

The "Plethora of Tools" some of those new kids in the block have is so vast .. and generate so much more income and geopolitical goals .. that I honestly do not know why so many people are so much obsessed with Ransomware ?!?!?!

[Anonymous Coward]

I had a dream...

... of those bastards pissing seriously some drug cartel or other similar NGO to deserve a courtesy visit with an appropriate blood efussion.

[Clausewitz 4.0]

Re: I had a dream...

Some already did.. sorry to disappoint you.

https://sputniknews.com/20170825/afghanistan-cia-heroin-ratline-1056794770.html

Dreamstime is much over.

[Anonymous Coward]

Backups

OK Anon because I'm going to get down voted to hell for this and i am in fact a coward!

Everyone saying it's the IT departments fault for not having good backups, well yes and no...

Our setup is that we back up from our live server to our backup one. We then push one backup copy to a nas box (on site) and one copy to a large USB drive that is swapped every night (we have two drives) and taken off site. We also spread our data over internal servers and onedrive so we havn't got all of our eggs in one basket.

I read recently, on El Reg I think, that on average ransome ware gangs are in a network for over 200 days before they take the data hostage. what exactly am I supposed to do to protect against that? Have unlimited drives and never use the same one twice? Well great I can get our data back as of 200+ days ago.

Is there actually any point to doing this though? We can't rekey all orders and stock movements for the last 200+ days back onto the system we would be better to start again.

At the end of the day all IT can do is put in the best solution that they can with the money that is availiable (in our case not much!).

As long as management are aware that if x happens the IT department can not guarentee getting anything back, we may have to start from scratch and have accepted this that's all you can do. Especially if you're talking about a small company with just one IT person, who may or may not be an expert in the field of cyber security and have about 1000 other jobs that are viewed as more urgent.

[veti]

Re: Backups

Well said. And don't forget the time it will take you to work out how long the attackers have been in the system, and therefore how far back you have to go for a safe backup.

There's a lot of simplistic piety about backups, but the painful truth is that against a really determined attack, they are of very limited value.

[Plest]

Re: Backups

So what you're saying is that it's "risk vs cost".

That is IT in a single phrase, day in and day out for me for the last 40 years. Every day it's "We do the expensive thing that will have all the bells and whistles....OR you can have the cheap thing that will suffice but comes with a lot of caveats!". Worst case there's always Fred in the corner who can kick the case when it plays up to keep the "Techo El-Cheapo"(tm) solution going until the expensive one becomes cheap enough to replace the current pile of crap.

Well surprise, surprise! The PHB and the board want the cheap one 'cos IT is a dirty black hole of spend, spend, spend and nothing in return. GIve me a call when your online biz and emails servers fall on their arse and then we'll talk about the value of "risk vs cost"!

[doublelayer]

Re: Backups

It depends on what resources you have and what risks you're willing to adopt. Nothing can make your system impervious to attack, but some things can make it better. If you are successfully attacked, it doesn't automatically mean it's your fault. There are very determined attackers who can get through anything you could put in place and there are places with so little to spend on resources that they can't have the resillience they need.

That said, there are some steps which mean you don't have to go to 200-day old data. Having incremental backups of various files can allow you to roll forward files which cannot contain executables. If ransomware encrypts them, the incremental gets a lot bigger since every file has changed entirely, so you get a warning about it. Recovery from that can be a long process, but it brings you a lot closer. Some backup companies provide services like this, which of course cost more as they're storing data in the cloud, but it's an option. It all comes down to your willingness to take risks, which for the moment includes ransomware. If you don't do anything on the assumption that, if you're attacked, you can just pay them off and get your data back, what is your plan if they ask for more than you can afford, are the type who just asks for money but doesn't give your data back, or come back in a bit to ask for a renewal subscription? That's not including the ethical objections against funding criminals, even ones who can hurt you, when you have an alternative.

[NightFox]

Negotiators can end up being a means of bypassing sanctions, either inadvertently or intentionally.

Scenario 1: Company receives demand for $5m, brings in a legitimate negotiator. They pay negotiator $1m to resolve the situation directly, with no further involvement by the company. Negotiator (who's not US-based) negotiates and makes direct payment of $500,000 to the bad guys, keeps the other $500k as his profit. End result = ransom payment made without company breaking sanctions.

Scenario 2: Bad guys demand $1m from company. They know that company can't pay them directly so they tell company to engage Negotiator X (who works for the bad guys) as a front and pay him $1m in negotiation fees.

Both of these things happen in human kidnapping, so there's no reason they couldn't be or aren't already happening with ransomware.

[Anonymous Coward]

Call their bluff then!

I can imagine in half the cases you'd never see your data again anyways even if you paid double what they asked, so if they going to do it they'll do it anyway.

They delete the goods then they lose the chance of making cash from your rather than trying to stay calm and keep you clam so you'll pay up. No one wins when the kidnapped party is "murdered". Their business is extortion, so it's in their best interests not to lose their primary method of business and bargaining chip, they simply want to force you to pay up quicker, most kidnappers with half a brain will only resort to killing the victim when all hope is lost and they know there's zero chance.

[MJI]

Real world attacks.

A few I have heard of.

Normal is roll back with as much data as possible and shrug over data loss, go to an old back up and not worry about a few orders which were finished, got the data on paper.

Another is ooops barcode system left running, holding data server open, holding important data files open. Last backup restored other used files.

Another was a case of data directory only user with rights was the data server, no access for ransomware.

Another was restore from recent backups, and get running ASAP, no data loss.

I know of no companies paying.